Legacy BCC Workflow (Heavy & Brittle):
Production Server ──► [ Installs Clang + 500MB Kernel Headers ] ──► Compiles C at runtime on server! 💥

Modern BPF CO-RE Workflow (Compile Once – Run Everywhere):
Developer Machine ──► Compiles single hermetic 50KB eBPF ELF binary with Clang/Rust
Production Server ──► [ libbpf reads in-kernel BTF metadata ]
                  ──► Relocates kernel struct offsets dynamically in 10 microseconds!
                  ──► Executes safely across ANY Linux kernel 5.8+ with ZERO compiler dependencies! ✅

                        Compiled eBPF Binary (Field: task->pid)
                                          │
                                          ▼
                      [ libbpf Loader on Target Production Server ]
                                          │
                   ┌──────────────────────┴──────────────────────┐
                   ▼                                             ▼
       [ Kernel BTF (/sys/kernel/btf/vmlinux) ]       [ eBPF Relocation Record ]
       Reads exact layout of active kernel            Calculates offset delta: 0x48 -> 0x50
                                          │
                                          ▼
                [ In-Memory Bytecode Rewritten with Exact Kernel Offsets! ]
                                          │
                                          ▼
                [ Verified by BPF Verifier & Attached to Tracepoint! ]

// process_tracker.bpf.c - Production Process Exec Tracker with CO-RE
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_core_read.h>

struct event_t {
    __u32 pid;
    __u32 ppid;
    char comm[16];
    char filename[128];
};

struct {
    __uint(type, BPF_MAP_TYPE_RINGBUF);
    __uint(max_entries, 256 * 1024); // 256 KB Ring Buffer
} events_ringbuf SEC(".maps");

SEC("tp/sched/sched_process_exec")
int handle_process_exec(struct trace_event_raw_sched_process_exec *ctx) {
    struct task_struct *task = (struct task_struct *)bpf_get_current_task();
    struct event_t *event;

    // Allocate space in ring buffer
    event = bpf_ringbuf_reserve(&events_ringbuf, sizeof(*event), 0);
    if (!event)
        return 0;

    // CO-RE helper safely reads struct fields across any kernel version!
    event->pid = bpf_get_current_pid_tgid() >> 32;
    event->ppid = BPF_CORE_READ(task, real_parent, tgid);
    
    bpf_get_current_comm(&event->comm, sizeof(event->comm));
    
    // Submit event to user space
    bpf_ringbuf_submit(event, 0);
    return 0;
}

char LICENSE[] SEC("license") = "Dual BSD/GPL";

// main.rs - Rust User-Space eBPF Ring Buffer Consumer
use libbpf_rs::RingBufferBuilder;
use plain::Plain;
use std::time::Duration;

#[repr(C)]
#[derive(Default)]
struct ProcessEvent {
    pid: u32,
    ppid: u32,
    comm: [u8; 16],
    filename: [u8; 128],
}
unsafe impl Plain for ProcessEvent {}

fn handle_event(data: &[u8]) -> i32 {
    let mut event = ProcessEvent::default();
    plain::copy_from_bytes(&mut event, data).expect("Failed to parse event");
    
    let comm = String::from_utf8_lossy(&event.comm);
    println!("⚡ New Process Executed: PID={} PPID={} COMM={}", event.pid, event.ppid, comm.trim_matches(char::from(0)));
    0
}

fn main() -> Result<(), Box<dyn std::error::Error>> {
    // 1. Load and attach compiled eBPF skeleton
    let skel_builder = process_tracker::ProcessTrackerSkelBuilder::default();
    let open_skel = skel_builder.open()?;
    let mut load_skel = open_skel.load()?;
    load_skel.attach()?;

    // 2. Poll Ring Buffer
    let maps = load_skel.maps();
    let mut builder = RingBufferBuilder::new();
    builder.add(maps.events_ringbuf(), handle_event)?;
    let ringbuf = builder.build()?;

    println!("🚀 eBPF Process Monitor listening on kernel tracepoints...");
    loop {
        ringbuf.poll(Duration::from_millis(100))?;
    }
}

Tracing Agent RAM Footprint (Megabytes):
┌─────────────────────────────────────────────────────────┐
│ Legacy BCC Framework: ████████████████████ 145 MB       │
│ Modern BPF CO-RE:     █ 6.4 MB (22x Less Memory!)       │
└─────────────────────────────────────────────────────────┘