𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

Okay some tweaks have been done and the output is amazing, mostly complete it has detected the memory fault by the dummy shadow_stub.s

picasothedealer_com@cloudshell:~/ZeroShadow$ ./runtime/shadow_stub & sleep 0.5 && sudo ./ZeroShadow $! ./runtime/shadow_stub [6] 12577 [6]+ Stopped ./runtime/shadow_stub [*] booting ZeroShadow supervisor... [+] memory boundaries mapped. [*] hooking PID: 12577... [+] connected to prosses: 12577. monitoring loop active. [*] loaded 2 executable segment(s) from maps. [*] draining any leftover signals... [DEBUG] drain signal: 19 [DEBUG] drain signal: 5 [DEBUG] drained, RIP: 0x572eb2d8901f [+] synchronised and drained. Starting main loop. [!] SIGSEGV at instruction 0x572eb2d8903b, fault address = 0x0 [!] CRITICAL: Memory Fault (SIGSEGV) at 0x572eb2d8903b accessing invalid address 0x0 Error: supervisor loop drooped or connection lost. [6]+ Killed ./runtime/shadow_stub

66 views04:25

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

now for the stack based buffer overflow test

68 views04:26

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

for real tho i really hate putting the PID every time i am gonna test so yeah i ma add some lines

67 views04:31

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

vuala but i feel like i will need to test it more before launching too,

56 views09:29

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

I am 19, atlast gotta pack my bag after matrik I guess

👀6

54 viewsedited 10:34

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

found one bug false alert fires up because i am missing one executable memory region is missing from the valid_maps list.

50 views11:59

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

found one bug false alert fires up because i am missing one executable memory region is missing from the valid_maps list.

This media is not supported in your browser

VIEW IN TELEGRAM

54 views11:59

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

So now, ZeroShadow is missing some things which are:

The "Signal Race" (Asynchronous Bypassing)

Time-of-Check to Time-of-Use (TOCTOU)

Direct Memory Access (DMA) / Side-Channel

Signal Masking

66 viewsedited 14:24

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

Okay done, so another debug i was using hardcoding syscall number which is okay for x86-64, and i made t strictly bound, i will change it and add <sys/syscall.h> to include ARM and RISC-V. And a dead lock risk

65 viewsedited 02:03

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

good mending, I will rlease the project today.

62 views04:25

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

Have pushed the first release of this project. At last

62 views04:30

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

I finally present "ZeroShadow"

think of it like an automated debugger. you can watch functions execute, read memory or change how an app behaves on the fly without needing the source code.

it is a lightweight dynamic binary instrumentation engine for elf files. you use it to hook functions, trace execution paths and unpack malware without the massive overhead of heavy tools like frida.

https://github.com/PicasoTheDeal/ZeroShadow

GitHub

GitHub - PicasoTheDeal/ZeroShadow: ELF binary tracing and instrumentation

ELF binary tracing and instrumentation. Contribute to PicasoTheDeal/ZeroShadow development by creating an account on GitHub.

🔥5

1.37K viewsedited 04:44

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

Okay I am so locked in right now, so boom next proeject lol.

71 views07:59

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

Talk about locking in for the wrong reason

68 views08:03

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

So unlike last time i will start with blueprint but like digitally than my notebook. I will spoil it soon

🔥2

69 views08:18

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

You accept failure in the gym because you know it's optimal for growth. Then why fear it everywhere else?

KASCVE was one of my very many failed project i couldn't finished but in the way it taught me a lot stuff's.

I had and will have fail in the future, your life will have failure when trying to build your life, or a code or anything.You were never perfect and you never will, you were created to be imperfect. But you were created to build from that failure. It could be a code, no code was perfect from the first launch it had a lot of patches and fixes to reach were it is, so do you face the failure no matter what, it is the road to your success.

The more you try to avoid failure in your road of success, the longer it will take for you to reach your destiny.

@TetstackPM

101 viewsedited 09:13

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

This media is not supported in your browser

VIEW IN TELEGRAM

65 views09:18

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

I present

dSBOM

Well as of this days every major company is obsessed with supply chain security and generating Software Bill of Materials (SBOMs) to comply with government regulations.

and mainly 99% of current tools only generate Static SBOMs. They scan source code, package.json, or go.mod files. But what is written on disk is not always what runs in memory.

Hackers(non script kiddies) are exploiting this blind spot. For example, recent 2026 attacks, like the MicrosoftSystem64 RAT, hide massive 81MB payloads inside single executables disguised as native, stripped ELF binaries. A static scanner looks at the binary, sees a standard Linux file, and passes it. It completely misses the malicious libraries loaded dynamically at runtime via dlopen() or hidden Node.js runtimes packed inside.

So I will build a lightweight, C++ CLI tool that doesn't care about source code. Instead, it runs the binary and traces it to generate a Runtime SBOM.

89 views11:40

𓆣 𝔗̶𝔢̶𝔱̶𝔰̶𝔱̶𝔞̶𝔠̶𝔨̶ 𓆣

Guide-to-SBOMs-and-SBOMs-Generation.pdf

9.3 MB

sbom_gaiyo_en.pdf

284.6 KB

Okay according to this, handmade non AI pdfs that explains about SBOM to make the code and some tests. And the code is actually less than I expected.