𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

This media is not supported in your browser

47 views02:37

The debug is taking more time than the actual code architecture desing and writing.

555 views02:51

picasothedealer_com@cloudshell:~/ZeroShadow$ ./runtime/shadow_stub & sleep 0.5 && sudo ./ZeroShadow $! ./runtime/shadow_stub [6] 8635 [6]+ Stopped ./runtime/shadow_stub [*] booting ZeroShadow supervisor... [+] memory boundaries mapped. [*] hooking PID: 8635... [+] connected to prosses: 8635. monitoring loop active. [*] dynamic ASLR base offset applied to all monitored regions. [*] draining any leftover signals... [DEBUG] drain signal: 19 [DEBUG] drain signal: 5 [DEBUG] drained, RIP: 0x5749d70b801f [+] synchronised and drained. Starting main loop. [DEBUG] Check RIP: 0x5749d70b8026 signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b8029 signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b802c signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b802f signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b8026 signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b8029 signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b802c signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b802f signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b8026 signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b8029 signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b802c signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b802f signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b8026 signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b8029 signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b802c signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b802f signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b8026 signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b8029 signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b802c signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b802f signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b8026 signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b8029 signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b802c signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b802f signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b8026 signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b8029 signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b802c signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b802f signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b8026 signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b8029 signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b802c signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b802f signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b8026 signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b8029 signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b802c signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b802f signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b8026 signal: 5 region:

49 views03:08

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b8029 signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b802c signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b802f signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b8031 signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b803b signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b803b signal: b region: 0x95974652084224 - 0x95974652088320 [!] CRITICAL: control flow hijack detected! RIP: 0x5749d70b803b signal: b Error: supervisor loop drooped or connection lost. [6]+ Killed ./runtime/shadow_stub

48 views03:08

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b8029 signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b802c signal: 5 region: 0x95974652084224 - 0x95974652088320 [DEBUG] Check RIP: 0x5749d70b802f…

aight okay, now it's detecting the jump. Just a slight problem the allowed map was corrupted and then the verify_instructur_pointer see's it doesn't make sense and the stop that happened at the end doesn't show what happened.

48 views03:11

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

I don't want to write the offset boundary "by hand" so i will use ai, jk. I will read it from the

exact executable segment boundaries

directly from the process memory map.

46 viewsedited 03:17

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

okay boom, it has detected it correctly.

picasothedealer_com@cloudshell:~/ZeroShadow$ ./runtime/shadow_stub & sleep 0.5 && sudo ./ZeroShadow $! ./runtime/shadow_stub [6] 11834 [6]+ Stopped ./runtime/shadow_stub [*] booting ZeroShadow supervisor... [+] memory boundaries mapped. [*] hooking PID: 11834... [+] connected to prosses: 11834. monitoring loop active. [*] loaded 2 executable segment(s) from maps. [*] draining any leftover signals... [DEBUG] drain signal: 19 [DEBUG] drain signal: 5 [DEBUG] drained, RIP: 0x58075f76301f [+] synchronised and drained. Starting main loop. [!] SIGSEGV at instruction 0x58075f76303b, fault address = 0x0 [!] CRITICAL: control flow hijack detected! RIP: 0x58075f76303b signal: b Error: supervisor loop drooped or connection lost. [6]+ Killed ./runtime/shadow_stub

47 views04:06

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

if (sig != SIGTRAP || !verify_instruction_pointer(regs)) { std::cerr << "[!] CRITICAL: control flow hijack detected! " << "RIP: 0x" << std::hex << regs.rip << " signal: " << std::dec << sig << "\n"; ptrace(PTRACE_KILL, pid, nullptr, nullptr); waitpid(pid, &status, 0); // read the killed process return false; }

This logic is a bit greedy it's not differentiating b/n a crash and a hijack on the system. Too greedy it treets a hijack as a crash and a crash as a hijack.

44 viewsedited 04:18

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

Okay some tweaks have been done and the output is amazing, mostly complete it has detected the memory fault by the dummy shadow_stub.s

picasothedealer_com@cloudshell:~/ZeroShadow$ ./runtime/shadow_stub & sleep 0.5 && sudo ./ZeroShadow $! ./runtime/shadow_stub [6] 12577 [6]+ Stopped ./runtime/shadow_stub [*] booting ZeroShadow supervisor... [+] memory boundaries mapped. [*] hooking PID: 12577... [+] connected to prosses: 12577. monitoring loop active. [*] loaded 2 executable segment(s) from maps. [*] draining any leftover signals... [DEBUG] drain signal: 19 [DEBUG] drain signal: 5 [DEBUG] drained, RIP: 0x572eb2d8901f [+] synchronised and drained. Starting main loop. [!] SIGSEGV at instruction 0x572eb2d8903b, fault address = 0x0 [!] CRITICAL: Memory Fault (SIGSEGV) at 0x572eb2d8903b accessing invalid address 0x0 Error: supervisor loop drooped or connection lost. [6]+ Killed ./runtime/shadow_stub

66 views04:25

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

now for the stack based buffer overflow test

68 views04:26

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

for real tho i really hate putting the PID every time i am gonna test so yeah i ma add some lines

67 views04:31

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

vuala but i feel like i will need to test it more before launching too,

56 views09:29

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

I am 19, atlast gotta pack my bag after matrik I guess

👀6

54 viewsedited 10:34

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

found one bug false alert fires up because i am missing one executable memory region is missing from the valid_maps list.

50 views11:59

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

found one bug false alert fires up because i am missing one executable memory region is missing from the valid_maps list.

This media is not supported in your browser

VIEW IN TELEGRAM

54 views11:59

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

So now, ZeroShadow is missing some things which are:

The "Signal Race" (Asynchronous Bypassing)

Time-of-Check to Time-of-Use (TOCTOU)

Direct Memory Access (DMA) / Side-Channel

Signal Masking

66 viewsedited 14:24

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

Okay done, so another debug i was using hardcoding syscall number which is okay for x86-64, and i made t strictly bound, i will change it and add <sys/syscall.h> to include ARM and RISC-V. And a dead lock risk

65 viewsedited 02:03

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

good mending, I will rlease the project today.

62 views04:25

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

Have pushed the first release of this project. At last

62 views04:30

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

I finally present "ZeroShadow"

think of it like an automated debugger. you can watch functions execute, read memory or change how an app behaves on the fly without needing the source code.

it is a lightweight dynamic binary instrumentation engine for elf files. you use it to hook functions, trace execution paths and unpack malware without the massive overhead of heavy tools like frida.

https://github.com/PicasoTheDeal/ZeroShadow

GitHub

GitHub - PicasoTheDeal/ZeroShadow: ELF binary tracing and instrumentation

ELF binary tracing and instrumentation. Contribute to PicasoTheDeal/ZeroShadow development by creating an account on GitHub.

🔥5

1.37K viewsedited 04:44

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

Okay I am so locked in right now, so boom next proeject lol.

71 views07:59

About

Blog

Apps

Platform