#ebpf

Articles tagged with #ebpf

Squeezing Bytes: How I Optimised an eBPF Driver in Falco
1. How I Found This Opportunity I wanted to make my first open source contribution, so I decided to fork a few eBPF projects — one of them being falcosecurity/libs. After compiling and running Falco,
Jun 20, 20269 min read26
The Case of the Disappearing eBPF Instruction: Inside Map FD Relocation and BPF_LD_IMM64
While reading the disassembly of a compiled eBPF program I was working on, I noticed something strange — the 6th instruction was missing. Reading through the full disassembly again, I realized it wasn
Jun 8, 202618 min read114
eBPF Macros Are Just Costumes for ELF Metadata
Dissecting eBPF Internals — Part 2
May 18, 20267 min read
eBPF Map Definitions Are Fake — And That’s the Point
I originally just wanted to observe what really happens after an eBPF hash map gets populated at runtime. To explore that, I built a very small tracing program and started digging into how maps actual
May 11, 202610 min read26
When Killing a Process Doesn't Kill the Risk: How PID Reuse and Stale eBPF State Caused Cascading False Positives in KernelEye
During kernelEye detection rule adjustments, I encountered an interesting bug worth sharing. The issue can be reproduced and understood within a few minutes through the write-up or the debugging video
May 5, 202612 min read1