Learn something interesting by examples.

skbtracer on ebpf

kprobes template

Go library using eBPF to trace network flow events

Sys::Ebpf is a pure-perl library to read, modify and load eBPF programs and attach them to various hooks in the Linux kernel.In other words eBPF Loader for written in Perl.

RootShield : The Ultimate Shield for Rooted Android Devices - Protect your rooted Android device from unauthorized file operations and process executions! 🛡️ RootShield is a powerful kernel module that ensures your device remains secure by monitoring and preventing risky activities. RootShield is your device’s ultimate defense mechanism. 🛠️🔥

eBPF学习

Scalability improvement for Linux kretprobe return-instances management and performance evaluation of several lock-less queues.

Named After the Scottish loch, Lomond is a simple example on how to use kprobes in an LKM for learning purposes and gainning a deeper understanding of the Linux kernel.

Systemd service file example for kprobe

Experimental Rust-C Hybrid LKM (PoC). Utilizes kprobe for real-time syscall monitoring with zero-cost abstraction. Successfully bypassed WSL2 relocation constraints and implemented Docker signature pattern reverse engineering via C-FFI.