Search Engine
Full-text search across titles, headings, tags, descriptions, and body content.
Shortcut: Ctrl + K
Results
PROCESS INJECTION DETECTION LLD
Tamper resistance, sandboxing, remote scan policy, and security deep dives.
process injection detection lld 1 purpose this low level design lld explains how mutant currently detects process injection-related tampering and how to expand this into a richer m...
Tamper resistance, sandboxing, remote scan policy, and security deep dives.
remote process scan deep dive 1 scope this document describes the current remote process scan architecture and integration points it covers 1 config and mode gates 2 verdict correl...
Tamper resistance, sandboxing, remote scan policy, and security deep dives.
...be_enablement_lld antitamper_probe_enablement_lld md 4 binary_artifact_security_deep_dive binary_artifact_security_deep_dive md 5 remote_process_scan_deep_dive remote_process_scan_deep_dive md alignment rules 1 keep mode and policy semantics identical to lld d...
Tamper resistance, sandboxing, remote scan policy, and security deep dives.
...i-tamper and anti-piracy controls under an offline-first threat model companion deep dives 1 binary_artifact_security_deep_dive binary_artifact_security_deep_dive md 2 remote_process_scan_deep_dive remote_process_scan_deep_dive md --- 2 security objectives 2 1...
Canonical policies, reference sheets, migration matrices, and source-of-truth documentation.
... returns cache counters such as hits misses puts deletes and expires system and process - cmd_add builder arg - appends an argument to a command builder - cmd_builder shell - creates a command builder object for step-wise command composition - cmd_run builder ...
Editor integration, implementation workflow, and operational runbooks.
... anti-debug and sandbox staged checks 4 anti-tamper probe framework and windows process-protection probes 5 vm integrity probes and telemetry export 2 phase a documentation and observability hardening 1 keep all security docs aligned to lld source-of-truth doc...
Tamper resistance, sandboxing, remote scan policy, and security deep dives.
...and does not silently alter secure mode defaults unless chosen --- 10 probe and process-protection traceability 10 1 control additions 1 master anti-tamper probe gate runtime setting 1 2 runner process-protection gate runtime setting 3 runner enforcement thres...
Tamper resistance, sandboxing, remote scan policy, and security deep dives.
...execution 6 anti-tamper probe framework with confidence-based signals 7 windows process-protection probes process injection trampoline iat got module markers rwx anomalies 8 vm integrity probing and telemetry export 9 remote process scan manager with config co...
Big-picture explanations, quick reference material, and definitive orientation docs.
...1 pre-decode 2 pre-execution at each stage 1 anti-debug check 2 sandbox check 3 process-protection check if probe gate and process-protection gate allow it this catches tampering both before decode and before vm execution 3 anti-tamper probes signal model each...
Big-picture explanations, quick reference material, and definitive orientation docs.
... and pre-execution stages 3 response is policy-driven warn delay terminate 2 is process injection detection implemented yes as part of anti-tamper process-protection probes 1 probe execution requires runtime setting 1 2 runner enforcement path is additionally ...
Big-picture explanations, quick reference material, and definitive orientation docs.
...d pre-execution 5 anti-tamper probe framework with confidence signals 6 windows process-protection probes and runner threshold enforcement 7 vm runtime integrity probing and telemetry export 8 remote process scan manager with runner observe enforce integration...
Canonical policies, reference sheets, migration matrices, and source-of-truth documentation.
... json regex text policy cache in-memory db host-bound builtins not supported fs process exec network registry memory binary disk-image families completion modes supported supported callable-now and all discoverability output model supported buffered putf putln...
Tamper resistance, sandboxing, remote scan policy, and security deep dives.
...nti-tamper probe framework integrated and callable from runner and builtins 2 3 process protection 1 runner process-protection enforcement path implemented 2 windows-specific process protection probes implemented 3 confidence thresholding for enforcement imple...
Tamper resistance, sandboxing, remote scan policy, and security deep dives.
...on 3 builtin diagnostics can report sandbox type confidence and indicators 6 is process injection detection implemented yes as anti-tamper process-protection probes important gates 1 runtime setting 1 must be set to run probes 2 runtime setting controls runner...
Tamper resistance, sandboxing, remote scan policy, and security deep dives.
...detectors go cross-platform heuristics 4 security antitamper_windows go windows process-protection heuristics 5 runner runner go enforcement 6 builtin security_status go diagnostic exposure telemetry events used by this subsystem 1 anti_tamper_probe_invoked 2 ...
ANTITAMPER PROBE ENABLEMENT LLD
Tamper resistance, sandboxing, remote scan policy, and security deep dives.
...orcement 2 problem statement users often confuse 1 probe execution enablement 2 process-protection enforcement enablement 3 policy action after detection this design separates these decisions clearly 3 inputs 3 1 master probe gate runtime setting 1 value 1 mea...
Canonical policies, reference sheets, migration matrices, and source-of-truth documentation.
...ignal generation is separate from policy action 2 probe gates mermaid diagram 3 process protection scope mermaid diagram 4 remote scan gate model mermaid diagram 5 polymorphic status snapshot mermaid diagram 6 memory hardening snapshot mermaid diagram 7 source...
BINARY ARTIFACT SECURITY DEEP DIVE
Bytecode, VM, polymorphism, and execution internals.
binary artifact security deep dive 1 scope this deep dive covers binary artifact security for mutant from generation to runtime load 1 signed mu envelope format and trust model 2 standalone trailer v1 v2 v...
Tamper resistance, sandboxing, remote scan policy, and security deep dives.
...llels xen - windows sandbox detection defender sandboxie cuckoo wine - registry process dll and system metric analysis - mac address and cpu brand string detection 3 sandbox_linux go 420 lines - container detection docker kubernetes lxc systemd-nspawn - linux ...
Tamper resistance, sandboxing, remote scan policy, and security deep dives.
...ndows defender sandbox sandboxie cuckoo wine - detection methods - registry key scanning - process detection - dll injection detection - virtual mac address identification - cpu brand string analysis - system metrics validation linux sandbox_linux go - 400 lin...
Tamper resistance, sandboxing, remote scan policy, and security deep dives.
...nbus sys sbiedll dll - environment markers sandboxie cuckoo vbox_install_path - process markers from tasklist vmtoolsd exe vmwaretray exe vboxservice exe vboxtray exe xenservice exe qemu-ga exe sbiectrl exe sandboxiedcomlaunch exe potential types include vmwar...
Tamper resistance, sandboxing, remote scan policy, and security deep dives.
security architecture diagrams code-synced 1 end-to-end runtime security flow mermaid diagram 2 policy decision flow mermaid diagram 3 anti-tamper probe gates mermaid diagram 4 runner vs builtin probe scope mermaid diagr...
Bytecode, VM, polymorphism, and execution internals.
...vm security machinery and the polymorphic mutation engine status note this is a deep technical reference for current feature enablement and rollout status especially anti-tamper gates and polymorphic activation depth use 1 antitamper_probe_enablement_lld antit...
Canonical policies, reference sheets, migration matrices, and source-of-truth documentation.
...fields include payload checksum canary build profile code and provenance hash 7 remote process scan policy gate - optional remote scan manager can run in off observe enforce mode - enforce mode blocks only on critical verdicts protection profiles set runtime s...
Big-picture explanations, quick reference material, and definitive orientation docs.
...signature verification anti-tamper checks anti-debug checks anti-sandbox checks process protection and polymorphic bytecode stages - it ships with real examples that you can study adapt and chain together what you can do with it mutant is useful when you want ...
Editor integration, implementation workflow, and operational runbooks.
...rchitecture overview mermaid diagram core separation of concerns - extension is process lifecycle ux shell around the language server - lsp server is request handling state and protocol behavior - analyzer is language intelligence over current ast snapshot - w...
