Security Research Posts — Vulnerability Disclosures, Assembly & Network Protocols

C and Rust binaries carry compiler fingerprints that cannot be removed: GCC function prologues, LLVM unwind tables, CRT startup code, stack canary patterns, .eh_frame sections. Pure assembly has none of these. Empirical test on live x64 C2 implant: 0/65 static detections on VirusTotal, SROP kernel-mediated execution and process_vm_writev (syscall 311) invisible to behavioral sandbox, only entry-phase ptrace caught. CMOV branch-free execution collapses CFG to a single basic block — confirmed effective by SEBD 2019 academic research.

LockBit 5.0 Linux encrypts files with ChaCha20+Curve25519 with zero network activity — the public key is embedded at compile time. strace attachment triggers immediate termination. Free space is actively wiped post-encryption to prevent carving. Full analysis pipeline: eBPF syscall tracing, Ghidra static RE of crypto routines, pcap-confirmed network behavior, and extracted IOCs including file markers, dropped ransom note paths, and encryption extension patterns.

Governing an AI agent with another AI firewall creates the Quis Custodiet paradox: both systems are probabilistic and subject to prompt injection and data poisoning. The kernel has no concept of intent — it enforces access control via EPERM regardless of what the agent claims. Container isolation (namespace + cgroup), strict RBAC, stripped Linux capabilities, and SELinux/AppArmor MAC profiles provide deterministic guarantees that semantic AI parsing cannot. Agents with no .env file read permission cannot exfiltrate .env files, regardless of how they’re prompted.

Fixed-interval C2 beacons produce detectable periodic patterns in SOC traffic baselines and behavioral analysis engines. LCG jitter breaks this: rdtsc reads the CPU Time Stamp Counter for hardware entropy, imul+add applies the Numerical Recipes LCG scramble (X = 1664525X + 1013904223 mod 2^32), div maps the result to [100ms, 1000ms), sys_nanosleep (syscall 35) executes the delay. Result: uniform random inter-beacon intervals with 2^32 period, zero external dependencies, full register preservation, pure x64 Assembly.

Static analysis tools and AI-driven EDRs map malicious behavior through branching instructions — JMP, JZ, JNZ form the edges of a Control Flow Graph that heuristic engines traverse. CMOV-based CFG flattening removes all conditional branches, collapsing the graph to a single flat node sequence that defeats both signature-based and ML-based detection. Full x64 Assembly implementation: branch-free syscall obfuscation, CMOV patterns for JZ/JNZ/JLE replacement, and empirical bypass results against NGAV and Ghidra CFG analysis.

Standard ptrace injection generates detectable syscall sequences that EDR hooks intercept. Phantom Evasion Loader routes ptrace through SROP frames: crafting a fake sigcontext on the stack and firing sys_rt_sigreturn (syscall 15) causes the kernel to restore arbitrary register state — ptrace fires through the signal return path, invisible to direct syscall monitors. process_vm_writev (syscall 311) writes the full payload in one cross-process memory operation instead of 204 PTRACE_POKEDATA events. QWORD XOR decryption runs in-memory before injection. Results: 0/65 VirusTotal static, SROP + process_vm_writev invisible to Hatching Triage behavioral sandbox.