4 ms·
You can see the interpreter instructions through bpftool: bpftool prog dump xlated id 173 To see the JITed instructions: bpftool prog dump jited id 173
by mdaverde 4y ago
You can see the interpreter instructions through bpftool:
bpftool prog dump xlated id 173
To see the JITed instructions:
bpftool prog dump jited id 173
For the interpreted insns, you can also see the instructions in different forms, which is pretty neat. For example you can get a control flow graph in DOT format with `visual` specified at the end:
bpftool prog dump xlated id 173 visual
I learned about these commands through this blog post: https://qmonnet.github.io/whirl-offload/2021/09/23/bpftool-features-thread/ https://qmonnet.github.io/whirl-offload/2021/09/23/bpftool-f...
- sillystuff 4y agoThanks. Visibility seems to be pretty good. Something like AIDE/Tripwire for BPF might be the next step.
- nickstinemates 4y agoThis is effectively what Falco(https://falco.org/ https://falco.org/) is