alessandrogario
09/27/2022, 1:34 AMArtemis Tosini
09/27/2022, 1:59 PMalessandrogario
09/27/2022, 2:03 PM/sys/kernel/btf/vmlinux
and converts it to a C header file
2. https://github.com/trailofbits/ebpf-common is used to allocate the perf events (in this case just sched:sched_process_exec), the maps (1 per-cpu map to replace the stack and 1 map for the event id counters), the perf outputs to send data to our usermode process
3. CMake will then take that sched_process_exec.c file and create a string out of it
4. ebpf-common again: the IClangCompiler class gets the string we just created + the defines for the maps we generated, then the bytecode is loadedArtemis Tosini
09/27/2022, 3:27 PM