Two ways to attach an eBPF program to a kernel function: kprobe (old, INT3-based, more overhead) and fentry (newer, BPF trampoline, lower overhead). This video disassembles both attachment paths so you can see exactly where the hook intercepts the function and why fentry is the production-grade choice.
Foundation work for the SentinelEdge project — anything serious about kernel-level observability ends up here.
Comments
This space is waiting for your voice.
Comments will be supported shortly. Stay connected for updates!
This section will display user comments from various platforms like X, Reddit, YouTube, and more. Comments will be curated for quality and relevance.
Have questions? Reach out through:
Want to see your comment featured? Mention us on X or tag us on Reddit.