EParser is a simple utility that can be used to dump the eBPF programs and maps of an ELF file.
- golang 1.13+
- This project was developed on an Ubuntu Focal machine (Linux Kernel 5.4) but should be compatible with 4.13+ kernels (not tested).
- To build EParser, run:
# ~ make build
- To install EParser (copy to /usr/bin/eparser) run:
# ~ make install
Run eparser -h
to get help.
# ~ eparser -h
Usage:
eparser [command]
Available Commands:
help Help about any command
map prints information about one or multiple maps
prog prints information about one or multiple programs
Flags:
-a, --asset string path to the eBPF asset (ELF format expected)
-h, --help help for eparser
Use "eparser [command] --help" for more information about a command.
# ~ eparser prog --asset my_elf_file.o
# ~ eparser prog --asset my_elf_file.o --section kprobe/my_program --dump
# ~ eparser map --asset my_elf_file.o