readme

Architectural Exploitation via x64 Assembly: Low-Level Keylogger

An educational proof-of-concept demonstrating how fundamental computer architecture principles can be exploited through low-level x64 assembly programming.

📋 Project Overview

This project implements a low-level keylogger in x64 assembly language to demonstrate the critical relationship between hardware architecture (registers, stack, memory segments) and system security. It serves as an educational tool for understanding why modern operating systems require multiple layers of defense.

⚠️ Educational Purpose Only

This project is STRICTLY for EDUCATIONAL and RESEARCH purposes.

• Testing only on systems you own or have explicit permission to test
• Understanding defense mechanisms, not circumventing them
• Compliance with all applicable laws (CFAA, Computer Misuse Act, PECA 2016)

🎯 Key Learning Objectives

• x64 architecture and calling conventions
• Memory segmentation and management
• Low-level system programming
• Hardware-based security mechanisms
• Exploit development principles
• Defense-in-depth strategies

🔧 Technical Implementation

Architecture Components

• x64 Windows ABI Compliance
  • Register usage (RCX, RDX, R8, R9 for parameters)
  • Shadow space requirements (32 bytes)
  • Stack alignment (16-byte)

Core Modules

1. Environmental Reconnaissance

• API function resolution
• Environment variable access
• Memory address calculation

2. Persistence Mechanism

• Registry manipulation (HKCU)
• Handle-based API operations
• Memory-mapped I/O

3. Hook Installation

• SetWindowsHookExA implementation
• Low-level keyboard hook (WH_KEYBOARD_LL)
• Interrupt Descriptor Table (IDT) chain
• Ring 0 to Ring 3 transitions

4. Data Exfiltration

• Efficient string operations (rep movs)
• File I/O and buffering
• Register allocation optimization

Hook Procedure

• Calling convention compliance
• Non-volatile register preservation
• Keystroke processing pipeline
• Context capture (foreground window, username, computer name)
• Key translation (scan code to ASCII)

🛡️ Defense Mechanisms Analyzed

Hardware-Level Defenses

• DEP/NX Bit: Data Execution Prevention
• ASLR: Address Space Layout Randomization
• Stack Canaries: Buffer overflow protection
• CFG: Control Flow Guard

OS-Level Defenses

• Inline hook scanning
• SSDT integrity checks
• Thread stack analysis
• Machine learning-based detection

📊 CIA Triad Impact Analysis

• Confidentiality: CRITICAL - Complete compromise
• Integrity: HIGH - Potential for modification
• Availability: LOW - Minimal performance impact

🔬 Research Contributions

• Demonstration of Von Neumann architecture vulnerabilities
• x64 calling convention exploitation
• Low-level input interception techniques
• Multi-layered defense analysis

📚 References

• Intel® 64 and IA-32 Architectures Software Developer’s Manual
• Microsoft x64 Calling Convention Documentation
• Windows Internals (7th Edition)
• The Shellcoder’s Handbook

Author

Daniyal Aftab Mirza

License

Educational and research purposes only. Unauthorized use is illegal.