Furtex, developed by MatheuZSecurity, is a post-exploitation and evasion research toolkit for Linux built around io_uring and eBPF. The toolkit uses raw syscalls without liburing or frameworks, comprising 13 io_uring tools, 15 BPF userspace tools, 9 eBPF programs, 75 EDR evasion binaries, and 13 Falco bypass techniques. It requires kernel 5.4+ with BTF enabled (CONFIG_DEBUG_INFO_BTF=y), and capabilities including CAP_BPF, CAP_PERFMON, CAP_NET_RAW, CAP_NET_ADMIN, and CAP_AUDIT_CONTROL. Build via make targets: `make all`, `make uring`, `make bpf`, `make ebpf`, `make edrs`, `make techniques`.

io_uring operations bypass sys_call_table, livepatch, and sys_enter_* tracepoints by routing through kernel workqueues. Tools demonstrate file read/write/append, network connect/reverse shells, multi-file reads, memfd execution, process injection via /proc/PID/mem, pipe_splice for kernel-to-kernel data transfer, inotify bypass, DNS exfiltration, AF_PACKET and AF_XDP raw socket sends.

BPF tools require CAP_BPF and enable map reconnaissance, dumping, writing, poisoning Falco entries, program recon, EDR fingerprinting, LSM hook detection, BPF persistence, map snapshots, environment exfiltration, link detachment/updates, map freezing, and ICMP-triggered reverse shells. eBPF programs include exec tracing, credential access monitoring, keylogging, network hiding, process hiding, TTY sniffing, and XDP backdoors.