Get the latest tech news
Writing a system call tracer using eBPF
Pre-RequisitesSystem calls, eBPF, C, basics of low-level programming. IntroductioneBPF (Extended Berkeley Packet Filter) is a technology that allows users to run custom programs within the kernel. BPF
eBPF (Extended Berkeley Packet Filter) is a technology that allows users to run custom programs within the kernel. It also performs the crucial task of sending the child process’s ID to the eBPF program via the BPF hashmap. bpf_object__open: Creates a bpf_object by opening the BPF ELF object file pointed to by the passed path and loading it into memory.
Or read this on Hacker News