package cbpf

Get desktop application:
View/edit binary Protocol Buffers messages

This message should all fit in a single byte.

• AluOperationCode operation_code = 1

  4 bits MSB

• SrcOperand source = 2

  1 bit

• InsClass instruction_class = 3

  3 bits LSB

Used in: AluOpcode

• AluAdd = 0

• AluSub = 16

• AluMul = 32

• AluDiv = 48

• AluOr = 64

• AluAnd = 80

• AluLsh = 96

• AluRsh = 112

• AluNeg = 128

• AluMod = 144

• AluXor = 160

(message has no fields)

The Linux kernel has a couple of BPF extensions that are used along with the class of load instructions by “overloading” the k argument with a negative offset (-0x1000) + a particular extension offset.

• Protocol = 0

  skb -> protocol

• Type = 4

  skb -> pkt_type

• Poff = 52

  Playload start offset

• Ifidx = 8

  skb -> dev -> index

• Nla = 12

  Netlink attribute of type X with offset A

• Nlan = 16

  Nested Netlink attribute of type X with offset A

• Mark = 20

  skb -> mark

• Queue = 24

  skb -> queue_mapping

• Hatype = 28

  skb -> dev -> type

• Rxhash = 32

  skb -> has

• Cpu = 36

  raw_smp_processor_id()

• AluXorX = 40

• Vlan_tci = 44

  skb_vlan_tag_get(skb)

• Vlan_avail = 48

  skb_vlan_tag_present(skb)

• Vlan_tpid = 60

  skb -> vlan_proto

• Rand = 56

  prandom_u32()

• Max = 64

Used in: AluOpcode, JmpOpcode, MemOpcode

• InsClassLd = 0

• InsClassLdx = 1

• InsClassSt = 2

• InsClassStx = 3

• InsClassAlu = 4

• InsClassJmp = 5

• InsClassRet = 6

• InsClassMisc = 7

Used in: Program

• int32 opcode = 1

  16 bits for opcode

• int32 jt = 2

  8 bits for Jmp true

• int32 jf = 3

  8 bits for Jmp false

• int32 k = 4

  32 bits for miscellaneous argument that can be interpreted in different ways depending on the given instruction in opcode

• JmpOperationCode operation_code = 1

  4 bits MSB

• SrcOperand source = 2

  1 bit

• InsClass instruction_class = 3

  3 bits LSB

Used in: JmpOpcode

• JmpJA = 0

• JmpJEQ = 16

• JmpJGT = 32

• JmpJGE = 48

• JmpJSET = 64

• StLdMode mode = 1

  3 bits MSB

• StLdSize size = 2

  2 bits

• InsClass instruction_class = 3

  3 bits LSB

Used in: program.Program

• repeated Instruction instructions = 1

• A = 0

  RegA is the accumulator register. RegA is always the destination register of ALU operations.

• X = 1

  RegX is the indirection register, used by LoadIndirect operations.

Used in: AluOpcode, JmpOpcode

• Immediate = 0

• RegSrc = 8

Used in: MemOpcode

• StLdModeIMM = 0

• StLdModeABS = 32

• StLdModeIND = 64

• StLdModeMEM = 96

• StLdModeLEN = 128

• StLdModeMSH = 160

Used in: MemOpcode

• StLdSizeW = 0

• StLdSizeH = 8

• StLdSizeB = 16