ref->pid = e->pid;
        memcpy(ref->comm, e->comm, sizeof(ref->comm));
        refs->ref_cnt = 1;
+       refs->has_bpf_cookie = e->has_bpf_cookie;
+       refs->bpf_cookie = e->bpf_cookie;
 
        err = hashmap__append(map, u32_as_hash_field(e->id), refs);
        if (err)
                if (refs->ref_cnt == 0)
                        break;
 
+               if (refs->has_bpf_cookie)
+                       jsonw_lluint_field(json_writer, "bpf_cookie", refs->bpf_cookie);
+
                jsonw_name(json_writer, "pids");
                jsonw_start_array(json_writer);
                for (i = 0; i < refs->ref_cnt; i++) {
                if (refs->ref_cnt == 0)
                        break;
 
+               if (refs->has_bpf_cookie)
+                       printf("\n\tbpf_cookie %llu", (unsigned long long) refs->bpf_cookie);
+
                printf("%s", prefix);
                for (i = 0; i < refs->ref_cnt; i++) {
                        struct obj_ref *ref = &refs->refs[i];
 
        }
 }
 
+/* could be used only with BPF_LINK_TYPE_PERF_EVENT links */
+static __u64 get_bpf_cookie(struct bpf_link *link)
+{
+       struct bpf_perf_link *perf_link;
+       struct perf_event *event;
+
+       perf_link = container_of(link, struct bpf_perf_link, link);
+       event = BPF_CORE_READ(perf_link, perf_file, private_data);
+       return BPF_CORE_READ(event, bpf_cookie);
+}
+
 SEC("iter/task_file")
 int iter(struct bpf_iter__task_file *ctx)
 {
        if (file->f_op != fops)
                return 0;
 
+       __builtin_memset(&e, 0, sizeof(e));
        e.pid = task->tgid;
        e.id = get_obj_id(file->private_data, obj_type);
+
+       if (obj_type == BPF_OBJ_LINK) {
+               struct bpf_link *link = (struct bpf_link *) file->private_data;
+
+               if (BPF_CORE_READ(link, type) == BPF_LINK_TYPE_PERF_EVENT) {
+                       e.has_bpf_cookie = true;
+                       e.bpf_cookie = get_bpf_cookie(link);
+               }
+       }
+
        bpf_probe_read_kernel_str(&e.comm, sizeof(e.comm),
                                  task->group_leader->comm);
        bpf_seq_write(ctx->meta->seq, &e, sizeof(e));