\boolfalse {citerequest}\boolfalse {citetracker}\boolfalse {pagetracker}\boolfalse {backtracker}\relax 
\babel@toc {english}{}
\defcounter {refsection}{0}\relax 
\contentsline {chapter}{\numberline {1}Introduction}{1}{chapter.1}%
\defcounter {refsection}{0}\relax 
\contentsline {section}{\numberline {1.1}Motivation}{1}{section.1.1}%
\defcounter {refsection}{0}\relax 
\contentsline {section}{\numberline {1.2}Project objectives}{3}{section.1.2}%
\defcounter {refsection}{0}\relax 
\contentsline {section}{\numberline {1.3}Regulatory framework}{4}{section.1.3}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {1.3.1}Social and economic environment}{4}{subsection.1.3.1}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {1.3.2}Budget}{4}{subsection.1.3.2}%
\defcounter {refsection}{0}\relax 
\contentsline {section}{\numberline {1.4}Structure of the document}{4}{section.1.4}%
\defcounter {refsection}{0}\relax 
\contentsline {chapter}{\numberline {2}State of the art}{5}{chapter.2}%
\defcounter {refsection}{0}\relax 
\contentsline {section}{\numberline {2.1}eBPF history - Classic BPF}{5}{section.2.1}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {2.1.1}Introduction to the BPF system}{5}{subsection.2.1.1}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {2.1.2}The BPF virtual machine}{6}{subsection.2.1.2}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {2.1.3}Analysis of a BPF filter program}{7}{subsection.2.1.3}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {2.1.4}BPF bytecode instruction format}{8}{subsection.2.1.4}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {2.1.5}An example of BPF filter with tcpdump}{10}{subsection.2.1.5}%
\defcounter {refsection}{0}\relax 
\contentsline {section}{\numberline {2.2}Analysis of modern eBPF}{11}{section.2.2}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {2.2.1}eBPF instruction set}{13}{subsection.2.2.1}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {2.2.2}JIT compilation}{13}{subsection.2.2.2}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {2.2.3}The eBPF verifier}{14}{subsection.2.2.3}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {2.2.4}eBPF maps}{15}{subsection.2.2.4}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {2.2.5}The eBPF ring buffer}{16}{subsection.2.2.5}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {2.2.6}The bpf() syscall}{16}{subsection.2.2.6}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {2.2.7}eBPF helpers}{17}{subsection.2.2.7}%
\defcounter {refsection}{0}\relax 
\contentsline {section}{\numberline {2.3}eBPF program types}{18}{section.2.3}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {2.3.1}XDP}{18}{subsection.2.3.1}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {2.3.2}Traffic Control}{20}{subsection.2.3.2}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {2.3.3}Tracepoints}{21}{subsection.2.3.3}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {2.3.4}Kprobes}{22}{subsection.2.3.4}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {2.3.5}Uprobes}{22}{subsection.2.3.5}%
\defcounter {refsection}{0}\relax 
\contentsline {section}{\numberline {2.4}Developing eBPF programs}{23}{section.2.4}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {2.4.1}BCC}{23}{subsection.2.4.1}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {2.4.2}Bpftool}{24}{subsection.2.4.2}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {2.4.3}Libbpf}{24}{subsection.2.4.3}%
\defcounter {refsection}{0}\relax 
\contentsline {chapter}{\numberline {3}Analysis of offensive capabilities}{27}{chapter.3}%
\defcounter {refsection}{0}\relax 
\contentsline {section}{\numberline {3.1}Security features in eBPF}{27}{section.3.1}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {3.1.1}Access control}{28}{subsection.3.1.1}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {3.1.2}eBPF maps security}{30}{subsection.3.1.2}%
\defcounter {refsection}{0}\relax 
\contentsline {section}{\numberline {3.2}Abusing tracing programs}{30}{section.3.2}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {3.2.1}Access to function arguments}{30}{subsection.3.2.1}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {3.2.2}Reading memory out of bounds}{33}{subsection.3.2.2}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {3.2.3}Overriding function return values}{34}{subsection.3.2.3}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {3.2.4}Sending signals to user programs}{35}{subsection.3.2.4}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {3.2.5}Conclusion}{35}{subsection.3.2.5}%
\defcounter {refsection}{0}\relax 
\contentsline {section}{\numberline {3.3}Memory corruption}{36}{section.3.3}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {3.3.1}Memory management in Linux}{36}{subsection.3.3.1}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {3.3.2}Process virtual memory}{39}{subsection.3.3.2}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {3.3.3}The process stack}{40}{subsection.3.3.3}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {3.3.4}Attacks and limitations of bpf\_probe\_write\_user()}{44}{subsection.3.3.4}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {3.3.5}Conclusion}{47}{subsection.3.3.5}%
\defcounter {refsection}{0}\relax 
\contentsline {section}{\numberline {3.4}Abusing networking programs}{47}{section.3.4}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {3.4.1}An overview on the network layer}{48}{subsection.3.4.1}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {3.4.2}Introduction to the TCP protocol}{49}{subsection.3.4.2}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {3.4.3}Attacks and limitations of networking programs}{51}{subsection.3.4.3}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {3.4.4}Conclusion}{54}{subsection.3.4.4}%
\defcounter {refsection}{0}\relax 
\contentsline {chapter}{\numberline {4}Design of a malicious eBPF rootkit}{55}{chapter.4}%
\defcounter {refsection}{0}\relax 
\contentsline {section}{\numberline {4.1}Library injection via .GOT hijacking}{55}{section.4.1}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {4.1.1}Attacks at the stack: buffer overflow}{56}{subsection.4.1.1}%
\defcounter {refsection}{0}\relax 
\contentsline {subsection}{\numberline {4.1.2}Return oriented programming with eBPF}{60}{subsection.4.1.2}%
\defcounter {refsection}{0}\relax 
\contentsline {chapter}{\numberline {5}Results}{63}{chapter.5}%
\defcounter {refsection}{0}\relax 
\contentsline {chapter}{\numberline {6}Conclusion and future work}{64}{chapter.6}%
\defcounter {refsection}{0}\relax 
\contentsline {chapter}{Bibliography}{65}{chapter.6}%
\contentsfinish