/eBPF-for-Ghidra

eBPF Processor for Ghidra

Primary LanguageJavaMIT LicenseMIT

eBPF-for-Ghidra

This project was initially started as a part of Digital Security's Research Centre internship "Summer of Hack 2019".

The extension implements eBPF architecture support for Ghidra and allows for disassembly and decompilation of ELF files containing eBPF programs.

Example of eBPF program you can get here.

eBPF Extension

Installation

  • Download Release version of extension and install it in Ghidra File → Install Extensions...
  • Use gradle to build extension: GHIDRA_INSTALL_DIR=${GHIDRA_HOME} gradle and use Ghidra to install it: File → Install Extensions...
  • Clone this repository to \Ghidra\Extensions directory.

Screenshots

Example of disassembling and decompiling of eBPF

Example of decompiling

Function Graph for eBPF

Function Graph

Updates

03.09 - eBPF maps implementation (added string info of map in decompiler and disassembler by using custom relocation handler)

19.09 - stack problem is resolved. eBPF call-helpers are implemented as syscalls (added helper's signature through custom eBPFAnalyzer)

23.09 - bad bookmarks fixed

Useful links