eBPF Processor for Ghidra
The extension implements eBPF architecture support for Ghidra and allows for disassembly and decompilation of ELF files containing eBPF programs.
Example of eBPF program you can get here.
Example of disassembling and decompiling of eBPF:
File → Install Extensions...
GHIDRA_INSTALL_DIR=${GHIDRA_HOME} gradle
and use Ghidra to install it: File → Install Extensions...
\Ghidra\Extensions
directory.03.09.2019 — eBPF maps implementation, custom relocation handler was implemented
19.09.2019 — problem with stack is resolved
20.09.2019 — eBPF call-helpers are implemented as syscalls, added helper's signature through custom eBPFAnalyzer
23.09.2019 — bad bookmarks fixed
01.12.2020 — new eBPF-helpers added
23.06.2022 — added support for relative calls (R_BPF_64_32
relocation type). Thanks @cnwangjihe for this idea. imm
of call instruction where bpf_call->src_reg == BPF_PSEUDO_CALL
now contains the relative offset to target function.
Before:
After:
24.06.2022 — making the Pull Request to official Ghidra repository as the main supplier of the eBPF processor
19.12.2022 — added support for BPF_ATOMIC operations, ALU32 instructions added, BPF_JMP32 instructions added, JSET instruction fixed
03.05.2023 — eBPF processor support added to the Ghidra official repository in the commit 506ca1e. Expected to work out of the box in the next Ghidra release 10.3.
Despite the inclusion of this project in the Ghidra, I will continue to maintain this repository. If you have problems or questions, you can open an issue either here or in the Ghidra repository. This repository will continue to be maintained in order to be able to work with older versions of Ghidra.