News for hackers. Stuff that matters.
Re:Show HN: Using eBPF to see through encryption without a p... by jonfriesen on Thursday May 08, 2025 @02:18PM (#43929445)
Fair point on -O2 and -O3 optimized bins. We've approached this by building custom bin utils that are optimized for blazingly fast symbol recognition. Traditional ELF tools that focus on providing comprehensive context for debugging, we are strip away everything that is not the symbol locations we need.

We've also added caching so frequently used bins don't require multiple scans. Shared libraries as well. This has proven effective with optimized binaries, especially bins that are optimized, start, make a super quick network call, then exit, which was the bane of our existence for a little while.

There are no comments on this comment yet.