mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
64 lines
1.8 KiB
Markdown
64 lines
1.8 KiB
Markdown
# API Reference: Implementing Memory Protection with DEP and ASLR
|
|
|
|
## Windows PowerShell Commands
|
|
|
|
```powershell
|
|
# Check system-wide mitigations
|
|
Get-ProcessMitigation -System
|
|
# Check specific process
|
|
Get-ProcessMitigation -Name chrome.exe
|
|
# Set system-wide DEP
|
|
Set-ProcessMitigation -System -Enable DEP
|
|
# Import XML policy
|
|
Set-ProcessMitigation -PolicyFilePath policy.xml
|
|
# Export current policy
|
|
Get-ProcessMitigation -RegistryConfigFilePath export.xml
|
|
```
|
|
|
|
## Memory Protection Mechanisms
|
|
|
|
| Mechanism | OS | Description |
|
|
|-----------|-----|------------|
|
|
| DEP/NX | Windows/Linux | Prevent code execution from data pages |
|
|
| ASLR | Windows/Linux | Randomize memory layout |
|
|
| CFG | Windows | Control Flow Guard |
|
|
| SEHOP | Windows | SEH Overwrite Protection |
|
|
| Stack Canary | Linux | Detect stack buffer overflow |
|
|
| PIE | Linux | Position-Independent Executable |
|
|
| RELRO | Linux | Read-Only Relocations |
|
|
| FORTIFY_SOURCE | Linux | Buffer overflow checks |
|
|
|
|
## Linux ASLR Check
|
|
|
|
```bash
|
|
# Check ASLR level (0=off, 1=conservative, 2=full)
|
|
cat /proc/sys/kernel/randomize_va_space
|
|
# Enable full ASLR
|
|
echo 2 > /proc/sys/kernel/randomize_va_space
|
|
```
|
|
|
|
## ELF Binary Check (checksec)
|
|
|
|
```bash
|
|
checksec --file=/usr/bin/target
|
|
# Or with readelf
|
|
readelf -l binary | grep GNU_STACK
|
|
readelf -d binary | grep BIND_NOW
|
|
```
|
|
|
|
## GCC Compilation Flags
|
|
|
|
| Flag | Protection |
|
|
|------|-----------|
|
|
| `-fstack-protector-strong` | Stack canary |
|
|
| `-D_FORTIFY_SOURCE=2` | Buffer overflow checks |
|
|
| `-pie -fPIE` | Position-independent |
|
|
| `-Wl,-z,relro,-z,now` | Full RELRO |
|
|
| `-Wl,-z,noexecstack` | NX stack |
|
|
|
|
### References
|
|
|
|
- Windows Exploit Protection: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/exploit-protection
|
|
- checksec: https://github.com/slimm609/checksec.sh
|
|
- ASLR: https://en.wikipedia.org/wiki/Address_space_layout_randomization
|