# korneevscp/bypass-kernel-memoire-test architecture

> Architecture diagram of the GitHub repository korneevscp/bypass-kernel-memoire-test, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-10). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/korneevscp/bypass-kernel-memoire-test
- Repository: https://github.com/korneevscp/bypass-kernel-memoire-test

## Overview

X01 is a small Linux low-level learning project, not a production security tool. Its standalone programs demonstrate direct execve system calls, executable-memory shellcode execution, and kernel-symbol lookup. The README describes all three as run individually; excerpts show their internal behavior but not a shared orchestrator. Relationships below are limited to calls and operating-system interfaces visible in the excerpts.

Main entry points: [`X01_shellcode_bash.c`](https://github.com/korneevscp/bypass-kernel-memoire-test/blob/main/X01_shellcode_bash.c) (Shellcode runner), [`X01_exec_bash.c`](https://github.com/korneevscp/bypass-kernel-memoire-test/blob/main/X01_exec_bash.c) (Direct execve), [`X01_kernel_adresses.c`](https://github.com/korneevscp/bypass-kernel-memoire-test/blob/main/X01_kernel_adresses.c) (Symbol search)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_exec["Direct syscall demo"]
  node_exec_demo["Direct execve<br/>[X01_exec_bash.c]"]
end

subgraph group_memory["Memory execution demo"]
  node_shellcode_demo["Shellcode runner"]
end

subgraph group_symbols["Kernel symbol lookup"]
  node_symbol_tool["Symbol search"]
end

node_user(("Lab user"))
node_bash["Linux /bin/bash"]
node_exec_memory["Executable memory"]
node_kallsyms["/proc/kallsyms"]
node_linux_kernel["Linux kernel"]

node_user -->|"runs separately"| node_exec_demo
node_exec_demo -->|"invokes syscall"| node_linux_kernel
node_linux_kernel -->|"replaces process"| node_bash
node_user -->|"runs separately"| node_shellcode_demo
node_shellcode_demo -->|"maps and executes"| node_exec_memory
node_shellcode_demo -->|"shellcode syscall"| node_linux_kernel
node_linux_kernel -->|"replaces process"| node_bash
node_user -->|"runs separately"| node_symbol_tool
node_symbol_tool -->|"reads and searches"| node_kallsyms

click node_exec_demo "https://github.com/korneevscp/bypass-kernel-memoire-test/blob/main/X01_exec_bash.c"
click node_shellcode_demo "https://github.com/korneevscp/bypass-kernel-memoire-test/blob/main/X01_shellcode_bash.c"
click node_symbol_tool "https://github.com/korneevscp/bypass-kernel-memoire-test/blob/main/X01_kernel_adresses.c"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_exec_demo,node_user toneBlue
class node_shellcode_demo toneAmber
class node_symbol_tool toneMint
class node_bash,node_exec_memory,node_kallsyms,node_linux_kernel toneIndigo
```

## Components

### Direct syscall demo

- [Direct execve](https://github.com/korneevscp/bypass-kernel-memoire-test/blob/main/X01_exec_bash.c): `X01_exec_bash.c`

### Memory execution demo

- [Shellcode runner](https://github.com/korneevscp/bypass-kernel-memoire-test/blob/main/X01_shellcode_bash.c): `X01_shellcode_bash.c`

### Kernel symbol lookup

- [Symbol search](https://github.com/korneevscp/bypass-kernel-memoire-test/blob/main/X01_kernel_adresses.c): `X01_kernel_adresses.c`

### Other components

- **Lab user**
- **Linux /bin/bash**
- **Executable memory**
- **/proc/kallsyms**
- **Linux kernel**

## Connections

- Lab user → Direct execve: runs separately (evidence: `README.md`)
- Direct execve → Linux kernel: invokes syscall (evidence: `X01_exec_bash.c`)
- Linux kernel → Linux /bin/bash: replaces process
- Lab user → Shellcode runner: runs separately (evidence: `README.md`)
- Shellcode runner → Executable memory: maps and executes (evidence: `X01_shellcode_bash.c`)
- Shellcode runner → Linux kernel: shellcode syscall (evidence: `X01_shellcode_bash.c`)
- Linux kernel → Linux /bin/bash: replaces process (evidence: `README.md`)
- Lab user → Symbol search: runs separately (evidence: `README.md`)
- Symbol search → /proc/kallsyms: reads and searches (evidence: `X01_kernel_adresses.c`)