47,133 repositories indexed
1–9 of 9 · Most stars
Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.
eBPF-based Security Observability and Runtime Enforcement
A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
ebpfkit is a rootkit powered by eBPF
Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities
ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits
eBPF Information Flow Enforcement for AI Agent safety, security and effectiveness
Jailer is an eBPF-based process jailing system that provides mandatory access control (MAC) for Linux. It tracks processes using BPF task_storage maps and enforces role-based policies on file access, network operations, and process execution.
Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.