bpf_code.c 

function
1. gen_cmp 
2. gen_and 
3. gen_or 

/*
 * A single statement, corresponding to an instruction in a block.
 */
struct stmt {
	int code;		/* opcode */
	uint32_t k;		/* k field */
	int offset;		/* instruction offset */
};

struct slist {
	struct stmt s;
	struct slist *next;
};


struct block {
	struct slist *stmts;	/* side effect stmts */
	struct stmt s;		/* branch stmt */
	int sense;			/* sense값에 따라 다음 붙일 block이 jt(0)인지 jf(1)인지 정해짐*/
	struct block *jt;		/* edge corresponding to the jt branch */
	struct block *jf;		/* edge corresponding to the jf branch */
	int marked;	//이미 처리했던 블록인지 확인
};

struct bpf_insn {
	int ins_offset;
	uint16_t code;
	uint8_t	jt;
	uint8_t	jf;
	uint32_t k;
};

struct sock_fprog{
    int len; 
	struct bpf_insn bpf[CHUNK_NUM];
};

bpf_image.c

function
1. bpf_dd 
2. bpf_dump

typedef struct packet_s
{
    uint8_t *pkt_array; 
    int pkt_len; 
}packet_t;

typedef struct packet_handler_s
{
    packet_t pkt[MAX_PACKET];
    int pkt_num;
} packet_handler_t;

funcrion
pcaprec_hdr_t *rechdr = (pcaprec_hdr_t*)(file_state->buffer + read_len);

// file_state->buffer + read_len + sizeof(pcaprec_hdr_t) 하면 packet data임
uint8_t *packet_data = file_state->buffer + read_len + sizeof(pcaprec_hdr_t);

packet_handler->pkt[read_packet_num].pkt_array = (uint8_t*)malloc(sizeof(uint8_t) * rechdr->incl_len);
memcpy(packet_handler->pkt[read_packet_num].pkt_array, packet_data, rechdr->incl_len);
packet_handler->pkt[read_packet_num].pkt_len = rechdr->incl_len;
packet_handler->pkt_num += 1;

read_packet_num += 1;
read_data_bytes += rechdr->incl_len;

switch(ins.code)
{
	case BPF_LD | BPF_W | BPF_ABS:
		if(ins.k >= packet->pkt_len)
		{
			return BPF_FILTER_FALSE;
		}
		pstate->bpf_emu.a = extrack_long(&packet->pkt_array[ins.k]);
		break; 

	case BPF_LD | BPF_H | BPF_ABS:
		if(ins.k >= packet->pkt_len)
		{
			return BPF_FILTER_FALSE;
		}
		pstate->bpf_emu.a = extract_short(&packet->pkt_array[ins.k]);
		break;
}

void display_progess(parser_state *pstate)
{
    size_t pos, bpf_size; 
    pos = -1; 
    bpf_size = -1;
    struct bpf_insn ins = load_bpf_ins_from_offset(pstate);
    load_bpf_pos_and_size(pstate->bpf_emu, ins, &pos, &bpf_size);

    int index = pstate->bpf_emu.processed_packet_index;
    printf("\e[1;1H\e[2J");
    printf("─────────[REGISTER]─────────\n");
    printf("A(Accumulator)      : 0x%x\n", pstate->bpf_emu.a);
    printf("X(Index Register)   : 0x%x\n", pstate->bpf_emu.x);
    printf("PC(Program Counter) : %d\n", pstate->bpf_emu.pc);
    printf("────────[DISASSEMBLY]────────\n");
    bpf_dump(pstate);
    printf("───────[PACKET : %03d]───────\n", index);
    packet_t *packet = load_packet_from_index(pstate);
    dump_hex(packet->pkt_array, packet->pkt_len, pos, bpf_size);
    printf("──────────[COMMAND]──────────\n");
    printf("> ");

    return;
}