Separate probes and retprobes

[x1mus]

Hello (again),
I am trying to modify the output to have one line for the call and another line when the function returns. I read the source code to roughly identify where the different probes were set but can't figure out where the events are being processed and "merged". (I suspect that is it being done in the pipeline.go file but maybe I should do deeper modification in the bpf scripts themselves)
Would it be possible to do such a thing ?

[yanivagman]

There is only one event sent per hooked function.
For functions that have both entry and exit hooks, we save the data in ebpf maps at function entry, and use it to send the event on function return

[x1mus]

Thanks,
I just tried modifying the libc uprobe by sending the data in the buffer with a customized return value if it was a call. And it works!
By the way, weirdly enough, by doing so. We get a glimpse off what is happening in the other problem regarding access and faccessat since now I have the call to access, then the call to faccessat and then the return of faccessat but never the return of access