Zum Inhalt
HALOWERK

Technische Prüfungen & Formate

F TD2000 DOCUMENTS 10 / linux68 seccomp cbpf data load alu forward jump stacked action simulation

Verify and simulate an explicit stack of seccomp cBPF programs against supplied syscall data. Reconstruct the fully typed result and compare its complete canonical SHA256 claim.

POST https://detect.halowerk.com/v1/F-TD2000-DOCUMENTS-10/linux68-seccomp-cbpf-data-load-alu-forward-jump-stacked-action-simulation

Eingaben

Felder des veröffentlichten Eingabeschemas
FeldTypPflichtBeschreibung
artifactobjectJa
Vollständiges Eingabeschema anzeigen
{
  "type": "object",
  "additionalProperties": false,
  "required": [
    "artifact"
  ],
  "properties": {
    "artifact": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "seccompFilter"
      ],
      "properties": {
        "seccompFilter": {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "data",
            "claim"
          ],
          "properties": {
            "data": {
              "type": "object",
              "additionalProperties": false,
              "required": [
                "endianness",
                "data",
                "filters"
              ],
              "properties": {
                "endianness": {
                  "enum": [
                    "little",
                    "big"
                  ]
                },
                "data": {
                  "type": "object",
                  "additionalProperties": false,
                  "required": [
                    "nr",
                    "arch",
                    "instruction_pointer",
                    "arguments"
                  ],
                  "properties": {
                    "nr": {
                      "type": "integer",
                      "minimum": -2147483648,
                      "maximum": 2147483647
                    },
                    "arch": {
                      "type": "integer",
                      "minimum": 0,
                      "maximum": 4294967295
                    },
                    "instruction_pointer": {
                      "$ref": "#/properties/artifact/%24defs/s0"
                    },
                    "arguments": {
                      "type": "array",
                      "items": {
                        "$ref": "#/properties/artifact/%24defs/s0"
                      },
                      "minItems": 6,
                      "maxItems": 6
                    }
                  }
                },
                "filters": {
                  "type": "array",
                  "items": {
                    "type": "object",
                    "additionalProperties": false,
                    "required": [
                      "id",
                      "instructions"
                    ],
                    "properties": {
                      "id": {
                        "type": "string",
                        "minLength": 1,
                        "maxLength": 64,
                        "pattern": "^[A-Za-z_][A-Za-z0-9_.-]*$"
                      },
                      "instructions": {
                        "type": "array",
                        "items": {
                          "type": "object",
                          "additionalProperties": false,
                          "required": [
                            "code",
                            "jt",
                            "jf",
                            "k"
                          ],
                          "properties": {
                            "code": {
                              "type": "integer",
                              "minimum": 0,
                              "maximum": 65535
                            },
                            "jt": {
                              "type": "integer",
                              "minimum": 0,
                              "maximum": 255
                            },
                            "jf": {
                              "type": "integer",
                              "minimum": 0,
                              "maximum": 255
                            },
                            "k": {
                              "type": "integer",
                              "minimum": 0,
                              "maximum": 4294967295
                            }
                          }
                        },
                        "minItems": 0,
                        "maxItems": 128
                      }
                    }
                  },
                  "minItems": 1,
                  "maxItems": 8
                }
              }
            },
            "claim": {
              "anyOf": [
                {
                  "type": "null"
                },
                {
                  "type": "string",
                  "minLength": 64,
                  "maxLength": 64,
                  "pattern": "^[0-9a-f]{64}$"
                }
              ]
            }
          }
        }
      },
      "$defs": {
        "s0": {
          "type": "string",
          "minLength": 1,
          "maxLength": 20,
          "pattern": "^(?:0|[1-9][0-9]{0,19})$"
        }
      }
    }
  }
}

Originalschema öffnen

Ergebnis & Dokumentation

Maschinenlesbare Dokumentation dieses Hubs

Quelle dieser Seite: der veröffentlichte HALOWERK-Katalog. Stand: 2026-11-01, 15:19 UTC.

Weitere Endpunkte dieses Hubs

Alle Endpunkte dieses Hubs →