OneLane: Reverse-Engineering Lost Updates in eBPF Per-CPU Counters Under Interrupt Pressure1.The First Thread Pulled If you've read my previous write-up and looked at its code, you might have noticed a small comment block inside update_error_stats(). static __always_inline void update_error16d ago · 46 min readravindu-priyankara.hashnode.dev
Reverse-Engineering Linux Kernel Crypto: From HMAC Key Preparation to AES Key Memory1. Introduction 1.1 Why Crypto Internals? Last two month, I spent a significant amount of time investigating copy-fail vulnerability. During that process, I started looking deeper into Linux kernel me1Oct 13 · 44 min readravindu-priyankara.hashnode.dev
Reverse Engineering Linux's Dummy Kernel Module: Lessons from Binary to Kernel BehaviourAfter successfully reversing the Linux dummy.ko network driver, I wanted to document not only what I found, but also the problems I faced during the process. This was my first serious attempt at reverJul 28 · 7 min readravindu-priyankara.hashnode.dev
Squeezing Bytes: How I Optimised an eBPF Driver in Falco1. How I Found This Opportunity I wanted to make my first open source contribution, so I decided to fork a few eBPF projects — one of them being falcosecurity/libs. After compiling and running Falco, Jun 20 · 9 min readravindu-priyankara.hashnode.dev
The Case of the Disappearing eBPF Instruction: Inside Map FD Relocation and BPF_LD_IMM64While reading the disassembly of a compiled eBPF program I was working on, I noticed something strange — the 6th instruction was missing. Reading through the full disassembly again, I realized it wasnJun 8 · 18 min readravindu-priyankara.hashnode.dev
