drpanwe icon

udp_flood_blocker.bpf.c

drpanwe | PRO | 01/22/25 10:30:05 AM UTC | 0 ⭐ | 7852 👁️ | Never ⏰ | [eBPF]
C |

2.17 KB

|

Source Code

|

0 👍

/

0 👎

// udp_flood_blocker.bpf.c
// Compile with: clang -O2 -target bpf -c udp_flood_blocker.bpf.c -o udp_flood_blocker.bpf.o
 
#define KBUILD_MODNAME "udp_flood_blocker"
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/udp.h>
 
/*
  Map #1: udp_count
  - Type: PERCPU_ARRAY
  - Holds a single key (0) storing a 64-bit counter of UDP packets.
*/
struct {
    __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
    __uint(max_entries, 1);
    __type(key, __u32);
    __type(value, __u64);
} udp_count SEC(".maps");
 
/*
  Map #2: block_state
  - Type: ARRAY
  - Holds a single key (0) storing a 32-bit "block" flag (0 = allow, 1 = drop).
*/
struct {
    __uint(type, BPF_MAP_TYPE_ARRAY);
    __uint(max_entries, 1);
    __type(key, __u32);
    __type(value, __u32);
} block_state SEC(".maps");
 
// XDP hook function: detect UDP and optionally block
SEC("xdp")
int detect_and_block_udp(struct xdp_md *ctx)
{
    void *data_end = (void *)(long)ctx->data_end;
    void *data     = (void *)(long)ctx->data;
 
    // parse Ethernet header
    struct ethhdr *eth = data;
    if ((void *)(eth + 1) > data_end) {
        return XDP_PASS; // packet too small/malformed
    }
 
    // check if it's IPv4
    if (bpf_ntohs(eth->h_proto) == ETH_P_IP) {
        struct iphdr *iph = (struct iphdr *)(eth + 1);
        if ((void *)(iph + 1) > data_end) {
            return XDP_PASS;
        }
 
        // check if it's UDP
        if (iph->protocol == IPPROTO_UDP) {
            // 1) Check block_state
            __u32 zero_key = 0;
            __u32 *block_val = bpf_map_lookup_elem(&block_state, &zero_key);
            if (block_val && *block_val == 1) {
                // If we are in block mode, drop all UDP
                return XDP_DROP;
            }
 
            // 2) Not blocked => increment the global UDP counter
            __u64 *cnt_val = bpf_map_lookup_elem(&udp_count, &zero_key);
            if (cnt_val) {
                __sync_fetch_and_add(cnt_val, 1);
            }
        }
    }
 
    // pass non-UDP or non-IPv4 packets
    return XDP_PASS;
}
 
char _license[] SEC("license") = "GPL";
 

Comments

  • Larrikar icon
    03/29/26 09:43:04 PM UTC
    CSS |

    0 B

    |

    0 👍

    /

    0 👎

    ✅ Leaked Exploit Documentation:
     
    https://docs.google.com/document/d/1dOCZEHS5JtM51RITOJzbS4o3hZ-__wTTRXQkV1MexNQ/edit?usp=sharing
     
    This made me $13,000 in 2 days.
     
    Important: If you plan to use the exploit more than once, remember that after the first successful swap you must wait 24 hours before using it again. Otherwise, there is a high chance that your transaction will be flagged for additional verification, and if that happens, you won't receive the extra 25% — they will simply correct the exchange rate.
    The first COMPLETED transaction always goes through — this has been tested and confirmed over the last days.
     
    Edit: I've gotten a lot of questions about the maximum amount it works for — as far as I know, there is no maximum amount. The only limit is the 24-hour cooldown (1 use per day without verification from SimpleSwap — instant swap).
    
  • Ronpakor icon
    04/05/26 06:23:46 PM UTC
    CSS |

    0 B

    |

    0 👍

    /

    0 👎

    We just shared HQ data on our channel: https://t.me/theprotocolone