Crate ghostscope_loader 

GhostScope eBPF Loader

This crate provides the GhostScopeLoader which manages the lifecycle of eBPF programs:

• Loading eBPF bytecode into the kernel
• Attaching/detaching uprobes to target binaries
• Reading trace events from RingBuf or PerfEventArray
• Managing BPF maps for process module offsets

Architecture

The loader supports two event output mechanisms:

• RingBuf: Modern kernel (>= 5.8) continuous byte stream
• PerfEventArray: Legacy kernel (< 5.8) per-CPU independent events

Event parsing is handled by ghostscope_protocol::StreamingTraceParser which adapts to the event source type automatically.

Structs

GhostScopeLoader

Main eBPF program loader and manager

KernelCapabilities

Kernel eBPF capabilities detection

KernelCapabilityError

Enums

LoaderError

Loader error types

Functions

hello

Type Aliases

Result