Low-Level

Traditional /tmp files leave disk traces and inode artifacts. memfd_create (Linux 3.17+, syscall 319) allocates anonymous files backed exclusively by RAM-resident tmpfs — invisible to directory listings, destroyed on fd close, and undetectable by standard forensic imaging. x64 Assembly implementation: null-terminated name label visible only in /proc/pid/fd/, MFD_CLOEXEC flag, fd sealing via fcntl. Blue Team surface: eBPF sys_memfd_create hooks and /proc/pid/fd/ memfd: link auditing.

Every Linux syscall follows the x64 ABI register protocol: RAX holds the syscall number, RDI/RSI/RDX hold the first three arguments, return value lands in RAX. File descriptors 0/1/2 map to stdin/stdout/stderr — everything else (files, sockets, pipes) is a number above 2 returned by open(). .bss reserves zero-initialized RAM without increasing binary size on disk — ideal for runtime buffers. Complete implementation: sys_open → sys_read into .bss buffer → sys_write to stdout → sys_close → sys_exit.

Raw socket ICMP sniffing in x64 Assembly without libc: SOCK_RAW+IPPROTO_ICMP instructs the kernel to deliver only ICMP frames, filtering TCP/UDP at the socket layer. sys_recvfrom delivers the full frame including IP header — lea rsi,[sniffed_data+28] skips the 20-byte IPv4 header and 8-byte ICMP header to reach payload. IP address conversion: fetch each octet from sockaddr_in, repeatedly divide by 10 via div instruction, add 0x30 for ASCII, write digits backward into 16-byte buffer, insert 0x2E dot separators via conditional jump. Full source on GitHub.

Network packet IP addresses arrive in Big-Endian byte order inside sockaddr_in. x86/x64 Little-Endian architecture reverses the bytes on load — naive printing yields 5.1.168.192 instead of 192.168.1.5. The standard two-pass approach (convert forward, then reverse string) wastes memory cycles. Single-pass backward-build: start reading from the last IP octet (offset 7), write ASCII digits to the end of the output buffer, work backward simultaneously — the string forms correctly in one pass. Each octet uses div bl to extract decimal digits, add 0x30 to convert to ASCII, dot separator skipped on last octet via cmp rcx,4.