fix index link in website

This commit is contained in:
yunwei37
2024-01-19 00:44:26 +00:00
parent d709ceb915
commit 6a75e1f306
2 changed files with 43 additions and 28 deletions

View File

@@ -58,7 +58,7 @@ Dive straight into eBPF development with this concise tutorial, built around the
### 高级主题 ### 高级主题
这里涵盖了一系列和 eBPF 相关的高级内容,包含在 Android 上使用 eBPF 程序、使用 eBPF 程序进行可能的攻击与防御、复杂的追踪等等。将 eBPF 用户态与内核态的部分结合起来,可能能带来巨大的威力(同时也是安全隐患)。这部分主要基于 libbpf、Cilium 等框架进行开发。 这里涵盖了一系列和 eBPF 相关的高级内容,包含在 Android 上使用 eBPF 程序、使用 eBPF 程序进行可能的攻击与防御、复杂的追踪等等。将 eBPF 用户态与内核态的部分结合起来,可能能带来巨大的威力(同时也是安全隐患)。这部分较为复杂的示例会基于 libbpf、Cilium 等框架进行开发,简单示例使用 eunomia-bpf 完成
Android: Android:

View File

@@ -12,49 +12,64 @@ For the complete source code of the tutorial, please refer to the repo [https://
This section contains simple eBPF program examples and introductions. It primarily utilizes the `eunomia-bpf` framework to simplify development and introduces the basic usage and development process of eBPF. This section contains simple eBPF program examples and introductions. It primarily utilizes the `eunomia-bpf` framework to simplify development and introduces the basic usage and development process of eBPF.
- [lesson 0-introduce](0-introduce/README_en.md) Introduces basic concepts of eBPF and common development tools - [lesson 0-introduce](0-introduce/README.md) Introduces basic concepts of eBPF and common development tools
- [lesson 1-helloworld](1-helloworld/README_en.md) Develops the simplest "Hello World" program using eBPF and introduces the basic framework and development process of eBPF - [lesson 1-helloworld](1-helloworld/README.md) Develops the simplest "Hello World" program using eBPF and introduces the basic framework and development process of eBPF
- [lesson 2-kprobe-unlink](2-kprobe-unlink/README_en.md) Uses kprobe in eBPF to capture the unlink system call - [lesson 2-kprobe-unlink](2-kprobe-unlink/README.md) Uses kprobe in eBPF to capture the unlink system call
- [lesson 3-fentry-unlink](3-fentry-unlink/README_en.md) Uses fentry in eBPF to capture the unlink system call - [lesson 3-fentry-unlink](3-fentry-unlink/README.md) Uses fentry in eBPF to capture the unlink system call
- [lesson 4-opensnoop](4-opensnoop/README_en.md) Uses eBPF to capture the system call collection of processes opening files, and filters process PIDs in eBPF using global variables - [lesson 4-opensnoop](4-opensnoop/README.md) Uses eBPF to capture the system call collection of processes opening files, and filters process PIDs in eBPF using global variables
- [lesson 5-uprobe-bashreadline](5-uprobe-bashreadline/README_en.md) Uses uprobe in eBPF to capture the readline function calls in bash - [lesson 5-uprobe-bashreadline](5-uprobe-bashreadline/README.md) Uses uprobe in eBPF to capture the readline function calls in bash
- [lesson 6-sigsnoop](6-sigsnoop/README_en.md) Captures the system call collection of processes sending signals and uses a hash map to store states - [lesson 6-sigsnoop](6-sigsnoop/README.md) Captures the system call collection of processes sending signals and uses a hash map to store states
- [lesson 7-execsnoop](7-execsnoop/README_en.md) Captures process execution times and prints output to user space through perf event array - [lesson 7-execsnoop](7-execsnoop/README.md) Captures process execution times and prints output to user space through perf event array
- [lesson 8-exitsnoop](8-exitsnoop/README_en.md) Captures process exit events and prints output to user space using a ring buffer - [lesson 8-exitsnoop](8-exitsnoop/README.md) Captures process exit events and prints output to user space using a ring buffer
- [lesson 9-runqlat](9-runqlat/README_en.md) Captures process scheduling delays and records them in histogram format - [lesson 9-runqlat](9-runqlat/README.md) Captures process scheduling delays and records them in histogram format
- [lesson 10-hardirqs](10-hardirqs/README_en.md) Captures interrupt events using hardirqs or softirqs - [lesson 10-hardirqs](10-hardirqs/README.md) Captures interrupt events using hardirqs or softirqs
# Advanced Documents and Examples # Advanced Documents and Examples
We start to build complete eBPF projects mainly based on `libbpf` and combine them with various application scenarios for practical use. We start to build complete eBPF projects mainly based on `libbpf` and combine them with various application scenarios for practical use.
- [lesson 11-bootstrap](11-bootstrap/README_en.md) Writes native libbpf user space code for eBPF using libbpf-bootstrap and establishes a complete libbpf project. - [lesson 11-bootstrap](11-bootstrap/README.md) Writes native libbpf user space code for eBPF using libbpf-bootstrap and establishes a complete libbpf project.
- [lesson 12-profile](12-profile/README_en.md) Performs performance analysis using eBPF - [lesson 12-profile](12-profile/README.md) Performs performance analysis using eBPF
- [lesson 13-tcpconnlat](13-tcpconnlat/README_en.md) Records TCP connection latency and processes data in user space using libbpf - [lesson 13-tcpconnlat](13-tcpconnlat/README.md) Records TCP connection latency and processes data in user space using libbpf
- [lesson 14-tcpstates](14-tcpstates/README_en.md) Records TCP connection state and TCP RTT.- [lesson 15-javagc](15-javagc/README_en.md) Capture user-level Java GC event duration using usdt - [lesson 14-tcpstates](14-tcpstates/README.md) Records TCP connection state and TCP RTT.- [lesson 15-javagc](15-javagc/README.md) Capture user-level Java GC event duration using usdt
- [lesson 16-memleak](16-memleak/README_en.md) Detect memory leaks - [lesson 16-memleak](16-memleak/README.md) Detect memory leaks
- [lesson 17-biopattern](17-biopattern/README_en.md) Capture disk IO patterns - [lesson 17-biopattern](17-biopattern/README.md) Capture disk IO patterns
- [lesson 18-further-reading](18-further-reading/README_en.md) Further reading: papers list, projects, blogs, etc. - [lesson 18-further-reading](18-further-reading/README.md) Further reading: papers list, projects, blogs, etc.
- [lesson 19-lsm-connect](19-lsm-connect/README_en.md) Use LSM for security detection and defense - [lesson 19-lsm-connect](19-lsm-connect/README.md) Use LSM for security detection and defense
- [lesson 20-tc](20-tc/README_en.md) Use eBPF for tc traffic control - [lesson 20-tc](20-tc/README.md) Use eBPF for tc traffic control
- [lesson 21-xdp](21-xdp/README_en.md) Use eBPF for XDP packet processing - [lesson 21-xdp](21-xdp/README.md) Use eBPF for XDP packet processing
# In-Depth Topics # In-Depth Topics
This section covers advanced topics related to eBPF, including using eBPF programs on Android, possible attacks and defenses using eBPF programs, and complex tracing. Combining the user-mode and kernel-mode aspects of eBPF can bring great power (as well as security risks). This section covers advanced topics related to eBPF, including using eBPF programs on Android, possible attacks and defenses using eBPF programs, and complex tracing. Combining the user-mode and kernel-mode aspects of eBPF can bring great power (as well as security risks).
<<<<<<< HEAD
- [Using eBPF programs on Android](22-android/README_en.md) - [Using eBPF programs on Android](22-android/README_en.md)
- [Tracing HTTP requests or other layer-7 protocols using eBPF socket filter or syscall trace](23-http/README_en.md) - [Tracing HTTP requests or other layer-7 protocols using eBPF socket filter or syscall trace](23-http/README_en.md)
- [Accelerating network request forwarding using sockops](29-sockops/README_en.md) - [Accelerating network request forwarding using sockops](29-sockops/README_en.md)
- [Capturing Plain Text Data of Various Libraries' SSL/TLS Using uprobe](30-sslsniff/README_en.md) - [Capturing Plain Text Data of Various Libraries' SSL/TLS Using uprobe](30-sslsniff/README_en.md)
=======
Android:
- [Using eBPF programs on Android](22-android/README.md)
Networking and tracing:
- [Tracing HTTP requests or other layer-7 protocols using eBPF socket filter or syscall trace](23-http/README.md)
- [Accelerating network request forwarding using sockops](29-sockops/README.md)
- [Capturing Plain Text Data of Various Libraries' SSL/TLS Using uprobe](30-sslsniff/README.md)
Security:
>>>>>>> 89ab1d3 (fix index link in website)
- [Use eBPF to modify syscall parameters](34-syscall/README.md) - [Use eBPF to modify syscall parameters](34-syscall/README.md)
- [The Secure Path Forward for eBPF: Challenges and Innovations](18-further-reading/ebpf-security.md) - [The Secure Path Forward for eBPF: Challenges and Innovations](18-further-reading/ebpf-security.md)
- [Hiding process or file information using eBPF](24-hide/README_en.md) - [Hiding process or file information using eBPF](24-hide/README.md)
- [Terminating processes by sending signals using bpf_send_signal](25-signal/README_en.md) - [Terminating processes by sending signals using bpf_send_signal](25-signal/README.md)
- [Adding sudo users using eBPF](26-sudo/README_en.md) - [Adding sudo users using eBPF](26-sudo/README.md)
- [Replacing text read or written by any program using eBPF](27-replace/README_en.md) - [Replacing text read or written by any program using eBPF](27-replace/README.md)
- [BPF lifecycle: Running eBPF programs continuously in Detached mode after user-mode applications exit](28-detach/README_en.md) - [BPF lifecycle: Running eBPF programs continuously in Detached mode after user-mode applications exit](28-detach/README.md)
- [Userspace eBPF Runtimes: Overview and Applications](src\36-userspace-ebpf\README_en.md) - [Userspace eBPF Runtimes: Overview and Applications](src\36-userspace-ebpf\README.md)
# bcc tutorial # bcc tutorial