Skip to content

Commit

Permalink
fix index link in website
Browse files Browse the repository at this point in the history
  • Loading branch information
yunwei37 committed Jan 19, 2024
1 parent d709ceb commit 6a75e1f
Show file tree
Hide file tree
Showing 2 changed files with 43 additions and 28 deletions.
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ Dive straight into eBPF development with this concise tutorial, built around the

### 高级主题

这里涵盖了一系列和 eBPF 相关的高级内容,包含在 Android 上使用 eBPF 程序、使用 eBPF 程序进行可能的攻击与防御、复杂的追踪等等。将 eBPF 用户态与内核态的部分结合起来,可能能带来巨大的威力(同时也是安全隐患)。这部分主要基于 libbpf、Cilium 等框架进行开发。
这里涵盖了一系列和 eBPF 相关的高级内容,包含在 Android 上使用 eBPF 程序、使用 eBPF 程序进行可能的攻击与防御、复杂的追踪等等。将 eBPF 用户态与内核态的部分结合起来,可能能带来巨大的威力(同时也是安全隐患)。这部分较为复杂的示例会基于 libbpf、Cilium 等框架进行开发,简单示例使用 eunomia-bpf 完成

Android:

Expand Down
69 changes: 42 additions & 27 deletions src/SUMMARY_en.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,49 +12,64 @@ For the complete source code of the tutorial, please refer to the repo [https://

This section contains simple eBPF program examples and introductions. It primarily utilizes the `eunomia-bpf` framework to simplify development and introduces the basic usage and development process of eBPF.

- [lesson 0-introduce](0-introduce/README_en.md) Introduces basic concepts of eBPF and common development tools
- [lesson 1-helloworld](1-helloworld/README_en.md) Develops the simplest "Hello World" program using eBPF and introduces the basic framework and development process of eBPF
- [lesson 2-kprobe-unlink](2-kprobe-unlink/README_en.md) Uses kprobe in eBPF to capture the unlink system call
- [lesson 3-fentry-unlink](3-fentry-unlink/README_en.md) Uses fentry in eBPF to capture the unlink system call
- [lesson 4-opensnoop](4-opensnoop/README_en.md) Uses eBPF to capture the system call collection of processes opening files, and filters process PIDs in eBPF using global variables
- [lesson 5-uprobe-bashreadline](5-uprobe-bashreadline/README_en.md) Uses uprobe in eBPF to capture the readline function calls in bash
- [lesson 6-sigsnoop](6-sigsnoop/README_en.md) Captures the system call collection of processes sending signals and uses a hash map to store states
- [lesson 7-execsnoop](7-execsnoop/README_en.md) Captures process execution times and prints output to user space through perf event array
- [lesson 8-exitsnoop](8-exitsnoop/README_en.md) Captures process exit events and prints output to user space using a ring buffer
- [lesson 9-runqlat](9-runqlat/README_en.md) Captures process scheduling delays and records them in histogram format
- [lesson 10-hardirqs](10-hardirqs/README_en.md) Captures interrupt events using hardirqs or softirqs
- [lesson 0-introduce](0-introduce/README.md) Introduces basic concepts of eBPF and common development tools
- [lesson 1-helloworld](1-helloworld/README.md) Develops the simplest "Hello World" program using eBPF and introduces the basic framework and development process of eBPF
- [lesson 2-kprobe-unlink](2-kprobe-unlink/README.md) Uses kprobe in eBPF to capture the unlink system call
- [lesson 3-fentry-unlink](3-fentry-unlink/README.md) Uses fentry in eBPF to capture the unlink system call
- [lesson 4-opensnoop](4-opensnoop/README.md) Uses eBPF to capture the system call collection of processes opening files, and filters process PIDs in eBPF using global variables
- [lesson 5-uprobe-bashreadline](5-uprobe-bashreadline/README.md) Uses uprobe in eBPF to capture the readline function calls in bash
- [lesson 6-sigsnoop](6-sigsnoop/README.md) Captures the system call collection of processes sending signals and uses a hash map to store states
- [lesson 7-execsnoop](7-execsnoop/README.md) Captures process execution times and prints output to user space through perf event array
- [lesson 8-exitsnoop](8-exitsnoop/README.md) Captures process exit events and prints output to user space using a ring buffer
- [lesson 9-runqlat](9-runqlat/README.md) Captures process scheduling delays and records them in histogram format
- [lesson 10-hardirqs](10-hardirqs/README.md) Captures interrupt events using hardirqs or softirqs

# Advanced Documents and Examples

We start to build complete eBPF projects mainly based on `libbpf` and combine them with various application scenarios for practical use.

- [lesson 11-bootstrap](11-bootstrap/README_en.md) Writes native libbpf user space code for eBPF using libbpf-bootstrap and establishes a complete libbpf project.
- [lesson 12-profile](12-profile/README_en.md) Performs performance analysis using eBPF
- [lesson 13-tcpconnlat](13-tcpconnlat/README_en.md) Records TCP connection latency and processes data in user space using libbpf
- [lesson 14-tcpstates](14-tcpstates/README_en.md) Records TCP connection state and TCP RTT.- [lesson 15-javagc](15-javagc/README_en.md) Capture user-level Java GC event duration using usdt
- [lesson 16-memleak](16-memleak/README_en.md) Detect memory leaks
- [lesson 17-biopattern](17-biopattern/README_en.md) Capture disk IO patterns
- [lesson 18-further-reading](18-further-reading/README_en.md) Further reading: papers list, projects, blogs, etc.
- [lesson 19-lsm-connect](19-lsm-connect/README_en.md) Use LSM for security detection and defense
- [lesson 20-tc](20-tc/README_en.md) Use eBPF for tc traffic control
- [lesson 21-xdp](21-xdp/README_en.md) Use eBPF for XDP packet processing
- [lesson 11-bootstrap](11-bootstrap/README.md) Writes native libbpf user space code for eBPF using libbpf-bootstrap and establishes a complete libbpf project.
- [lesson 12-profile](12-profile/README.md) Performs performance analysis using eBPF
- [lesson 13-tcpconnlat](13-tcpconnlat/README.md) Records TCP connection latency and processes data in user space using libbpf
- [lesson 14-tcpstates](14-tcpstates/README.md) Records TCP connection state and TCP RTT.- [lesson 15-javagc](15-javagc/README.md) Capture user-level Java GC event duration using usdt
- [lesson 16-memleak](16-memleak/README.md) Detect memory leaks
- [lesson 17-biopattern](17-biopattern/README.md) Capture disk IO patterns
- [lesson 18-further-reading](18-further-reading/README.md) Further reading: papers list, projects, blogs, etc.
- [lesson 19-lsm-connect](19-lsm-connect/README.md) Use LSM for security detection and defense
- [lesson 20-tc](20-tc/README.md) Use eBPF for tc traffic control
- [lesson 21-xdp](21-xdp/README.md) Use eBPF for XDP packet processing

# In-Depth Topics

This section covers advanced topics related to eBPF, including using eBPF programs on Android, possible attacks and defenses using eBPF programs, and complex tracing. Combining the user-mode and kernel-mode aspects of eBPF can bring great power (as well as security risks).

<<<<<<< HEAD
- [Using eBPF programs on Android](22-android/README_en.md)
- [Tracing HTTP requests or other layer-7 protocols using eBPF socket filter or syscall trace](23-http/README_en.md)
- [Accelerating network request forwarding using sockops](29-sockops/README_en.md)
- [Capturing Plain Text Data of Various Libraries' SSL/TLS Using uprobe](30-sslsniff/README_en.md)
=======
Android:

- [Using eBPF programs on Android](22-android/README.md)

Networking and tracing:

- [Tracing HTTP requests or other layer-7 protocols using eBPF socket filter or syscall trace](23-http/README.md)
- [Accelerating network request forwarding using sockops](29-sockops/README.md)
- [Capturing Plain Text Data of Various Libraries' SSL/TLS Using uprobe](30-sslsniff/README.md)

Security:

>>>>>>> 89ab1d3 (fix index link in website)
- [Use eBPF to modify syscall parameters](34-syscall/README.md)
- [The Secure Path Forward for eBPF: Challenges and Innovations](18-further-reading/ebpf-security.md)
- [Hiding process or file information using eBPF](24-hide/README_en.md)
- [Terminating processes by sending signals using bpf_send_signal](25-signal/README_en.md)
- [Adding sudo users using eBPF](26-sudo/README_en.md)
- [Replacing text read or written by any program using eBPF](27-replace/README_en.md)
- [BPF lifecycle: Running eBPF programs continuously in Detached mode after user-mode applications exit](28-detach/README_en.md)
- [Userspace eBPF Runtimes: Overview and Applications](src\36-userspace-ebpf\README_en.md)
- [Hiding process or file information using eBPF](24-hide/README.md)
- [Terminating processes by sending signals using bpf_send_signal](25-signal/README.md)
- [Adding sudo users using eBPF](26-sudo/README.md)
- [Replacing text read or written by any program using eBPF](27-replace/README.md)
- [BPF lifecycle: Running eBPF programs continuously in Detached mode after user-mode applications exit](28-detach/README.md)
- [Userspace eBPF Runtimes: Overview and Applications](src\36-userspace-ebpf\README.md)

# bcc tutorial

Expand Down

0 comments on commit 6a75e1f

Please sign in to comment.