kl-kbpf

BPF programs and maps

Canonical: kernlens-kbpf
Category: memory & symbols
Synopsis: kl-kbpf [-h] [-v] [-b NTH] [-p] [-m] [--values]

Walks the BPF object lists and prints each program and map. Root-only in a normal kernel, but readable through a debugger regardless of credentials.

Options

Option	Argument	Meaning
-v, --verbose	—	Increase the verbosity.
-b, --break	—	Break at the start of the nth JIT compiled ebpf prog.
-p, --progs	—	Print progs
-m, --maps	—	Print maps
--values	—	dump array-map element values

The default view

Invocation

kl-kbpf

Output

bpf progs: 0
bpf maps: 0

Reading it

Two summary lines when nothing is loaded. The counts come from the prog_idr/map_idr IDR structures, so they are the kernel's own totals.

Programs only

Invocation

kl-kbpf -p

Output

bpf progs: 0

Reading it

-p restricts the output to programs, which is what you want when looking for a hook: each row carries the program type, its bpf_func entry point, and the map it uses.

Maps only

Invocation

kl-kbpf -m

Output

bpf maps: 0

Reading it

-m restricts to maps. --values additionally dumps each map's contents, which is how a BPF-based keylogger or rootkit is spotted.

Notes

An empty list is a normal state for a minimal kernel, not a failure. -b N prints the Nth program and sets a breakpoint at its bpf_func, which is the practical way to catch a program running.

---

Part of the KernLens tutorial. Every output block on this page was captured from the kernel described in the tutorial index.