Skip to content

Commit b5ec510

Browse files
committed
Updated comments and README
1 parent 39142de commit b5ec510

File tree

2 files changed

+5
-4
lines changed

2 files changed

+5
-4
lines changed

README.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -76,8 +76,8 @@ Other distributions provide equivalent packages, which at minimum allow compilin
7676
- [X] Insert checks on kernel versions and ```CONFIG_``` kernel options to extend support
7777
- [X] Implement network dump (TCP)
7878
- [X] Implement dump with reduced granule if page fail to be read
79+
- [X] Introduce support for kernels that do not have uprobes
7980
- [ ] Support other CPU architectures (x32, ARM32, MIPS, PowerPC, POWER, RISC-V)
80-
- [ ] Introduce support for kernels that do not have uprobes (by hooking some syscall or intectept egress traffic in read only from TC?)
8181
- [ ] Use of `_stext` in x64 to bypass missing `CONFIG_KALLSYMS_ALL`
8282
- [ ] Bruteforce scanning (?) for page containing same data of `_stext` page in ARM64 to bypass missing `CONFIG_KALLSYMS_ALL`
8383
- [ ] Implement network dump (UDP)
@@ -90,11 +90,11 @@ Other distributions provide equivalent packages, which at minimum allow compilin
9090
- Introduction of kProbe/uProbe support 4.1
9191
- Introduction of tracepoint support (syscalls tracing) 4.7
9292
- Introduction of XDP 4.8
93-
- !!! Android 9 support eBPF: 4.9
93+
- Android 9 support eBPF: 4.9
9494
- Introduction of BTF 4.18
9595
- Introduction mmap() support for array maps 5.5
9696
- !!! Introduction of read_kernel() 5.5 <==== Minimum Lemon target version
9797
- Introduction of ring_buffer 5.8
98-
- !!! Android 13 support BTF 5.15
98+
- Android 13 support BTF 5.15
9999
- Introduction of SYSCALL program type 5.15
100100
- Introduction of kallsyms() in ebpf 5.16

ebpf/mem.ebpf.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,8 @@ struct {
3131
#endif
3232
#endif
3333

34-
/* VA bits for ARM64
34+
/*
35+
* read_memory() - Read kernel memory and save the content in the eBPF map
3536
*
3637
* Attempts to read a specified chunk of kernel memory starting from a given address,
3738
* validating the request against architecture-specific constraints and dump size limits.

0 commit comments

Comments
 (0)