From 1d78ac6cb237a6003e8f85b5abed1d2c297ca4cd Mon Sep 17 00:00:00 2001
From: Guy Kaplan <guyk@platinum-sec.com>
Date: Mon, 26 Dec 2022 22:05:50 +0200
Subject: [PATCH] Added support for arm64 syscall prefixes

---
 bcc/module.go | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/bcc/module.go b/bcc/module.go
index 67d43eb..fa271ed 100644
--- a/bcc/module.go
+++ b/bcc/module.go
@@ -548,12 +548,23 @@ func GetSyscallFnName(name string) string {
 
 var syscallPrefix string
 
+func canFindName(symbol string) bool {
+	_, err := bccResolveName("", symbol, -1)
+	return err == nil
+}
 func GetSyscallPrefix() string {
 	if syscallPrefix == "" {
-		_, err := bccResolveName("", "__x64_sys_bpf", -1)
-		if err == nil {
-			syscallPrefix = "__x64_sys_"
-		} else {
+		symbolToPrefix := map[string]string{
+			"__x64_sys_bpf":   "__x64_sys_",
+			"__arm64_sys_bpf": "__arm64_sys_",
+		}
+		for symbol, prefix := range symbolToPrefix {
+			if canFindName(symbol) {
+				syscallPrefix = prefix
+				break
+			}
+		}
+		if syscallPrefix == "" {
 			syscallPrefix = "sys_"
 		}
 	}