Infatoshi
精选
netherite
A from-scratch C/CUDA reimplementation of Minecraft 1.11.2 that is bit-verified against the original Java game and includes batched CUDA reinforcement learning support.
AI 仓库情报摘要
FR-AI / ANALYSIS为什么值得关注
它展示了利用 io_uring（绕过系统调用表钩子）和 eBPF（操作映射、解除链接）的高级内核级绕过技术，提供超过 100 个按类别组织的工具，并针对全部 25 条 Falco 默认规则给出了文档化的绕过方法。
适合谁使用
- 进行授权演练的红队成员
- 需要规避技术的渗透测试人员
- 研究 Linux 内核绕过的安全研究人员
- 分析攻击向量的防御工具开发者
典型使用场景
- 红队行动中绕过 EDR 钩子
- 无系统调用跟踪点的后渗透文件与网络 I/O
- 测试和验证 Falco 规则的有效性
- 通过原始以太网或 ICMP 实现隐蔽命令与控制
项目优势
- 75 个 EDR 规避工具，涵盖 kprobe 移除、BPF 链接分离、审计禁用等
- 13 个 io_uring 工具，使用原始系统调用绕过 sys_call_table 和跟踪点
- 详细的 Falco 绕过覆盖，13 个工具针对全部 25 条默认规则
- 自包含的构建系统，不依赖任何外部框架（无 liburing）
使用前须知
- 需要内核 5.4+（部分工具需要 5.19）并启用 BTF
- 许多工具需要 root 权限或特定能力（CAP_BPF、CAP_PERFMON 等）
- 仅支持 Linux，不支持 Windows/macOS
README 快速开始
Furtex
Post-exploitation and evasion research toolkit for Linux, built around io_uring and eBPF. No liburing, no frameworks, raw syscalls throughout.
More tools soon. PRs are welcome. 🇧🇷
Join in Rootkit Researchers
For authorized research and red team engagements only. Don't run this on systems you don't own.
Furtex/
├── io_uring/ raw io_uring ops: file, net, injection, exfil (13 tools)
├── bpf/ BPF map and program tooling (15 tools)
├── ebpf/ BPF-side programs and loaders (9 programs + 2 runners)
├── edrs/ EDR evasion and post-exploitation (75 tools)
└── techniques/ Falco-specific bypass, all 25 default rules (13 tools)
Requirements
Toolchain
| tool | needed for |
|---|---|
gcc | all userspace binaries |
clang | ebpf/*.bpf.c BPF-side programs |
make | build system |
Headers and libraries
| package | needed for |
|---|---|
linux-headers-$(uname -r) | , and related kernel headers |
libbpf-dev | `` and friends used in ebpf/ programs |
bpftool | generate vmlinux.h via make vmlinux inside ebpf/ |
On Debian/Kali/Ubuntu:
sudo apt install gcc clang make linux-headers-$(uname -r) libbpf-dev bpftool
Kernel versions
| minimum | what it unlocks |
|---|---|
| 5.4 | io_uring base (IORING_FEAT_SINGLE_MMAP, BPF map iteration) |
| 5.6 | IORING_OP_OPENAT, IORING_OP_STATX, pidfd_getfd (pidfd_steal) |
| 5.8 | CAP_BPF + CAP_PERFMON split (replaces CAP_SYS_ADMIN for BPF) |
| 5.9 | BPF_LINK_DETACH (bpf_link_detach) |
| 5.19 | IORING_OP_SOCKET (af_packet_send, dns_exfil, xdp_socket_send, bpf_kprobe_bypass) |
Capabilities
| capability | tools that require it |
|---|---|
CAP_BPF (or CAP_SYS_ADMIN pre-5.8) | all bpf/ tools, ebpf/ loaders |
CAP_PERFMON | ebpf/ tracepoint and kprobe programs |
CAP_NET_RAW | icmp_tunnel, af_packet_shell, skf_c2_runner, icmp_trigger |
CAP_NET_ADMIN | xdp_socket_send, netfilter_flush |
CAP_AUDIT_CONTROL | audit_kill |
BTF must be enabled in the kernel (CONFIG_DEBUG_INFO_BTF=y) to run make vmlinux for ebpf/ programs.
On distros with older libc-dev headers (Ubuntu 22.04 etc.) you may need #ifndef IORING_OP_SOCKET / #define IORING_OP_SOCKET 45. Already handled in this repo.
Build
| command | builds |
|---|
项目描述
Post-exploitation and evasion research toolkit for Linux.
相关仓库与替代方案
根据分类、Topic 和编程语言匹配的相似项目。
nsdkinx
精选
twell
Twell is a tiny, embeddable, zero-allocation physics engine for interruptible, Apple-style UI animations, available as a single-header C library with Python bindings.
sqliteai
精选
waste
WASTE is a C-based inference engine that streams MoE experts from disk to run a 2.78 trillion-parameter model on a consumer laptop with 64 GB RAM.