syscall-tracing

Userspace eBPF runtime for Observability, Network, GPU & General Extensions Framework

Human-friendly cross-platform system call tracing and hooking library based on Frida's Stalker

The lazypoline syscall interposer

The scalable approach to build secure in-process syscall interposers

This is my implementation of syscalls tracing system and copy on write (COW) mechanism, that I've implemented for xv6 educational kernel

Private dynamic analysis engine and sandbox for malware research, blue team and DFIR (observation only).

Bedrock ebpf-based file access pattern tracing tool.

syscall trace utility for Linux written in Rust

A pure Python CLI tool for tracing and analyzing system calls on Linux using strace. Zero dependencies, modular architecture, JSON/TXT reports.

Wraith is a low-level Rust security sensor that answers a question most tools can't: "is this process being exploited right now?" By focusing entirely on anomalous runtime behavior rather than known signatures or payloads, Wraith detects live exploits and uncovers zero-day vulnerabilities completely in advance of a patch.

Observe file, network, and process capabilities used while installing or requiring Ruby gems.

Trace-and-learn containerizer that turns Linux installers into hardened Podman containers.

Android observability CLI for AI agents: syscall and Binder tracing with machine-readable evidence, capture health, scope and provenance.

See what an npm lifecycle script actually did: files touched, processes spawned, network endpoints contacted. Linux + strace.