https://netacoding.com/tags/process-vm-writev/ Recent content in Process-Vm-Writev on Netacoding | Cybersecurity, Assembly & Network Research https://netacoding.com/img/logo-netacoding.png https://netacoding.com/img/logo-netacoding.png Hugo en-us Wed, 29 Apr 2026 00:00:00 +0000 https://netacoding.com/posts/byovd-vs_userspace_inj/ Wed, 29 Apr 2026 00:00:00 +0000 https://netacoding.com/posts/byovd-vs_userspace_inj/ BYOVD exploits signed vulnerable kernel drivers to reach Ring 0 and terminate EDR processes (Windows). User-space SROP injection uses ptrace+sigreturn+process_vm_writev to run inside a trusted host process identity without touching Ring 0 (Linux). Empirical results: 0/65 VirusTotal, SROP injection and process_vm_writev invisible to behavioral sandbox. Threat model, privilege ring, and detection surface comparison. https://netacoding.com/posts/language_malware-evasion/ Sat, 25 Apr 2026 00:00:00 +0000 https://netacoding.com/posts/language_malware-evasion/ Pure x64 Assembly eliminates compiler artifacts (GCC prologues, LLVM panic stubs, CRT startup code) that AV/EDR engines fingerprint. Empirical results: 0/65 VirusTotal detections, SROP injection and process_vm_writev invisible to behavioral sandbox. CMOV-based CFG flattening defeats heuristic graph analysis. Backed by Ianni et al. (SEBD 2019) on exotic compiler evasion. https://netacoding.com/posts/phantom-evasion-loader-blog/ Mon, 13 Apr 2026 00:00:00 +0000 https://netacoding.com/posts/phantom-evasion-loader-blog/ Phantom Evasion Loader injects shellcode into a live process using SROP (rt_sigreturn syscall 15) to hide ptrace calls from EDR monitors, and process_vm_writev (syscall 311) for single-shot direct cross-memory payload write — bypassing PTRACE_POKEDATA behavioral detection. XOR-decrypted in-memory payload. Confirmed: 0/65 VirusTotal, SROP and injection invisible to Falco eBPF and Hatching Triage.