Debugging crashes is frustrating - by the time you see the segfault, the damage is done. Traditional debuggers only show you the crash moment, not what led to it. I wanted to build a "time machine" that records everything, so when a crash happens, you can rewind and see the full story. eBPF makes this possible with minimal overhead, running safely in kernel space without modifying the target program.

Built With

  • buffer
  • ebpf-c-libbpf-linux-kernel-bpf-co-re-(compile-once
  • everywhere)
  • not-what-led-to-it.-i-wanted-to-build-a-"time-machine"-that-records-everything
  • ring
  • run
  • so-when-a-crash-happens
  • the-damage-is-done.-traditional-debuggers-only-show-you-the-crash-moment
  • uprobe/uretprobe
  • you-can-rewind-and-see-the-full-story.-ebpf-makes-this-possible-with-minimal-overhead
Share this project:

Updates