I have a binary file which runs a bpf server. The BPF is "loosely" defined as follows:
struct bpf{
length = 0x64
code = &c
}
A snippet of the code portion is: 0x00000028 0x00000004 0x61000015 0x00000028 I am looking at this through GDB. How can I look at the above memory addresses and determine which parts go into the sock_filter struct?
How would I determine which hexidecimal value maps to which specific BPF instruction?
User contributions licensed under CC BY-SA 3.0