[QUESTION] How to hot patch user space eBPF program?

[D1cestor]

First of all, nice work from you.

Let's say we have a user space eBPF program a.bpf.c running. Is it possible to update it to b.bpf.c without stopping the program a.bpf.c is hooking to?

I have checked tailcall_minimal but I found it confusing because I am not familiar with the eBPF byte code.

Thanks

[Officeyutong]

If you mean to detach a userspace eBPF program, and then attach a new one:

• Send SIGUSR1 to the process which was injected by agent, so agent will detach all attaches. See https://github.com/eunomia-bpf/bpftime/blob/88a79587639afd59103b88747940c6627a434cc4/tools/cli/main.cpp#L315 for details
• Re-attach desired hooks

[D1cestor]

Thanks for your reply.

I can detach the attaches but how do I re-attach a new hook?

I tried bpftime attach but it doesn't work.

[Officeyutong]

Thanks for your reply.

I can detach the attaches but how do I re-attach a new hook?

I tried bpftime attach but it doesn't work.

After a glance at the source of frida-gum:

• https://github.com/frida/frida-gum/blob/235c7a57b5b5220a758712eccac73ae7ddecaa38/gum/backend-linux/gumprocess-linux.c#L1812
• https://github.com/frida/frida-gum/blob/235c7a57b5b5220a758712eccac73ae7ddecaa38/gum/backend-linux/gumprocess-linux.c#L1831 This error will be raised when /proc/PID/auxv wasn't found, or in a size of 0. Please check the content of that file.

[D1cestor]

The file did exist. Do I need to turn on some settings or grant some permissions?