Ravidu Priyankara (@ravindupriyankara)

ravindu-priyankara.hashnode.dev6d ago · 44 min read

Reverse-Engineering Linux Kernel Crypto: From HMAC Key Preparation to AES Key Memory

1. Introduction 1.1 Why Crypto Internals? Last two month, I spent a significant amount of time investigating copy-fail vulnerability. During that process, I started looking deeper into Linux kernel me

0

ravindu-priyankara.hashnode.devJul 28 · 7 min read

Reverse Engineering Linux's Dummy Kernel Module: Lessons from Binary to Kernel Behaviour

After successfully reversing the Linux dummy.ko network driver, I wanted to document not only what I found, but also the problems I faced during the process. This was my first serious attempt at rever

0

ravindu-priyankara.hashnode.devJun 20 · 9 min read

Squeezing Bytes: How I Optimised an eBPF Driver in Falco

1. How I Found This Opportunity I wanted to make my first open source contribution, so I decided to fork a few eBPF projects — one of them being falcosecurity/libs. After compiling and running Falco,

0

ravindu-priyankara.hashnode.devJun 8 · 18 min read

The Case of the Disappearing eBPF Instruction: Inside Map FD Relocation and BPF_LD_IMM64

While reading the disassembly of a compiled eBPF program I was working on, I noticed something strange — the 6th instruction was missing. Reading through the full disassembly again, I realized it wasn

0

ravindu-priyankara.hashnode.devMay 18 · 7 min read

eBPF Macros Are Just Costumes for ELF Metadata

In the previous part, we explored how our eBPF maps changed during preprocessing time. At first, those transformations looked strange. But after digging deeper, it became clear that most of the “speci

0

Ravidu Priyankara

About

Available for

Ravidu Priyankara's blogs

Reverse-Engineering Linux Kernel Crypto: From HMAC Key Preparation to AES Key Memory

Reverse Engineering Linux's Dummy Kernel Module: Lessons from Binary to Kernel Behaviour

Squeezing Bytes: How I Optimised an eBPF Driver in Falco

The Case of the Disappearing eBPF Instruction: Inside Map FD Relocation and BPF_LD_IMM64

eBPF Macros Are Just Costumes for ELF Metadata

Ravidu Priyankara

About

Available for

Ravidu Priyankara's blogs

Reverse-Engineering Linux Kernel Crypto: From HMAC Key Preparation to AES Key Memory

Reverse Engineering Linux's Dummy Kernel Module: Lessons from Binary to Kernel Behaviour

Squeezing Bytes: How I Optimised an eBPF Driver in Falco

The Case of the Disappearing eBPF Instruction: Inside Map FD Relocation and BPF_LD_IMM64

eBPF Macros Are Just Costumes for ELF Metadata

Ravidu Priyankara

About

Available for

Ravidu Priyankara's blogs

Reverse-Engineering Linux Kernel Crypto: From HMAC Key Preparation to AES Key Memory

Reverse Engineering Linux's Dummy Kernel Module: Lessons from Binary to Kernel Behaviour

Squeezing Bytes: How I Optimised an eBPF Driver in Falco

The Case of the Disappearing eBPF Instruction: Inside Map FD Relocation and BPF_LD_IMM64

eBPF Macros Are Just Costumes for ELF Metadata

Search Hashnode

Ravidu Priyankara

About

Available for

Ravidu Priyankara's blogs

Reverse-Engineering Linux Kernel Crypto: From HMAC Key Preparation to AES Key Memory

Reverse Engineering Linux's Dummy Kernel Module: Lessons from Binary to Kernel Behaviour

Squeezing Bytes: How I Optimised an eBPF Driver in Falco

The Case of the Disappearing eBPF Instruction: Inside Map FD Relocation and BPF_LD_IMM64

eBPF Macros Are Just Costumes for ELF Metadata