ICMP-Ghost v3.6.3 hardens DNS tunneling with 5-domain rotation, RFC 4648 Base32 encoding, and A record QTYPE — eliminating static fingerprinting for rule-based NDR systems like Suricata and Snort.
Every HTTP server abstraction collapses to the same syscall chain: socket → bind → listen → accept → read → sendfile → close. In pure x86_64 Assembly, each step is explicit: bswap converts port to network byte order, SCASB/LODSB scans the GET request path byte-by-byte for ../ traversal sequences, sys_fstat retrieves exact file size for sys_sendfile, sys_sendfile(40) transfers file data directly from disk to NIC via kernel space — zero user-space copy, zero libc, zero external libraries. Full source on GitHub.
Traditional /tmp files leave disk traces and inode artifacts. memfd_create (Linux 3.17+, syscall 319) allocates anonymous files backed exclusively by RAM-resident tmpfs — invisible to directory listings, destroyed on fd close, and undetectable by standard forensic imaging. x64 Assembly implementation: null-terminated name label visible only in /proc/pid/fd/, MFD_CLOEXEC flag, fd sealing via fcntl. Blue Team surface: eBPF sys_memfd_create hooks and /proc/pid/fd/ memfd: link auditing.
Every Linux syscall follows the x64 ABI register protocol: RAX holds the syscall number, RDI/RSI/RDX hold the first three arguments, return value lands in RAX. File descriptors 0/1/2 map to stdin/stdout/stderr — everything else (files, sockets, pipes) is a number above 2 returned by open(). .bss reserves zero-initialized RAM without increasing binary size on disk — ideal for runtime buffers. Complete implementation: sys_open → sys_read into .bss buffer → sys_write to stdout → sys_close → sys_exit.
Raw socket ICMP sniffing in x64 Assembly without libc: SOCK_RAW+IPPROTO_ICMP instructs the kernel to deliver only ICMP frames, filtering TCP/UDP at the socket layer. sys_recvfrom delivers the full frame including IP header — lea rsi,[sniffed_data+28] skips the 20-byte IPv4 header and 8-byte ICMP header to reach payload. IP address conversion: fetch each octet from sockaddr_in, repeatedly divide by 10 via div instruction, add 0x30 for ASCII, write digits backward into 16-byte buffer, insert 0x2E dot separators via conditional jump. Full source on GitHub.
