{"id":20101155,"url":"https://github.com/fkie-cad/bpf-rootkit-workshop","last_synced_at":"2025-10-05T17:32:55.524Z","repository":{"id":215078153,"uuid":"732798288","full_name":"fkie-cad/bpf-rootkit-workshop","owner":"fkie-cad","description":"Workshop: Forensic Analysis of eBPF based Linux Rootkits","archived":false,"fork":false,"pushed_at":"2024-03-13T12:47:56.000Z","size":4212,"stargazers_count":8,"open_issues_count":0,"forks_count":2,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-09-20T22:36:56.330Z","etag":null,"topics":["bpf","bpf-malware","ebpf","ebpf-malware","forensics","linux","live-forensics","malware","memory-forensics","rootkit"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/fkie-cad.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-12-17T21:19:13.000Z","updated_at":"2025-09-17T10:02:40.000Z","dependencies_parsed_at":"2024-11-13T17:36:22.555Z","dependency_job_id":null,"html_url":"https://github.com/fkie-cad/bpf-rootkit-workshop","commit_stats":null,"previous_names":["fkie-cad/bpf-rootkit-workshop"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/fkie-cad/bpf-rootkit-workshop","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fkie-cad%2Fbpf-rootkit-workshop","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fkie-cad%2Fbpf-rootkit-workshop/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fkie-cad%2Fbpf-rootkit-workshop/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fkie-cad%2Fbpf-rootkit-workshop/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/fkie-cad","download_url":"https://codeload.github.com/fkie-cad/bpf-rootkit-workshop/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fkie-cad%2Fbpf-rootkit-workshop/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":278487398,"owners_count":25995169,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-05T02:00:06.059Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bpf","bpf-malware","ebpf","ebpf-malware","forensics","linux","live-forensics","malware","memory-forensics","rootkit"],"created_at":"2024-11-13T17:23:33.091Z","updated_at":"2025-10-05T17:32:55.507Z","avatar_url":"https://github.com/fkie-cad.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# DFRWS EU 2023 Workshop: Forensic Analysis of eBPF based Linux Rootkits\n\nMaterials for the Workshop [_Forensic Analysis of eBPF based Linux Rootkits_](https://dfrws.org/forensic-analysis-of-ebpf-based-linux-rootkits/) that our colleagues [Martin Clauß](https://github.com/martinclauss/) and [Valentin Obst](https://github.com/vobst) gave at the DFRWS EU 2023 conference. We have published a blog post that covers some of the materials [here](https://lolcads.github.io/posts/2023/12/bpf_memory_forensics_with_volatility3/), and the presented Volatility 3 plugins are available [here](https://github.com/vobst/BPFVol3).\n\n## Structure\n\nThis is a three-part workshop: introduction, live forensics, and memory forensics. We do not expect you to have any prior knowledge about the BPF subsystem and thus introduce the necessary prerequisites in part one. Part two covers tools and techniques to discover BPF malware from a shell running on the system under investigation. In the third part, we discuss methods to analyze memory images for malicious activities in the BPF subsystem. The slides are located at the root of each subdirectory.\n\nEvery part contains several practical exercises. All the materials needed to solve the problems can be found in the `materials` folder and the solutions can be found in the `solutions` folder.\n\n## Downloads\n\nCertain workshop materials are unsuitable for storage in a git repository. Below are links to download them from external sources.\n\n### Virtual Machines\n\nIn the slides we mention two virtual machines.\n\n- The Kali Linux VM contains these materials as well as all required third-party tools and can be used to complete the workshop if the operating system does not support BPF, e.g., in case you use a hardened Linux kernel or any other operating system (BSD, Mac, Windows...). [Download](https://uni-bonn.sciebo.de/s/8r2QKoJccLQLeyo)\n- The Ubuntu VM is used during the live forensics exercise. [Download](https://uni-bonn.sciebo.de/s/8r2QKoJccLQLeyo)\n\n### Memory Images and Symbols\n\nIn the memory forensics part, there are multiple exercises where you have to analyze memory images. [Download](https://owncloud.fraunhofer.de/index.php/s/IeriGoh60FXVpd9)\n\nTo analyze them with Volatility you also need the corresponding symbol files. [Download](https://owncloud.fraunhofer.de/index.php/s/the1K7tlAhvNkBb)\n\n### Packet Captures\n\nSome exercises involve the analysis of pcap files. [Download](https://owncloud.fraunhofer.de/index.php/s/u5oG91ZP7HnUxJw)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffkie-cad%2Fbpf-rootkit-workshop","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffkie-cad%2Fbpf-rootkit-workshop","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffkie-cad%2Fbpf-rootkit-workshop/lists"}