GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → Nalen98 → eBPF-for-Ghidra

Nalen98 / eBPF-for-Ghidra

Licence: MIT license
eBPF Processor for Ghidra

Programming Languages

java
68154 projects - #9 most used programming language

Labels

extensionreverse-engineeringdecompileebpfebpf-opcodeghidradissassembly

Projects that are alternatives of or similar to eBPF-for-Ghidra

libbpf-sys
Rust bindings to libbpf from the Linux kernel
Stars: ✭ 103 (-34.39%)
Mutual labels:  ebpf
emerald
Import DynamoRIO drcov code coverage data into Ghidra
Stars: ✭ 30 (-80.89%)
Mutual labels:  ghidra
ilogtail
Fast and Lightweight Observability Data Collector
Stars: ✭ 1,035 (+559.24%)
Mutual labels:  ebpf
qinst
Draft of generic instrumentation tool based on QEMU using eBPF to implement trivial instrumentations with trivial code
Stars: ✭ 17 (-89.17%)
Mutual labels:  ebpf
swoll
an experimental suite of applications and APIs for monitoring kernel-level activity on a live Kubernetes cluster
Stars: ✭ 66 (-57.96%)
Mutual labels:  ebpf
ovs-ebpf
No description or website provided.
Stars: ✭ 34 (-78.34%)
Mutual labels:  ebpf
ebpf
Elastic's eBPF
Stars: ✭ 45 (-71.34%)
Mutual labels:  ebpf
hubble-ui
Observability & Troubleshooting for Kubernetes Services
Stars: ✭ 210 (+33.76%)
Mutual labels:  ebpf
ghidra-r2web
Ghidra plugin to start an r2 webserver to let r2 interact with it
Stars: ✭ 38 (-75.8%)
Mutual labels:  ghidra
ghidra-nsis-extension
Ghidra extension to disassemble NSIS installers
Stars: ✭ 17 (-89.17%)
Mutual labels:  ghidra
hBPF
hBPF = eBPF in hardware
Stars: ✭ 335 (+113.38%)
Mutual labels:  ebpf
ebpfkit-monitor
ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits
Stars: ✭ 80 (-49.04%)
Mutual labels:  ebpf
gdt helper
Ghidra Data Type (GDT) Helper
Stars: ✭ 24 (-84.71%)
Mutual labels:  ghidra
ghidra2dwarf
🐉 Export ghidra decompiled code to dwarf sections inside ELF binary
Stars: ✭ 135 (-14.01%)
Mutual labels:  ghidra
portablebpf
You came here so you could have a base code to serve you as an example on how to develop a BPF application, compatible to BCC and/or LIBBPF, specially LIBBPF, having the userland part made in C or PYTHON.
Stars: ✭ 32 (-79.62%)
Mutual labels:  ebpf
kube-knark
Open Source runtime tool which help to detect malware code execution and run time mis-configuration change on a kubernetes cluster
Stars: ✭ 32 (-79.62%)
Mutual labels:  ebpf
parca-agent
eBPF based always-on profiler auto-discovering targets in Kubernetes and systemd, zero code changes or restarts needed!
Stars: ✭ 250 (+59.24%)
Mutual labels:  ebpf
ebpfault
A BPF-based syscall fault injector
Stars: ✭ 65 (-58.6%)
Mutual labels:  ebpf
ghidra-findcrypt
Ghidra analysis plugin to locate cryptographic constants
Stars: ✭ 138 (-12.1%)
Mutual labels:  ghidra
sleigh
Unofficial CMake build for Ghidra SLEIGH
Stars: ✭ 54 (-65.61%)
Mutual labels:  ghidra
View All Similar Projects ➔

eBPF processor for Ghidra

This project was initially started as a part of Digital Security's Research Centre internship "Summer of Hack 2019".

The extension implements eBPF architecture support for Ghidra and allows for disassembly and decompilation of ELF files containing eBPF programs.

Example of eBPF program you can get here.

eBPF Extension

Example of disassembling and decompiling of eBPF:

Example of decompiling

Installation

  • Download Release version of extension and install it in Ghidra File → Install Extensions...
  • Use gradle to build extension: GHIDRA_INSTALL_DIR=${GHIDRA_HOME} gradle and use Ghidra to install it: File → Install Extensions...
  • Clone this repository to \Ghidra\Extensions directory.

Updates

03.09.2019 — eBPF maps implementation, custom relocation handler was implemented

19.09.2019 — stack problem is resolved

20.09.2019 — eBPF call-helpers are implemented as syscalls, added helper's signature through custom eBPFAnalyzer

23.09.2019 — bad bookmarks fixed

01.12.2020 — new eBPF-helpers added

23.06.2022 — added support for relative calls (R_BPF_64_32 relocation type). Thanks @cnwangjihe for this idea. imm of call instruction where bpf_call->src_reg == BPF_PSEUDO_CALL now contains the relative offset to target function.

Before:

image

After:

24.06.2022 — making a Pull Request to official Ghidra repository as the main supplier of the eBPF processor

Useful links

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].