What's the performance hit for doing this? And, the rootkit question, how would eBPF notice you doing this?
What's the performance hit for doing this? And, the rootkit question, how would eBPF notice you doing this?