{"repo":"gojue/ebpfmanager","free":true,"listed":false,"github":"https://github.com/gojue/ebpfmanager","clone":"git clone https://github.com/gojue/ebpfmanager.git","description":"A golang ebpf libary based on cilium/ebpf and datadog/ebpf.","language":"Go","stars":351,"topics":["ebpf","golang","hids"],"license":"Apache-2.0","category":"dev-tools","readme_excerpt":"介绍 ebpfmanager参照datadog/ebpf/manager包的思想，基于cilium/ebpf实现的ebpf类库封装。 相比 cilium/ebpf 实现配置化，自动加载，更具备面向对象思想，且实现了 probe 颗粒的卡开启关闭功能。 相比 datadog/ebpf ，实现了依赖包方式加载 cilium/ebpf ，而非fork方式，这点与其期望走的方向一致。且依赖 cilium/ebpf 版本更新到最新v0.9.0。 Work is underway to convert this library to wrap the upstream library, rather than forking. 依赖 cilium/ebpf v0.18.0 2025-05-18 go-bindata 用于生成ebpf字节码文件的go包，与 go:embed 类似。 说明 manager与probe是一对多关系。每个probe必须配置 Section 与 EbpfFuncName 两个属性。如果是 k(ret)probe 或 u(ret)probe ，则还需要配置 AttachToFuncName 属性。 使用方法 参考 examples 目录下例子，比如 uprobe 案例项目 eCapture : capture SSL/TLS text content without CA cert using eBPF. eHIDS-Agent : A Linux Host-based Intrusion Detection System based on eBPF. 注意 1. v0.7.0及以后的版本中，ebpf在 loadProgram 函数返回的progs map中，索引已经改为C代码中函数名。 见 elf reader.go 312行 res[prog.Name] = prog ，这点不同于老版本。（老版本是以section名字作为索引） 2. 在 datadog/ebpf af587081 Nov 17, 2021 版本上实现本类库。 感谢 感谢 https://jetbrains.com/ 的 All Products Pack IDE使用授权。","default_branch":null,"files":null,"tree":[],"storefront":"/r/gojue","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/gojue/ebpfmanager/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}