tracepoint

Learn something interesting by examples.

kprobes template

Advanced kernel-native security framework to disrupt and prevent DNS-based breaches including C2 channels and tunneling with zero data loss. Combines TC, Netfilter, raw socket interception, BPF maps, and ring buffers, runs entirely on eBPF in the Linux kernel. Integrates with deep learning for advanced intelligent EDR

eBPF学习

Live audit log of every command, file, and network connection a Claude Code (or any matched) session makes, from the kernel.

A high-performance eBPF and C++20 kernel security engine for sub-microsecond process monitoring and execve execution blocking.

Easy eBPF Tracepoint Finder

Live exec-provenance monitor. Flags execs from tmp/shm, fileless binaries, and setuid privilege jumps, all in-kernel.

An exhaustively explained example of eBPF file operation tracking and logging using `lsm` hooks.

Hybrid dead-code detection for Ruby projects.

🐕 Ruby execution evidence for coding agents. A failing test writes a JSON snapshot of its own failure, and names the file in its output.