User-space & language probing
Turn the lens around: uprobes, USDT, and probing inside running applications and language runtimes — bash, your own Rust binaries, TLS, and more.
uprobe + bashreadline
The first user-space probe — attach a uretprobe to bash's readline() to capture commands typed at interactive prompts, learning how uprobes target a binary or library by symbol and read the calling process's memory.
uprobe on a Rust binary
Point a uprobe at a function in a Rust program you built — confront symbol mangling and calling conventions, read a function argument at entry, and lay the groundwork for tracing your own services.
BTF-assisted uprobe
Read a struct argument from a uprobe by following a pointer into the target's memory, and understand how BTF recovers a struct's layout so you can probe binaries you didn't write without hardcoding offsets.
Bootstrap: containerized targets (Java & Python)
Stand up real application targets — Java 25 + Quarkus and Python 3.14 + FastAPI, both as multi-stage UBI containers — and learn to observe a process that lives inside a container by scoping eBPF to its cgroup, with crun's role on Fedora.
sslsniff
See the plaintext crossing TLS by probing OpenSSL — SSL_write before encryption and SSL_read after decryption — learning to probe a shared library and to capture bounded binary data, with the ethics that come with it.
funclatency
Time a function per call by pairing a uprobe at entry with a uretprobe at return and bpf_ktime_get_ns, then turn the durations into an OTLP latency histogram — and weigh per-call events against an in-kernel histogram.
Tracing goroutine states
Probe the Go scheduler's state machine through runtime.casgstatus — and meet two Go-specific realities head-on: the register ABI (args aren't where C puts them) and why you must never put a uretprobe on Go.
javagc
Time JVM garbage-collection pauses — learn what USDT is and why it's the ideal surface, discover that a stock OpenJDK ships no gc USDT markers, and fall back to uprobing the G1 collector's real stop-the-world function resolved from libjvm.so's symbol table.