/root/.ssh/authorized_keys evil file watchdog with ebpf tracepoint hook.

Modernized kernel functions, kernel tracepoints and bpf progs tracing tool for the bpf era.

ebpfpub is a generic function tracing library for Linux that supports tracepoints, kprobes and uprobes.

Provide task runtime implementation with pidfd and eBPF sched_process_exit tracepoint to manage deamonless container with low overhead.

Learn something interesting by examples.

kprobes template

[ALPHA] TraceSpy is a wrapper around TracePoint with some extra pattern matching magic

C/C++ libraries for working with Linux Tracepoints and user_events

android 全埋点数据采集gradle插件（字节码插桩，支持androidx）

A formatted output of all methods called in your rails application of code created by the developer, with the complete path to the class/module, including passed params.

Advanced kernel-native security framework to disrupt and prevent DNS-based breaches including C2 channels and tunneling with zero data loss. Combines TC, Netfilter, raw socket interception, BPF maps, and ring buffers, runs entirely on eBPF in the Linux kernel. Integrates with deep learning for advanced intelligent EDR

An example of an eBPF program hooking into the kill tracepoint

eBPF学习

Static tracepoints primitives and extensions for the ruby language

Rust libraries for Linux Tracepoints and user_events

Inspect socketaddrs using eBPF tracepoints

Dynamic tracing in Linux using fast tracepoints

A modern causal profiler built leveraging Linux tracepoints

No description available

Beyond #set_trace_func

Library to add tracepoints for CARET

Demo of self-modifying code in quasi-C

.NET libraries for Linux Tracepoints and user_events

Perf tracepoint support for the JVM

send your collected tracepoint & logpoint events to Elasticsearch

Examples of EPT hooking & tracepoints using the `hv` hypervisor project

Compressed alignment representation

A zero-overhead CLI tool for capturing stdout/stderr output from a running process (and optionally its entire descendant tree) using eBPF tracepoints. Useful for attaching to processes that have already started, that redirect their output to `/dev/null`, that are buried inside a service manager, or that you simply don't want to restart.

A library for introducing USDT tracepoints into Haskell programs

Lightweight Ruby profiler using Ruby's TracePoint API