Ya, I was curious about that too. Finally started messing with bcc, found: https://stackoverflow.com/questions/43003805/can-ebpf-modify-the-return-value-or-para

Ya, I was curious about that too. Finally started messing with bcc, found: https://stackoverflow.com/questions/43003805/can-ebpf-modify-the-return-value-or-parameters-of-a-syscall https://stackoverflow.com/questions/43003805/can-ebpf-modify... and a tangentally related https://dev.framing.life/tracing/uprobes-and-int3-insn/ https://dev.framing.life/tracing/uprobes-and-int3-insn/