Assembly

Implementing a reverse shell in pure x64 Assembly exposes the raw POSIX syscall sequence: socket() creates the TCP FD, connect() establishes the outbound connection, dup2() iterates 2→1→0 to redirect all three standard streams to the socket, execve() spawns /bin/sh which inherits the redirected FDs. PIC Stack Anchor (sub rsp,0x8000 + and rsp,-16 + mov rbp,rsp) enables ASLR-safe deployment — no absolute addresses, no .data/.bss, sockaddr_in struct copied from .text to writable stack via rep movsb. Zero libc, zero external dependencies.

Every HTTP server abstraction collapses to the same syscall chain: socket → bind → listen → accept → read → sendfile → close. In pure x86_64 Assembly, each step is explicit: bswap converts port to network byte order, SCASB/LODSB scans the GET request path byte-by-byte for ../ traversal sequences, sys_fstat retrieves exact file size for sys_sendfile, sys_sendfile(40) transfers file data directly from disk to NIC via kernel space — zero user-space copy, zero libc, zero external libraries. Full source on GitHub.

OS-level clocks (gettimeofday, clock_gettime) introduce their own scheduling jitter — unusable for nanosecond-scale network measurement. RDTSC reads the CPU’s Time Stamp Counter directly: rdtsc + shl rdx,32 + or rax,rdx yields a 64-bit cycle count. Delta between two RDTSC reads gives precise inter-packet timing. Jitter = |D_i - D_{i-1}| across packet sequence. Gaussian distribution = stable network. High variance = bufferbloat, middlebox processing, or behavioral detection baseline deviation. CPUID/RDTSCP prevent out-of-order execution from skewing measurements.

Traditional /tmp files leave disk traces and inode artifacts. memfd_create (Linux 3.17+, syscall 319) allocates anonymous files backed exclusively by RAM-resident tmpfs — invisible to directory listings, destroyed on fd close, and undetectable by standard forensic imaging. x64 Assembly implementation: null-terminated name label visible only in /proc/pid/fd/, MFD_CLOEXEC flag, fd sealing via fcntl. Blue Team surface: eBPF sys_memfd_create hooks and /proc/pid/fd/ memfd: link auditing.

Every Linux syscall follows the x64 ABI register protocol: RAX holds the syscall number, RDI/RSI/RDX hold the first three arguments, return value lands in RAX. File descriptors 0/1/2 map to stdin/stdout/stderr — everything else (files, sockets, pipes) is a number above 2 returned by open(). .bss reserves zero-initialized RAM without increasing binary size on disk — ideal for runtime buffers. Complete implementation: sys_open → sys_read into .bss buffer → sys_write to stdout → sys_close → sys_exit.

ICMP packets with incorrect checksums are silently dropped by the kernel before reaching the destination. RFC 1071 mandates 16-bit one’s complement sum: accumulate packet words in eax, handle odd trailing byte separately, fold the carry bits (shr r11d,16 → and eax,0xFFFF → add ax,r11w → adc ax,0), invert with not ax. The receiver repeats the same sum — result must be 0xFFFF for a valid packet. Full x64 Assembly implementation with register layout, loop termination, and ICMP header integration.