Furtex是一款面向Linux平台的后渗透和规避研究工具包，基于io_uring和eBPF技术构建 [1]。该项目包含137个工具和技术实现，涵盖文件操作、网络通信、EDR规避和Falco检测绕过等功能 [1]。
工具包由多个模块组成：io_uring模块包含13个工具，bpf模块15个工具，ebpf模块9个程序和2个运行器，edrs模块75个工具，techniques模块13个工具 [1]。
系统要求方面，该项目最低支持Linux 5.4内核以获得io_uring基础功能 [1]。运行时需要CAP_BPF、CAP_PERFMON、CAP_NET_RAW、CAP_NET_ADMIN、CAP_AUDIT_CONTROL等权限 [1]。编译依赖包括gcc、clang、make、linux-headers、libbpf-dev和bpftool [1]。
从技术优势看，io_uring可绕过sys_call_table指针替换、livepatch钩子和sys_enter_*追踪点 [1]。在检测规避方面，该工具包覆盖了25条Falco默认规则的绕过技术 [1]。
项目明确标注了使用限制："仅用于授权安全研究和红队测试。请勿在未授权的系统上运行。" [1]
Furtex is an open-source toolkit designed for post-exploitation, rootkit development, and evasion research on Linux systems [1]. Built on io_uring and eBPF technologies, the project comprises 137 tools and technical implementations spanning file operations, network communications, EDR evasion, and detection bypass capabilities [1].
The toolkit is organized into five primary modules [1]. The io_uring module contains 13 tools, while the bpf module includes 15 tools [1]. The ebpf module provides 9 programs plus 2 runners, the edrs module offers 75 tools, and the techniques module contains 13 tools [1]. Notably, the project covers 25 default Falco rule bypasses [1].
System requirements include a minimum Linux kernel version of 5.4 to support io_uring functionality [1]. The toolkit requires specific capabilities including CAP_BPF, CAP_PERFMON, CAP_NET_RAW, CAP_NET_ADMIN, and CAP_AUDIT_CONTROL [1]. Compilation dependencies encompass gcc, clang, make, linux-headers, libbpf-dev, and bpftool [1].
A key technical advantage of io_uring is its ability to circumvent sys_call_table pointer replacement, livepatch hooks, and sys_enter_* tracepoints [1].
The project explicitly restricts its use, stating: "For authorized research and red team engagements only. Don't run this on systems you don't own." [1]