Skip to content

Home

Jump to bottom
Ali Firas (thesmartshadow) edited this page Apr 1, 2026 · 1 revision

CyberShield Wiki

Welcome to the official wiki for CyberShield.

CyberShield is a security-focused C++ project designed for encrypted file handling, runtime interception, and integrity-oriented defensive controls on POSIX-compatible systems.

This wiki provides a central place for understanding the project structure, build flow, usage, design ideas, and security-related behavior.

Overview

CyberShield combines multiple defensive concepts into one project:

  • modern authenticated file encryption
  • syscall-level interception
  • runtime access monitoring
  • integrity-oriented execution logic
  • short-lived cryptographic handling
  • defensive experimentation for local system protection

The project is intended for research, learning, security experimentation, and practical demonstrations of system-level defensive techniques.

Main Components

1. Standalone Binary

The main binary can be used to encrypt files directly from the command line.

Example:

./CyberShield /etc/passwd

This produces an encrypted output file such as:

passwd.enc

2. Shared Object Runtime Layer

CyberShield can also be used as a shared object through LD_PRELOAD to monitor or restrict selected file access behavior in a target process.

Example:

sudo LD_PRELOAD=./CyberShield.so /usr/sbin/sshd

This mode is useful for runtime monitoring and defensive interception experiments.

Features

  • Authenticated encryption

    • Protects file contents using modern cryptographic primitives

  • Runtime interception

    • Monitors selected process behavior through preload-based hooking

  • Integrity-focused design

    • Adds defensive logic around sensitive access paths

  • Self-test support

    • Includes a built-in test mode for quick validation

  • Research-friendly structure

    • Suitable for security experimentation and future hardening work

Build Requirements

CyberShield targets POSIX-compatible systems.

Install dependencies:

sudo apt update
sudo apt install -y g++ libsodium-dev libssl-dev git

Build Instructions

Clone the repository:

git clone https://github.com/thesmartshadow/CyberShield.git
cd CyberShield

Build using the Makefile:

make build

Other build targets:

make debug
make sanity
make clean

Manual build:

g++ -std=c++20 -fPIC -shared -o CyberShield.so cyber_shield.cpp -ldl -lsodium
g++ -std=c++20 -o CyberShield cyber_shield.cpp -lsodium -ldl

Quick Start

Run the self-test

./CyberShield --self-test

Encrypt a file

./CyberShield /etc/passwd

Test preload-based protection

LD_PRELOAD=./CyberShield.so nano /etc/shadow

If the defensive interception layer is active, access should be denied.

Encrypted Output Format

Encrypted files use the .enc extension.

Current format:

  • 4-byte magic: CSH1
  • 1-byte version: 0x01
  • 1-byte nonce length
  • nonce bytes
  • ciphertext bytes

Output file permissions are restricted to:

0600

Project Goals

CyberShield is built around a simple idea:

protecting sensitive data should not stop at encryption alone

The project explores how encryption, process behavior control, and runtime defensive logic can work together in a lightweight security-oriented workflow.

Intended Use

CyberShield may be useful for:

  • local security research
  • defensive proof-of-concept development
  • file protection demonstrations
  • runtime hardening experiments
  • educational security projects

Project Status

CyberShield is an actively evolving project. Future improvements may include stronger hardening logic, broader runtime controls, and additional security-focused features.

Author

Ali Firas (thesmartshadow) Phantom Force Team

Suggested Wiki Pages

You can expand this wiki with dedicated pages such as:

  • Build Guide
  • Usage Examples
  • Architecture
  • Encryption Format
  • LD_PRELOAD Mode
  • Security Notes
  • Roadmap
  • FAQ

Clone this wiki locally