Low Level on Prepakis Georgios | Kernelstub | Security Researcher

Domain Generation Algorithms and Automatic Domain Registration in C2

Fri, 04 Oct 2024 00:00:00 +0000

What Is a Domain Generation Algorithm (DGA)?

If you’re running a botnet, you have a problem: your infected hosts need a way to phone home, but the moment defenders find your command and control (C2) domain, they blocklist it, sinkhole it, or hand it to a takedown request, and your whole fleet goes dark at once. A single hardcoded IP or domain baked into your malware is a single point of failure, and it’s the first thing an incident responder goes looking for when they pull apart a sample in a sandbox.

Custom Linux Kernel Hooks with eBPF

Wed, 02 Oct 2024 00:00:00 +0000

Understanding eBPF

What is eBPF?

If you’ve ever wanted to peek inside a running Linux kernel without recompiling it, patching it, or crossing your fingers and loading a sketchy out-of-tree module, eBPF is probably the tool you were looking for. The name is short for “extended Berkeley Packet Filter,” which is a bit of a historical accident: the original BPF, from the late 1980s, was a tiny virtual machine built to do one job, deciding whether a network packet matched a filter (think tcpdump). It was small, fast, and deliberately dumb, which made it safe to run inside the kernel.

Introduction to ARM Architecture

Sat, 21 Sep 2024 00:00:00 +0000

If you’ve spent any time around x86 assembly and then gone to look at ARM, the first thing you probably noticed is how much cleaner it feels. That’s not an accident. ARM was designed from day one around a philosophy called RISC (Reduced Instruction Set Computer), which trades a huge, irregular menu of complex instructions for a small set of simple, fast, predictable ones. Instead of one instruction doing five things at once (the CISC way, which is how x86 grew up), ARM prefers to do those five things as five simple instructions, each of which the CPU can execute in a single, predictable cycle. This sounds like it should be slower, and instruction-for-instruction it sometimes is, but it makes the hardware simpler, cheaper to build, and dramatically more power efficient, which is exactly why ARM ended up running basically every phone, tablet, and now a growing share of laptops and servers on the planet.

Introduction to x64 ASM

Sat, 21 Sep 2024 00:00:00 +0000

1. Introduction to Assembly and x64 Architecture

What is Assembly Language?

Every program you’ve ever run, whether it’s a shell script, a Python interpreter, or a AAA game engine, eventually gets reduced to a stream of raw binary instructions that a CPU can execute directly. Assembly language is the thin, human-readable layer sitting right on top of that binary stream. Each assembly instruction maps almost one-to-one to a single machine instruction, so when you write mov rax, rbx, you’re really just writing a mnemonic for a specific sequence of bits that tells the processor “copy the contents of one register into another.” There’s no compiler doing clever things behind your back, no garbage collector, no runtime. What you write is (almost) exactly what runs.

Introduction to Windows Syscalls

Tue, 17 Sep 2024 00:00:00 +0000

What Are System Calls, Really?

Every time your program does something that touches the outside world, opening a file, allocating memory, talking to the network, waiting on another thread, it’s asking the operating system to do that work on its behalf. Your program doesn’t get to poke the disk controller or the network card directly. It can’t, by design. The CPU itself enforces this separation through privilege rings: user-mode code (ring 3 on x86/x64) runs with a restricted set of permissions, while the kernel (ring 0) runs with full access to hardware and memory. A system call is the formal, controlled doorway between those two worlds.

Linux Syscalls Table (x86-64)

Fri, 13 Sep 2024 00:00:00 +0000

Overview

Every time a program on Linux does something that touches the outside world, reading a file, allocating memory, sending a packet, spawning another process, it eventually has to ask the kernel to do it. User space code can’t just reach into the kernel’s data structures and start editing process tables or filesystem metadata; that would be a security and stability nightmare. Instead, it has to go through a narrow, well-defined door: the system call interface. This post is a reference table for that door on x86-64 Linux, listing every syscall number, its libc-facing name, its man page, and the kernel function that actually handles it once your program’s request lands.

Advanced C Programming Best Practices

Mon, 29 Jul 2024 00:00:00 +0000

C gives you almost nothing for free. There’s no garbage collector cleaning up after you, no runtime checking your array bounds, no exception handler catching your mistakes before they corrupt memory. That’s exactly why C is still the language of choice for operating systems, embedded firmware, and anything that needs to talk directly to hardware, and it’s also exactly why C code has such a long, embarrassing history of security vulnerabilities. The language trusts you completely. Most of “best practices in C” really boils down to one idea: build habits and guardrails that compensate for the safety net the language refuses to provide.

Hooking `getdents64` to Hide Directories in Linux

Wed, 05 Jun 2024 00:00:00 +0000

Why Directory Hiding Even Works

Every time you run ls in a terminal, or a graphical file manager draws a folder icon, something has to ask the kernel “what’s in this directory?” On Linux that question gets answered by the getdents64 syscall (the modern replacement for the older getdents). The C library wraps it up neatly, but underneath, every single directory listing you have ever seen on a Linux box came from a userspace program calling into the kernel and getting back a buffer full of linux_dirent64 structures, one per file or subdirectory.