kprobes 开源项目推荐（36 个）

bpftrace /bpftrace

适用于Linux的高级跟踪语言

okhsunrog /vpnhide

在选定的Android应用中隐藏主动VPN（内核模块+LSPosed + Zygisk）

EBWi11 /AgentSmith-HIDS

By Kprobe technology Open Source Host-based Intrusion Detection System(HIDS), from E_Bwill.

dkorunic /pktstat-bpf

eBPF-based Ethernet traffic monitor using TC, XDP, kprobes and cgroups

pmem /vltrace

Tool tracing syscalls in a fast way using eBPF linux kernel feature

malefax /Adrishya

Author of Project Adrishya a rootkit which use ftrace mechanism to hook syscall; (write this because God commanded me); work for both x86_64 and arm; CREDIT-(Oleksii Lozovskyi{ilammy})FOUNDER OF FTRACE HOOKING

mildsunrise /node_bpf

🔬 eBPF / libbpf bindings for Node.js

yeet-src /redissnoop

Live terminal Redis traffic profiler built on eBPF. Ranks key patterns, flags footguns, reads TLS.

mildsunrise /node_bpfcc

🔬 BPF Compiler Collection (BCC) frontend for Node.js

sahmad98 /ebpf-tools

eBPF Tools - Tool for monitoring, performance benchmarking and tracing linux kernel

vitalyvch /strace.ebpf

This repository contains a tool which traces syscalls in a fast way using eBPF linux kernel feature

zj1244 /kprobe_hook

使用kprobe获取sys_execve参数

yeet-src /container-traffic

Live per-container HTTP dashboard read from the kernel with eBPF. Rate, errors, latency. No sidecar, no app changes.

konstantin89 /linux-kernel-kprobes-demo

Short demo of Linux kernel hooks with kprobes.

ldorau /strace.ebpf

Tool tracing syscalls in a fast way using eBPF linux kernel feature

rogercoll /learningeBPF

Examples of C++ programs that generates BPF bytecodes

r4um /bpf-dump

Misc BCC BPF Scripts

achraf-laazizi /agent-smith

Enable parallel AI agent collaboration with conflict-free task splitting using directory isolation and recursive multi-agent spawning.

KshitijKasodkar /CS331_T001_PerProcess_eBPF_Final

Real-time per-process network bandwidth tracker using eBPF kprobes. TCP/UDP per remote IP, retransmissions and packet loss, validated on a Raspberry Pi 5

Assaf-R /lomond

Named After the Scottish loch, Lomond is a simple example on how to use kprobes in an LKM for learning purposes and gainning a deeper understanding of the Linux kernel.