{"id":29827056,"url":"https://github.com/knightchaser/ebpftracer","last_synced_at":"2026-05-07T15:32:40.502Z","repository":{"id":305159628,"uuid":"1022098411","full_name":"KnightChaser/ebpftracer","owner":"KnightChaser","description":"A simple and handcrafted strace-like eBPF-based syscall tracer","archived":false,"fork":false,"pushed_at":"2025-08-02T09:31:34.000Z","size":227,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-08-02T09:54:40.531Z","etag":null,"topics":["ebpf","linux","strace","system-calls","trace","utility"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/KnightChaser.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-07-18T12:58:05.000Z","updated_at":"2025-08-02T09:32:21.000Z","dependencies_parsed_at":"2025-07-25T12:11:43.268Z","dependency_job_id":"82c972cc-56af-4fe5-ad93-f4f080ae25ea","html_url":"https://github.com/KnightChaser/ebpftracer","commit_stats":null,"previous_names":["knightchaser/ebpf-tracer","knightchaser/ebpftracer"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/KnightChaser/ebpftracer","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KnightChaser%2Febpftracer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KnightChaser%2Febpftracer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KnightChaser%2Febpftracer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KnightChaser%2Febpftracer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/KnightChaser","download_url":"https://codeload.github.com/KnightChaser/ebpftracer/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KnightChaser%2Febpftracer/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":281366884,"owners_count":26488696,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-27T02:00:05.855Z","response_time":61,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ebpf","linux","strace","system-calls","trace","utility"],"created_at":"2025-07-29T06:01:09.617Z","updated_at":"2025-10-28T00:44:29.152Z","avatar_url":"https://github.com/KnightChaser.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ebpftracer\n\n\u003e A simple `strace`-like syscall tracer for Linux, built with C and eBPF.\n\nThis project is a personal exploration into Linux systems programming and eBPF(extended Berkeley Packet Filter). It is not intended to be a feature-complete or production-grade replacement for tools like `strace` (Of course). Side note, I was incredibly motivated by [SH4DY's \"Writing a system call tracer using eBPF\" article](https://sh4dy.com/2024/08/03/beetracer/) and [its public source code on GitHub](https://github.com/0xSh4dy/bee_tracer) while making this project!\n\n| Screenshot #1 | Screenshot #2 |\n|--------|--------|\n| \u003cimg width=\"600\" height=\"400\" alt=\"image\" src=\"https://github.com/user-attachments/assets/ef9e7417-fd91-4e26-977b-51783531fceb\" /\u003e | \u003cimg width=\"600\" height=\"400\" alt=\"image\" src=\"https://github.com/user-attachments/assets/cf352df0-0f46-4864-bfa0-3309fbeea431\" /\u003e |\n\n\n## Purpose \u0026 Features\n\nThe goal of this project is to intercept and log system calls made by a specified program. It uses eBPF tracepoints (`raw_syscalls:sys_enter` and `raw_syscalls:sys_exit`) to capture events efficiently at the kernel level and sends them to a user-space C application for processing and printing.\n\n- **Core Functionality**: Traces a target program and prints its system calls.\n- **Technology**: Built entirely in C using `libbpf`, `clang`, and the Meson build system.\n- **State Management**: Uses thread-safe hash maps to associate syscall correctly enter/exit events for complex I/O operations.\n- **Detailed Output**:\n  - Resolves file descriptor numbers to their absolute paths.\n  - Dumps data for I/O syscalls like `read`, `write`, `readv`, and `writev`.\n  - Resolves relative paths (e.g. `./file`) to their absolute paths (e.g. `/home/user/file`).\n\nThe tracer has dedicated handlers for the system calls planned in [my project's GitHub issue (#1)](https://github.com/KnightChaser/ebpftracer/issues/1). Other syscalls are not printed for simplicity.\n\n## Building and Running\n\n### Prerequisites\n\n- A Linux system with a modern kernel that supports BTF (BSS Type Format).\n- `clang` and `llvm` toolchain.\n- `libbpf` development library.\n- `bpftool` (to generate `vmlinux.h` header file).\n- `meson` (C/C++ build system).\n\n### Build Steps\n\n1.  **Clone the repository (including submodules):**\n    ```sh\n    git clone --recurse-submodules https://github.com/KnightChaser/ebpftracer.git\n    cd ebpf-tracer\n    ```\n\n2.  **Generate eBPF Artifacts:**\n    The user-space program depends on a few kernel-specific headers that must be generated on the host machine.\n    ```sh\n    # Generate vmlinux.h for kernel type definitions\n    bpftool btf dump file /sys/kernel/btf/vmlinux format c \u003e src/vmlinux.h\n\n    # Compile the eBPF C code and generate its user-space skeleton header\n    clang -g -O2 -target bpf -c src/controller.c -o src/controller.bpf.o\n    bpftool gen skeleton src/controller.bpf.o \u003e src/controller.skel.h\n    ```\n    *Note: These generated files are specific to your kernel version and architecture and are not checked into version control.*\n\n3.  **Configure and Compile with Meson:**\n    ```sh\n    meson setup builddir --native-file=clang.ini\n    cd builddir\n    meson compile\n    ```\n    This will create the `ebpftracer` executable in the `builddir`.\n\n### Usage\n\nRun the tracer by passing the program you want to trace as an argument, like `strace`.\n\n```sh\n# From the builddir directory\nsudo ./src/ebpftracer /bin/ls -l /tmp\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fknightchaser%2Febpftracer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fknightchaser%2Febpftracer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fknightchaser%2Febpftracer/lists"}