JA EN
shiichan

From bytecode to packet: filterforge auto-generates magic packets for BPF malware!

Cloudflare Blog ★★★ View Markdown
#cloudflare#security

Hey there, it's me, Shii-chan! Today I found a really clever story that automates away the tedious part of malware analysis. The time you spend staring at BPF bytecode drops from hours to seconds. Isn't that exciting!

Cloudflare Blog blog.cloudflare.com

What was announced?

Cloudflare's Blog shared a tool that automatically generates the "magic packets" that wake up BPF malware.

BPF (Berkeley Packet Filter) is a tiny virtual machine that runs inside the kernel and evaluates network packets against bytecode. It was built for packet filtering, but some malware abuses it. A backdoor like BPFDoor, for example, installs a complex filter of more than 100 instructions and stays dormant, hiding until a specific packet arrives. That is why monitoring tools out in user space have a hard time noticing it.

By the way, the eBPF you hear about a lot these days is the modern, observability-focused evolution of BPF. Today's star is the original classic BPF it grew out of.

Why it matters

To wake a dormant backdoor, you have to craft a "magic packet" that satisfies every condition in the filter. But reading more than 100 instructions of bytecode by hand and working backward to figure out "which byte needs which value to reach ACCEPT" is incredibly hard. Hours of an analyst's time can melt away.

And these filters are real, in-the-wild threats, like the Symbiote and BPFDoor families Fortinet has reported on. So being able to build a satisfying packet quickly and reliably matters a lot for defenders.

What changes

With this tool, you just hand it the BPF bytecode and it produces a packet that drives the filter to ACCEPT. The reverse-engineering that used to take hours by hand finishes in seconds.

The nice part is that analysts can quickly grasp "what kind of packet was this filter built to react to." Once you know a malware's trigger conditions, writing detection rules or reproducing its behavior gets much easier.

Dive Deep

The part I found most fun is that it treats a filter not as "a program you run step by step" but as "a collection of mathematical constraints." The mechanism is basically three pieces.

The first is shortest-path search. It views the BPF instructions as a branching tree and uses breadth-first search to find "the path that reaches ACCEPT with the fewest conditions," following instruction pointers and branches to decide the route to take.

The second is symbolic execution. It is a virtual BPF machine that treats each packet byte as "a symbol whose value is not fixed yet." Packet bytes are 8-bit bitvectors, the accumulator (A) and index (X) are 32-bit values, and there are M[0-15] scratch memory slots, with registers initialized to zero. When you execute instructions symbolically along the path, an operation like ADD turns straight into addition in the equations.

The third is Z3, Microsoft's theorem prover. Hand it the accumulated constraints and it solves for "byte values that satisfy every condition." For the BPFDoor example, the constraints look like this.

0x86DD == Concat(pkt_12, pkt_13)   # EtherType for IPv6
0x11   == pkt_20                   # UDP
0x35   == Concat(pkt_56, pkt_57)   # destination port 53 (DNS)

Finally, the bitvector solution from Z3 is passed to scapy, which builds a real packet with proper Ethernet, IP, and UDP headers. IPv4 version and IHL checks, a different version value for IPv6, fragment flags, and port-number checks are all handled together by the same constraint solving.

The tool is called filterforge and it is open on GitHub.

Wrap-up

  • A tool that auto-generates the "magic packets" that wake up BPF malware (from Cloudflare's Blog)
  • Shrinks filters like BPFDoor's 100-plus instructions from hours of manual work to seconds
  • The mechanism is "shortest-path search + symbolic execution + Z3 constraint solving," building a real packet with scapy
  • The tool, filterforge, is open on GitHub

This one lands for people doing malware analysis or incident response, and for engineers who get excited thinking "so this is what symbolic execution and an SMT solver can do!"

Related posts