ghostscope-process
| Crates.io | ghostscope-process |
| lib.rs | ghostscope-process |
| version | 0.1.1 |
| created_at | 2025-11-08 14:49:33.899695+00 |
| updated_at | 2025-11-08 14:49:33.899695+00 |
| description | Low-level process controller that coordinates probes, loaders, and eBPF programs on target binaries. |
| homepage | https://github.com/swananan/ghostscope |
| repository | https://github.com/swananan/ghostscope |
| max_upload_size | |
| id | 1922947 |
| size | 96,378 |
swananan (swananan)
documentation
https://github.com/swananan/ghostscope#readme
README
ghostscope-process
ghostscope-process drives low-level process orchestration for GhostScope. It selects attachment points, prepares loader state, and exposes helpers consumed by both user-space and eBPF code.
eBPF Artifacts
Prebuilt CO-RE objects live under ebpf/obj/. The build.rs script copies them into the Cargo output directory. If you need to regenerate the objects:
$ ./ghostscope-process/ebpf/build_sysmon_bpf.sh
The script expects:
- Rust nightly toolchain (default
nightly-2024-07-01) with thebpfel-unknown-noneandbpfeb-unknown-nonetargets rust-srccomponent installed for that toolchainclang,llc, andbpftoolavailable onPATH
Additional details are documented in the workspace README: https://github.com/swananan/ghostscope#readme.