A while back I was messing around with eBPF and I couldn’t find any good materials on using BPF without libbpf/LLVM/GCC (i.e. rawdogging bytecode), so here’s the resource I wished I had.

Lobsters is a community-driven platform for sharing and discussing links to articles, tutorials, and projects related to technology and programming. Readers can learn about a wide range of topics, from software development and system administration to cybersecurity and artificial intelligence. With user submissions, comments, and voting, Lobsters provides a platform for collaborative learning and knowledge sharing among technology enthusiasts.

Lobsters

A deep dive into writing eBPF programs at the raw bytecode level without libbpf, LLVM, or GCC, using Zig as the host language. Covers the full workflow: loading programs via the bpf() syscall, using eBPF maps for kernel-userspace data sharing, writing socket filter and sk_skb programs, and constructing BTF (BPF Type Format) objects manually to satisfy the verifier for features like subprograms, callbacks (bpf_loop), and KFuncs (bpf_strcmp). Includes working code examples for a packet filter that drops packets containing 'foobar', privilege requirements (CAP_BPF, CAP_NET_ADMIN, CAP_PERFMON), and parsing btf_vmlinux to look up KFunc BTF IDs at runtime. A Nix flake for running the examples in QEMU is also provided.

eBPF on Hard Mode

Passing data between kernel and user space