CrowArmor is a driver for Linux aimed at system security
Features
Communicates with MalDec EDR
Modifies the Syscall Table and hooks it
Monitors if the Syscall Table has been modified
Restores the Syscall if it has been modified by an unknown driver
Monitors the CPU Control Registers and restores them if they are modified
Our research is associated with detecting anomalies using syscall at the kernel level implemented in our telekinesis driver, looking in the scripts folder you can access a python script that has a part of the research that takes the std (standard deviation) of the syscalls. Law Suit
Bem-vindo ao moblog, meu portal dedicado à engenharia reversa e programação de baixo nível! Aqui, compartilho meu interesse pela análise de sistemas complexos, decodificação de algoritmos e compreensão do funcionamento interno de dispositivos e softwares.
CoffeeBoot is a UEFI bootloader for x86_64 architecture. It looks for an executable elf (KERNEL.ELF) in the /KERNEL directory of a FAT partition. If the kernel is found, then the perks are copied to address 0x100000 and the code is passed to the kernel.
Features