support simple kprobe tracing

sample:
trace "kprobes:do_sys_open" function (e) { BODY }