diff --git a/src/drsnoop/drsnoop.bpf.c b/src/drsnoop/drsnoop.bpf.c
new file mode 100644
index 0000000000000000000000000000000000000000..122228e33436c1c45c292b2a112210439ded6990
--- /dev/null
+++ b/src/drsnoop/drsnoop.bpf.c
@@ -0,0 +1,29 @@
+// SPDX-License-Identifier: GPL-2.0
+#include "vmlinux.h"
+#include <bpf/bpf_core_read.h>
+#include <bpf/bpf_tracing.h>
+#include <bpf/bpf_helpers.h>
+#include "drsnoop.h"
+
+const volatile pid_t target_pid = 0;
+const volatile pid_t target_tgid = 0;
+const volatile __u64 vm_zone_stat_kaddr = 0;
+
+struct piddata {
+	u64 ts;
+	u64 nr_free_pages;
+};
+
+struct {
+	__uint(type, BPF_MAP_TYPE_HASH);
+	__uint(max_entries, 8192);
+	__type(key, u32);
+	__type(value, struct piddata);
+} start SEC(".maps");
+
+struct {
+	__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
+	__uint(key_size, sizeof(u32));
+	__uint(value_size, sizeof(u32));
+} events SEC(".maps");
+