Very entertaining article, thanks for that. I recognized a lot of my own a-ha moments w.r.t eBPF/bcc reading all the sections (especially the kern_version thing

Very entertaining article, thanks for that. I recognized a lot of my own a-ha moments w.r.t eBPF/bcc reading all the sections (especially the kern_version thing). You seem to want to avoid either LLVM (understandable) or run-time compilation (would be great, but it's hard as you state). I'd like to introduce you to ply(1). It's a DSL interpreter (think dtrace) that compiles an awk/dtrace like language to eBPF and wires up the necessary pipes/maps/... Link https://github.com/iovisor/ply https://github.com/iovisor/ply. Please take some time to read the code. It's tiny. Every time I come away with a renewed appreciation for well written C (and wkz).