çınar

Posted on Sep 25

Building 9 Zero-Dependency Cybersecurity & DFIR Tools in Pure Python and Win32 API

#security #opensource #showdev #python

Hey DEV community! 👋

I'm Çınar, a high school student from Turkey studying low-level systems architecture, Windows internals, and Digital Forensics & Incident Response (DFIR).

When an incident responder plugs a triage USB into a compromised enterprise workstation or an isolated host, they cannot run pip install psutil scapy cryptography. Furthermore, bundling third-party C-extension wheels across different Windows builds often breaks due to missing Visual C++ Redistributable DLLs.

Over the past few months, I challenged myself to build 9 open-source security tools under one strict engineering rule: Zero External PyPI Dependencies. Everything runs strictly on the Python Standard Library (ctypes, struct, winreg, socket, sqlite3, math) and direct Win32 / NT Kernel API calls.

Here is the technical breakdown of the suite and how each tool works under the hood!

🔍 1. Sub-Second Live Forensics & DFIR

⚡ OmniTriage — Live Incident Response Engine

prox0959 / OmniTriage

Zero-dependency, sub-second Windows live digital forensics & incident response (DFIR) triage engine for USB responders.

In live response, collection order is critical. Calling disk-heavy browsers or registry parsers before capturing active network sockets destroys volatile evidence. OmniTriage enforces the RFC 3227 Order of Volatility:

Tier 1 (Volatile Memory & Network): Active TCP/UDP sockets, DNS cache, and running processes.
Tier 2 (System & Persistence): Registry Run keys, ShimCache, and ROT13-decoded UserAssist records.
Tier 3 (Disk & Application Artifacts): Locked Chromium SQLite history, PowerShell ConsoleHost_history.txt, and temp staging executables.

Instead of spawning noisy wmic.exe or tasklist.exe child processes, OmniTriage calls kernel32.dll directly via ctypes (CreateToolhelp32Snapshot), completing full host triage in 0.88 seconds from a 10MB Portable Python USB folder while generating a SHA-256 evidence manifest.

import ctypes
from ctypes import wintypes

TH32CS_SNAPPROCESS = 0x00000002

# Captures full process tree in <15ms with zero subprocess creation
h_snap = ctypes.windll.kernel32.CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)

🕵️‍♂️ ShadowTrace — Program Execution Forensics

prox0959 / ShadowTrace

Even if an attacker deletes an executable after running it, Windows retains execution telemetry in the registry. ShadowTrace decodes ROT13-obfuscated UserAssist keys (CEBFF5CD...) and unpacks binary registry structures to recover execution counts, focus duration (ms), and 64-bit FILETIME timestamps.

🔌 GhostUSB — Removable Storage Hardware Forensics

prox0959 / GhostUSB

Parses USBSTOR and USB registry hives to extract hardware Vendor IDs, Product IDs, firmware revisions, and serial numbers, reconstructing a chronological USB connection timeline for physical exfiltration investigations.

🛡️ 2. Windows Internals & Kernel Memory Defense

🛡️ MemGuard — LSASS Memory Shield & Handle Auditor

prox0959 / MemGuard

Credential dumpers like Mimikatz and ProcDump require a handle to lsass.exe with PROCESS_VM_READ (0x0010) permissions (MITRE T1003.001).

Queries the NT Kernel Handle Table directly from usermode via ntdll.NtQuerySystemInformation (SystemExtendedHandleInformation / Class 64).
When it catches an unauthorized process holding a read handle to lsass.exe, it calls ntdll.NtSuspendProcess to freeze the attacker process in RAM rather than killing it, preserving volatile evidence for the SOC.
Scans ntdll.dll export stubs in memory to detect 0xE9 inline EDR hooks.

📋 CryptoClipGuard — Real-Time Clipboard Hijack Shield

prox0959 / CryptoClipGuard

Monitors Windows clipboard state changes via Win32 API to defend against crypto-clipper malware. If a background process silently swaps a copied BTC, ETH, SOL, or USDT wallet address, it immediately rolls back the clipboard to the original address and logs the offending PID.

📡 3. Network Defense & Information Theory

📡 SpectralCovert — Covert Channel & Entropy Leak Detector

prox0959 / SpectralCovert

Enterprise firewalls often permit ICMP Echo (Type 8/0) blindly, which APTs abuse to smuggle data inside ping payloads or packet timing. SpectralCovert uses two mathematical models:

Payload Tunneling via Normalized Shannon Entropy (H(X)): Separates deterministic OS ping padding from AES/XOR encrypted exfiltration streams.
Timing Channels via Sarle's Bimodality Coefficient (BC > 0.555): Analyzes Inter-Packet Delays (IPD) using skewness and kurtosis to detect and automatically decode hidden binary bitstreams in packet jitter.

import math
from collections import Counter

def normalized_shannon_entropy(data: bytes) -> float:
    if not data:
        return 0.0
    length = len(data)
    counts = Counter(data)
    entropy = -sum((c / length) * math.log2(c / length) for c in counts.values())
    return entropy / 8.0  # Normalized to [0.0, 1.0]

🌐 ProxNet — Live Network Threat Visualizer & IDS

prox0959 / ProxNet

Combines active ARP discovery, OUI vendor lookup, and TTL OS fingerprinting with a live D3.js force-directed physics graph over WebSockets to flag ARP spoofing and exposed management ports (445 SMB, 3389 RDP).

🤖 4. AI Security & Behavioral Biometrics

🤖 PromptSentry — Deterministic AI Prompt Injection Firewall

prox0959 / PromptSentry

A sub-millisecond (~0.18ms) reverse proxy gateway protecting LLMs (OWASP LLM01). Applies Unicode NFKC normalization to neutralize Cyrillic/Greek homoglyph bypasses, strips invisible zero-width characters (U+200B), decodes smuggled Base64/Hex payloads, and evaluates structural jailbreak heuristics before token consumption.

🧬 KeyDNA — Keystroke Dynamics Biometric Authentication

prox0959 / KeyDNA

Captures microsecond keystroke Dwell Time and Flight Time in JavaScript. Even if an attacker steals a plaintext password, KeyDNA blocks login attempts when the typing rhythm deviates from the user's statistical profile.

🚀 Full Portfolio & Feedback

All 9 tools are MIT licensed and available on my GitHub profile:
👉 github.com/prox0959

I'm currently preparing for university admissions in Computer Science (targeting ETH Zurich) and building out my next tool focused on deterministic antivirus false-positive reduction. If you have any feedback on the code, Win32 API implementations, or forensic methodology, I'd love to hear your thoughts in the comments!

DEV Community