Launch a command under observation — or attach to an existing process — and see what it actually does at runtime: process lifecycle, file activity, network connections, privilege transitions, namespace changes, and more.
@@ -30,7 +25,7 @@ Launch a command under observation — or attach to an existing process — and
## Quick Start
-[](https://killercoda.com/mutasem04/scenario/procscope-scenario)
+[](https://killercoda.com/mutasem04/scenario/procscope-scenario)
### 1-Minute Install (Go 1.24+)
@@ -82,7 +77,7 @@ procscope will detect missing capabilities at startup and provide actionable gui
| GitHub releases | Available |
| `go install` | Available |
| Debian / Kali / Parrot packages | Packaging metadata maintained in-tree; not yet shipped by the distro |
-| Arch / BlackArch package | `arch/PKGBUILD` maintained in-tree; not yet shipped by BlackArch |
+| Arch / BlackArch package | Available in BlackArch |
## Installation
@@ -267,7 +262,7 @@ See [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) for community participation guideli
## About the Author
-**procscope** was developed by [Mutasem Kharma](https://github.com/Mutasem-mk4), a **Security Engineer** and **eBPF Specialist** focused on building high-performance, offensive and defensive security tools for the modern cloud-native landscape. Mutasem specializes in low-level system observation, automated vulnerability research, and autonomous security agents.
+**procscope** was developed by [Mutasem Kharma (معتصم خرما)](https://github.com/Mutasem-mk4), a **Security Engineer** and **eBPF Specialist** focused on building high-performance, offensive and defensive security tools for the modern cloud-native landscape. Mutasem specializes in low-level system observation, automated vulnerability research, and autonomous security agents.
---
diff --git a/arch/.SRCINFO b/arch/.SRCINFO
index 3689509..4c4bdb7 100644
--- a/arch/.SRCINFO
+++ b/arch/.SRCINFO
@@ -6,11 +6,11 @@ pkgbase = procscope
arch = x86_64
arch = aarch64
groups = blackarch
+ groups = blackarch-defensive
groups = blackarch-forensic
- groups = blackarch-scanner
license = MIT
- makedepends = go>=2:1.25
+ makedepends = go>=1.25
source = procscope-1.1.0.tar.gz::https://github.com/Mutasem-mk4/procscope/archive/v1.1.0.tar.gz
- sha256sums = 7efcd3b031115637b2bac1c2243786e2f6430445743ff42c5b5f7f680fa3d624
+ sha512sums = f8483681b1f3b6349e65d668aec67ab02bb7a0dced4f86478280561f23cdffbf139d50ba275cbf1ce17062c045b2e944f674c5c108efa38d50e752cc2e5d48bd
pkgname = procscope
diff --git a/arch/PKGBUILD b/arch/PKGBUILD
index a472b3b..90b41e7 100644
--- a/arch/PKGBUILD
+++ b/arch/PKGBUILD
@@ -1,19 +1,17 @@
-# Maintainer: Mutasem-mk4 <140179052+Mutasem-mk4@users.noreply.github.com>
+# This file is part of BlackArch Linux ( https://www.blackarch.org/ ).
+# See COPYING for license details.
+
pkgname=procscope
pkgver=1.1.0
pkgrel=1
pkgdesc='Process-scoped runtime investigation tool using eBPF'
arch=('x86_64' 'aarch64')
+groups=('blackarch' 'blackarch-defensive' 'blackarch-forensic')
url='https://github.com/Mutasem-mk4/procscope'
license=('MIT')
-groups=('blackarch' 'blackarch-forensic' 'blackarch-scanner')
-depends=()
-makedepends=('go>=2:1.25')
+makedepends=('go>=1.25')
source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/v${pkgver}.tar.gz")
-# The sha256sum below must be updated after cutting a GitHub release.
-# Generate it with: curl -sL "$url/archive/v$pkgver.tar.gz" | sha256sum
-# For local development builds: makepkg --skipchecksums
-sha256sums=('7efcd3b031115637b2bac1c2243786e2f6430445743ff42c5b5f7f680fa3d624')
+sha512sums=('f8483681b1f3b6349e65d668aec67ab02bb7a0dced4f86478280561f23cdffbf139d50ba275cbf1ce17062c045b2e944f674c5c108efa38d50e752cc2e5d48bd')
build() {
cd "${pkgname}-${pkgver}"
@@ -24,13 +22,14 @@ build() {
go build \
-ldflags "-s -w \
-X 'github.com/Mutasem-mk4/procscope/internal/version.Version=${pkgver}' \
- -X 'github.com/Mutasem-mk4/procscope/internal/version.Commit=${pkgrel}'" \
+ -X 'github.com/Mutasem-mk4/procscope/internal/version.Commit=blackarch'" \
-o "${pkgname}" \
./cmd/procscope
}
check() {
cd "${pkgname}-${pkgver}"
+
go test -short ./internal/events/... ./internal/output/... ./internal/redact/... ./internal/version/...
}
@@ -48,5 +47,5 @@ package() {
install -Dm644 "completions/${pkgname}.fish" \
"${pkgdir}/usr/share/fish/vendor_completions.d/${pkgname}.fish"
- install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
+ install -Dm644 README.md -t "${pkgdir}/usr/share/doc/${pkgname}"
}
diff --git a/docs/index.html b/docs/index.html
index 9c50c1f..d67042d 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -5,28 +5,58 @@
- procscope — Zero-Overhead eBPF Process Tracer for Linux | Mutasem Kharma
-
-
-
-
-
+ procscope — Zero-Overhead eBPF Process Tracer for Linux | Mutasem Kharma (معتصم خرما)
+
+
+
+
+
+
+
+
-
-
+
+
-
+
-
+
+
@@ -194,7 +224,12 @@
-
-
- 
-
- 
- 
- 
- 
- 
- 
+ 
+ 
+ 
+ 
+ 
+ 