In-Memory-Execution on Netacoding | Cybersecurity, Assembly & Network Research https://netacoding.com/tags/in-memory-execution/ Recent content in In-Memory-Execution on Netacoding | Cybersecurity, Assembly & Network Research Netacoding | Cybersecurity, Assembly & Network Research https://netacoding.com/img/logo-netacoding.png https://netacoding.com/img/logo-netacoding.png Hugo en-us Fri, 27 Mar 2026 11:30:25 +0300 memfd_create Linux: Fileless In-Memory Execution & Anti-Forensics via Syscall 319 in x64 Assembly https://netacoding.com/posts/volatile-storage/ Fri, 27 Mar 2026 11:30:25 +0300 https://netacoding.com/posts/volatile-storage/ memfd_create (syscall 319) creates anonymous RAM-backed file descriptors invisible to ls and standard forensic tools — no disk writes, no /tmp traces, no permanent inode. Full x64 Assembly implementation covering MFD_CLOEXEC, fd sealing, and Blue Team detection via /proc/pid/fd/ and eBPF auditd.