https://github.com/badboy/ebpf-disasm

Simple ebpf disassembler in Rust
https://github.com/badboy/ebpf-disasm

Last synced: 24 days ago
JSON representation

Simple ebpf disassembler in Rust

• Host: GitHub
• URL: https://github.com/badboy/ebpf-disasm
• Owner: badboy
• License: mit
• Created: 2017-01-16T14:53:01.000Z (about 8 years ago)
• Default Branch: master
• Last Pushed: 2019-07-29T08:55:49.000Z (over 5 years ago)
• Last Synced: 2024-12-24T02:01:15.306Z (27 days ago)
• Language: Rust
• Homepage:
• Size: 13.7 KB
• Stars: 35
• Watchers: 2
• Forks: 5
• Open Issues: 1
• Metadata Files:
  • Readme: README.md
  • Changelog: CHANGELOG.md
  • License: LICENSE

Awesome Lists containing this project

README

        
# ebpf-disasm

A simple eBPF disassembler, based on [rbpf](https://github.com/qmonnet/rbpf).

It loads the compiled eBPF code from an ELF file and prints it out.

## Installation

```

cargo install --git https://github.com/badboy/ebpf-disasm

```

## Usage

If your code is in the section `.classifier` of your ELF file `bpf.o`:

```

ebpf-disasm --section .classifier bpf.o

```

### Example output

```

$ ebpf-disasm -s .classifier bpf.o

mov64	r6,	r1

ldabsh	0x4

mov64	r7,	r0

ldabsw	0x0

lsh64	r0,	0x10

or64	r0,	r7

stxdw	[r10+0xfff8],	r0

mov64	r2,	r10

add64	r2,	0xfffffff8

lddw	r1,	0x0

call	0x1

jeq	r0,	0x0,	+0x5

ldxw	[r3+0x0],	r0

mov64	r1,	r6

lddw	r2,	0x0

call	0xc

mov64	r0,	0x0

exit

```

## License

MIT. See [LICENSE](LICENSE).