uprobe

Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64 and arm64.

一个基于uprobe，能同时hook大量用户地址空间函数的kpm内核模块

Android Gyroscope Hook｜基于 Xposed 框架和内核模块实现的陀螺仪 Hook 方案，支持应用层事件拦截与系统传感器数据修改。

eBPF学习

eBPF based prometheus Exporter for mysql/mariadb query latencies.

tail -f for SQLite. Every statement any process on the box runs against libsqlite3 — the SQL (syntax-highlighted), the values bound to its ? placeholders, the per-step latency and result code — decoded and streamed live to your terminal. No cooperation from the traced apps, no recompile, no PRAGMA.

Learning eBPF (Extended Berkeley Packet Filter) and more

callweave is an eBPF-based asynchronous causal tracing and latency attribution tool for Linux.

Linux tool that captures plaintext TLS traffic per-process by attaching ftrace uprobes to libssl SSL_read/SSL_write, in Go

eBPF tracer for FirebirdSQL — engine-level statement timing and kernel-level I/O correlation

User-space memory-leak detection with eBPF uprobes - attach to a live process, no recompile and no restart

A lightweight user-space dynamic instrumentation library using ptrace for function-level probing without kernel traps.