\relax \providecommand\hyper@newdestlabel[2]{} \providecommand\HyperFirstAtBeginDocument{\AtBeginDocument} \HyperFirstAtBeginDocument{\ifx\hyper@anchor\@undefined \global\let\oldcontentsline\contentsline \gdef\contentsline#1#2#3#4{\oldcontentsline{#1}{#2}{#3}} \global\let\oldnewlabel\newlabel \gdef\newlabel#1#2{\newlabelxx{#1}#2} \gdef\newlabelxx#1#2#3#4#5#6{\oldnewlabel{#1}{{#2}{#3}}} \AtEndDocument{\ifx\hyper@anchor\@undefined \let\contentsline\oldcontentsline \let\newlabel\oldnewlabel \fi} \fi} \global\let\hyper@last\relax \gdef\HyperFirstAtBeginDocument#1{#1} \providecommand\HyField@AuxAddToFields[1]{} \providecommand\HyField@AuxAddToCoFields[2]{} \providecommand\babel@aux[2]{} \@nameuse{bbl@beforestart} \@writefile{toc}{\boolfalse {citerequest}\boolfalse {citetracker}\boolfalse {pagetracker}\boolfalse {backtracker}\relax } \@writefile{lof}{\boolfalse {citerequest}\boolfalse {citetracker}\boolfalse {pagetracker}\boolfalse {backtracker}\relax } \@writefile{lot}{\boolfalse {citerequest}\boolfalse {citetracker}\boolfalse {pagetracker}\boolfalse {backtracker}\relax } \abx@aux@refcontext{none/global//global/global} \babel@aux{english}{} \abx@aux@cite{ransomware_pwc} \abx@aux@segm{0}{0}{ransomware_pwc} \@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {chapter}{\numberline {1}Introduction}{1}{chapter.1}\protected@file@percent } \@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\defcounter {refsection}{0}\relax }\@writefile{lot}{\addvspace {10\p@ }} \@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {section}{\numberline {1.1}Motivation}{1}{section.1.1}\protected@file@percent } \abx@aux@cite{rootkit_ptsecurity} \abx@aux@segm{0}{0}{rootkit_ptsecurity} \abx@aux@cite{ebpf_linux318} \abx@aux@segm{0}{0}{ebpf_linux318} \abx@aux@cite{bvp47_report} \abx@aux@segm{0}{0}{bvp47_report} \abx@aux@cite{bpfdoor_pwc} \abx@aux@segm{0}{0}{bpfdoor_pwc} \abx@aux@cite{ebpf_windows} \abx@aux@segm{0}{0}{ebpf_windows} \abx@aux@cite{ebpf_android} \abx@aux@segm{0}{0}{ebpf_android} \abx@aux@cite{evil_ebpf} \abx@aux@segm{0}{0}{evil_ebpf} \abx@aux@cite{bad_ebpf} \abx@aux@segm{0}{0}{bad_ebpf} \abx@aux@cite{ebpf_friends} \abx@aux@segm{0}{0}{ebpf_friends} \@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {section}{\numberline {1.2}Project objectives}{3}{section.1.2}\protected@file@percent } \@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {section}{\numberline {1.3}Regulatory framework}{4}{section.1.3}\protected@file@percent } \@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {subsection}{\numberline {1.3.1}Social and economic environment}{4}{subsection.1.3.1}\protected@file@percent } \@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {subsection}{\numberline {1.3.2}Budget}{4}{subsection.1.3.2}\protected@file@percent } \@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {section}{\numberline {1.4}Structure of the document}{4}{section.1.4}\protected@file@percent } \abx@aux@cite{ebpf_io} \abx@aux@segm{0}{0}{ebpf_io} \abx@aux@cite{bpf_bsd_origin} \abx@aux@segm{0}{0}{bpf_bsd_origin} \abx@aux@cite{ebpf_history_opensource} \abx@aux@segm{0}{0}{ebpf_history_opensource} \@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {chapter}{\numberline {2}State of the art}{5}{chapter.2}\protected@file@percent } \@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\defcounter {refsection}{0}\relax }\@writefile{lot}{\addvspace {10\p@ }} \@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {section}{\numberline {2.1}Introduction to eBPF}{5}{section.2.1}\protected@file@percent } \@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {subsection}{\numberline {2.1.1}eBPF history}{5}{subsection.2.1.1}\protected@file@percent } \@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\contentsline {figure}{\numberline {2.1}{\ignorespaces Sketch of the functionality of classic BPF\relax }}{5}{figure.caption.7}\protected@file@percent } \providecommand*\caption@xref[2]{\@setref\relax\@undefined{#1}} \newlabel{fig:classif_bpf}{{2.1}{5}{Sketch of the functionality of classic BPF\relax }{figure.caption.7}{}} \abx@aux@cite{bpf_bsd_origin_bpf_page1} \abx@aux@segm{0}{0}{bpf_bsd_origin_bpf_page1} \abx@aux@cite{index_register} \abx@aux@segm{0}{0}{index_register} \@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {chapter}{\numberline {3}Methods??}{7}{chapter.3}\protected@file@percent } \@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\defcounter {refsection}{0}\relax }\@writefile{lot}{\addvspace {10\p@ }} \@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {chapter}{\numberline {4}Results}{8}{chapter.4}\protected@file@percent } \@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\defcounter {refsection}{0}\relax }\@writefile{lot}{\addvspace {10\p@ }} \@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {chapter}{\numberline {5}Conclusion and future work}{9}{chapter.5}\protected@file@percent } \@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\defcounter {refsection}{0}\relax }\@writefile{lot}{\addvspace {10\p@ }} \@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {chapter}{Bibliography}{10}{chapter.5}\protected@file@percent } \abx@aux@read@bbl@mdfivesum{A38CCF92715F96EEC0C0F545CC410B50} \abx@aux@refcontextdefaultsdone \abx@aux@defaultrefcontext{0}{ransomware_pwc}{none/global//global/global} \abx@aux@defaultrefcontext{0}{rootkit_ptsecurity}{none/global//global/global} \abx@aux@defaultrefcontext{0}{ebpf_linux318}{none/global//global/global} \abx@aux@defaultrefcontext{0}{bvp47_report}{none/global//global/global} \abx@aux@defaultrefcontext{0}{bpfdoor_pwc}{none/global//global/global} \abx@aux@defaultrefcontext{0}{ebpf_windows}{none/global//global/global} \abx@aux@defaultrefcontext{0}{ebpf_android}{none/global//global/global} \abx@aux@defaultrefcontext{0}{evil_ebpf}{none/global//global/global} \abx@aux@defaultrefcontext{0}{bad_ebpf}{none/global//global/global} \abx@aux@defaultrefcontext{0}{ebpf_friends}{none/global//global/global} \abx@aux@defaultrefcontext{0}{ebpf_io}{none/global//global/global} \abx@aux@defaultrefcontext{0}{bpf_bsd_origin}{none/global//global/global} \abx@aux@defaultrefcontext{0}{ebpf_history_opensource}{none/global//global/global} \abx@aux@defaultrefcontext{0}{bpf_bsd_origin_bpf_page1}{none/global//global/global} \abx@aux@defaultrefcontext{0}{index_register}{none/global//global/global} \ttl@finishall \gdef \@abspage@last{27}