[QUESTION] How to hot patch user space eBPF program?

[D1cestor]

First of all, nice work from you.

Let's say we have a user space eBPF program a.bpf.c running. Is it possible to update it to b.bpf.c without stopping the program a.bpf.c is hooking to?

I have checked tailcall_minimal but I found it confusing because I am not familiar with the eBPF byte code.

Thanks

[Officeyutong]

If you mean to detach a userspace eBPF program, and then attach a new one:

• Send SIGUSR1 to the process which was injected by agent, so agent will detach all attaches. See

  bpftime/tools/cli/main.cpp

  Line 315 in 88a7958

  } else if (program.is_subcommand_used("detach")) {

  for details
• Re-attach desired hooks

[D1cestor]

Thanks for your reply.

I can detach the attaches but how do I re-attach a new hook?

I tried bpftime attach but it doesn't work.

[Officeyutong]

Thanks for your reply.

I can detach the attaches but how do I re-attach a new hook?

I tried bpftime attach but it doesn't work.

After a glance at the source of frida-gum:

• https://github.com/frida/frida-gum/blob/235c7a57b5b5220a758712eccac73ae7ddecaa38/gum/backend-linux/gumprocess-linux.c#L1812
• https://github.com/frida/frida-gum/blob/235c7a57b5b5220a758712eccac73ae7ddecaa38/gum/backend-linux/gumprocess-linux.c#L1831
  This error will be raised when /proc/PID/auxv wasn't found, or in a size of 0. Please check the content of that file.

[D1cestor]

The file did exist. Do I need to turn on some settings or grant some permissions?