test.bt

#include<asm/signal.h>
BEGIN
{
	printf("Tracing sliver implant... Hit Ctrl-C to end.\n");
	printf("%-9s %-20s %-10s %-10s %-20s\n", "TIME", "IMPLANT", "PID", "TID", "COMMAND");
}

tracepoint:syscalls:sys_enter_accept
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_accept4
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_acct
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_add_key
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_adjtimex
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_arm64_personality
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_bind
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_bpf
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_brk
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_capget
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_capset
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_chdir
{
	if(@states[pid,tid]==2)
	{
		@states[pid,tid]=3;
	}
	else
	{
		@states[pid,tid]=0;
	}
}

tracepoint:syscalls:sys_enter_chroot
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_clock_adjtime
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_clock_getres
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_clock_gettime
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_clock_nanosleep
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_clock_settime
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_clone
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_clone3
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_close
{
	if(@states[pid,tid]==77)
	{
		@states[pid,tid]=78;
	}
	else if(@states[pid,tid]==68)
	{
		@states[pid,tid]=69;
	}
	else if(@states[pid,tid]==38)
	{
		@states[pid,tid]=39;
	}
	else if(@states[pid,tid]==29)
	{
		@states[pid,tid]=30;
	}
	else
	{
		@states[pid,tid]=0;
	}
}

tracepoint:syscalls:sys_enter_close_range
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_connect
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_copy_file_range
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_delete_module
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_dup
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_dup3
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_epoll_create1
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_epoll_ctl
{
	if(@states[pid,tid]==64)
	{
		@states[pid,tid]=65;
	}
	else if(@states[pid,tid]==57)
	{
		@states[pid,tid]=75;
	}
	else if(@states[pid,tid]==25)
	{
		@states[pid,tid]=26;
	}
	else if(@states[pid,tid]==18)
	{
		@states[pid,tid]=36;
	}
	else
	{
		@states[pid,tid]=0;
	}
}

tracepoint:syscalls:sys_enter_epoll_pwait
{
	if(@states[pid,tid]==98 && (args->epfd==4 && args->maxevents==128))
	{
		time("%H:%M:%S  ");
		printf("%-20s %-10d %-10d %-20s\n",comm,pid,tid,"cd");
		@states[pid,tid]=0;
	}
	else if(@states[pid,tid]==97 && (args->epfd==4 && args->maxevents==128))
	{
		@states[pid,tid]=98;
	}
	else if(@states[pid,tid]==94 && (args->epfd==4 && args->maxevents==128))
	{
		time("%H:%M:%S  ");
		printf("%-20s %-10d %-10d %-20s\n",comm,pid,tid,"cd");
		@states[pid,tid]=0;
	}
	else if(@states[pid,tid]==93 && (args->epfd==4 && args->maxevents==128))
	{
		@states[pid,tid]=94;
	}
	else if(@states[pid,tid]==86 && (args->epfd==4 && args->maxevents==128))
	{
		time("%H:%M:%S  ");
		printf("%-20s %-10d %-10d %-20s\n",comm,pid,tid,"mkdir");
		@states[pid,tid]=0;
	}
	else if(@states[pid,tid]==85 && (args->epfd==4 && args->maxevents==128))
	{
		@states[pid,tid]=86;
	}
	else if(@states[pid,tid]==81 && (args->epfd==4 && args->maxevents==128))
	{
		time("%H:%M:%S  ");
		printf("%-20s %-10d %-10d %-20s\n",comm,pid,tid,"ls");
		@states[pid,tid]=0;
	}
	else if(@states[pid,tid]==80 && (args->epfd==4 && args->maxevents==128))
	{
		@states[pid,tid]=81;
	}
	else if(@states[pid,tid]==73)
	{
		time("%H:%M:%S  ");
		printf("%-20s %-10d %-10d %-20s\n",comm,pid,tid,"cat");
		@states[pid,tid]=0;
	}
	else if(@states[pid,tid]==72)
	{
		@states[pid,tid]=73;
	}
	else if(@states[pid,tid]==71)
	{
		time("%H:%M:%S  ");
		printf("%-20s %-10d %-10d %-20s\n",comm,pid,tid,"cat");
		@states[pid,tid]=0;
	}
	else if(@states[pid,tid]==70)
	{
		time("%H:%M:%S  ");
		printf("%-20s %-10d %-10d %-20s\n",comm,pid,tid,"cat");
		@states[pid,tid]=0;
	}
	else if(@states[pid,tid]==69)
	{
		@states[pid,tid]=70;
	}
	else if(@states[pid,tid]==62 && (args->epfd==4 && args->maxevents==128))
	{
		time("%H:%M:%S  ");
		printf("%-20s %-10d %-10d %-20s\n",comm,pid,tid,"rm");
		@states[pid,tid]=0;
	}
	else if(@states[pid,tid]==61 && (args->epfd==4 && args->maxevents==128))
	{
		@states[pid,tid]=62;
	}
	else if(@states[pid,tid]==59)
	{
		@states[pid,tid]=55;
	}
	else if(@states[pid,tid]==55)
	{
		time("%H:%M:%S  ");
		printf("%-20s %-10d %-10d %-20s\n",comm,pid,tid,"cat");
		@states[pid,tid]=0;
	}
	else if(@states[pid,tid]==53 && (args->epfd==4 && args->maxevents==128))
	{
		time("%H:%M:%S  ");
		printf("%-20s %-10d %-10d %-20s\n",comm,pid,tid,"pwd");
		@states[pid,tid]=0;
	}
	else if(@states[pid,tid]==52 && (args->epfd==4 && args->maxevents==128))
	{
		@states[pid,tid]=53;
	}
	else if(@states[pid,tid]==50)
	{
		@states[pid,tid]=55;
	}
	else if(@states[pid,tid]==47 && (args->epfd==4 && args->maxevents==128))
	{
		time("%H:%M:%S  ");
		printf("%-20s %-10d %-10d %-20s\n",comm,pid,tid,"mkdir");
		@states[pid,tid]=0;
	}
	else if(@states[pid,tid]==46 && (args->epfd==4 && args->maxevents==128))
	{
		@states[pid,tid]=47;
	}
	else if(@states[pid,tid]==42 && (args->epfd==4 && args->maxevents==128))
	{
		time("%H:%M:%S  ");
		printf("%-20s %-10d %-10d %-20s\n",comm,pid,tid,"ls");
		@states[pid,tid]=0;
	}
	else if(@states[pid,tid]==41 && (args->epfd==4 && args->maxevents==128))
	{
		@states[pid,tid]=42;
	}
	else if(@states[pid,tid]==34)
	{
		time("%H:%M:%S  ");
		printf("%-20s %-10d %-10d %-20s\n",comm,pid,tid,"cat");
		@states[pid,tid]=0;
	}
	else if(@states[pid,tid]==33)
	{
		@states[pid,tid]=34;
	}
	else if(@states[pid,tid]==32)
	{
		time("%H:%M:%S  ");
		printf("%-20s %-10d %-10d %-20s\n",comm,pid,tid,"cat");
		@states[pid,tid]=0;
	}
	else if(@states[pid,tid]==31)
	{
		time("%H:%M:%S  ");
		printf("%-20s %-10d %-10d %-20s\n",comm,pid,tid,"cat");
		@states[pid,tid]=0;
	}
	else if(@states[pid,tid]==30)
	{
		@states[pid,tid]=31;
	}
	else if(@states[pid,tid]==23 && (args->epfd==4 && args->maxevents==128))
	{
		time("%H:%M:%S  ");
		printf("%-20s %-10d %-10d %-20s\n",comm,pid,tid,"rm");
		@states[pid,tid]=0;
	}
	else if(@states[pid,tid]==22 && (args->epfd==4 && args->maxevents==128))
	{
		@states[pid,tid]=23;
	}
	else if(@states[pid,tid]==20)
	{
		@states[pid,tid]=16;
	}
	else if(@states[pid,tid]==16)
	{
		time("%H:%M:%S  ");
		printf("%-20s %-10d %-10d %-20s\n",comm,pid,tid,"cat");
		@states[pid,tid]=0;
	}
	else if(@states[pid,tid]==14 && (args->epfd==4 && args->maxevents==128))
	{
		time("%H:%M:%S  ");
		printf("%-20s %-10d %-10d %-20s\n",comm,pid,tid,"pwd");
		@states[pid,tid]=0;
	}
	else if(@states[pid,tid]==13 && (args->epfd==4 && args->maxevents==128))
	{
		@states[pid,tid]=14;
	}
	else if(@states[pid,tid]==7 && (args->epfd==4 && args->maxevents==128))
	{
		time("%H:%M:%S  ");
		printf("%-20s %-10d %-10d %-20s\n",comm,pid,tid,"ping");
		@states[pid,tid]=0;
	}
	else if(@states[pid,tid]==6 && (args->epfd==4 && args->maxevents==128))
	{
		@states[pid,tid]=7;
	}
	else if(@states[pid,tid]==11)
	{
		@states[pid,tid]=16;
	}
	else
	{
		@states[pid,tid]=0;
	}
}

tracepoint:syscalls:sys_enter_epoll_pwait2
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_eventfd2
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_execve
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_execveat
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_exit
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_exit_group
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_faccessat
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_faccessat2
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_fadvise64_64
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_fallocate
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_fanotify_init
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_fanotify_mark
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_fchdir
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_fchmod
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_fchmodat
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_fchown
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_fchownat
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_fcntl
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_fdatasync
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_fgetxattr
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_finit_module
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_flistxattr
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_flock
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_fremovexattr
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_fsconfig
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_fsetxattr
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_fsmount
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_fsopen
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_fspick
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_fstatfs
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_fsync
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_ftruncate
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_get_mempolicy
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_get_robust_list
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_getcpu
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_getcwd
{
	if(@states[pid,tid]==90)
	{
		@states[pid,tid]=91;
	}
	else if(@states[pid,tid]==9)
	{
		@states[pid,tid]=10;
	}
	else
	{
		@states[pid,tid]=0;
	}
}

tracepoint:syscalls:sys_enter_getdents64
{
	if(@states[pid,tid]==76)
	{
		@states[pid,tid]=77;
	}
	else if(@states[pid,tid]==75)
	{
		@states[pid,tid]=76;
	}
	else if(@states[pid,tid]==37)
	{
		@states[pid,tid]=38;
	}
	else if(@states[pid,tid]==36)
	{
		@states[pid,tid]=37;
	}
	else
	{
		@states[pid,tid]=0;
	}
}

tracepoint:syscalls:sys_enter_getegid
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_geteuid
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_getgid
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_getgroups
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_getitimer
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_getpeername
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_getpgid
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_getpid
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_getppid
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_getpriority
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_getrandom
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_getresgid
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_getresuid
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_getrlimit
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_getrusage
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_getsid
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_getsockname
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_getsockopt
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_gettid
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_gettimeofday
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_getuid
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_getxattr
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_init_module
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_inotify_add_watch
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_inotify_init1
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_inotify_rm_watch
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_io_cancel
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_io_destroy
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_io_getevents
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_io_pgetevents
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_io_setup
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_io_submit
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_io_uring_enter
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_io_uring_register
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_io_uring_setup
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_ioctl
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_ioprio_get
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_ioprio_set
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_kcmp
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_kexec_file_load
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_kexec_load
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_keyctl
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_kill
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_landlock_add_rule
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_landlock_create_ruleset
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_landlock_restrict_self
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_lgetxattr
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_linkat
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_listen
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_listxattr
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_llistxattr
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_lremovexattr
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_lseek
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_lsetxattr
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_mbind
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_membarrier
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_memfd_create
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_memfd_secret
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_migrate_pages
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_mincore
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_mkdirat
{
	if(@states[pid,tid]==56)
	{
		@states[pid,tid]=83;
	}
	else if(@states[pid,tid]==17)
	{
		@states[pid,tid]=44;
	}
	else
	{
		@states[pid,tid]=0;
	}
}

tracepoint:syscalls:sys_enter_mknodat
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_mlock
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_mlock2
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_mlockall
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_mount
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_mount_setattr
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_move_mount
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_move_pages
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_mprotect
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_mq_getsetattr
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_mq_notify
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_mq_open
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_mq_timedreceive
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_mq_timedsend
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_mq_unlink
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_mremap
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_msgctl
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_msgget
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_msgrcv
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_msgsnd
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_msync
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_munlock
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_munlockall
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_munmap
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_name_to_handle_at
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_nanosleep
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_newfstat
{
	if(@states[pid,tid]==75)
	{
		@states[pid,tid]=66;
	}
	else if(@states[pid,tid]==65)
	{
		@states[pid,tid]=66;
	}
	else if(@states[pid,tid]==36)
	{
		@states[pid,tid]=27;
	}
	else if(@states[pid,tid]==26)
	{
		@states[pid,tid]=27;
	}
	else
	{
		@states[pid,tid]=0;
	}
}

tracepoint:syscalls:sys_enter_newfstatat
{
	if(@states[pid,tid]==89)
	{
		@states[pid,tid]=90;
	}
	else if(@states[pid,tid]==76)
	{
		@states[pid,tid]=76;
	}
	else if(@states[pid,tid]==50)
	{
		@states[pid,tid]=56;
	}
	else if(@states[pid,tid]==37)
	{
		@states[pid,tid]=37;
	}
	else if(@states[pid,tid]==11)
	{
		@states[pid,tid]=17;
	}
	else if(@states[pid,tid]==10)
	{
		@states[pid,tid]=50;
	}
	else if(@states[pid,tid]==9)
	{
		@states[pid,tid]=11;
	}
	else if(@states[pid,tid]==4)
	{
		@states[pid,tid]=9;
	}
	else if(@states[pid,tid]==3)
	{
		@states[pid,tid]=89;
	}
	else if(@states[pid,tid]==2)
	{
		@states[pid,tid]=4;
	}
	else
	{
		@states[pid,tid]=0;
	}
}

tracepoint:syscalls:sys_enter_newuname
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_open_by_handle_at
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_open_tree
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_openat
{
	if(@states[pid,tid]==59)
	{
		@states[pid,tid]=64;
	}
	else if(@states[pid,tid]==50)
	{
		@states[pid,tid]=57;
	}
	else if(@states[pid,tid]==20)
	{
		@states[pid,tid]=25;
	}
	else if(@states[pid,tid]==11)
	{
		@states[pid,tid]=18;
	}
	else
	{
		@states[pid,tid]=0;
	}
}

tracepoint:syscalls:sys_enter_openat2
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_perf_event_open
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_pidfd_getfd
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_pidfd_open
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_pidfd_send_signal
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_pipe2
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_pivot_root
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_ppoll
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_prctl
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_pread64
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_preadv
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_preadv2
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_prlimit64
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_process_madvise
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_process_mrelease
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_process_vm_readv
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_process_vm_writev
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_pselect6
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_ptrace
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_pwrite64
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_pwritev
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_pwritev2
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_quotactl
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_quotactl_fd
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_read
{
	if(@states[pid,tid]==67)
	{
		@states[pid,tid]=68;
	}
	else if(@states[pid,tid]==66)
	{
		@states[pid,tid]=67;
	}
	else if(@states[pid,tid]==28)
	{
		@states[pid,tid]=29;
	}
	else if(@states[pid,tid]==1 && (args->fd==3 && args->count==1676))
	{
		printf("read1\n");
		printf("read2\n");
		@states[pid,tid]=2;
	}
	else if(@states[pid,tid]==0 && (args->fd==3 && args->count==1676))
	{
		printf("read1\n");
		printf("read2\n");
		@states[pid,tid]=1;
	}
	else if(@states[pid,tid]==27)
	{
		@states[pid,tid]=28;
	}
	else
	{
		@states[pid,tid]=0;
	}
}

tracepoint:syscalls:sys_enter_readahead
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_readlinkat
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_readv
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_reboot
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_recvfrom
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_recvmmsg
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_recvmsg
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_remap_file_pages
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_removexattr
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_renameat
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_renameat2
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_request_key
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_restart_syscall
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_rseq
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_rt_sigaction
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_rt_sigpending
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_rt_sigprocmask
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_rt_sigqueueinfo
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_rt_sigsuspend
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_rt_sigtimedwait
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_rt_tgsigqueueinfo
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_sched_get_priority_max
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_sched_get_priority_min
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_sched_getaffinity
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_sched_getattr
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_sched_getparam
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_sched_getscheduler
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_sched_rr_get_interval
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_sched_setaffinity
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_sched_setattr
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_sched_setparam
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_sched_setscheduler
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_sched_yield
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_seccomp
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_semctl
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_semget
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_semop
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_semtimedop
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_sendfile64
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_sendmmsg
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_sendmsg
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_sendto
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_set_mempolicy
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_set_robust_list
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_set_tid_address
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_setdomainname
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_setfsgid
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_setfsuid
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_setgid
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_setgroups
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_sethostname
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_setitimer
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_setns
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_setpgid
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_setpriority
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_setregid
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_setresgid
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_setresuid
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_setreuid
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_setrlimit
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_setsid
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_setsockopt
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_settimeofday
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_setuid
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_setxattr
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_shmat
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_shmctl
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_shmdt
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_shmget
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_shutdown
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_sigaltstack
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_signalfd4
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_socket
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_socketpair
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_splice
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_statfs
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_statx
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_swapoff
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_swapon
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_symlinkat
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_sync
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_sync_file_range
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_syncfs
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_sysinfo
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_syslog
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_tee
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_tgkill
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_timer_create
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_timer_delete
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_timer_getoverrun
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_timer_gettime
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_timer_settime
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_timerfd_create
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_timerfd_gettime
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_timerfd_settime
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_times
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_tkill
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_truncate
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_umask
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_umount
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_unlinkat
{
	if(@states[pid,tid]==58)
	{
		@states[pid,tid]=58;
	}
	else if(@states[pid,tid]==50)
	{
		@states[pid,tid]=58;
	}
	else if(@states[pid,tid]==19)
	{
		@states[pid,tid]=19;
	}
	else if(@states[pid,tid]==11)
	{
		@states[pid,tid]=19;
	}
	else
	{
		@states[pid,tid]=0;
	}
}

tracepoint:syscalls:sys_enter_unshare
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_userfaultfd
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_utimensat
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_vhangup
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_vmsplice
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_wait4
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_waitid
{
	@states[pid,tid]=0;
}

tracepoint:syscalls:sys_enter_write
{
	if(@states[pid,tid]==96 && (args->fd==3))
	{
		@states[pid,tid]=97;
	}
	else if(@states[pid,tid]==92 && (args->fd==3))
	{
		@states[pid,tid]=93;
	}
	else if(@states[pid,tid]==91 && (args->fd==3))
	{
		@states[pid,tid]=96;
	}
	else if(@states[pid,tid]==90 && (args->fd==3))
	{
		@states[pid,tid]=92;
	}
	else if(@states[pid,tid]==84 && (args->fd==3))
	{
		@states[pid,tid]=85;
	}
	else if(@states[pid,tid]==83 && (args->fd==3))
	{
		@states[pid,tid]=84;
	}
	else if(@states[pid,tid]==79 && (args->fd==3))
	{
		@states[pid,tid]=80;
	}
	else if(@states[pid,tid]==78 && (args->fd==3))
	{
		@states[pid,tid]=79;
	}
	else if(@states[pid,tid]==72)
	{
		@states[pid,tid]=72;
	}
	else if(@states[pid,tid]==70)
	{
		@states[pid,tid]=72;
	}
	else if(@states[pid,tid]==69)
	{
		@states[pid,tid]=69;
	}
	else if(@states[pid,tid]==60 && (args->fd==3))
	{
		@states[pid,tid]=61;
	}
	else if(@states[pid,tid]==59)
	{
		@states[pid,tid]=59;
	}
	else if(@states[pid,tid]==58 && (args->fd==3))
	{
		@states[pid,tid]=60;
	}
	else if(@states[pid,tid]==51 && (args->fd==3))
	{
		@states[pid,tid]=52;
	}
	else if(@states[pid,tid]==50 && (args->fd==3))
	{
		@states[pid,tid]=60;
	}
	else if(@states[pid,tid]==50)
	{
		@states[pid,tid]=59;
	}
	else if(@states[pid,tid]==45 && (args->fd==3))
	{
		@states[pid,tid]=46;
	}
	else if(@states[pid,tid]==44 && (args->fd==3))
	{
		@states[pid,tid]=45;
	}
	else if(@states[pid,tid]==40 && (args->fd==3))
	{
		@states[pid,tid]=41;
	}
	else if(@states[pid,tid]==39 && (args->fd==3))
	{
		@states[pid,tid]=40;
	}
	else if(@states[pid,tid]==33)
	{
		@states[pid,tid]=33;
	}
	else if(@states[pid,tid]==31)
	{
		@states[pid,tid]=33;
	}
	else if(@states[pid,tid]==30)
	{
		@states[pid,tid]=30;
	}
	else if(@states[pid,tid]==21 && (args->fd==3))
	{
		@states[pid,tid]=22;
	}
	else if(@states[pid,tid]==20)
	{
		@states[pid,tid]=20;
	}
	else if(@states[pid,tid]==19 && (args->fd==3))
	{
		@states[pid,tid]=21;
	}
	else if(@states[pid,tid]==12 && (args->fd==3))
	{
		@states[pid,tid]=13;
	}
	else if(@states[pid,tid]==11 && (args->fd==3))
	{
		@states[pid,tid]=21;
	}
	else if(@states[pid,tid]==10 && (args->fd==3))
	{
		@states[pid,tid]=51;
	}
	else if(@states[pid,tid]==9 && (args->fd==3))
	{
		@states[pid,tid]=12;
	}
	else if(@states[pid,tid]==5 && (args->fd==3))
	{
		@states[pid,tid]=6;
	}
	else if(@states[pid,tid]==2 && (args->fd==3))
	{
		@states[pid,tid]=5;
	}
	else if(@states[pid,tid]==11)
	{
		@states[pid,tid]=20;
	}
	else
	{
		@states[pid,tid]=0;
	}
}

tracepoint:syscalls:sys_enter_writev
{
	@states[pid,tid]=0;
}








































































































































































































































































































END
{
	printf("Tracing sliver implant end.\n");
}