pathtofile/bpf-hookdetect external links

---

GitHub - View repository

GitHub.dev - Open in online code editor

Star history - Growth chart over time

deps.dev - Dependencies and security vulnerabilities

Gitingest - Export source code for LLM usage

Repomix - Export source code for LLM usage

uithub - Export source code for LLM usage

Close

pathtofile/bpf-hookdetect

Readme badge preview -

If you own this repo, copy the snippet below and add it to your README.md

---

Copy

[![RelatedRepos](https://img.shields.io/badge/related-repos-yellow)](https://relatedrepos.com/gh/pathtofile/bpf-hookdetect)

Close

pathtofile / bpf-hookdetectView on GitHubMore

• External links
• Readme badge

Dectect syscall hooking using eBPF

☆169Apr 28, 2023Updated 2 years ago

Alternatives and similar repositories for bpf-hookdetect

Users that are interested in bpf-hookdetect are comparing it to the libraries listed below

• linuxthor / rkbreaker

  View on GitHub
  Rootkit breaker - experimental Linux anti-rootkit tool based on kprobes
  ☆12Sep 30, 2020Updated 5 years ago
• CDuPlooy / arm64tracer

  View on GitHub
  ☆15Jun 24, 2021Updated 4 years ago
• citronneur / blindssl

  View on GitHub
  Disable SSL certificate verification for all binaries that use libssl
  ☆48Jul 15, 2022Updated 3 years ago
• lumontec / lsmtrace

  View on GitHub
  Trace deep kernel events through eBPF and lsm hooks
  ☆42Feb 9, 2021Updated 5 years ago
• linux-lock / bpflock

  View on GitHub
  bpflock - eBPF driven security for locking and auditing Linux machines
  ☆151Feb 16, 2022Updated 4 years ago
• redcanaryco / redcanary-ebpf-sensor

  View on GitHub
  Red Canary's eBPF Sensor
  ☆113Jun 10, 2025Updated 8 months ago
• pathtofile / bad-bpf

  View on GitHub
  A collection of eBPF programs demonstrating bad behavior, presented at DEF CON 29
  ☆683Jul 7, 2024Updated last year
• carloslack / KoviD

  View on GitHub
  Red-Team LKM
  ☆637Dec 16, 2025Updated 2 months ago
• 0xjacklove / xflower

  View on GitHub
  deobfuscation BR
  ☆54Mar 4, 2024Updated last year
• tiann / ebpf-jnitrace

  View on GitHub
  Trace jni calls with eBPF on Android
  ☆24Jun 21, 2022Updated 3 years ago
• gojue / ehids-agent

  View on GitHub
  A Linux Host-based Intrusion Detection System based on eBPF.
  ☆457Dec 20, 2023Updated 2 years ago
• 3intermute / arm64_silent_syscall_hook

  View on GitHub
  silent syscall hooking without modifying sys_call_table/handlers via patching exception handler
  ☆152Apr 22, 2024Updated last year
• h3xduck / TripleCross

  View on GitHub
  A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
  ☆1,942Apr 7, 2024Updated last year
• gojue / rootkit-sample

  View on GitHub
  ☆49Mar 19, 2022Updated 3 years ago
• SsageParuders / Android_SVC_Edu

  View on GitHub
  A Project for people to study android svc.
  ☆25Aug 12, 2022Updated 3 years ago
• krisnova / boopkit

  View on GitHub
  Linux eBPF backdoor over TCP. Spawn reverse shells, RCE, on prior privileged access. Less Honkin, More Tonkin.
  ☆1,662Oct 19, 2023Updated 2 years ago
• Gui774ume / ebpfkit

  View on GitHub
  ebpfkit is a rootkit powered by eBPF
  ☆837Feb 28, 2023Updated 3 years ago
• therealunicornsecurity / tricard

  View on GitHub
  Tricard - Malware Sandbox Fingerprinting
  ☆23Dec 11, 2023Updated 2 years ago
• gagalin95 / FART_repairdex

  View on GitHub
  修复通过FART dump下来的dex
  ☆29Aug 1, 2020Updated 5 years ago
• linuxthor / rkspotter

  View on GitHub
  Rootkit spotter - experimental Linux rootkit finder LKM
  ☆30Oct 11, 2020Updated 5 years ago
• huaerxiela / frida-script

  View on GitHub
  ☆58Nov 10, 2021Updated 4 years ago
• tr3ee / CVE-2022-23222

  View on GitHub
  CVE-2022-23222: Linux Kernel eBPF Local Privilege Escalation
  ☆579Jun 7, 2022Updated 3 years ago
• kiosk404 / openssl_tracer

  View on GitHub
  openssl tracer using eBPF
  ☆16Jan 4, 2026Updated last month
• m0nad / Diamorphine

  View on GitHub
  LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x/6.x (x86/x86_64 and ARM64)
  ☆2,264Jan 24, 2026Updated last month
• FrenchYeti / interruptor

  View on GitHub
  Human-friendly cross-platform system call tracing and hooking library based on Frida's Stalker
  ☆356Jul 21, 2023Updated 2 years ago
• binarly-io / idapcode

  View on GitHub
  IDA plugin that displays the P-code for the current function
  ☆72Nov 18, 2025Updated 3 months ago
• nullhook / ollvm-14.x

  View on GitHub
  WIP
  ☆15Jan 13, 2022Updated 4 years ago
• KKGanguly / DataCentricFuzzJS

  View on GitHub
  ☆16Updated this week
• BassamGraini / CVE-2022-2588

  View on GitHub
  ☆12Dec 16, 2022Updated 3 years ago
• SsageParuders / Android_Anti-Hcak_Inotify

  View on GitHub
  Inotify监听测试
  ☆35Apr 17, 2022Updated 3 years ago
• AkaAny / proc_injector

  View on GitHub
  Inject remote process without using ptrace on linux based system
  ☆19Apr 26, 2022Updated 3 years ago
• Gui774ume / krie

  View on GitHub
  Linux Kernel Runtime Integrity with eBPF
  ☆184Nov 23, 2023Updated 2 years ago
• VerSprite / engage

  View on GitHub
  Tools and Materials for the Frida Engage Blog Series
  ☆45Mar 28, 2018Updated 7 years ago
• quarkslab / peetch

  View on GitHub
  An eBPF playground
  ☆210Dec 12, 2023Updated 2 years ago
• aleden / ptracetricks

  View on GitHub
  stupid ptrace tricks
  ☆12May 19, 2021Updated 4 years ago
• XhyEax / AndroidGotHook

  View on GitHub
  Simple Android ARM&ARM64 GOT Hook
  ☆37Jun 8, 2022Updated 3 years ago
• SeeFlowerX / frida-smali-trace

  View on GitHub
  smali trace
  ☆207May 22, 2022Updated 3 years ago
• Gui774ume / ssh-probe

  View on GitHub
  monitor and protect SSH sessions with eBPF
  ☆73Jul 2, 2021Updated 4 years ago
• gojue / ebpfmanager

  View on GitHub
  A golang ebpf libary based on cilium/ebpf and datadog/ebpf.
  ☆348May 18, 2025Updated 9 months ago