Security Research Posts — Vulnerability Disclosures, Assembly & Network Protocols

Every Linux syscall follows the x64 ABI register protocol: RAX holds the syscall number, RDI/RSI/RDX hold the first three arguments, return value lands in RAX. File descriptors 0/1/2 map to stdin/stdout/stderr — everything else (files, sockets, pipes) is a number above 2 returned by open(). .bss reserves zero-initialized RAM without increasing binary size on disk — ideal for runtime buffers. Complete implementation: sys_open → sys_read into .bss buffer → sys_write to stdout → sys_close → sys_exit.

ICMP packets with incorrect checksums are silently dropped by the kernel before reaching the destination. RFC 1071 mandates 16-bit one’s complement sum: accumulate packet words in eax, handle odd trailing byte separately, fold the carry bits (shr r11d,16 → and eax,0xFFFF → add ax,r11w → adc ax,0), invert with not ax. The receiver repeats the same sum — result must be 0xFFFF for a valid packet. Full x64 Assembly implementation with register layout, loop termination, and ICMP header integration.

udisks2 handles XFS resize via temporary /tmp/blockdev.XXXXXX mount points. Between mount creation and nosuid application, a race window allows SUID binary execution. Three-stage exploit: Polkit bypass via ~/.pam_environment local seat0 session spoofing, XFS image crafting with pwnbash SUID binary baked into mkfs.xfs Protofile metadata, D-Bus resize request flood to continuously recreate race window. Architecture-agnostic (x86/x64/ARM). Confirmed LPE on openSUSE Leap 15.6 kernel 6.4.0.

eBPF executes verified bytecode at kernel hook points — kprobes, tracepoints, XDP driver level — with JIT-compiled native performance and no module stability risk. XDP intercepts packets before the kernel networking stack for DDoS mitigation at millions of packets/second. Kprobes attach to any kernel function for real-time syscall argument tracing. Security application: behavioral detection that captures syscall sequences regardless of compiler artifacts or CFG obfuscation — the only reliable detection layer against pure assembly implants.

IDS/IPS evasion requires more than encryption — it requires blending into ambient traffic. Five-layer approach: Linux-accurate 56-byte RDTSC-timestamped ICMP payloads defeat timing anomaly detection; OS-signature-aligned fragmentation avoids MTU and volume signatures; Magic Sequence stateless port knocking (ID+SEQ=K) eliminates detectable persistent connections; memfd_create fileless execution leaves zero disk forensic artifacts; LCG nanosleep jitter destroys periodic beaconing patterns. Full x64 Assembly implementation, Suricata v8.0.3 bypass confirmed.

Linux and Windows ICMP Echo Requests differ in payload size (64B vs 40B), default content (timestamp vs alphabetical), and TTL values — forming OS-specific network fingerprints that NIDS use for traffic classification. Traffic mimicry replicates these signatures at the assembly level: 8-byte RDTSC timestamp emulation, sequential byte padding (0x10–0x1F), and strict 64-byte structural alignment bypass DPI anomaly detection without triggering empty-payload or entropy signatures.