Probex - eBPF Process Tracing Tool

Flow Overview

1. STARTUP
   probex -- sleep 1
        │
        ▼
   ┌─────────────────────────────────────┐
   │  Load eBPF bytecode into kernel     │
   │  (embedded at compile time)         │
   └─────────────────────────────────────┘
        │
        ▼
2. SPAWN TARGET PROCESS
   ┌─────────────────────────────────────┐
   │  fork() child with pre_exec hook    │
   │  that calls raise(SIGSTOP)          │
   │  Child stops before exec()          │
   └─────────────────────────────────────┘
        │
        ▼
3. SETUP TRACING
   ┌─────────────────────────────────────┐
   │  Insert child PID into TRACED_PIDS  │
   │  HashMap in kernel                  │
   └─────────────────────────────────────┘
        │
        ▼
   ┌─────────────────────────────────────┐
   │  Attach tracepoint handlers:        │
   │  - sched:sched_switch               │
   │  - sched:sched_process_fork         │
   │  - sched:sched_process_exit         │
   │  - exceptions:page_fault_user       │
   │  - syscalls:sys_enter/exit_read     │
   │  - syscalls:sys_enter/exit_write    │
   └─────────────────────────────────────┘
        │
        ▼
   ┌─────────────────────────────────────┐
   │  Send SIGCONT to resume child       │
   │  Child now exec()s target program   │
   └─────────────────────────────────────┘
        │
        ▼
4. EVENT LOOP
   ┌──────────────────────────────────────────────────────────┐
   │  KERNEL (eBPF)              │   USERSPACE (probex)       │
   │                             │                            │
   │  Tracepoint fires ──────────┼──► Ring buffer poll        │
   │       │                     │         │                  │
   │       ▼                     │         ▼                  │
   │  Check TRACED_PIDS map      │    Parse event struct      │
   │       │                     │         │                  │
   │       ▼                     │         ▼                  │
   │  If PID tracked:            │    Buffer events in batch  │
   │  Write event to ring buffer │         │                  │
   │                             │         ▼                  │
   │  (Fork events also add      │    Write batch to Parquet  │
   │   child PID to map)         │    when batch is full      │
   └──────────────────────────────────────────────────────────┘
        │
        ▼
5. TERMINATION
   ┌─────────────────────────────────────┐
   │  On process_exit for target PID     │
   │  or Ctrl-C: exit event loop         │
   └─────────────────────────────────────┘

Key Components

• TRACED_PIDS: HashMap<u32, u8> in kernel - tracks which PIDs to trace
• EVENTS: RingBuf (2MB) - kernel→userspace event transfer
• SIGSTOP/SIGCONT: Ensures probes attach before target executes

Event Types