#ebpf #tui #elf #linux

app tbm

a Terminal Blueprint Meddler, for inspecting eBPF programs

2 releases

0.1.1 Jan 17, 2022
0.1.0 Jan 17, 2022

#65 in #ebpf

MIT license

175KB
182 lines

TBM - Terminal Blueprint Meddler

A TUI application for fooling around inside eBPF files.

Installation

cargo install tbm

Usage

Currently, only prints out the binary and dumps a ProgramBlueprint to the terminal. It must be run as root because oxidebpf requires an enumerated kernel version for parsing blueprints.

$ sudo ./tbm --file /path/to/my_ebpf_program
screenshot of eBELt reading an eBPF program

Wait, what's a blueprint?

Blueprints are what we call the processed and parsed eBPF objects used by oxidebpf. It contains all the program's sections, details about its probes, maps, and instructions, and more.

Dependencies

~11–20MB
~262K SLoC