Bypassing Enterprise Bloatware: Building a Zero-Framework Asynchronous EDR Triad in Go and Pure WinAPI

Stop wasting your hardware threads and RAM pools on corporate endpoint detection agents that consume 500MB of memory just to stream telemetry to a cloud bucket. When you secure a host at the bare-metal subsystem layer, you don't need static signature databases, heavy Electron-based dashboards, or background bloatware overhead. You need execution velocity and aggressive, multi-threaded memory isolation.Here is the architectural blueprint of a standalone, zero-signature security stack designed for low-overhead Windows environments, engineered natively across an asynchronous, dual-binary pipeline: Scidrow Hunter (Asynchronous Golang Telemetry) and Scidrow Sniper (Pure WinAPI C++ Eviction Engine). The Core Philosophy: Modular Telemetry vs. Native VaporizationGromozdkie enterprise EDR solutions fail because they chain connection sniffing, memory forensics, and process termination within a single monolithic execution thread. If a high-privilege stealer halts the main scan module, the entire telemetry loop goes down.The Scidrow Engine Architecture splits this responsibility into an interconnected asynchronous loop:[ Raw Network Wire ] ---> ( Npcap Sniffer via BPF )
|
( Golang Core: JA3 / VirtualQueryEx )
|
[ Named Pipe: \.\pipe\scidrow_edr ]
|
( C++ Core: PIPE_WAIT Kernel Sleep )
|
[ Native TerminateProcess (0XDEADC0DE) ]
Part 1: Scidrow Hunter — Asynchronous Socket & Memory Auditor (Golang)The front-line defense module operates as an independent, multi-threaded telemetry collector compiled natively in Go with completely stripped debugging tables (-ldflags="-s -w") to deter static reverse-engineering. 1. Network Telemetry at Wire LevelInstead of hooking high-level user-mode network sockets (which advanced stagers can easily bypass via direct syscalls), Hunter utilizes Npcap under a highly optimized Berkeley Packet Filter (BPF):tcp dst port 443 or tcp dst port 80 or tcp dst port 8080It performs deep, real-time JA3 Fingerprinting on active TLS Handshake Client Hello packets. If a connection footprint matches the hardcoded cryptographic signatures of known stealth command-and-control (C2) stealers (e.g., Lumma Stealer fingerprint), an instant IPC payload is generated.2. Deep Memory Inspection (VirtualQueryEx)Simultaneously, a background routine continuously maps the memory layout (MEM_COMMIT) of local target wrappers (browsers, temp-stagers). It flags any unverified shellcode allocation masks containing RWX execution privileges (PAGE_EXECUTE_READWRITE), immediately tracing the socket ownership back to its physical PID. Part 2: Scidrow Sniper — Pure WinAPI Registry & Process Vaporizer (C++)Once a threat is flagged, the mitigation must happen natively with zero execution lag. This is handled by Scidrow Sniper, a compact C++ daemon optimized aggressively via MinGW (-O3 -static) to run flawlessly even on legacy x86-64 hardware layers. 1. 0% CPU Kernel Sleep via Named PipesSniper doesn't waste CPU cycles in a continuous polling loop. The listener thread drops straight into an OS kernel-level sleep utilizing PIPE_WAIT properties on a secure Windows Named Pipe:\.\pipe\scidrow_edrThe moment the Go-based Hunter transmits a high-priority 4-byte DWORD PID, the pipe instantly wakes the eviction thread. 2. Programmatic Vaporization (0XDEADC0DE)The eviction thread bypasses standard Windows process management subroutines, targeting the malicious memory footprint directly via native TerminateProcess hooks. The daemon passes an explicit, hardcoded forensic signature 0XDEADC0DE as the exit code. This ensures that any third-party forensic tool or event log audit can trace the programmatic eviction to our security stack. 3. Registry Integrity WatchdogWhile the pipe listener sleeps, the primary thread executes a high-velocity loop targeting critical Windows user-init persistence vectors:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ShellHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserinitTo bypass WoW64 subsystem virtualization and prevent malware from manipulating hidden alternative registry views, Sniper utilizes explicit KEY_WOW64_64KEY execution flags. If an unauthorized alteration attempt is detected, Sniper instantly triggers a self-healing routine, overwriting the hive back to clean system defaults (explorer.exe), and safely recycles the scanning context via exit(0). Conclusion: True Local SovereigntyBy separating raw packet capture from low-level process termination via secure IPC channels, this dual-binary stack ensures total local host integrity with a near-zero idle footprint. You don't need cloud-heavy enterprise agent wrappers to defend your machine. Secure your endpoints at the native OS sub-layer.The source code for both independent modules is fully open-source and open for community audit:Telemetry Guard: ://github.com Forensic Vaporizer: ://github.com
To be clear: this is my personal passion project and late-night hobby. I don't build this for corporate venture capital or commercial monetization. I engineered this stack because I love pure, low-level WinAPI mechanics, and I wanted to see how far I could push real-time host isolation without the modern bloatware layers.