Netacoding | Cybersecurity, Assembly & Network Research

CDP (Cyclic Digit-sum Projection) maps SHA-256 hex outputs into a 961-class finite projection space, exposing two deterministic fixed-point cycles, ergodic Markov basin structure, bijective 2-char fingerprinting, and a 42.55x compound lookup index speedup…

A single RFC 9114-compliant frame type — the trailer HEADERS frame — breaks HTTP/3 state machines across two independent CDN edge implementations and the shared quiche QUIC library used in major Chromium-based browsers.

Sending a trailer HEADERS frame without END_STREAM on a WebTransport CONNECT stream causes Microsoft Edge and Chromium to permanently hold QUIC connections open, driving Network Service memory from 6 MB to 339 MB with 5,000 connections before an OOM crash.

Every HIP kernel launch crashes with 0xC0000005 on Windows gfx1201.

Warp/Wraith Linux RAT static analysis: Go binary with ELF section header mangling, oversized LOAD segment, and SSH credential harvesting.

Sending an RFC 9114-compliant trailer HEADERS frame to music.youtube.com causes Google's ESF (Edge Side Frontend) to hang for ~60 seconds before closing the connection with QUIC INTERNAL_ERROR (0x0001) — the RFC-defined signal for implementation errors. 1…

EnableICMPTimestampRep=0 does not suppress ICMP Timestamp Replies (Type 14) on Windows 11.

ICMP-Ghost is a fileless, pure x64 Assembly C2 agent with dual-channel ICMP and DNS tunneling, protocol hot-swapping, EDR evasion, and Suricata v8.0.3 bypass.

Depth-8 ftrace analysis of icmp_timestamp() in the Linux kernel: full call chain from ip_rcv() to ICMP Type 14 reply generation, payload length threshold behavior, conntrack interaction, ts_ori unconditional echo across the full 32-bit range, and six docu…

Complete Linux x64 syscall reference with pure x64 Assembly examples.

HTTP request smuggling exploits Content-Length vs Transfer-Encoding parsing differentials between frontend proxies and backend servers.

uRPF absence (CWE-290) at Layer 3 unconditionally trusts IP source addresses — enabling Smurf amplification, ICMP Timestamp information leaks, and pre-auth reflection attacks with no authentication required.

RFC 2644 disabled directed broadcast at router level — not L2 broadcast domains.

EtherLeak leaks NIC DMA ring buffer memory through ICMP Echo replies by trusting IP Total Length over actual frame length.

ArubaOS 8.13.2.0 accepts ICMP Echo Requests with spoofed source IPs (no uRPF/BCP38) and replies to broadcast source addresses — enabling Smurf amplification from L2 adjacency.

ArubaOS 8.13.2.0 port 32000/TCP exposes an unauthenticated XML parser (default-xml-api AAA profile) that resolves SYSTEM external entities.

ArubaOS 8.13.2.0 leaks up to 18 bytes of NIC DMA buffer per ICMP Echo via inflated IP Total Length (CWE-126).

TCP connection capacity is bounded by 4-tuple uniqueness and kernel conntrack table size — not port numbers.

DNS resolvers carry exhaustible per-query state: recursive-client tables, pending-query slots, TCP/853 DoT and TCP/443 DoH sockets, delegation chains, and DNSSEC validation trees.

An unprivileged FUSE daemon holds semantic authority over i_size — lying in vfs_getattr responses desynchronizes kernel allocation size from ingestion size in kernel_read_file(). finit_module(2), the firmware loader, and kexec_file_load(2) become kmalloc-…

fuse_req borrows inode references without incrementing i_count.

FUSE daemon controls i_size — setting it to 0xFFFFFFFFFFFFFFFF wraps pgoff_t arithmetic in mm/filemap.c and mm/mmap.c, inverting page cache loop invariants and turning vma_merge() into an OOB-write primitive on Maple Tree-backed kernels (5.15+).

BYOVD exploits signed vulnerable kernel drivers to reach Ring 0 and terminate EDR processes (Windows).

Pure x64 Assembly eliminates compiler artifacts (GCC prologues, LLVM panic stubs, CRT startup code) that AV/EDR engines fingerprint.

Full reverse engineering of LockBit 5.0 Linux (LINUX Locker v1.01 amd64): offline-capable ChaCha20+Curve25519 encryption, strace anti-analysis evasion, aggressive free space wiping, and zero network activity during encryption. eBPF dynamic tracing, Ghidra…

AI firewalls attempt to govern autonomous agents by parsing semantic intent — a probabilistic solution to a deterministic security problem.

Fixed-interval beaconing is trivially detected by SOC behavioral analysis.

NGAV and AI-powered EDRs rely on Control Flow Graph analysis to detect malicious binaries.

Phantom Evasion Loader injects shellcode into a live process using SROP (rt_sigreturn syscall 15) to hide ptrace calls from EDR monitors, and process_vm_writev (syscall 311) for single-shot direct cross-memory payload write — bypassing PTRACE_POKEDATA beh…

VESQER implements a DPCM+RLE hybrid compression pipeline in pure x64 Assembly with zero external dependencies — designed for C2 payload compression.

Complete TCP reverse shell in libc-free pure x64 Assembly using PIC Stack Anchor architecture: sys_socket(41) → sys_connect(42) → sys_dup2(33) loop redirects stdin/stdout/stderr to socket FD → sys_execve(59) spawns /bin/sh.

PIC shellcode uses RIP-relative addressing instead of absolute addresses, remaining functional regardless of load address — required for ASLR-bypassing payloads.

Complete HTTP/1.1 server in pure x86_64 Assembly with zero external dependencies: sys_socket(41)→sys_bind(49)→sys_listen(50)→sys_accept(43)→sys_read(0) request parsing, SCASB/LODSB path traversal (../) detection, sys_fstat(5) file size, sys_sendfile(40) z…

Introduction to Netacoding: Research focusing on Assembly language, Network Protocol Analysis, CVE research, and Signal Intelligence (SIGINT).

Get in touch for technical inquiries, project collaborations, or feedback regarding low-level security and network research.

RDTSC (Read Time-Stamp Counter) measures CPU cycles between packet transmission and reception with nanosecond precision — bypassing OS clock jitter from gettimeofday/clock_gettime.

memfd_create (syscall 319) creates anonymous RAM-backed file descriptors invisible to ls and standard forensic tools — no disk writes, no /tmp traces, no permanent inode.

Linux x64 syscall ABI: RAX=syscall ID, RDI=first arg, RSI=second arg, RDX=third arg.

CVE-2025-6019: udisks2 XFS resize creates /tmp/blockdev.XXXXXX mount points without immediately applying nosuid — a TOCTOU race window allows SUID binary execution before the flag is set.

RFC 1071 checksum computes a 16-bit one's complement sum over the entire packet in 2-byte chunks. x64 Assembly implementation: word-by-word accumulation loop, odd-byte final block, carry folding via shr/and/add/adc, not ax inversion for final checksum.

Implement Linux process self-defense in pure x64 Assembly: PTRACE_TRACEME blocks debugger attachment at kernel level, PR_SET_DUMPABLE=0 prevents core dumps and memory acquisition.

sockaddr_in delivers IP addresses in Big-Endian network byte order — x86/x64 reads them Little-Endian, producing reversed output like 5.1.168.192 instead of 192.168.1.5.

ICMP Type 3 (Destination Unreachable) mandates reflection of the original IP header plus 8 bytes — a field attackers control entirely.

Zero-dependency ICMP sniffer in pure x64 Assembly: sys_socket(41) with AF_INET+SOCK_RAW+IPPROTO_ICMP filters to ICMP-only traffic, sys_recvfrom reads raw frames, manual 28-byte header strip (20B IP + 8B ICMP) via lea rsi,[buf+28] reaches payload, custom d…

Every OS leaves a unique ICMP fingerprint: Linux sends 64-byte payloads with 8-byte RDTSC timestamps, Windows sends 32-byte alphabetical sequences.

Multi-layer ICMP C2 evasion: RDTSC hardware timestamps mimic legitimate Linux ping signatures, 56-byte/32-byte OS-aligned payloads defeat DPI volume anomalies, stateless Magic Sequence port knocking eliminates persistent connections, memfd_create enables…

eBPF runs sandboxed bytecode inside the Linux kernel via JIT compilation — no kernel modules, no source changes.