OSS + ELC EU 2026

While most instructions the Linux kernel executes come from a standard compiler like GCC or Clang, the kernel can also patch itself at runtime: ftrace, kprobes, eBPF programs... Debugging these runtime-generated instructions is a whole new challenge, as we lack the usual debug data: symbol names, offsets, debug info. Fortunately, we can adapt our tooling to observe them.

This talk explores practical debugging techniques for runtime-generated instructions, using eBPF as a concrete example: when a user loads an eBPF program, the kernel's JIT compiler emits native machine code. After a brief eBPF introduction, we will debug these programs and the surrounding generated code (trampolines, dynamic instrumentation, verifier patches...). Starting from standard debug information in bare binaries or exposed at runtime, we will gradually build up our toolkit: running a custom kernel under QEMU, taking control with GDB, debugging userspace and kernel space together, adding TUI and GDB scripts, and finally stepping through raw machine instructions. Aimed at developers familiar with C/kernel
development, attendees will gain hands-on techniques and confidence for any kind of low-level analysis.