Security Research Posts — Vulnerability Disclosures, Assembly & Network Protocols

eBPF executes verified bytecode at kernel hook points — kprobes, tracepoints, XDP driver level — with JIT-compiled native performance and no module stability risk. XDP intercepts packets before the kernel networking stack for DDoS mitigation at millions of packets/second. Kprobes attach to any kernel function for real-time syscall argument tracing. Security application: behavioral detection that captures syscall sequences regardless of compiler artifacts or CFG obfuscation — the only reliable detection layer against pure assembly implants.

IDS/IPS evasion requires more than encryption — it requires blending into ambient traffic. Five-layer approach: Linux-accurate 56-byte RDTSC-timestamped ICMP payloads defeat timing anomaly detection; OS-signature-aligned fragmentation avoids MTU and volume signatures; Magic Sequence stateless port knocking (ID+SEQ=K) eliminates detectable persistent connections; memfd_create fileless execution leaves zero disk forensic artifacts; LCG nanosleep jitter destroys periodic beaconing patterns. Full x64 Assembly implementation, Suricata v8.0.3 bypass confirmed.

Linux and Windows ICMP Echo Requests differ in payload size (64B vs 40B), default content (timestamp vs alphabetical), and TTL values — forming OS-specific network fingerprints that NIDS use for traffic classification. Traffic mimicry replicates these signatures at the assembly level: 8-byte RDTSC timestamp emulation, sequential byte padding (0x10–0x1F), and strict 64-byte structural alignment bypass DPI anomaly detection without triggering empty-payload or entropy signatures.

Raw socket ICMP sniffing in x64 Assembly without libc: SOCK_RAW+IPPROTO_ICMP instructs the kernel to deliver only ICMP frames, filtering TCP/UDP at the socket layer. sys_recvfrom delivers the full frame including IP header — lea rsi,[sniffed_data+28] skips the 20-byte IPv4 header and 8-byte ICMP header to reach payload. IP address conversion: fetch each octet from sockaddr_in, repeatedly divide by 10 via div instruction, add 0x30 for ASCII, write digits backward into 16-byte buffer, insert 0x2E dot separators via conditional jump. Full source on GitHub.

Stateful firewalls and DPI engines classify ICMP Type 3 (Port Unreachable) as error traffic and skip deep inspection. RFC 792 requires the original IP header plus 8 bytes in the reflection field — this is attacker-controlled space. By placing a fully-formed secondary ICMP header inside the reflection segment, arbitrary protocol data traverses perimeter controls unanalyzed. The 0xFFFF boundary anomaly causes packet boundary miscalculation in DPI engines, leaving the nested payload invisible to signature matching. Full x64 Assembly implementation with raw socket crafting.

Network packet IP addresses arrive in Big-Endian byte order inside sockaddr_in. x86/x64 Little-Endian architecture reverses the bytes on load — naive printing yields 5.1.168.192 instead of 192.168.1.5. The standard two-pass approach (convert forward, then reverse string) wastes memory cycles. Single-pass backward-build: start reading from the last IP octet (offset 7), write ASCII digits to the end of the output buffer, work backward simultaneously — the string forms correctly in one pass. Each octet uses div bl to extract decimal digits, add 0x30 to convert to ASCII, dot separator skipped on last octet via cmp rcx,4.