Building 9 Zero-Dependency Cybersecurity & DFIR Tools in Pure Python and Win32 API

Hey DEV community! 👋

I'm Çınar, a high school student from Turkey studying low-level systems architecture, Windows internals, and Digital Forensics & Incident Response (DFIR).

When an incident responder plugs a triage USB into a compromised enterprise workstation or an isolated host, they cannot run pip install psutil scapy cryptography. Furthermore, bundling third-party C-extension wheels across different Windows builds often breaks due to missing Visual C++ Redistributable DLLs.

Over the past few months, I challenged myself to build 9 open-source security tools under one strict engineering rule: Zero External PyPI Dependencies. Everything runs strictly on the Python Standard Library (ctypes, struct, winreg, socket, sqlite3, math) and direct Win32 / NT Kernel API calls.

Here is the technical breakdown of the suite and how each tool works under the hood!

🔍 1. Sub-Second Live Forensics & DFIR

⚡ OmniTriage — Live Incident Response Engine

In live response, collection order is critical. Calling disk-heavy browsers or registry parsers before capturing active network sockets destroys volatile evidence. OmniTriage enforces the RFC 3227 Order of Volatility:

• Tier 1 (Volatile Memory & Network): Active TCP/UDP sockets, DNS cache, and running processes.
• Tier 2 (System & Persistence): Registry Run keys, ShimCache, and ROT13-decoded UserAssist records.
• Tier 3 (Disk & Application Artifacts): Locked Chromium SQLite history, PowerShell ConsoleHost_history.txt, and temp staging executables.

Instead of spawning noisy wmic.exe or tasklist.exe child processes, OmniTriage calls kernel32.dll directly via ctypes (CreateToolhelp32Snapshot), completing full host triage in 0.88 seconds from a 10MB Portable Python USB folder while generating a SHA-256 evidence manifest.

import ctypes
from ctypes import wintypes

TH32CS_SNAPPROCESS = 0x00000002

# Captures full process tree in <15ms with zero subprocess creation
h_snap = ctypes.windll.kernel32.CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)

🕵️‍♂️ ShadowTrace — Program Execution Forensics

Even if an attacker deletes an executable after running it, Windows retains execution telemetry in the registry. ShadowTrace decodes ROT13-obfuscated UserAssist keys (CEBFF5CD...) and unpacks binary registry structures to recover execution counts, focus duration (ms), and 64-bit FILETIME timestamps.

🔌 GhostUSB — Removable Storage Hardware Forensics

Parses USBSTOR and USB registry hives to extract hardware Vendor IDs, Product IDs, firmware revisions, and serial numbers, reconstructing a chronological USB connection timeline for physical exfiltration investigations.

🛡️ 2. Windows Internals & Kernel Memory Defense

🛡️ MemGuard — LSASS Memory Shield & Handle Auditor

Credential dumpers like Mimikatz and ProcDump require a handle to lsass.exe with PROCESS_VM_READ (0x0010) permissions (MITRE T1003.001).

• Queries the NT Kernel Handle Table directly from usermode via ntdll.NtQuerySystemInformation (SystemExtendedHandleInformation / Class 64).
• When it catches an unauthorized process holding a read handle to lsass.exe, it calls ntdll.NtSuspendProcess to freeze the attacker process in RAM rather than killing it, preserving volatile evidence for the SOC.
• Scans ntdll.dll export stubs in memory to detect 0xE9 inline EDR hooks.

📋 CryptoClipGuard — Real-Time Clipboard Hijack Shield

Monitors Windows clipboard state changes via Win32 API to defend against crypto-clipper malware. If a background process silently swaps a copied BTC, ETH, SOL, or USDT wallet address, it immediately rolls back the clipboard to the original address and logs the offending PID.

📡 3. Network Defense & Information Theory

📡 SpectralCovert — Covert Channel & Entropy Leak Detector

Enterprise firewalls often permit ICMP Echo (Type 8/0) blindly, which APTs abuse to smuggle data inside ping payloads or packet timing. SpectralCovert uses two mathematical models:

1. Payload Tunneling via Normalized Shannon Entropy (H(X)): Separates deterministic OS ping padding from AES/XOR encrypted exfiltration streams.
2. Timing Channels via Sarle's Bimodality Coefficient (BC > 0.555): Analyzes Inter-Packet Delays (IPD) using skewness and kurtosis to detect and automatically decode hidden binary bitstreams in packet jitter.

import math
from collections import Counter

def normalized_shannon_entropy(data: bytes) -> float:
    if not data:
        return 0.0
    length = len(data)
    counts = Counter(data)
    entropy = -sum((c / length) * math.log2(c / length) for c in counts.values())
    return entropy / 8.0  # Normalized to [0.0, 1.0]

🌐 ProxNet — Live Network Threat Visualizer & IDS

Combines active ARP discovery, OUI vendor lookup, and TTL OS fingerprinting with a live D3.js force-directed physics graph over WebSockets to flag ARP spoofing and exposed management ports (445 SMB, 3389 RDP).

🤖 4. AI Security & Behavioral Biometrics

🤖 PromptSentry — Deterministic AI Prompt Injection Firewall

A sub-millisecond (~0.18ms) reverse proxy gateway protecting LLMs (OWASP LLM01). Applies Unicode NFKC normalization to neutralize Cyrillic/Greek homoglyph bypasses, strips invisible zero-width characters (U+200B), decodes smuggled Base64/Hex payloads, and evaluates structural jailbreak heuristics before token consumption.

🧬 KeyDNA — Keystroke Dynamics Biometric Authentication

Captures microsecond keystroke Dwell Time and Flight Time in JavaScript. Even if an attacker steals a plaintext password, KeyDNA blocks login attempts when the typing rhythm deviates from the user's statistical profile.

🚀 Full Portfolio & Feedback

All 9 tools are MIT licensed and available on my GitHub profile:
👉 github.com/prox0959

I'm currently preparing for university admissions in Computer Science (targeting ETH Zurich) and building out my next tool focused on deterministic antivirus false-positive reduction. If you have any feedback on the code, Win32 API implementations, or forensic methodology, I'd love to hear your thoughts in the comments!