Security Research Posts — Vulnerability Disclosures, Assembly & Network Protocols

Raw socket ICMP sniffing in x64 Assembly without libc: SOCK_RAW+IPPROTO_ICMP instructs the kernel to deliver only ICMP frames, filtering TCP/UDP at the socket layer. sys_recvfrom delivers the full frame including IP header — lea rsi,[sniffed_data+28] skips the 20-byte IPv4 header and 8-byte ICMP header to reach payload. IP address conversion: fetch each octet from sockaddr_in, repeatedly divide by 10 via div instruction, add 0x30 for ASCII, write digits backward into 16-byte buffer, insert 0x2E dot separators via conditional jump. Full source on GitHub.

Stateful firewalls and DPI engines classify ICMP Type 3 (Port Unreachable) as error traffic and skip deep inspection. RFC 792 requires the original IP header plus 8 bytes in the reflection field — this is attacker-controlled space. By placing a fully-formed secondary ICMP header inside the reflection segment, arbitrary protocol data traverses perimeter controls unanalyzed. The 0xFFFF boundary anomaly causes packet boundary miscalculation in DPI engines, leaving the nested payload invisible to signature matching. Full x64 Assembly implementation with raw socket crafting.

Network packet IP addresses arrive in Big-Endian byte order inside sockaddr_in. x86/x64 Little-Endian architecture reverses the bytes on load — naive printing yields 5.1.168.192 instead of 192.168.1.5. The standard two-pass approach (convert forward, then reverse string) wastes memory cycles. Single-pass backward-build: start reading from the last IP octet (offset 7), write ASCII digits to the end of the output buffer, work backward simultaneously — the string forms correctly in one pass. Each octet uses div bl to extract decimal digits, add 0x30 to convert to ASCII, dot separator skipped on last octet via cmp rcx,4.

Two syscalls, zero libc: PTRACE_TRACEME (sys_ptrace 101) self-traces the process to block gdb/strace with EPERM, PR_SET_DUMPABLE=0 (sys_prctl 157) kills core dump creation at OS level. Syscall numbers are calculated dynamically at runtime to evade YARA static analysis. Full x64 Assembly implementation with eBPF detection surface analysis.