Infatoshi
Featured
netherite
A from-scratch C/CUDA reimplementation of Minecraft 1.11.2 that is bit-verified against the original Java game and includes batched CUDA reinforcement learning support.
AI repository intelligence
FR-AI / ANALYSISWhy it is worth attention
It demonstrates advanced kernel-level bypass techniques using io_uring (which avoids syscall table hooks) and eBPF (map manipulation, link detachment), offers over 100 tools organized by category, and specifically targets all 25 Falco default rules with documented bypass methods.
Who it is for
- Red teamers conducting authorized engagements
- Penetration testers needing evasion techniques
- Security researchers studying Linux kernel bypass
- Defensive tool developers analyzing attack vectors
Use cases
- Bypassing EDR hooks during red team operations
- Post-exploitation file and network I/O without syscall tracepoints
- Testing and validating Falco rule effectiveness
- Covert command and control over raw Ethernet or ICMP
Strengths
- 75 EDR evasion tools covering kprobe removal, BPF link detach, audit kill, and more
- 13 io_uring tools that bypass sys_call_table and tracepoints using raw syscalls
- Detailed Falco bypass coverage with 13 tools addressing all 25 default rules
- Self-contained build system with no external frameworks (no liburing)
Considerations
- Requires kernel 5.4+ (5.19 for some tools) and BTF enabled
- Many tools need root privileges or specific capabilities (CAP_BPF, CAP_PERFMON, etc.)
- Primarily Linux-only; Windows/macOS not supported
README quick start
Furtex
Post-exploitation and evasion research toolkit for Linux, built around io_uring and eBPF. No liburing, no frameworks, raw syscalls throughout.
More tools soon. PRs are welcome. 🇧🇷
Join in Rootkit Researchers
For authorized research and red team engagements only. Don't run this on systems you don't own.
Furtex/
├── io_uring/ raw io_uring ops: file, net, injection, exfil (13 tools)
├── bpf/ BPF map and program tooling (15 tools)
├── ebpf/ BPF-side programs and loaders (9 programs + 2 runners)
├── edrs/ EDR evasion and post-exploitation (75 tools)
└── techniques/ Falco-specific bypass, all 25 default rules (13 tools)
Requirements
Toolchain
| tool | needed for |
|---|---|
gcc | all userspace binaries |
clang | ebpf/*.bpf.c BPF-side programs |
make | build system |
Headers and libraries
| package | needed for |
|---|---|
linux-headers-$(uname -r) | , and related kernel headers |
libbpf-dev | `` and friends used in ebpf/ programs |
bpftool | generate vmlinux.h via make vmlinux inside ebpf/ |
On Debian/Kali/Ubuntu:
sudo apt install gcc clang make linux-headers-$(uname -r) libbpf-dev bpftool
Kernel versions
| minimum | what it unlocks |
|---|---|
| 5.4 | io_uring base (IORING_FEAT_SINGLE_MMAP, BPF map iteration) |
| 5.6 | IORING_OP_OPENAT, IORING_OP_STATX, pidfd_getfd (pidfd_steal) |
| 5.8 | CAP_BPF + CAP_PERFMON split (replaces CAP_SYS_ADMIN for BPF) |
| 5.9 | BPF_LINK_DETACH (bpf_link_detach) |
| 5.19 | IORING_OP_SOCKET (af_packet_send, dns_exfil, xdp_socket_send, bpf_kprobe_bypass) |
Capabilities
| capability | tools that require it |
|---|---|
CAP_BPF (or CAP_SYS_ADMIN pre-5.8) | all bpf/ tools, ebpf/ loaders |
CAP_PERFMON | ebpf/ tracepoint and kprobe programs |
CAP_NET_RAW | icmp_tunnel, af_packet_shell, skf_c2_runner, icmp_trigger |
CAP_NET_ADMIN | xdp_socket_send, netfilter_flush |
CAP_AUDIT_CONTROL | audit_kill |
BTF must be enabled in the kernel (CONFIG_DEBUG_INFO_BTF=y) to run make vmlinux for ebpf/ programs.
On distros with older libc-dev headers (Ubuntu 22.04 etc.) you may need #ifndef IORING_OP_SOCKET / #define IORING_OP_SOCKET 45. Already handled in this repo.
Build
| command | builds |
|---|
Description
Post-exploitation and evasion research toolkit for Linux.
Related repositories
Similar projects matched by category, topics, and programming language.
nsdkinx
Featured
twell
Twell is a tiny, embeddable, zero-allocation physics engine for interruptible, Apple-style UI animations, available as a single-header C library with Python bindings.
sqliteai
Featured
waste
WASTE is a C-based inference engine that streams MoE experts from disk to run a 2.78 trillion-parameter model on a consumer laptop with 64 GB RAM.