(备注1: 为了格式工整, 前面都是废话, 建议直接从11 hello world开始看)
(备注2: 60秒指的是在Linux上, 如果是Android可能要在基础再上加点)

目录

整理自2022/10 (bcc Release v0.25.0)

(1) BPF是什么?

(2) eBPF是什么?

(3) BCC是什么?

(4) IO Visor是什么?

(5) BCC在内核调试技术栈中的位置?

(6) 不同Linux内核版本对eBPF的支持?

(7) 官方文档

(8) 其他参考

(9) 安装BCC二进制包 (Ubuntu) (测试发现没法用)

(10) 自行编译安装 (Ubuntu) (推荐)

(11) hello world!

(12) 如何用监控open()函数的执行?

(13) 如何hook 任意system call?

(14) 更新

.
.

1 BPF是什么?

Linux内核中运行的虚拟机,
可以在外部向其注入代码执行.
.
.

2 eBPF是什么?

理解成BFP PLUS++
.
.

3 BCC是什么?

BPF虚拟机只运行BPF指令, 直接敲BPF指令比较恶心.
BCC可以理解成辅助写BPF指令的工具包,
用python和c语言间接生成EBPF指令.
.
.

4 IO Visor是什么?

指的是开源项目&&开发者社区,
BCC是IOVisor项目下的编译器工具集.
.
.

5 BCC在内核调试技术栈中的位置?

.
.

6 不同Linux内核版本对eBPF的支持?

• 参考官方文档
  266K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6A6L8%4k6A6M7$3!0J5i4K6u0r3j5X3y4U0i4K6u0r3j5X3I4G2j5W2)9J5c8X3#2S2M7%4c8W2M7W2)9J5c8X3c8G2j5%4y4Q4x3V1k6C8k6i4u0F1k6h3I4Q4x3X3c8$3k6i4u0K6K9h3!0F1M7#2)9J5k6h3#2V1
  .

• 查看自己Linux 内核版本 (ubuntu)

.
.

7 官方文档

• 项目地址
  bfaK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6A6L8%4k6A6M7$3!0J5i4K6u0r3j5X3y4U0
  .
• 使用bcc快速排除性能/故障/网络问题的例子
  3dbK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6A6L8%4k6A6M7$3!0J5i4K6u0r3j5X3y4U0i4K6u0r3j5X3I4G2j5W2)9J5c8X3#2S2M7%4c8W2M7W2)9J5c8X3c8G2j5%4y4Q4x3V1k6@1N6i4c8G2M7X3W2S2L8q4)9J5k6h3#2V1
  .
• API指南
  fd4K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6A6L8%4k6A6M7$3!0J5i4K6u0r3j5X3y4U0i4K6u0r3j5X3I4G2j5W2)9J5c8X3#2S2M7%4c8W2M7W2)9J5c8X3c8G2j5%4y4Q4x3V1k6J5k6h3k6W2M7X3g2F1j5$3g2Q4y4h3k6Y4N6h3W2V1k6g2)9J5k6h3#2V1
  .
• python开发者教程
  68dK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6A6L8%4k6A6M7$3!0J5i4K6u0r3j5X3y4U0i4K6u0r3j5X3I4G2j5W2)9J5c8X3#2S2M7%4c8W2M7W2)9J5c8X3c8G2j5%4y4Q4x3V1k6@1N6i4c8G2M7X3W2S2L8q4)9#2k6X3u0U0j5#2)9#2k6Y4m8&6N6r3S2G2L8W2)9#2k6X3c8W2N6X3g2D9L8%4m8W2M7W2)9J5k6h3#2V1
  .
• examples
  265K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6A6L8%4k6A6M7$3!0J5i4K6u0r3j5X3y4U0i4K6u0r3N6s2u0W2k6g2)9J5c8X3#2S2M7%4c8W2M7W2)9J5c8X3g2^5j5h3#2H3L8r3g2K6
  .
  .

8 其他参考

• Brendan Gregg出品教程
  287K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2T1M7X3g2F1k6r3q4F1k6%4u0W2k6$3N6Q4x3X3g2U0L8$3#2Q4x3V1k6W2j5Y4m8X3i4K6u0W2K9s2c8E0L8l9`.`.
  .

• linux内核调试追踪技术20讲
  28dK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6K6M7r3q4U0k6g2)9J5k6h3u0A6L8r3W2T1K9h3I4A6i4K6u0W2j5$3!0E0i4K6u0r3y4U0b7$3x3e0M7^5y4e0p5H3i4K6u0r3j5$3S2S2L8X3&6W2L8q4)9J5c8X3y4G2L8r3I4W2j5%4c8A6L8$3&6V1k6i4c8S2K9h3I4Q4x3@1k6K6K9h3c8Q4x3@1b7@1y4U0R3H3z5e0p5`.
  .

• 使用ebpf跟踪rpcx微服务
  335K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0L8$3I4G2j5Y4g2Q4x3X3g2U0L8$3#2Q4x3V1j5J5x3o6t1J5i4K6u0r3x3o6g2Q4x3V1j5J5x3W2)9J5c8Y4g2K6k6g2)9J5k6r3g2T1M7r3k6Q4x3X3c8@1L8#2)9J5k6s2c8J5j5h3y4W2i4K6u0V1M7Y4m8U0P5q4)9J5k6r3#2A6j5%4u0G2M7$3g2J5N6X3W2U0k6i4y4Q4x3V1j5`.
  .
  .

9 安装BCC二进制包 (Ubuntu) (测试发现没法用)

• 具体参考官方文档
  b7fK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6A6L8%4k6A6M7$3!0J5i4K6u0r3j5X3y4U0i4K6u0r3j5X3I4G2j5W2)9J5c8X3#2S2M7%4c8W2M7W2)9J5c8V1W2z5f1#2c8m8e0p5I4Q4x3X3g2E0k6l9`.`.
  .

• iovisor版 (官网说这个比较旧)

.

[注意]看雪招聘，专注安全领域的专业人才平台！