bcc
ebpf-for-windows
Our great sponsors
bcc | ebpf-for-windows | |
---|---|---|
71 | 13 | |
19,404 | 2,583 | |
2.2% | 2.6% | |
9.2 | 9.6 | |
9 days ago | 2 days ago | |
C | C | |
Apache License 2.0 | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
bcc
-
eBPF: Unleashing Kernel Magic for Modern Infrastructure
But wait, there's more! Enter the BCC toolkit and library, your trusty sidekick in simplifying the arcane art of writing eBPF applications. With BCC by your side, you'll be wielding eBPF like a seasoned pro in no time.
-
Linux: Easy Keylogger with eBPF (2018)
Nice - I normally use [bash-readline](https://github.com/iovisor/bcc/blob/master/tools/bashreadlin...) when coworking/co-inhabiting a server or training someone.
-
eBPF Documentary
One of the big wins is not so much “build and run your own stuff” but there are very nice low-cost (in terms of compute) performance utilities built on eBPF
https://github.com/iovisor/bcc
There are so many utilities in that list; there’s a diagram midway down the readme which tries to help show their uses. bcc-tools should be available in any distro.
Also, Brendan Gregg does a ton of performance stuff that is worth knowing about if you check out his other work. Not eBPF only. Flame graphs are useful.
- Bpftop: Streamlining eBPF performance optimization
-
eBPF Tutorial by Example 16: Monitoring Memory Leaks
Reference: https://github.com/iovisor/bcc/blob/master/libbpf-tools/memleak.c
- eBPF Tutorial by Example 9: Capturing Scheduling Latency and Recording as Histogram
-
Uprobes Siblings - Capturing HTTPS Traffic: A Rust and eBPF Odyssey
In this article, we'll build a basic version of an HTTPS sniffer, inspired by bcc-sslsniff.py, but we'll use Rust and Aya. We're going to demonstrate the capabilities of uprobes by employing uprobe and uretprobe along with familiar maps like PerCpuArray, HashMap, and PerEventArray. This will be a straightforward example to help us explore how uprobes function.
-
Issue XDP_REDIRECT on other interface in the same namespace
As xpd program I am using the BCC example xdp_redirect_map.py in skb mode as my NIC does not support native mode, attaching the program to veth2 and a dummy function to veth3
-
Linux runtime security agent powered by eBPF
https://github.com/iovisor/bcc/blob/master/docs/reference_gu...
- eBPF Practical Tutorial: Capturing SSL/TLS Plain Text Data Using uprobe
ebpf-for-windows
-
Why ACPI?
There already is an eBPF for Windows, it's even Microsoft's own project https://github.com/microsoft/ebpf-for-windows
-
eBPF Verification Is Untenable
This link is about a proposed new eBPF verifier for the Linux kernel that doesn't use signing. As a research project it is not integrated to the kernel, but their plan does not involve trusting user space (instead they suggest doing the heavy lifting of the verification in user space and provide a proof of safety that the kernel checks, which seems sensible to me).
I believe you meant to link https://github.com/microsoft/ebpf-for-windows/ instead (discussed on HN recently) which is an implementation by Microsoft using the above research project that indeed does not follow the suggestion from the authors of the research project to use validation and does require trusting user space.
- eBPF for Windows
-
GitHub - microsoft/DTrace-on-Windows: Code for the cross platform, single source, OpenDTrace implementation
Somewhat funnily, Microsoft also developed eBPF for Windows.
-
ELI5: eBPF
Not for long https://github.com/microsoft/ebpf-for-windows
- Linux developers patch security holes faster than anyone else, says Google
- Linux's IPTABLES Vs OpenBSD's PF ...... Which is more secure ?
- How to add eBPF observability to your product
- eBPF implementation that runs on top of Windows
What are some alternatives?
libbpf - Automated upstream mirror for libbpf stand-alone build.
UACME - Defeating Windows User Account Control
bpftrace - High-level tracing language for Linux eBPF [Moved to: https://github.com/bpftrace/bpftrace]
ebpf-verifier - eBPF verifier based on abstract interpretation
zfs - OpenZFS on Linux and FreeBSD
ebpf - ebpf-go is a pure-Go library to read, modify and load eBPF programs and attach them to various hooks in the Linux kernel.
linux - Linux kernel source tree
nokogiri-rust - Ruby FFI wrapper around scraper crate to be used instead of Nokogiri. Status: proof of concept.
xdp-tools - Utilities and example programs for use with XDP
libbpf-bootstrap - Scaffolding for BPF application development with libbpf and BPF CO-RE
opensnitch - OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch.