corpus.blog
41,554 blogs · 5,149,205 posts Claim your blog
Record · corpus.blog/posts/01a0879c-2528-7350-b9ec-13547efb1f73

BPF Memory Forensics with Volatility 3

lolcads.github.io · published 21 December 2023

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at lolcads.github.io Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
External links
108
Words captured
12,049

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://github.com/Gui774ume/ebpfkit
github.com
https://github.com/volatilityfoundation/volatility3
github.com
https://datatracker.ietf.org/doc/draft-ietf-bpf-isa/
datatracker.ietf.org
https://elixir.bootlin.com/linux/v6.1.68/source/kernel/bpf/core.c
elixir.bootlin.com
https://www.kernel.org/doc/html/latest/bpf/verifier.html
kernel.org
https://dl.acm.org/doi/proceedings/10.1145/3609021
dl.acm.org
https://elixir.bootlin.com/linux/v6.1.68/source/include/uapi/linux/capability.h
elixir.bootlin.com
https://www.zerodayinitiative.com/blog/2020/4/8/cve-2020-8835-linux-kernel-privilege-escalation-via-improper-ebpf-program-verification
zerodayinitiative.com
https://chompie.rip/Blog+Posts/Kernel+Pwning+with+eBPF+-+a+Love+Story
chompie.rip
https://github.com/hamishcoleman/spectre-tests/blob/master/project-zero/writeup_files/WRITEUP
github.com
https://spectreattack.com/spectre.pdf
spectreattack.com
https://elixir.bootlin.com/linux/v6.1.68/source/kernel/bpf/Kconfig
elixir.bootlin.com
https://github.com/cilium/cilium
github.com
https://github.com/facebookincubator/katran
github.com
https://www.usenix.org/conference/usenixsecurity23/presentation/he
usenix.org
https://github.com/h3xduck/TripleCross
github.com
https://github.com/eeriedusk/nysm
github.com
https://github.com/Esonhugh/sshd_backdoor
github.com
https://github.com/krisnova/boopkit
github.com
https://github.com/citronneur/pamspy
github.com
https://github.com/pathtofile/bad-bpf
github.com
https://github.com/nccgroup/ebpf
github.com
https://github.com/wunderwuzzi23/Offensive-BPF
github.com
https://lwn.net/Articles/740146/
lwn.net
https://elixir.bootlin.com/linux/v6.1.64/source/arch/x86/include/asm/syscall_wrapper.h
elixir.bootlin.com
https://elixir.bootlin.com/linux/v6.1.64/source/kernel/trace/Kconfig
elixir.bootlin.com
https://elixir.bootlin.com/linux/v6.1.67/source/lib/Kconfig.debug
elixir.bootlin.com
https://github.com/Gui774ume/ebpfkit/blob/5727985eab7eca7255ca5cb7c74133c0074e3324/ebpf/ebpfkit/signal.h
github.com
https://github.com/cilium/tetragon/blob/d8f5d44810ad2079ee408175454aab5c1159f09e/docs/content/en/docs/concepts/tracing-policy/selectors.md?plain=1
github.com
https://github.com/nccgroup/ebpf/tree/master/glibcpwn
github.com
https://github.com/pathtofile/bad-bpf/blob/main/src/textreplace.bpf.c
github.com
https://github.com/DataDog/datadog-agent/blob/f425dfa882dd9ca8533172c246ea047be1a40799/pkg/security/ebpf/probes/all.go
github.com
https://elixir.bootlin.com/linux/v6.1.67/source/security/lockdown/Kconfig
elixir.bootlin.com
https://www.netronome.com/blog/ever-deeper-bpf-update-hardware-offload-support/
netronome.com
https://www.kernelconfig.io/CONFIG_NET_CLS_BPF?q=NET_CLS_BPF&kernelversion=6.6.6&arch=x86
kernelconfig.io
https://www.kernelconfig.io/CONFIG_NET_ACT_BPF?q=CONFIG_NET_ACT_BPF&kernelversion=6.6.6&arch=x86
kernelconfig.io
https://www.youtube.com/watch?v=0BDB53PqcoU
youtube.com
https://github.com/cilium/tetragon
github.com
https://blogs.blackberry.com/en/2021/12/reverse-engineering-ebpfkit-rootkit-with-blackberrys-free-ida-processor-tool
blogs.blackberry.com
https://www.pangulab.cn/en/post/the_bvp47_a_top-tier_backdoor_of_us_nsa_equation_group/
pangulab.cn
https://blogs.blackberry.com/en/2022/06/symbiote-a-new-nearly-impossible-to-detect-linux-threat
blogs.blackberry.com
https://sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/
sandflysecurity.com
https://github.com/libbpf/bpftool
github.com
https://github.com/vobst/BPFVol3
github.com
https://blog.eb9f.de/2023/04/24/lsm2bpf.html
blog.eb9f.de
https://github.com/systemd/systemd/commit/021d1e96123289182565f0b3ce5a705b0e84fe48
github.com
https://www.kernel.org/doc/html/latest/core-api/idr.html?highlight=idr
kernel.org
https://www.kernel.org/doc/html/latest/core-api/xarray.html?highlight=xarray
kernel.org
https://github.com/vobst/BPFVol3/blob/main/src/utility/datastructures.py
github.com
https://elixir.bootlin.com/linux/v6.1.63/source/kernel/bpf/syscall.c
elixir.bootlin.com
https://elixir.bootlin.com/linux/v6.1.63/source/include/linux/bpf.h
elixir.bootlin.com
https://elixir.bootlin.com/linux/v6.1.63/source/include/uapi/linux/bpf.h
elixir.bootlin.com
https://github.com/vobst/BPFVol3/blob/main/src/plugins/bpf_listprogs.py
github.com
https://github.com/capstone-engine/capstone
github.com
https://github.com/vobst/BPFVol3/blob/main/src/plugins/bpf_listmaps.py
github.com
https://elixir.bootlin.com/linux/v6.1.63/source/kernel/trace/bpf_trace.c
elixir.bootlin.com
https://github.com/vobst/BPFVol3/blob/main/src/plugins/bpf_listlinks.py
github.com
https://github.com/vobst/BPFVol3/blob/main/src/plugins/bpf_lsm.py
github.com
https://elixir.bootlin.com/linux/v6.1.65/source/include/net/sch_generic.h
elixir.bootlin.com
https://github.com/volatilityfoundation/community3/blob/master/Sheffer_Shaked_Docker/plugins/ifconfig.py
github.com
https://github.com/vobst/BPFVol3/blob/main/src/plugins/bpf_netdev.py
github.com
https://github.com/vobst/BPFVol3/blob/main/src/plugins/bpf_listprocs.py
github.com
https://elixir.bootlin.com/linux/v6.1.63/source/include/linux/fs.h
elixir.bootlin.com
https://github.com/vobst/BPFVol3/blob/main/src/plugins/bpf_graph.py
github.com
https://github.com/vobst/BPFVol3/tree/main/docs
github.com
https://github.com/libbpf/libbpf-bootstrap
github.com
https://drive.proton.me/urls/DBWB4GFRK8
drive.proton.me
https://drive.proton.me/urls/BCKSBBZ6Z4
drive.proton.me
https://github.com/vobst/BPFVol3/blob/main/docs/examples/krie/krie.md
github.com
https://github.com/libbpf/libbpf-bootstrap/blob/master/examples/c/minimal.bpf.c
github.com
https://elixir.bootlin.com/linux/v6.1.65/source/include/net/tcp.h
elixir.bootlin.com
https://www.vagrantup.com/
vagrantup.com
https://libvirt.org/
libvirt.org
https://linux-kvm.org/page/Main_Page
linux-kvm.org
https://github.com/volatilityfoundation/dwarf2json
github.com
https://download.rockylinux.org/pub/rocky/9/BaseOS/x86_64/debug/tree/Packages/k/
download.rockylinux.org
https://github.com/volatilityfoundation/dwarf2json/issues/57
github.com
https://github.com/volatilityfoundation/volatility3/issues/1065
github.com
https://github.com/volatilityfoundation/volatility3/blob/fdf93f502fa8d0edc2b60764463aee3c455aeb03/volatility3/framework/automagic/linux.py
github.com
https://github.com/volatilityfoundation/volatility3/pull/1070
github.com
https://github.com/crash-utility/crash/tree/master
github.com
https://github.com/crash-utility/crash/blob/master/bpf.c
github.com
https://github.com/osandov/drgn
github.com
https://github.com/osandov/drgn/blob/main/tools/bpf_inspect.py
github.com
https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Fixing-A-Memory-Forensics-Blind-Spot-Linux-Kernel-Tracing-wp.pdf
i.blackhat.com
https://github.com/volatilityfoundation/volatility3/blame/develop/volatility3/framework/plugins/linux/sockstat.py
github.com
https://github.com/NationalSecurityAgency/ghidra
github.com
https://github.com/NationalSecurityAgency/ghidra/pull/4258
github.com
https://github.com/Gui774ume/ebpfkit-monitor
github.com
https://github.com/Gui774ume/krie
github.com
https://medium.com/@yunwei356/the-secure-path-forward-for-ebpf-runtime-challenges-and-innovations-968f9d71fc16
medium.com
https://bpfman.io/main/
bpfman.io
https://lwn.net/Articles/947173/
lwn.net
https://dl.acm.org/doi/abs/10.5555/3620237.3620571
dl.acm.org
https://lwn.net/Articles/927354/
lwn.net
https://www.youtube.com/watch?v=9p4qviq60z8
youtube.com
https://dl.acm.org/doi/10.1145/3609021.3609305
dl.acm.org
https://web.archive.org/web/20230323233100/https://dfrws.org/forensic-analysis-of-ebpf-based-linux-rootkits/
web.archive.org
https://github.com/fkie-cad/bpf-rootkit-workshop
github.com
https://networkx.org/documentation/stable/reference/algorithms/index.html
networkx.org
https://github.com/vobst/BPFVol3/blob/extractbtf/src/plugins/btf_extract.py
github.com
https://elixir.bootlin.com/linux/v6.1.68/source/lib/Kconfig.debug
elixir.bootlin.com
https://elixir.bootlin.com/linux/v6.1.68/source/net/netfilter/Kconfig
elixir.bootlin.com
https://blog.cloudflare.com/programmable-packet-filtering-with-magic-firewall/
blog.cloudflare.com
https://elixir.bootlin.com/linux/v6.1.68/source/kernel/trace/Kconfig
elixir.bootlin.com
https://elixir.bootlin.com/linux/v6.1.68/source/net/bpfilter/Kconfig
elixir.bootlin.com
https://elixir.bootlin.com/linux/v6.1.68/source/net/Kconfig
elixir.bootlin.com
https://elixir.bootlin.com/linux/v6.1.68/source/init/Kconfig
elixir.bootlin.com