{"repo":"azqzazq1/SunnyDayBPF","free":true,"listed":false,"github":"https://github.com/azqzazq1/SunnyDayBPF","clone":"git clone https://github.com/azqzazq1/SunnyDayBPF.git","description":"SunnyDayBPF: eBPF-based post-syscall user-buffer telemetry deception research by Azizcan Daştan","language":"Python","stars":24,"topics":["blue-team","bpf","detection-engineering","ebpf","edr","linux","linux-security","observability","red-team","security-research"],"license":"MIT","category":"analytics","readme_excerpt":"SunnyDayBPF SunnyDayBPF is an eBPF-based post-syscall user-buffer telemetry deception research technique originally proposed and researched by Azizcan Dastan . The technique investigates whether data observed by user-space security, logging, or telemetry agents can be altered after a read-like syscall has completed , but before the agent parses, analyzes, or forwards that data to a downstream security pipeline. The core idea is: The event still happens. The monitoring agent still reads data. But the data observed by the agent may no longer fully represent the original event. SunnyDayBPF focuses on the gap between ground truth and observed telemetry . --- Architecture (v2.1) Syscall Coverage Syscall Kernel Hook Arg Extraction Coverage --------- ------------ ---------------- ---------- read() ksys read PT REGS PARM2 (direct) File reads, pipes, /proc , log files pread64() x64 sys pread64 Nested pt regs via bpf probe read kernel (offset 104/RSI) Random-access file reads, journald recvfrom() sys recvfrom PT REGS PARM2 (direct) Network sockets, syslog forwarding BPF Verifier Constraints The BPF verifier enforces a jump sequence limit of 8,192 conditional branches per program. SunnyDayBPF works around this using: - BPF tail calls ( BPF PROG ARRAY ): 31 rules split across 10 independent programs, each with its own verifier budget - Case-insensitive optimization : (d[i] 32)==lower reduces jumps per byte from 2 to 1 for alphabetic characters - Dynamic scan limits : Each group's scan wi","default_branch":null,"files":null,"tree":[],"storefront":"/r/azqzazq1","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/azqzazq1/SunnyDayBPF/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}