Comment by lights0123

Most programs do encryption without syscalls! eBPF can intercept userspace execution, which they do as mentioned in the post:

> The key idea is to hook into common TLS libraries (like OpenSSL) before encryption and after decryption