Awesome GitHub RepositoriesKernel Symbol Resolution

BCC is an eBPF development toolkit and tracing framework used for monitoring and analyzing the Linux kernel. It functions as a performance analysis tool and debugging utility to capture system events, measure kernel latency, and provide network observability. The project distinguishes itself by providing a build system that integrates with LLVM to compile C-like code into BPF bytecode at runtime. It utilizes BPF Type Format data for relocations to maintain cross-kernel compatibility and extracts kernel headers to ensure the generated programs match the specific kernel version. The toolkit co

This project is a bare-metal operating system developed for ARM64 architecture. It serves as a low-level implementation of kernel engineering, focusing on the fundamental construction of an OS from the hardware level up. The system is distinguished by its comprehensive approach to ARM64 processor control, featuring a red-black tree task scheduler and a hierarchical page table system for virtual memory management. It implements a sophisticated privilege model that handles transitions between kernel and user modes, ensuring process isolation through address space splitting and exception level m

pwndbg is a GDB plugin and binary analysis framework designed for reverse engineering, exploit development, and low-level program analysis. It extends the core functionality of the debugger to provide advanced memory inspection and automation tools. The project distinguishes itself with specialized capabilities for heap analysis across glibc, jemalloc, and musl, as well as a comprehensive kernel debugging toolkit for inspecting Linux kernel tasks and slab allocators. It includes an integrated ROP gadget searcher for constructing exploit chains and an LLM-powered debugging assistant that provi

CppGuide is a curated collection of educational resources and practical guides focused on C++ server development, Linux kernel internals, concurrent programming, network protocols, and security exploitation. It provides structured learning paths for backend developers, covering everything from interview preparation to building high-performance network servers and understanding operating system fundamentals. The guide distinguishes itself by offering in-depth, hands-on tutorials that walk through real-world implementations, including building a Redis-like server from scratch, designing custom

Volatility3 एक मेमोरी फॉरेंसिक फ्रेमवर्क और विश्लेषण टूल है जिसका उपयोग वोलेटाइल मेमोरी डंप को पार्स करने के लिए किया जाता है। यह डिजिटल आर्टिफैक्ट्स निकालता है और प्रोसेस जानकारी, नेटवर्क आर्टिफैक्ट्स और अन्य फॉरेंसिक साक्ष्य को पुनर्प्राप्त करने के लिए सिस्टम की रनटाइम स्थिति को पुनर्निर्माण करता है। यह सिस्टम एक प्लगइन-आधारित फॉरेंसिक इंजन और ऑपरेटिंग सिस्टम सिंबल रिज़ॉल्वर के रूप में कार्य करता है। यह सिंबल टेबल और ट्रांसलेशन लेयर्स का उपयोग करके कच्चे मेमोरी एड्रेस को ज्ञात सिस्टम संरचनाओं से मैप करता है, और कस्टम स्कैनर और रेंडरर्स बनाने के लिए एक एक्स्टेंसिबल आर्किटेक्चर प्रदान करता है। इस फ्रेमवर्क में रीयल-टाइम डेटा खोज के लिए एक कमांड-लाइन मेमोरी एक्सप्लोरर और मेमोरी रिपोर्ट के निर्माण को स्वचालित करने के लिए एक प्रोग्रामेबल इंटरफेस शामिल है। यह लेयर-आधारित एड्रेस ट्रांसलेशन प्रक्रिया के माध्यम से डिजिटल आर्टिफैक्ट एक्सट्रैक्शन और सिस्टम सिंबल रिज़ॉल्यूशन को संभालता है।

kdmapper is a kernel driver mapper and loader designed to deploy unsigned binaries into privileged kernel memory. It functions as a manual mapper that resolves imports and relocations to execute unsigned code in a privileged environment. The tool bypasses driver signature enforcement by leveraging vulnerable signed drivers to gain write access to protected kernel memory regions. It includes a kernel offset resolver that parses debug symbol files to identify correct memory addresses across different operating system builds. To maintain stealth, the project implements driver trace obfuscation