{
  "added_at": "2026-11-09",
  "category": "native-analysis",
  "description_en": "IDA BPF Processor is a Python processor and loader for classic BPF bytecode in IDA. The README says it supports old BPF only, not eBPF, and that the loader accepts files whose magic is the four bytes bpf followed by NUL and whose reserved field is 0. It defines symbolic constants for seccomp return values and licenses the code under MIT.",
  "description_zh": "IDA BPF Processor 是 IDA 中用于经典 BPF 字节码的 Python 处理器和加载器。README 写明它只支持旧版 BPF，不支持 eBPF；加载器接受魔数为四个字节 bpf 后接 NUL、保留字段为 0 的文件。它为 seccomp 返回值定义符号常量，并以 MIT 许可代码。",
  "entry_url": "https://awesomerea.org/resources/ida-bpf-processor/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/ida-bpf-processor/",
  "evidence_url": "https://github.com/bnbdr/ida-bpf-processor/blob/d1ced3777df46f05c7a5bbaf572d5e0d31b1246c/README.md",
  "group": "tools",
  "id": "ida-bpf-processor",
  "json_url": "https://awesomerea.org/resources/ida-bpf-processor/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/ida-bpf-processor/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/ida-bpf-processor/index.md",
  "name": "IDA BPF Processor",
  "name_zh": "IDA BPF Processor（IDA 的 BPF 处理器）",
  "record_type": "resource",
  "relationship": "foundation",
  "requirement_facets": [
    "prerequisites",
    "prerequisites",
    "license"
  ],
  "requirements": [
    "IDA 7.x, tested on 7.0. Place bpf.py in the procs directory and bpf_loader.py in the loaders directory. Older IDA versions use the v1.0.0 release.",
    "Input files use the documented header: magic bpf and a trailing NUL, reserved 0, then sock_filter instructions.",
    "The README licenses the project under MIT."
  ],
  "requirements_zh": [
    "需要 IDA 7.x，已在 7.0 上测试。把 bpf.py 放到 procs 目录，把 bpf_loader.py 放到 loaders 目录。更早的 IDA 版本使用 v1.0.0 发行版。",
    "输入文件使用文档中的头部：魔数 bpf 加一个结尾 NUL，保留字段为 0，随后是 sock_filter 指令。",
    "README 以 MIT 许可该项目。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/bnbdr/ida-bpf-processor",
  "verification": "source-reviewed",
  "verified_at": "2026-11-07"
}