cookiengineer/gobayashi

:construction: Experimental eBPF sandbox tool to analyze and modify malware samples dynamically

stars

commits

primary language

Jul 27, 2026

updated

README

gobayashi

eBPF-based Linux malware dynamic analysis sandbox. Intercepts system calls, network connections, and DNS requests — allows the analyst to make real-time decisions (allow / block / spoof).

Quick Start

# One-time setup (after every reboot)
sudo ./scripts/setup.sh

# Build
make build

Running Tests

# Unit tests (no root needed, always runs)
make test

# BPF integration tests (requires root after setup.sh)
make test-integration

# Full podman-based test suite (unit + vet + BPF + E2E)
./scripts/podman-test.sh

Manual Daemon + Client

# Terminal 1: start the daemon
sudo ./bin/gobayashid --foreground --verbose

# Terminal 2: analyze a sample
./bin/gobayashi analyze ./samples/bin/fs_probe

# Or ping the daemon
./bin/gobayashi ping

Makefile Targets

Command	What it does
`make build`	Compiles `gobayashid` + `gobayashi`
`make test`	Unit tests (~50 tests, ~3s)
`make test-bpf`	BPF kernel tests (needs root)
`make test-e2e`	Malware sample tests (needs root)
`make test-all`	Both unit + BPF kernel tests
`make vet`	Static analysis
`make samples`	Build C malware samples
`make clean`	Remove build artifacts
`make clean-bpf`	Unload leftover BPF programs/maps (needs root)

License

AGPL-3.0

Contributors

cookiengineer

4 commits

See what people are saying

Hacker News (1)

I accidentally turned LLM memory into program analysis

0 points · Aug 29, 2026

Similar repos

anfedotoff/bombini

eBPF Security Monitoring and Sandboxing Agent Based on Aya

cloudflare/sandbox

Simple Linux seccomp rules without writing any code

533

eunomia-bpf/bpf-developer-tutorial

eBPF Developer Tutorial: Learning eBPF Step by Step with Examples

4,280

falcosecurity/falco

Cloud Native Runtime Security

9,355

qeeqbox/rhino

Agile Sandbox for analyzing Windows, Linux and macOS malware and execution behaviors

binsec/binsec

BINSEC binary-level open-source platform

425

mandiant/speakeasy

Windows kernel and user mode emulation.

2,044

0xrawsec/kunai

Threat-hunting tool for Linux

1,086

Languages

72.3%

Shell

15.6%

10.4%

Makefile

1.4%