Development

mquire is a Linux memory forensics tool that can analyze kernel memory snapshots without relying on external debug symbols, by using BTF type data and kallsyms information already embedded inside the kernel itself. [Read More]

A short post on how the BTF type format was born, why I wrote a small parser library for it and where to find it. [Read More]

I’ve released two new BPF tools written in C++ with LLVM: ebpfault (a system call fault injector) and ebpfpub (a system call tracer). [Read More]