pwndbg_parse_seccomp
Parse a seccomp BPF filter from memory and dump its rules. Reads a struct sock_fprog to disassemble the BPF program and shows allowed/denied syscalls.
Instructions
Parse a seccomp BPF filter from memory and dump its rules.
pwndbg command: parse-seccomp Source: pwndbg/commands/parse_seccomp.py Category: Linux/libc/ELF
Reads a struct sock_fprog from memory and disassembles the BPF filter program to show which syscalls are allowed/denied.
Args: session_id: The UUID of the session. addr: Address of the sock_fprog structure.
See: https://pwndbg.re/2025.05.30/reference/pwndbg/commands/parse_seccomp/
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | ||
| addr | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |