Security Research Posts — Vulnerability Disclosures, Assembly & Network Protocols

Two syscalls, zero libc: PTRACE_TRACEME (sys_ptrace 101) self-traces the process to block gdb/strace with EPERM, PR_SET_DUMPABLE=0 (sys_prctl 157) kills core dump creation at OS level. Syscall numbers are calculated dynamically at runtime to evade YARA static analysis. Full x64 Assembly implementation with eBPF detection surface analysis.

ICMP packets with incorrect checksums are silently dropped by the kernel before reaching the destination. RFC 1071 mandates 16-bit one’s complement sum: accumulate packet words in eax, handle odd trailing byte separately, fold the carry bits (shr r11d,16 → and eax,0xFFFF → add ax,r11w → adc ax,0), invert with not ax. The receiver repeats the same sum — result must be 0xFFFF for a valid packet. Full x64 Assembly implementation with register layout, loop termination, and ICMP header integration.