co-re

bpf 学习仓库

An In-Kernel Solution Based on eBPF / XDP for 5G UPF

Live, system-wide USB transfer sniffer in eBPF — decodes USB traffic inline (control SETUP, SCSI, HID) from two universal URB hooks. No usbmon, no hardware sniffer. CO-RE portable.

Kernel-based Process Monitoring on Linux Endpoints for File System, TCP and UDP Networking Events and optionally DNS, HTTP and SYSLOG Application Messages via eBPF Subsystem

BPF portability analyzer for compiled eBPF object files. Reports minimum kernel version requirements, data flow patterns, and CO-RE coverage.

An opinionated BPF CO-RE library for Python3. Targets easy deployment on embedded systems with minimal dependency overhead.

compatible library for ebpf programs to improve BTF portability

A simple OpenTelemetry collector for custom eBPF metrics with Wasm

Learning eBPF (Extended Berkeley Packet Filter) and more

Comparison of SystemTap, procfs, bpftrace and eBPF/CO-RE middlewares across Linux interference profiler implementations. Master's dissertation (PPGCC/PUCRS)

Every outbound TCP connection, captured in-kernel and grouped by the process that dialed it. Flags public egress.

Live eBPF TCP/UDP session tracer with an interactive TUI and tcplife-style plain output

Ultra-low overhead Linux kernel-space observability and intrusion detection agent built with eBPF (CO-RE) and Go.

Live exec-provenance monitor. Flags execs from tmp/shm, fileless binaries, and setuid privilege jumps, all in-kernel.

eBPF CO-RE rootkit detector for Linux—finds hidden syscalls, modules, processes, and files.

Kernel-level eBPF sensor for blue team visibility and threat detection: tracks process execution, network connections, and file access via CO-RE/libbpf, with a live connection dashboard, forensic summaries.

Linux Kernel Runtime Security Observability & Syscall Anomaly Tracer using eBPF

Generate seccomp profiles from observed syscalls of a running process via eBPF

Minimal Python library for loading CO-RE eBPF programs

Small C++20 tool to compare Linux BTF struct layouts from bpftool dumps