Open-source alternatives to Maybe

Fastsocket is a high-performance Linux socket implementation designed for linear scalability on multicore systems. It functions as a TCP throughput optimizer and a multicore packet steering engine that reduces system call overhead and lock contention to increase total network processing capacity. The project distinguishes itself through a network system call interceptor that uses a shared library to redirect standard socket calls to optimized interfaces without requiring changes to application binaries. It employs active connection steering by encoding CPU core IDs into source ports and utili

HyperDbg is a hardware-assisted kernel-mode debugging platform that leverages virtualization to monitor and control system execution. By utilizing hypervisor-level primitives, it enables deep system analysis and instrumentation without relying on standard operating system debugging interfaces. The framework provides a comprehensive environment for inspecting both kernel and user-mode processes, allowing for granular control over execution flow and system state. The project distinguishes itself through a transparent debugging layer designed to remain invisible to the target environment. It emp

Box64 is a cross-architecture runtime and user-mode emulation layer that allows Linux and Windows software to run on non-native hardware. It functions as an x86-64 instruction emulator and binary translator, executing 64-bit binaries on different CPU architectures by translating machine code into native instructions. The project utilizes dynamic recompilation to accelerate execution and maps guest system calls to native host libraries to increase speed and hardware compatibility. It can simulate a 32-bit execution environment to support legacy software and integrates with the operating system

LXD is a unified platform for managing both system containers and virtual machines through a single REST API and command-line interface. It provides a programmatic HTTP interface for controlling the full lifecycle of instances, enabling automation and integration with external tools. The system runs unprivileged containers with per-instance UID/GID mappings, seccomp filters, and AppArmor profiles for kernel-level isolation, while supporting multiple storage backends including directory, Btrfs, LVM, ZFS, Ceph, LINSTOR, and TrueNAS through a unified driver interface. The platform distinguishes

This project is an OS-level process sandbox and cross-platform security wrapper for Linux and macOS. It is designed to isolate arbitrary processes from the host machine by restricting filesystem and network access without the use of full containerization. The system functions as a system-call interceptor and access controller, blocking unauthorized operating system calls based on predefined security policies. It employs allowlists and denylists to manage resource requests and monitors for security violations in real time. Capability areas include filesystem access management using glob-patte

rdpwrap is a set of system utilities and services designed to enable, configure, and manage remote desktop protocol access and video compression settings. It functions as a service and manager that allows remote desktop connections on operating system versions where the feature is restricted or disabled by the vendor. The project provides tools to override system-level restrictions for remote access and activate remote desktop protocol services on unsupported versions. It includes a configuration tool for managing H.264 video compression and encoding settings to balance visual quality, networ

This project is a red teaming knowledge base and offensive security playbook designed to simulate adversary behavior. It serves as a comprehensive collection of technical guides and tactics for executing red team operations. The repository provides detailed instructions for Active Directory exploitation, including Kerberos abuse and domain privilege escalation. It covers defense evasion through API unhooking and payload obfuscation, as well as Windows internals research involving the manipulation of kernel objects and system memory. The capability surface extends to network penetration testi

Sylar is a high-performance C++ asynchronous server framework and event-driven network library. It functions as a coroutine scheduler and HTTP server implementation designed to build network services using non-blocking I/O. The project distinguishes itself through a system call interceptor that hooks blocking socket and sleep APIs, transforming synchronous operations into non-blocking asynchronous events. It employs a user-space threading system to distribute lightweight tasks across a worker thread pool to maximize CPU utilization. The framework covers a broad range of networking and system

WeChatRobot is a framework providing programmatic interfaces for automating messages and interactions within the WeChat ecosystem. It functions as a bot framework that enables the automation of sending and receiving messages by intercepting system processes. The project includes specialized tools for intercepting system calls and utilizing memory-based application hooking to automate workflows, including support for Enterprise WeChat. It further provides capabilities to decrypt local application databases to recover historical chat logs and user information. Additional functionality covers t

ScyllaHide is an anti-debugger bypass plugin and reverse engineering tool designed to hide a debugger from a target application. It functions as a user-mode API hooking library and DLL injection framework that prevents programs from detecting and closing themselves when being analyzed. The project enables malware analysis and the study of protected software by neutralizing security defenses. It achieves this by intercepting and modifying system library responses to deceive applications about their execution environment. The utility employs several technical methods to maintain stealth, inclu

mac-cleanup-sh is a command-line utility designed for macOS that automates the removal of temporary files, system logs, and application caches. It functions as a system maintenance tool to reclaim storage capacity by identifying and purging redundant data across the operating system and development environments. The tool distinguishes itself by providing a dry-run simulation mode that calculates potential disk space recovery before any files are deleted. It utilizes pattern matching to target specific directories and handles cleanup operations idempotently, ensuring that the process continues

Organize is a command-line utility designed to automate file system management, storage cleanup, and directory organization. It functions as a rule-based engine that processes files through sequential pipelines, allowing users to define complex workflows for moving, renaming, and managing local data. The system utilizes structured configuration files to map file system triggers to specific actions. It distinguishes itself through a simulation engine that allows users to preview the impact of their rules on a virtual file system before applying changes, ensuring data integrity. Additionally, t

pyinfra is a Python-based infrastructure automation framework that turns Python code into shell commands for managing servers, Docker containers, and local machines. It operates as a declarative, idempotent deployment tool, applying desired system states by comparing target configurations against current states and making only the necessary changes. The framework provides a connector-based transport abstraction that unifies SSH, Docker, and local execution behind a common interface, with a parallel execution engine that manages concurrent operations across hosts. The tool distinguishes itself

kops is a Kubernetes cluster provisioner and lifecycle manager designed to automate the creation, maintenance, and destruction of production-grade clusters on cloud infrastructure. It functions as a declarative infrastructure manager, synchronizing the live state of a cluster with versioned manifests stored in remote object storage to ensure idempotent operations. The project distinguishes itself by offering comprehensive automation for the entire cluster lifecycle, including high-availability control plane deployment, incremental rolling updates, and automated version upgrades. It also serve

pyinfra is an agentless infrastructure automation framework that turns declarative Python code into idempotent shell commands to manage servers, containers, and local machines over SSH without requiring any pre-installed software on target hosts. It operates by comparing the desired state of a system against its current state, using a dry-run simulation mode to preview changes and a fact-based conditional execution engine to gather host attributes at runtime and control which operations run. The tool compiles Python operations into optimized shell commands and executes them in parallel across

fclones is a command-line tool designed to locate identical files across a filesystem by comparing file sizes and cryptographic hashes. It functions as a parallel filesystem scanner and a deduplication utility that identifies duplicate files to reclaim disk space. The tool distinguishes itself through a persistent hash cache system that stores hashes and metadata on disk to accelerate repeated scans. It employs a multi-phase scanning process and device-aware parallel I/O, which adjusts thread pools based on whether the storage is an SSD or HDD to maximize throughput. Beyond discovery, the pr

Search-Replace-DB is a MySQL search and replace tool designed for updating database strings and migrating PHP-based websites and content management systems. It functions as a database migration utility to update references and table engines when moving sites to new servers or domains. The project specifically handles the updating of text inside serialized PHP arrays and objects, recalculating lengths to maintain data structure integrity and prevent corruption. It also includes a converter for modifying storage engines and character collations across multiple MySQL tables. Additional capabili

Docker cleanup volumes is a containerized system maintenance tool and shell script designed to scan host systems and delete unused Docker storage volumes. It reclaims disk space by identifying leftover data assets that are no longer attached to any active containers. The utility inspects container-graph dependencies to distinguish between active and orphaned storage items. It supports dry-run preview execution to simulate cleanup operations and review target volumes before any actual data deletion occurs. The software can be executed directly as a command-line shell script or run as a contai

This project is an Android security analysis toolkit and mobile app runtime manipulator designed for reverse engineering and auditing mobile applications. It provides a system for modifying Java classes and method behavior in active mobile processes to bypass security controls. The toolkit includes a web-based interface for controlling the instrumentation engine and a specialized utility for disabling certificate validation to intercept and inspect encrypted network traffic via SSL pinning bypass. It also features an Android file explorer for browsing and managing files within private data di

Cloudstream is an Android media streaming client and extensible media player that aggregates video and audio content from external sources. It operates as an Android application container within a Linux-based environment, enabling the installation and execution of Android software packages via APK files. The project utilizes an extension-based provider system that allows for the creation of custom plugins. These extensions define the logic for scraping and retrieving multimedia content and metadata from third-party sources. Additional capabilities include the ability to cast media playback t

MAME is a vintage hardware emulation platform designed to recreate the circuitry of arcade games, computers, and consoles to run original software on modern devices. It functions as a retro gaming preservation framework for managing, verifying, and archiving ROM sets and disk images to ensure long-term software accessibility. The project features a system debugging tool for inspecting emulated memory, CPU registers, and execution flow via breakpoints and disassembly. It also includes a Lua-based automation layer that exposes core system state and hardware controls for custom behavior and anal

OpenTTD is an open-source game engine and transport simulation game. It provides an isometric sandbox environment for building and managing complex logistics and transport networks. The project functions as a multiplayer simulation sandbox where users can build infrastructure cooperatively or competitively in a shared virtual world. The platform is designed as a moddable simulation system that supports external assets, graphics, and gameplay modifications. It includes mechanisms for downloading and integrating add-on content and utilizes a plugin-based system to extend game mechanics beyond t

Kill Bill is a subscription billing platform and usage-based billing engine designed to manage recurring invoicing and automated payment collection. It functions as a multi-tenant billing infrastructure, providing isolated environments for different organizational entities through a dedicated API. The system is distinguished by a plugin-based extension framework that allows for the integration of third-party payment gateways and custom business logic. It includes a payment gateway orchestrator to handle transactions and refunds, as well as a revenue recognition system to allocate contract rev

KernelSU-Next is a kernel-level framework designed to provide administrative privileges and granular access control on the Android operating system. By integrating directly into the kernel during the build process, the project enables superuser management and system-wide modifications through kernel-level patching and system call interception. The framework distinguishes itself by utilizing non-persistent file system overlays, which allow for system partition modifications and module injection without altering underlying read-only storage blocks. This approach facilitates dynamic functionalit

Falco is an eBPF runtime security monitor and cloud native detection engine that identifies abnormal behavior and security threats across hosts and containers. It functions as a Linux kernel event auditor, capturing system calls and kernel events in real-time to detect malicious activity. The system distinguishes itself through a rule-based threat detection model that evaluates system activity against a library of community-maintained rules and custom security definitions. It enriches raw kernel events with container and Kubernetes metadata to provide observability into isolated environments

HttpRunner is a multi-protocol network testing framework designed for automating functional and regression tests of HTTP interfaces. It functions as a multi-protocol network tester supporting HTTP/1.1, HTTP/2, WebSocket, TCP, and RPC to validate diverse communication patterns. The project includes specialized engines for API performance testing, data-driven testing, and a test case generator that converts HAR files, curl commands, and Swagger definitions into executable scripts. The framework is distinguished by its ability to separate test logic from business data via a data-driven execution

Higress is an AI API gateway and cloud-native traffic manager that functions as a Kubernetes ingress controller. It provides a centralized system for routing, securing, and optimizing traffic directed toward large language models, AI agents, and microservice architectures. The project distinguishes itself through deep AI orchestration, including the ability to host and manage Model Context Protocol servers that transform REST APIs into tools for AI agents. It features specialized AI infrastructure for model request proxying, protocol translation across multiple providers, and semantic-based c