edb icon indicating copy to clipboard operation
edb copied to clipboard

Add map "live" mode

Open dylandreimerink opened this issue 2 years ago • 0 comments

This issue proposes that we add the ability to use actual eBPF maps instead of the emulated maps. So after loading maps from an ELF file you would be able to map live pin {path to pinned map} or map live new to use an existing pinned map or create a new map in the kernel. After this, all reads/writes/deletes will use this actual map via the syscalls.

This would allow us to to a few things, for example in a use-case where a user has multiple eBPF programs coordinating via maps, this would allow you to replace one program with EDB while debugging it.

This also allows a user to very easily switch between running a program live and debugging it with little setup, to persist map state over multiple EDB sessions and it is a pre-cursor to run programs in "live" mode.

dylandreimerink avatar May 23 '22 09:05 dylandreimerink