well, kprobe can be used without ebpf, if I remember correctly, the kernel headers are needed because of ebpf JIT