X64-Assembly

XOR encryption in assembly is three operations: open a file, XOR each byte against a key in a tight loop, write the output. The fixed-key version is eight instructions per iteration; the rolling-key version adds one — add r15b, 0x11 — which updates the key every cycle and wraps automatically at 0xFF because r15b is 8-bit. Both versions decrypt with the same code. The real lesson is a pointer bug that every assembly programmer hits: mov rdx, [buffer] dereferences the label, turning file data into a memory address and segfaulting; lea rdx, [buffer] takes the address itself.

Static analysis tools and AI-driven EDRs map malicious behavior through branching instructions — JMP, JZ, JNZ form the edges of a Control Flow Graph that heuristic engines traverse. CMOV-based CFG flattening removes all conditional branches, collapsing the graph to a single flat node sequence that defeats both signature-based and ML-based detection. Full x64 Assembly implementation: branch-free syscall obfuscation, CMOV patterns for JZ/JNZ/JLE replacement, and empirical bypass results against NGAV and Ghidra CFG analysis.

Standard Assembly code with absolute addresses breaks under ASLR — fixed addresses become invalid at runtime. PIC solves this via RIP-relative addressing: all memory references computed as offsets from the current instruction pointer. The Stack Anchor technique carves a 32KB R/W region (sub rsp,0x8000 + and rsp,-16 + mov rbp,rsp), providing writable storage without .data or .bss sections. Read-only templates in .text are copied to the stack via rep movsb for runtime modification. Result: a single position-independent code block deployable anywhere in memory — standard for shellcode, injection payloads, and fileless implants.