https://netacoding.com/tags/shellcode-injection/ Recent content in Shellcode-Injection on Netacoding | Cybersecurity, Assembly & Network Research https://netacoding.com/img/logo-netacoding.png https://netacoding.com/img/logo-netacoding.png Hugo en-us Mon, 13 Apr 2026 00:00:00 +0000 https://netacoding.com/posts/phantom-evasion-loader-blog/ Mon, 13 Apr 2026 00:00:00 +0000 https://netacoding.com/posts/phantom-evasion-loader-blog/ Phantom Evasion Loader injects shellcode into a live process using SROP (rt_sigreturn syscall 15) to hide ptrace calls from EDR monitors, and process_vm_writev (syscall 311) for single-shot direct cross-memory payload write — bypassing PTRACE_POKEDATA behavioral detection. XOR-decrypted in-memory payload. Confirmed: 0/65 VirusTotal, SROP and injection invisible to Falco eBPF and Hatching Triage.