Reverse engineering eBPF programs

This post provides an overview of eBPF architecture, loading, verifier rules, helper functions, and maps, then walks through a reverse-engineering exercise of a small eBPF rootkit (from a public GitHub project) that hooks the execve tracepoint, modifies the target process name via bpf_probe_write_user, and emits an event to a ring buffer. The author disassembles the compiled object, explains the logic step-by-step, and includes the original C source to illustrate how an eBPF-based hijack operates and the security implications of kernel-level eBPF maps and helpers.