Malware protection
that lives in RAM.
2,000,000 bloom signatures + 540,000 MD5 hashes. 12 detection engines. Nothing to install.

📋 Architecture

ZeptoGuard is a single assembly source file (zeptoguard.asm, 3,500 lines) that compiles to a standalone ELF or PE binary. No external dependencies, no shared libraries, no configuration files. Everything is embedded in the binary.

Startup Sequence

_start
  │
  ├─► init bloom filter (embed 2M sigs in .rodata)
  │
  ├─► init boot sectors (FNV-1a hash /dev/sda, /dev/nvme0n1)
  │
  ├─► load external sigs (/var/lib/zeptoguard/sigs.bloom)
  │     └─ if valid ZGBF: replace embedded bloom
  │     └─ if missing/invalid: use embedded bloom
  │
  ├─► init kernel module baseline (/proc/modules byte count)
  │
  ├─► fork() → watchdog child process
  │     └─ monitors parent, auto-restarts if killed
  │
  └─► main scan loop (every 10 seconds)
        │
        ├─► scan /proc/*/maps for each PID
        │     └─ check RWX, anon exec, deleted, no-path
        │
        ├─► check boot sectors (FNV-1a re-hash)
        │
        ├─► check /proc/modules (byte count compare)
        │
        ├─► check /proc/net/tcp (C2 port scan)
        ├─► check /proc/net/udp (DNS exfil port 53)
        │
        ├─► scan drop dirs (/tmp, /var/tmp, /dev/shm)
        ├─► scan disk dirs (/home, /opt, /var/www)
        │     └─ bloom_check → tier-2 → MD5 hashdb
        │
        └─► sleep 10 seconds → repeat

Per-File Detection Flow

file detected in scan dir
  │
  ├─► read 8KB into file_scan_buf
  │
  ├─► bloom_check(buf, len)
  │     └─ FNV-1a hash #1 → check bit
  │     └─ FNV-1a hash #2 → check bit
  │     └─ FNV-1a hash #3 → check bit
  │     └─ all 3 bits set → possible match
  │
  ├─► scan_buffer (tier-2 exact match)
  │     └─ check 17 signatures against buffer
  │     └─ EICAR, OLE2, PE MZ, ZIP, RTF, VBA, JS...
  │
  ├─► MD5 hashdb lookup (if USE_HASHDB)
  │     └─ hash entire file (up to 64KB)
  │     └─ binary search in 540K sorted hash array
  │     └─ exact match → definitive detection
  │
  ├─► multi-page: read next 8KB page (up to 8 pages)
  │     └─ repeat bloom + tier-2 for each page
  │
  └─► if detected: SIGKILL process + log + alert

Process Memory Scan Flow

for each PID in /proc/
  │
  ├─► read /proc/PID/maps
  │
  ├─► for each memory region:
  │     ├─ RWX permissions? → suspicious (self-modifying)
  │     ├─ anon + exec + no file path? → shellcode injection
  │     ├─ exec + deleted file path? → hidden process
  │     └─ exec + no path at all? → suspicious mapping
  │
  ├─► read /proc/PID/mem (if suspicious)
  │     └─ bloom_check on memory contents
  │     └─ tier-2 scan on memory contents
  │
  └─► if detected: SIGKILL + log + alert

🔨 Build Commands

ZeptoGuard is built with NASM (the Netwide Assembler) and linked with GNU ld. No compiler, no makefiles, no build system — just two commands.

Standard Build (4.2MB — 2M bloom sigs, no hashdb)

Full Build (12.9MB — 2M bloom + 540K MD5 hashes)

IoT Variant (540KB — 250K bloom sigs)

Windows PE Build (4.2MB)

⚙️ Build Flags

NASM preprocessor flags control which features are compiled into the binary.

Windows builds omit -D LINUX and use -f win64 instead of -f elf64.

📦 Install & Deploy

Installation is 4 commands: copy the binary, copy the service file, enable, start.

⚙️ systemd Service Configuration

The zeptoguard.service file runs ZeptoGuard as a system service with automatic restart.

📂 Scan Directories

ZeptoGuard monitors two categories of directories on a 10-second scan cycle.

Each file in these directories is scanned up to 64KB (8 × 8KB pages) through the bloom filter, tier-2 signatures, and MD5 hashdb (if enabled).

🛡️ Detection Engines (12)

Each engine operates independently. A file or process only needs to trigger ONE engine to be detected and killed.

🧠 Memory Layout

ZeptoGuard's RAM footprint is deterministic — no dynamic allocation, no mmap, no heap. All buffers are statically allocated in the .bss section.

Total RAM: 3.7 MB (standard) / ~12 MB (full with hashdb)

📥 External Signature File Loading (ZGBF)

Load custom bloom filter signatures at runtime without rebuilding the binary. ZeptoGuard checks for an external signature file at startup.

ZGBF File Format

Loading Behavior

• File path: /var/lib/zeptoguard/sigs.bloom
• Checked at startup, before the main scan loop
• If valid ZGBF format: replaces embedded bloom filter
• If missing or invalid: falls back to embedded bloom filter
• No restart needed during operation — loaded once at init

🖥️ Admin Portal

Web-based administration portal for license management, customer tracking, and download logging.

Database Tables

📝 Logs

ZeptoGuard logs to two destinations: systemd journal and a flat file. All log entries are append-only.

Log Entry Format

⚙️ Configuration Summary

All configuration is hardcoded in assembly constants. There are no config files, no environment variables, no command-line arguments. This is by design — an attacker can't modify what isn't on disk.

🚀 Quick Deploy (60 Seconds)