Context
Zero network visibility. Cheats phone home for configs, upload game state, or proxy aimbot calculations. Top EDR capability gap.
Work
- New
ebpf/owlbear_net.bpf.c: kprobes on tcp_v4_connect and udp_sendmsg. Filter by protected PID. Emit event with dst_addr, dst_port. Observe only (no blocking).
- New events:
OWL_EVENT_NET_CONNECT (0x0600), OWL_EVENT_NET_SEND (0x0601)
- New payload:
struct owl_payload_network { __u32 dst_addr; __u16 dst_port; __u16 protocol; __u64 bytes; char comm[48]; }
- New
daemon/net_allowlist.{h,c}: static allowlist of expected server IPs. LOG if destination not in list.
- New
cheats/net_exfil.c: sends game state over UDP
- Modify:
ebpf/Makefile, daemon/bpf_loader.c, daemon/bpf_event_convert.c, headers
- New
tests/test_net_allowlist.c
Tests
8 unit + 2 E2E (net_exfil detected, event contains correct IP/port).
Part of v2.0.0
Context
Zero network visibility. Cheats phone home for configs, upload game state, or proxy aimbot calculations. Top EDR capability gap.
Work
ebpf/owlbear_net.bpf.c: kprobes ontcp_v4_connectandudp_sendmsg. Filter by protected PID. Emit event with dst_addr, dst_port. Observe only (no blocking).OWL_EVENT_NET_CONNECT(0x0600),OWL_EVENT_NET_SEND(0x0601)struct owl_payload_network { __u32 dst_addr; __u16 dst_port; __u16 protocol; __u64 bytes; char comm[48]; }daemon/net_allowlist.{h,c}: static allowlist of expected server IPs. LOG if destination not in list.cheats/net_exfil.c: sends game state over UDPebpf/Makefile,daemon/bpf_loader.c,daemon/bpf_event_convert.c, headerstests/test_net_allowlist.cTests
8 unit + 2 E2E (net_exfil detected, event contains correct IP/port).
Part of v2.0.0