I wrote a new blog post, dissecting the Linux BPFDoor malware solely with strace (and a bit of ltrace). 🤓https://dfir.ch/posts/strace/