SunnyDayBPF

SunnyDayBPF is an eBPF-based research tool designed for post-syscall user-buffer telemetry deception, investigating the integrity of data observed by user-space security agents after read-like syscalls. It alters the telemetry data before it is processed by security pipelines, allowing for a detailed examination of discrepancies between actual events and the observed telemetry. Notable features include support for multiple syscalls (e.g., read, pread64, recvfrom), a modular BPF architecture utilizing tail calls to circumvent verifier constraints, and customizable scanning rules for enhanced security analysis.