Skip to content

Latest commit

 

History

History
32 lines (21 loc) · 545 Bytes

README.md

File metadata and controls

32 lines (21 loc) · 545 Bytes
Raw

catp-ebpf

Print the output of a running process (or any of its open fd) like catp does, but using eBPF instead of ptrace.

Prerequisites

  1. Install a rust stable toolchain: rustup install stable
  2. Install a rust nightly toolchain: rustup install nightly
  3. Install bpf-linker: cargo install bpf-linker

Build eBPF

cargo xtask build-ebpf

Build Userspace

cargo build

Run

cargo xtask run -- -p <PID>

Examples

screenshot