Projects sharing features with Ebpf

bpftrace is a high-level eBPF tracing tool and kernel instrumentation framework for Linux. It provides a tracing language to instrument kernel and user-space events without recompiling the system, functioning as a dynamic system profiler and event aggregator. The project enables dynamic system tracing and Linux kernel observability by capturing tracepoints and dynamic probes in real time. It allows for kernel data inspection and runtime process debugging by accessing internal data structures and filtering specific process events. Its capability surface covers system performance analysis, inc

xv6 is a Unix-like educational operating system designed for teaching kernel concepts. It is implemented as an instructional kernel for x86 and RISC-V architectures, featuring a virtual memory manager and support for symmetric multiprocessing. The system is designed to demonstrate core OS principles through a simplified re-implementation of Unix Version 6. It provides a controlled environment for studying system calls, trap handling, and process lifecycles. Its capability surface covers process management, including scheduling and context switching, and memory management via page tables for

Inspektor Gadget is an eBPF observability toolset and program framework designed for tracing Linux systems and debugging Kubernetes nodes. It provides a suite of tools to collect kernel-level telemetry and export system metrics via the OpenTelemetry standard. The project distinguishes itself by packaging inspection tools as OCI-compliant container images, allowing for standardized distribution and deployment across clusters and hosts. It employs a modular data processing pipeline that utilizes WebAssembly modules to transform and filter telemetry, and leverages Compile Once Run Everywhere for

Falco is an eBPF runtime security monitor and cloud native detection engine that identifies abnormal behavior and security threats across hosts and containers. It functions as a Linux kernel event auditor, capturing system calls and kernel events in real-time to detect malicious activity. The system distinguishes itself through a rule-based threat detection model that evaluates system activity against a library of community-maintained rules and custom security definitions. It enriches raw kernel events with container and Kubernetes metadata to provide observability into isolated environments

WinFSP is a framework for implementing custom file systems on Windows. It enables the creation of user-mode file systems that appear as standard disk drives or network shares to the operating system, allowing developers to implement file system logic in user space via a proxy architecture that avoids the need for custom kernel code. A primary differentiator is its FUSE compatibility layer, which maps POSIX-based file system calls to native Windows requests. This allows existing file systems written for the FUSE API to be ported to Windows and Cygwin environments. The project covers a wide ra

Pyroscope is a continuous profiling platform designed to collect, store, and visualize application performance data. It functions as an application performance management suite that tracks historical resource usage to identify bottlenecks and detect performance regressions over time. The platform distinguishes itself through its use of kernel-level instrumentation and dynamic runtime hooks, which allow for performance monitoring without requiring manual code modifications or application restarts. It employs a sidecar agent architecture to offload telemetry processing, utilizing delta-encoded

ViGEmBus is a Windows kernel-mode driver and USB HID emulation framework that creates virtual gaming peripherals. It functions as a virtual gamepad driver that the operating system recognizes as physical hardware devices at the kernel level. The project enables kernel-level hardware mimicry to bypass game-specific device requirements and supports remote input redirection, allowing controller data to be sent over a network to a remote machine. The system covers a range of capabilities including USB game controller emulation and game input automation, which allows for the recording and playbac

Kernel-Bridge is a C++ framework designed for Windows kernel-mode development, providing a comprehensive toolkit for building drivers, hypervisors, and system-level monitoring tools. It serves as a foundational environment for managing low-level operating system interactions, including memory management, process control, and cross-layer communication. The project distinguishes itself by offering specialized primitives for hypervisor construction and hardware-assisted memory isolation. It facilitates advanced system manipulation through techniques such as direct kernel object modification, asy

Tracee is a cloud-native runtime security and forensics tool that uses eBPF to capture system calls and kernel events in real time. It operates as a standalone binary or a Helm-deployable agent for Kubernetes, normalizing system calls, network events, and container activities into a unified event pipeline for consistent analysis. The tool distinguishes itself through policy-driven event filtering using YAML-based rules, allowing users to target specific workloads and reduce noise during monitoring. It includes built-in threat detection signatures that flag suspicious behavioral patterns witho

macfuse is a framework for implementing custom file systems in user space. It utilizes a macOS kernel extension to bridge the operating system kernel's virtual file system layer to a user-process daemon. This project allows the implementation of file system logic outside of the kernel to improve system stability and simplify development. It enables the mapping of remote data, network resources, or memory to a local folder so they can be accessed through standard system interfaces. The framework supports the development of cross-platform storage by providing a portable interface for consisten

ArchWSL is a pre-configured Arch Linux distribution designed to run within the Windows Subsystem for Linux. It provides a method for deploying a functional Linux environment through root filesystem bootstrapping via application packages or zip archives. The project includes a dedicated instance manager for backing up, restoring, and managing multiple isolated Linux environment instances. It also features a compatibility patch for the standard C library and core system libraries to ensure software runs on older kernel versions. The system covers service management through native or emulated s

XNU is a hybrid operating system kernel that combines a microkernel architecture with a monolithic layer for system services. It provides a foundation for operating system development, incorporating standardized system-call interfaces, a modular device driver framework, and mandatory access control security. The architecture features a Mach-based microkernel and a BSD-based monolithic layer. It utilizes a message-passing inter-process communication bus for secure data exchange between isolated kernel components and user-space processes, alongside an object-oriented driver framework that decou

FRRouting is an internet routing suite comprising a collection of daemons that implement standard IPv4 and IPv6 routing protocols. It provides a protocol engine for BGP, an EVPN network virtualizer, and an MPLS label manager, alongside a gRPC routing interface for programmatic configuration and data retrieval using YANG models. The suite is distinguished by its extensibility through a Lua scripting framework that executes custom scripts at internal hooks to modify routing behavior. It also features a transactional configuration model that uses separate candidate and running databases to ensur

DeepFlow is an eBPF observability platform that provides a suite for continuous profiling, distributed tracing, service dependency mapping, and unified telemetry storage. It functions as a monitoring system that collects metrics, traces, and profiles without requiring manual application instrumentation or modifications to source code. The platform distinguishes itself through the use of protocol-aware packet parsing to reconstruct request chains and automated service dependency mapping to visualize interactions between applications and infrastructure. It utilizes a telemetry data store design

CppGuide is a curated collection of educational resources and practical guides focused on C++ server development, Linux kernel internals, concurrent programming, network protocols, and security exploitation. It provides structured learning paths for backend developers, covering everything from interview preparation to building high-performance network servers and understanding operating system fundamentals. The guide distinguishes itself by offering in-depth, hands-on tutorials that walk through real-world implementations, including building a Redis-like server from scratch, designing custom

Velociraptor is a digital forensics and incident response platform, endpoint detection and response system, and visibility tool. It provides a query engine and remote forensic collector used to hunt for indicators of compromise and perform triage across a fleet of hosts. The system is distinguished by its specialized query language for interrogating host state and parsing binary files. It features a notebook environment that combines markdown documentation with executable query cells to standardize investigative workflows and enable collaborative reporting. The platform covers a wide range o

This project is a curated resource directory and tooling list for the extended Berkeley Packet Filter technology. It serves as a reference guide to software projects, libraries, and frameworks built on the eBPF kernel subsystem. The directory covers a range of domains including Linux kernel observability, system security monitoring, and cloud native networking. It also provides an eBPF learning path with tutorials and guides for those implementing custom kernel instrumentation. The collection is maintained as a markdown-based directory using a manual curation workflow to organize external to

usbipd-win is a USB device sharing tool and network device driver that binds physical USB hardware to a network protocol. It serves as a management interface for sharing and attaching USB devices via network protocols, specifically providing a utility to map shared hardware directly into Windows Subsystem for Linux instances. The project implements USB over IP networking to share locally connected devices over a network for discovery by remote client machines. It enables virtual machine USB passthrough, allowing guest operating systems to interact with physical hardware directly. The softwar

dbtpl is a database model generator and schema introspector that produces type-safe source code and data models from SQL database schemas. It functions as a command line tool that maps SQL types to Go structs and execution functions, while providing a template-based system for creating custom source code and schema definitions. The tool supports multiple database engines, including PostgreSQL, MySQL, SQLite, Oracle, and SQL Server. It distinguishes itself by allowing users to define custom output formats through text templates and the ability to generate compatible model definitions for the D

FlameGraph is a performance profiling and visualization toolkit designed to identify bottlenecks in software execution. It functions as a processing engine that transforms raw stack trace samples into interactive, hierarchical diagrams. By representing aggregated execution frequency as nested rectangles, the tool allows developers to visualize hot code paths and analyze system behavior across both kernel and user-space environments. The project distinguishes itself through its ability to perform differential profile analysis, which highlights performance regressions or improvements by compari

Skill-Tree is an educational framework designed to map theoretical technical concepts to practical implementation pipelines and structured interview preparation. It organizes technical knowledge into a tree-based index to enable structured navigation and uses a theory-to-implementation pipeline to verify conceptual understanding through concrete software tasks. The project provides curated study paths and cross-referenced indexing that links common interview questions and simulated exam sets to specific technical modules. It employs module-based subject isolation to separate diverse backend d

Tock is a secure embedded operating system and microcontroller kernel designed to isolate untrusted applications and drivers. It functions as a memory-safe process isolator that uses a combination of hardware memory protection and language-level type safety to execute mutually distrustful applications on bare metal. The system distinguishes itself through a hardware abstraction layer that decouples high-level components from specific microcontroller implementations using standardized traits. It further employs a virtualization layer to allow multiple independent software components to share a

Wire is a compile-time dependency injection framework for Go that generates code to wire application components together. It analyzes function signatures at compile time to build an explicit initialization graph, removing the need for runtime reflection or manual wiring code. The framework operates as a Go code generator and static analysis tool, transforming annotated source code into generated wire files that compile alongside the original project. It connects dependencies by matching function parameters and return types, producing a directed acyclic graph of component dependencies that is

Templ is a type-safe HTML templating engine and UI framework for Go. It provides a system for building reusable HTML components that compile into Go code for server-side rendering, ensuring type safety and compile-time validation of data and logic. The project features a dedicated language server that provides autocomplete and syntax validation for template files within supported code editors. It employs compile-time code generation to transform a custom template language into Go source code, enabling the creation of modular HTML fragments and logic blocks. The framework includes automated s

This project is a Protocol Buffers Go compiler and code generation framework that translates schema definitions into optimized Go structures and reflection-free serialization methods. It includes a gRPC service generator for producing client and server communication code and a serialization performance toolkit for generating automated benchmarks and test suites. The framework features a plugin-based system for transforming data definitions into source code with custom field mapping and struct tag injection. It allows for custom type mapping and struct type overriding to link data fields to sp

Tokio-uring is an asynchronous runtime for Rust that provides a framework for high-performance, non-blocking input and output operations. By integrating directly with the Linux kernel interface, it enables applications to offload heavy data transfer tasks to the operating system, maintaining responsiveness while managing concurrent tasks through a specialized asynchronous executor. The framework distinguishes itself by utilizing kernel-level submission and completion queues to facilitate data transfers. It employs zero-copy techniques and pre-allocated memory buffer pools, which allow data to

Swift System is a low-level library that provides safe, idiomatic abstractions for operating system calls and file path manipulation. It serves as a programming interface wrapping native operating system calls and platform types for reliable desktop and mobile integration. The library enforces strict separation of incompatible string types at compile time by wrapping raw values in domain-specific structures, preventing the mixing of system paths with arbitrary text. It translates raw numeric operating system error codes into strongly typed enumeration cases and manages system handles and file