EDR-Evasion

Traditional /tmp files leave disk traces and inode artifacts. memfd_create (Linux 3.17+, syscall 319) allocates anonymous files backed exclusively by RAM-resident tmpfs — invisible to directory listings, destroyed on fd close, and undetectable by standard forensic imaging. x64 Assembly implementation: null-terminated name label visible only in /proc/pid/fd/, MFD_CLOEXEC flag, fd sealing via fcntl. Blue Team surface: eBPF sys_memfd_create hooks and /proc/pid/fd/ memfd: link auditing.

Two syscalls, zero libc: PTRACE_TRACEME (sys_ptrace 101) self-traces the process to block gdb/strace with EPERM, PR_SET_DUMPABLE=0 (sys_prctl 157) kills core dump creation at OS level. Syscall numbers are calculated dynamically at runtime to evade YARA static analysis. Full x64 Assembly implementation with eBPF detection surface analysis.