diff --git a/43-kfuncs/kfunc.bpf.c b/43-kfuncs/kfunc.bpf.c
index f282bc4..afbb7a9 100644
--- a/43-kfuncs/kfunc.bpf.c
+++ b/43-kfuncs/kfunc.bpf.c
@@ -8,7 +8,7 @@ typedef unsigned int u32;
 typedef unsigned long long u64;
 typedef int pid_t;
 
-extern u64 bpf_kfunc_call_test(u32 a, u64 b, u32 c, u64 d) __ksym;
+extern int bpf_strstr(const char *str, u32 str__sz, const char *substr, u32 substr__sz) __ksym;
 
 char LICENSE[] SEC("license") = "Dual BSD/GPL";
 
@@ -16,7 +16,13 @@ SEC("kprobe/do_unlinkat")
 int handle_kprobe(void *ctx)
 {
 	pid_t pid = bpf_get_current_pid_tgid() >> 32;
-	u64 result = bpf_kfunc_call_test(1, 2, 3, 4);
-	bpf_printk("BPF triggered do_unlinkat from PID %d. Result: %lld\n", pid, result);
+	char str[] = "Hello, world!";
+	char substr[] = "wor";
+	u32 result = bpf_strstr(str, sizeof(str) - 1, substr, sizeof(substr) - 1);
+	if (result != -1)
+	{
+		bpf_printk("'%s' found in '%s' at index %d\n", substr, str, result);
+	}
+	bpf_printk("Hello, world! (pid: %d) bpf_strstr %d\n", pid, result);
 	return 0;
 }
diff --git a/43-kfuncs/module/hello.c b/43-kfuncs/module/hello.c
index 9552e1d..6691b01 100644
--- a/43-kfuncs/module/hello.c
+++ b/43-kfuncs/module/hello.c
@@ -1,24 +1,51 @@
-#include <linux/init.h>    // Macros for module initialization
-#include <linux/module.h>  // Core header for loading modules
-#include <linux/kernel.h>  // Kernel logging macros
+#include <linux/init.h>   // Macros for module initialization
+#include <linux/module.h> // Core header for loading modules
+#include <linux/kernel.h> // Kernel logging macros
 #include <linux/bpf.h>
 #include <linux/btf.h>
 #include <linux/btf_ids.h>
 
-__bpf_kfunc u64 bpf_kfunc_call_test(u32 a, u64 b, u32 c, u64 d);
+__bpf_kfunc int bpf_strstr(const char *str, u32 str__sz, const char *substr, u32 substr__sz);
 
 /* Define a kfunc function */
 __bpf_kfunc_start_defs();
 
-__bpf_kfunc u64 bpf_kfunc_call_test(u32 a, u64 b, u32 c, u64 d)
+__bpf_kfunc int bpf_strstr(const char *str, u32 str__sz, const char *substr, u32 substr__sz)
 {
-	return a + b + c + d;
+    // Edge case: if substr is empty, return 0 (assuming empty string is found at the start)
+    if (substr__sz == 0)
+    {
+        return 0;
+    }
+    // Edge case: if the substring is longer than the main string, it's impossible to find
+    if (substr__sz > str__sz)
+    {
+        return -1; // Return -1 to indicate not found
+    }
+
+    // Iterate through the main string, considering the size limit
+    for (size_t i = 0; i <= str__sz - substr__sz; i++)
+    {
+        size_t j = 0;
+        // Compare the substring with the current position in the string
+        while (j < substr__sz && str[i + j] == substr[j])
+        {
+            j++;
+        }
+        // If the entire substring was found
+        if (j == substr__sz)
+        {
+            return i; // Return the index of the first match
+        }
+    }
+    // Return -1 if the substring is not found
+    return -1;
 }
 
 __bpf_kfunc_end_defs();
 
 BTF_KFUNCS_START(bpf_kfunc_example_ids_set)
-BTF_ID_FLAGS(func, bpf_kfunc_call_test)
+BTF_ID_FLAGS(func, bpf_strstr)
 BTF_KFUNCS_END(bpf_kfunc_example_ids_set)
 
 // Register the kfunc ID set
@@ -35,12 +62,13 @@ static int __init hello_init(void)
     printk(KERN_INFO "Hello, world!\n");
     // Register the BTF kfunc ID set
     ret = register_btf_kfunc_id_set(BPF_PROG_TYPE_KPROBE, &bpf_kfunc_example_set);
-    if (ret) {
+    if (ret)
+    {
         pr_err("bpf_kfunc_example: Failed to register BTF kfunc ID set\n");
         return ret;
     }
     printk(KERN_INFO "bpf_kfunc_example: Module loaded successfully\n");
-    return 0;  // Return 0 if successful
+    return 0; // Return 0 if successful
 }
 
 // Function executed when the module is removed
@@ -55,7 +83,7 @@ static void __exit hello_exit(void)
 module_init(hello_init);
 module_exit(hello_exit);
 
-MODULE_LICENSE("GPL");               // License type (GPL)
-MODULE_AUTHOR("Your Name");          // Module author
+MODULE_LICENSE("GPL");                 // License type (GPL)
+MODULE_AUTHOR("Your Name");            // Module author
 MODULE_DESCRIPTION("A simple module"); // Module description
-MODULE_VERSION("1.0");               // Module version
+MODULE_VERSION("1.0");                 // Module version