[HN Gopher] Defeating eBPF Uprobe Monitoring
       ___________________________________________________________________
        
       Defeating eBPF Uprobe Monitoring
        
       Author : pcw888
       Score  : 37 points
       Date   : 2022-09-08 16:44 UTC (6 hours ago)
        
 (HTM) web link (blog.quarkslab.com)
 (TXT) w3m dump (blog.quarkslab.com)
        
       | tptacek wrote:
       | Pretty neat trick. Uprobes are like super-ptrace: they work by
       | creating standard x64 int3 breakpoints, but the kernel handles
       | them internally rather than context switching back to userland
       | with an event. eBPF allows you to attach kernel code to a uprobe
       | to execute logic when one of those breakpoints is hit.
       | 
       | But the probes themselves are just int3 instructions, and
       | userland code can shake them off by unmapping and remapping the
       | memory; what's more, as I understand this: if you remap a uprobe
       | target page writeable, the kernel won't re-install breakpoints
       | there.
       | 
       | Net-net: uprobes are useful for monitoring cooperative processes,
       | but right now probably aren't that trustworthy as a sandboxing
       | primitive.
        
       ___________________________________________________________________
       (page generated 2022-09-08 23:01 UTC)