SeeFlowerX SeeFlowerX

Seccomp BPF filter example

Use bpf programs as filters for seccomp, the one in the example will block all the write syscalls after it's loaded.

Compile it with just

gcc main.c

Last update at 2025-03-05

rm -rf /usr/local/go
GOVERSION="1.24.2"
wget "https://golang.org/dl/go${GOVERSION}.linux-amd64.tar.gz" -4

	#!/usr/bin/python3

	'''
	author: ceres-c
	usage: ./frida-extract-keystore.py
	Once the keystore(s) have been exported you have to convert them to PKCS12 using keytool
	'''

	import frida, sys, time

	#...

	function gitzip() {
	git archive -o [email protected] HEAD
	}

	#... gitzip ZIPPED_FILE_NAME


	#include <android/log.h>
	#include <jni.h>
	#include <binder/Binder.h>
	#include <binder/Parcel.h>
	#include <binder/IServiceManager.h>
	#include <dlfcn.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <unistd.h>

	#include <fcntl.h>
	#include <linux/hw_breakpoint.h>
	#include <linux/perf_event.h>
	#include <signal.h>
	#include <stdint.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <sys/syscall.h>
	#include <sys/types.h>