--- title: From bytecode to bytes: automated magic packet generation description: Linux malware often uses classic BPF socket programs as stealthy backdoors that stay dormant until receiving a specific 'magic' packet. Manually... canonical: https://daily.dev/posts/from-bytecode-to-bytes-automated-magic-packet-generation-ts88izwlt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: From bytecode to bytes: automated magic packet generation | daily.dev og:description: Linux malware often uses classic BPF socket programs as stealthy backdoors that stay dormant until receiving a specific 'magic' packet. Manually... og:url: https://daily.dev/posts/from-bytecode-to-bytes-automated-magic-packet-generation-ts88izwlt og:image: https://api.daily.dev/og/posts/tS88iZwlt.png og:image:alt: From bytecode to bytes: automated magic packet generation og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # From bytecode to bytes: automated magic packet generation **[Cloudflare](https://daily.dev/sources/cloudflare)** · 12 min read · 5 upvotes · 0 comments ## Summary Linux malware often uses classic BPF socket programs as stealthy backdoors that stay dormant until receiving a specific 'magic' packet. Manually reverse-engineering these filters is slow and error-prone, especially for programs exceeding 100 instructions. Cloudflare researchers built a tool called filterforge that applies symbolic execution and the Z3 theorem prover to BPF bytecode, automatically tracing all paths leading to an ACCEPT verdict and generating the corresponding trigger packet using scapy. The approach reduces analysis from hours to seconds. The tool is open-sourced on GitHub and demonstrated against a real BPFDoor malware sample. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [LinkPro Linux Rootkit Uses eBPF to Hide and Activates via Magic TCP Packets](https://daily.dev/posts/linkpro-linux-rootkit-uses-ebpf-to-hide-and-activates-via-magic-tcp-packets-tf7t1vtc4) · The Hacker News · 0 upvotes · 0 comments - [eBPF the Hard Way](https://daily.dev/posts/ebpf-the-hard-way-ru1cateai) · Lobsters · 1 upvotes · 0 comments - [eBPF on Hard Mode](https://daily.dev/posts/ebpf-on-hard-mode-xc9nqtwhy) · Lobsters · 0 upvotes · 0 comments - [Using eBPF to attribute packet drops to netfilter rules](https://daily.dev/posts/using-ebpf-to-attribute-packet-drops-to-netfilter-rules-wg9bzx9tu) · Red Hat Developer · 0 upvotes · 0 comments --- Tags: [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/from-bytecode-to-bytes-automated-magic-packet-generation-ts88izwlt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"From bytecode to bytes: automated magic packet generation","url":"https://daily.dev/posts/from-bytecode-to-bytes-automated-magic-packet-generation-ts88izwlt","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/from-bytecode-to-bytes-automated-magic-packet-generation-ts88izwlt"},"datePublished":"2026-04-08T13:41:20.117Z","dateModified":"2026-04-08T13:41:47.019Z","description":"Linux malware often uses classic BPF socket programs as stealthy backdoors that stay dormant until receiving a specific 'magic' packet. Manually...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f2550fcc28d029ef0afc2ba7c544cdba?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f2550fcc28d029ef0afc2ba7c544cdba?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Cloudflare","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Cloudflare","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/38522e1d11354cd6b7af66f9d4316735","url":"https://daily.dev/sources/cloudflare"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/from-bytecode-to-bytes-automated-magic-packet-generation-ts88izwlt","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":5},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"malware","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Cloudflare","item":"https://daily.dev/sources/cloudflare"},{"@type":"ListItem","position":3,"name":"From bytecode to bytes: automated magic packet generation"}]} ```