{"repo":"trailofbits/ebpfault","free":true,"listed":false,"github":"https://github.com/trailofbits/ebpfault","clone":"git clone https://github.com/trailofbits/ebpfault.git","description":"A BPF-based syscall fault injector","language":"C++","stars":110,"topics":["ebpf","fault-injection","debugging","llvm","bpf"],"license":"Apache-2.0","category":"dev-tools","readme_excerpt":"ebpfault This tool is a syscall fault injector built on top of eBPF that has no requirements on the target machine other than a kernel version good enough to support the required features. Usage Sample configuration The configuration supports both integers and errno value names. Against a new process Against one or more running processes System wide, excluding one or more running processes Building Prerequisites A recent Clang/LLVM installation (9.0 or better), compiled with BPF support A recent libc++ or stdc++ library, supporting C++17 CMake = 3.21.4. A pre-built binary can be downloaded from the CMake's download page. :warning: Linux kernel = 5.x (tested on Ubuntu 19.10) with the CONFIG BPF KPROBE OVERRIDE option enabled Building 1. Download the osquery-toolchain from the following page: https://github.com/osquery/osquery-toolchain 2. Extract the osquery-toolchain and set the TOOLCHAIN PATH environment variable to its location 3. Obtain the source code: git clone --recursive https://github.com/trailofbits/ebpfault 4. In case the --recursive flag was not provided, run git submodule update --init --recursive 7. Configure the project: cmake -S ebpfault -B build-ebpfault -DCMAKE TOOLCHAIN FILE=cmake/toolchain.cmake -DCMAKE BUILD TYPE=RelWithDebInfo -DEBPFAULT ENABLE INSTALL=true 8. Build the project: cmake --build build-ebpfault","default_branch":null,"files":null,"tree":[],"storefront":"/r/trailofbits","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/trailofbits/ebpfault/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}