bad-bpf
bad-bpf copied to clipboard
A collection of eBPF programs demonstrating bad behavior, presented at DEF CON 29
Thanks for sharing your great work on this. I noticed that the find/replace buffers were being initialized and checked with the filename_len_max value instead of the text_len_max value. This seems...
Maybe adding `bpf_program__set_autoattach(skel->progs.handle_getdents_patch, false);` before the code `err = pidhide_bpf__load(skel);` is a good choice? In my test, I found that function `handle_getdents_patch` will also be automatically mounted, not just called...