whitequark/unfork

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1488 stars · 34 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

unfork(2) is a proof-of-concept Linux technique and library that joins two process address spaces into one, the inverse of fork(2), by combining userfaultfd with process_vm_readv to create copy-on-write mappings of another process's memory. It enables stealthy dynamic binary analysis and instrumentation of applications with built-in integrity checks, leaving no ptrace traces or signals.

Use cases

• analyze a binary with anti-debugging protections without being detected
• instrument a running process by manipulating a private copy of its memory
• take a cheap snapshot of another application's address space to read, write, execute, and discard
• reverse engineer software that checks for ptrace or debugger attachment
• inspect and modify memory of a process running under the same uid

When to choose

• you need to dynamically analyze or instrument a target with integrity checks that detect ptrace
• you want a copy-on-write view of another process's memory without signals or traces
• you are doing security research on Linux x86_64 or i386 and can build with patched musl-gcc

When to avoid

• you need a production-ready or supported tool, since this is explicitly a proof of concept
• you need to share files or shared memory between the merged address spaces, which requires a kernel module
• you are not on Linux, or you cannot obtain ptrace privileges over the target process

Facets

library · maturity experimental

security reverse-engineering cryptography security reverse-engineering operating-systems cpp c ptrace userfaultfd process-injection binary-analysis proof-of-concept memory-introspection linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="whitequark/unfork")