A simple eBPF disassembler, based on rbpf.
It loads the compiled eBPF code from an ELF file and prints it out.
cargo install --git https://github.com/badboy/ebpf-disasm
If your code is in the section .classifier of your ELF file bpf.o:
ebpf-disasm --section .classifier bpf.o
$ ebpf-disasm -s .classifier bpf.o
mov64 r6, r1
ldabsh 0x4
mov64 r7, r0
ldabsw 0x0
lsh64 r0, 0x10
or64 r0, r7
stxdw [r10+0xfff8], r0
mov64 r2, r10
add64 r2, 0xfffffff8
lddw r1, 0x0
call 0x1
jeq r0, 0x0, +0x5
ldxw [r3+0x0], r0
mov64 r1, r6
lddw r2, 0x0
call 0xc
mov64 r0, 0x0
exit
MIT. See LICENSE.