DaniWeb Programming Topics https://www.daniweb.com/programming/4 Our Programming forum category encompasses application development, web development, programming theory, and everything in between. en-US Copyright 2026, DaniWeb LLC dani@daniwebmail.com (Dani Wolkowicki) dani@daniwebmail.com (Dani Wolkowicki) https://www.daniweb.com/welcome/api 60 How can the user input data into a PyQt program? https://www.daniweb.com/programming/threads/545421/how-can-the-user-input-data-into-a-pyqt-program Wed, 02 Sep 2026 19:26:48 +0000 Just asking about a good approach for the user. Just asking about a good approach for the user.

]]> Programming Dietrich_3 https://www.daniweb.com/programming/threads/545421/how-can-the-user-input-data-into-a-pyqt-program Is Python good with numbers? https://www.daniweb.com/programming/threads/545414/is-python-good-with-numbers Tue, 01 Sep 2026 15:22:30 +0000 I am asking this because I am habitually intrigued by numbers. Python seems to be a good language to explore all sorts of numeric facts. Do you have any 'tricks' hidden away? Here is one about the number 61 I recently bumped into: I am asking this because I am habitually intrigued by numbers. Python seems to be a good language to explore all sorts of numeric facts. Do you have any 'tricks' hidden away? Here is one about the number 61 I recently bumped into:

]]> Programming Dietrich_3 https://www.daniweb.com/programming/threads/545414/is-python-good-with-numbers Python's modest power is in utility programs? https://www.daniweb.com/programming/threads/545405/python-s-modest-power-is-in-utility-programs Fri, 28 Aug 2026 17:54:56 +0000 I have been writing small Python utility programs, a few lines of code using module 'glob' that go through a working folder and search for strings in text and code files. Also have one that can give you a slide show of any image files there. These programs are tiny, ... I have been writing small Python utility programs, a few lines of code using module 'glob' that go through a working folder and search for strings in text and code files. Also have one that can give you a slide show of any image files there. These programs are tiny, less than 1k, I tuck them away right in the folder of interest, then run them from IDLE or whatever.
Here is an example of a small utility program searching for a segment of code in its 'working folder'.

]]> Programming Dietrich_3 https://www.daniweb.com/programming/threads/545405/python-s-modest-power-is-in-utility-programs U-tube Python Videos, good way to learn? https://www.daniweb.com/programming/threads/545403/u-tube-python-videos-good-way-to-learn Thu, 27 Aug 2026 12:41:26 +0000 I have watched a fair amount of those and only a few impress me! The once that sound like church sermons (do it my way ...) are the pits! I think Corey Schafer has good presentations, like his style and voice! I have watched a fair amount of those and only a few impress me! The once that sound like church sermons (do it my way ...) are the pits!

I think Corey Schafer has good presentations, like his style and voice!

]]> Programming Dietrich_3 https://www.daniweb.com/programming/threads/545403/u-tube-python-videos-good-way-to-learn Mithra EDR Platform: For those building Hypervisors and training using py https://www.daniweb.com/programming/threads/545363/mithra-edr-platform-for-those-building-hypervisors-and-training-using-py Thu, 20 Aug 2026 16:05:32 +0000 # Mithra EDR Platform (C) Complete Build & Deployment Guide > **Mithra** created by: Justin Linwood Ross, is a hypervisor-enforced, next-generation Endpoint Detection and Response (EDR) platform that combines user-space telemetry with Ring -1 hypervisor containment. This guide walks you through every step: prerequisites, model training, building, driver installation, ... # Mithra EDR Platform (C) Complete Build & Deployment Guide > **Mithra** created by: Justin Linwood Ross, is a hypervisor-enforced, next-generation Endpoint Detection and Response (EDR) platform that combines user-space telemetry with Ring -1 hypervisor containment. This guide walks you through every step: prerequisites, model training, building, driver installation, safety, and running the application. --- ## Table of Contents 1. [System Requirements](#1-system-requirements) 2. [Prerequisites & Tooling](#2-prerequisites--tooling) 3. [Solution Architecture Overview](#3-solution-architecture-overview) 4. [NuGet Packages & Assembly References](#4-nuget-packages--assembly-references) 5. [Step 1 Python ML Model Training](#step-1--python-ml-model-training) 6. [Step 2 Build the .NET Solution](#step-2--build-the-net-solution) 7. [Step 3 Driver Creation & Signing](#step-3--driver-creation--signing) 8. [Step 4 Administrator Privileges & Launch](#step-4--administrator-privileges--launch) 9. [Step 5 Running the Application](#step-5--running-the-application) 10. [Safety & Security Considerations](#6-safety--security-considerations) 11. [Detailed Application Narrative](#7-detailed-application-narrative) 12. [Troubleshooting](#8-troubleshooting) --- ## 1. System Requirements ### Operating System - **Windows 10 version 2004+** or **Windows 11** (x64 only) - Hypervisor-protected code integrity (HVCI) must be **supported by the CPU** (Intel VT-x / AMD-V) - Windows Defender Application Control (WDAC) recommended for production ### Hardware | Component | Minimum | Recommended | |-----------|---------|-------------| | CPU | 4 cores, VT-x/AMD-V | 8+ cores | | RAM | 8 GB | 16 GB | | Disk | 2 GB free | 10 GB (for dumps + models) | | Architecture | x64 | x64 | ### Software - **.NET Framework 4.8** (Developer Pack for building, Runtime for running) - **Visual Studio 2022** (17.0+) with: - .NET desktop development workload - .NET Framework 4.8 SDK - C# 8.0 language support (included in VS 2022) - **Python 3.10+** with pip (for ML model training) - **Windows SDK 10** (for kernel driver headers and tools) - **Windows Driver Kit (WDK)** (only if building the kernel driver from source) --- ## 2. Prerequisites & Tooling ### 2.1 Install Visual Studio 2022 1. Download the VS 2022 installer from https://visualstudio.microsoft.com/ 2. In the installer, select these workloads: - **.NET desktop development** (WPF/WinForms, .NET Framework 4.8) - **Desktop development with C++** (needed if you build the driver) - **.NET Framework 4.8 targeting pack** (under Individual Components) ### 2.2 Install .NET Framework 4.8 Developer Pack Download from Microsoft: https://dotnet.microsoft.com/download/dotnet-framework/thank-you/net48-developer-pack-offline-installer Verify: ```powershell dotnet --version # Should report 4.8 or higher runtime ``` ### 2.3 Install Python 3.10+ (for ML training) ```powershell # Install Python from https://www.python.org/downloads/ # Then install ML dependencies: pip install tensorflow tf2onnx onnx joblib scikit-learn pandas numpy ``` ### 2.4 Install Windows SDK & WDK (Driver Only) Only needed if you are building `Sentinels.sys` from source. If you already have a signed `Sentinels.sys` binary, skip this. - Windows SDK 10: https://developer.microsoft.com/windows/downloads/sdk-archive - WDK: https://learn.microsoft.com/windows-hardware/drivers/download-the-wdk --- ## 3. Solution Architecture Overview The Mithra solution contains **6 projects** organized in a single `Mithra.sln`: ``` Mithra_Fixed/ Mithra.sln Master solution file Mithra.Common/ Shared types & data structures Mithra.Common.csproj Alert.cs Alert levels & structured alert objects EptRingBuffer.cs Extended Page Table ring buffer FeatureVector.cs 12-float ML feature vector PageInfo.cs Telemetry page descriptor (audit fix) ProcessFsm.cs Process lifecycle state machine SentinelEvent.cs Managed wrapper for driver events Timestamp.cs High-resolution timestamps TimestampHeader.cs Timestamp framing Mithra.Driver/ Kernel driver user-mode interface Mithra.Driver.csproj MithraDevice.cs Raw interop structs (SentinelEvent) SentinelDriverClient.cs SafeHandle wrapper for \\.\Sentinels SentinelDriverInstaller.cs SCM install/start/stop/uninstall SentinelsDefinitions.cs IOCTL codes & structures MemoryRollback.cs Shadow rollback logic Mithra.Harness/ Telemetry collection & training harness Mithra.Harness.csproj TelemetryCollector.cs Live driver polling + FSM tracking DatasetCollector.cs Dataset aggregation for training HarnessRunner.cs CLI harness entry point Randomizer.cs Synthetic threat generation Mithra.Hypervisor/ Ring -1 hypervisor components SentinelsVmm.efi UEFI hypervisor payload SentinelsVmm.inf Driver installation INF VmxStubs.cs User-mode VMX stubs (safe fallbacks) MithraCore/ Sub-OS telemetry engine (core sensor) MithraCore.csproj Core/ AmsiMonitor.cs AMSI bypass detection (IL Ldsflda) WdacVerifier.cs WDAC enforcement status (WMI + Registry) InternalAgent.cs WMI process creation monitoring PerformanceValidator.cs Zero-alloc benchmarking ZeroAllocErrorHandler.cs Allocation-free error handling Incident/ IncidentResponder.cs Process freeze, dump, secure reboot ML/ MLBridge.cs ML.NET bridge (ONNX prediction engine) Memory/ MemoryManager.cs Memory telemetry management Telemetry/ SecurityEventSource.cs ETW event source (MithraCore-Security) StructuredLogger.cs Structured logging pipeline Program.cs MithraCore CLI entry point Mithra.Orchestrator/ ML decision engine (ONNX inference) Mithra.Orchestrator.csproj Program.cs Console host (Ctrl+C graceful shutdown) HeartbeatMonitor.cs 500ms driver heartbeat (3-strike alert) IOCTL.cs Static IOCTL wrapper (rollback, status) Models/ Pre-trained ONNX ensemble models member_1.onnx member_2.onnx member_3.onnx scaler.pkl Mithra.UI/ WPF/WinForms dashboard Mithra.UI.csproj Program.cs WinForms entry point Form1.cs Main dashboard (driver connect, process scan) Form1.Designer.cs UI layout (cobalt/neon theme) Form1.resx Embedded resources app.config Thresholds, device name, heatmap settings Mithra.UI.slnx VS solution explorer file ``` ### Data Flow (End-to-End Pipeline) ``` Sentinels MithraCore MLBridge.cs Kernel Driver (ETW + WMI) 12-float vector (Ring 0) AMSI/WDAC + EPT metrics Mithra.Orchestrator ONNX Ensemble (3) Score 0.500.87 Soft containment (IncidentResponder) Score 0.87 Hard isolation (Driver page isolation) Mithra.UI Dashboard: process list, snapshot, heal, threat heatmap ``` --- ## 4. NuGet Packages & Assembly References ### 4.1 MithraCore (packages.config style legacy .csproj) These packages restore to `Mithra.UI/packages/` (shared packages folder): | Package | Version | Purpose | |---------|---------|---------| | `Microsoft.ML` | 3.0.1 | ML.NET framework (model loading, prediction) | | `Microsoft.ML.CpuMath` | 3.0.1 | Native CPU math acceleration for ML.NET | | `Microsoft.ML.DataView` | 3.0.1 | IDataView schema for ML pipelines | | `Microsoft.ML.FastTree` | 3.0.1 | FastTree decision tree trainers | | `Microsoft.Bcl.Numerics` | 8.0.0 | Numerics compatibility for .NET 4.8 | | `Newtonsoft.Json` | 13.0.1 | JSON serialization (telemetry export) | | `System.Buffers` | 4.5.1 | Array pooling (zero-allocation) | | `System.Memory` | 4.5.5 | Span\<T\>, Memory\<T\> support | | `System.Numerics.Tensors` | 8.0.0 | Tensor operations for ML vectors | | `System.Numerics.Vectors` | 4.5.0 | Hardware-accelerated vector math | | `System.Collections.Immutable` | 8.0.0 | Thread-safe immutable collections | | `System.Runtime.CompilerServices.Unsafe` | 6.0.0 | Unsafe pointer operations | | `System.Threading.Channels` | 4.7.1 | Lock-free producer/consumer queues | | `System.Threading.Tasks.Extensions` | 4.5.4 | ValueTask support | | `System.CodeDom` | 4.5.0 | Dynamic IL emission (AmsiMonitor) | | `System.Reflection.Emit.Lightweight` | 4.3.0 | DynamicMethod for Ldsflda IL | ### 4.2 Mithra.UI (SDK-style PackageReference) | Package | Version | Purpose | |---------|---------|---------| | `System.Diagnostics.DiagnosticSource` | 10.0.11 | Diagnostic tracing pipeline | ### 4.3 Mithra.Harness (SDK-style PackageReference) | Package | Version | Purpose | |---------|---------|---------| | `System.CommandLine` | 2.0.0-beta4.22272.1 | CLI argument parsing | ### 4.4 Mithra.Orchestrator (SDK-style PackageReference) | Package | Version | Purpose | |---------|---------|---------| | `Microsoft.ML.OnnxRuntime` | 1.17.1 | ONNX model inference (ensemble scoring) | ### 4.5 .NET Framework Assembly References All projects reference these standard .NET Framework 4.8 assemblies: - `System` Core base class library - `System.Core` LINQ, expression trees - `System.Management` WMI queries (WDAC, process monitoring) - `System.Data` ADO.NET - `System.Xml` / `System.Xml.Linq` XML processing - `System.Net.Http` HTTP client - `Microsoft.CSharp` Dynamic language support ### 4.6 Project-to-Project Reference Graph ``` Mithra.UI Mithra.Driver MithraCore Mithra.Common Mithra.Harness Mithra.Harness Mithra.Driver Mithra.Common Mithra.Common Mithra.Driver (for raw SentinelEvent struct) Mithra.Orchestrator Mithra.Driver MithraCore (standalone, references NuGet packages directly) ``` --- ## Step 1 Python ML Model Training The Mithra ML pipeline trains a **3-member neural network ensemble** on process telemetry data, then converts each model to ONNX format for production inference. ### 1.1 Dataset Format Training data is stored as CSV files in `Mithra.ML/data/`: | File | Description | Label | |------|-------------|-------| | `benign.csv` | Normal process telemetry | `0` | | `raven.csv` | Known threat / process hollowing samples | `1` | | `synth.csv` | Synthetic adversarial samples | `1` | Each CSV row contains **12 features** (the feature vector): | # | Feature | Description | |---|---------|-------------| | 1 | `was_suspended` | Process created in suspended state (1/0) | | 2 | `cross_mem_ops` | Cross-process memory write operations count | | 3 | `peb_changed` | PEB image base modified (1/0) | | 4 | `token_lowered` | Token integrity level lowered (1/0) | | 5 | `thread_resume` | Suspended thread resumed by external process | | 6 | `image_base_changed` | Image base address mismatch detected | | 7 | `entry_point_changed` | Entry point RVA modified | | 8 | `handle_duplicates` | Duplicated handle count (potential injection) | | 9 | `remote_allocations` | Remote memory allocations in other processes | | 10 | `thread_injections` | Threads created in foreign processes | | 11 | `memory_write_ops` | Total memory write operations | | 12 | `integrity_level` | Process integrity level (Low=0, High=1) | ### 1.2 Train the Ensemble ```bash cd Mithra.ML # Install Python dependencies (one-time) pip install tensorflow tf2onnx onnx joblib scikit-learn pandas numpy # Step 1: Train 3 neural network ensemble members python train_pipeline.py ``` This will: 1. Load and combine `benign.csv`, `raven.csv`, `synth.csv` 2. Preprocess features with `StandardScaler` (saves `scaler.pkl`) 3. Split 80/20 train/validation with stratification 4. Train 3 independent Keras models with different random seeds (ensemble diversity) 5. Apply early stopping (patience=5, restore best weights) 6. Save each model as `member_1.keras`, `member_2.keras`, `member_3.keras` **Architecture per ensemble member:** ``` Dense(64, relu) BatchNorm Dropout(0.3) Dense(32, relu) BatchNorm Dropout(0.2) Dense(16, relu) Dense(1, sigmoid) ``` ### 1.3 Convert to ONNX ```bash # Step 2: Convert Keras models to ONNX for production inference python convert_to_onnx.py ``` This converts each `.keras` model to `.onnx` format using `tf2onnx` with opset 13. The ONNX models are used by: - **Mithra.Orchestrator** via `Microsoft.ML.OnnxRuntime` (production scoring) - **MithraCore** via `MLBridge.cs` (ML.NET prediction with caching) ### 1.4 Place Models in the Orchestrator After conversion, copy the ONNX models and scaler to the Orchestrator: ```powershell copy Mithra.ML\Models\*.onnx Mithra.Orchestrator\Models\ copy Mithra.ML\Models\scaler.pkl Mithra.Orchestrator\Models\ ``` ### 1.5 Verify Models ```bash python verify_models.py ``` This script validates that all 3 ONNX models load correctly and produce consistent output shapes. --- ## Step 2 Build the .NET Solution ### 2.1 Open the Solution 1. Open **Visual Studio 2022** 2. `File Open Project/Solution` 3. Navigate to `Mithra_Fixed/` and select **`Mithra.sln`** ### 2.2 Restore NuGet Packages 1. Right-click the solution in Solution Explorer **Restore NuGet Packages** 2. Wait for all packages to download (MithraCore uses packages.config; others use PackageReference) **If packages don't restore for MithraCore** (legacy .csproj): ```powershell nuget restore Mithra.sln # or msbuild -t:Restore Mithra.sln ``` ### 2.3 Build Configuration Set the build configuration: - **Debug** for development (includes console output, `#if DEBUG` blocks) - **Release** for production deployment Set the platform to **x64** (required for driver interop and hypervisor): ``` Build Configuration Manager Active solution platform x64 ``` ### 2.4 Build Order The solution dependencies enforce this build order automatically: ``` 1. Mithra.Driver (no dependencies) 2. Mithra.Common (depends on Mithra.Driver) 3. MithraCore (standalone, NuGet packages) 4. Mithra.Harness (depends on Mithra.Driver, Mithra.Common) 5. Mithra.Orchestrator (depends on Mithra.Driver) 6. Mithra.UI (depends on all above) ``` ### 2.5 Build ``` Build Build Solution (Ctrl+Shift+B) ``` Or from the command line: ```powershell msbuild Mithra.sln /p:Configuration=Release /p:Platform=x64 ``` ### 2.6 Build Outputs | Project | Output Type | Location | |---------|------------|----------| | Mithra.Driver | `Mithra.Driver.dll` | `Mithra.Driver/bin/x64/Release/` | | Mithra.Common | `Mithra.Common.dll` | `Mithra.Common/bin/x64/Release/` | | MithraCore | `MithraCore.dll` | `MithraCore/bin/Release/` | | Mithra.Harness | `Mithra.Harness.exe` | `Mithra.Harness/bin/x64/Release/` | | Mithra.Orchestrator | `Mithra.Orchestrator.exe` | `Mithra.Orchestrator/bin/x64/Release/` | | Mithra.UI | `Mithra.UI.exe` | `Mithra.UI/bin/x64/Release/` | --- ## Step 3 Driver Creation & Signing The **Sentinels kernel driver** (`Sentinels.sys`) runs at Ring 0 and provides: - Process creation/handle stripping telemetry - Memory snapshot and rollback IOCTLs - EPT fault monitoring (via hypervisor) ### 3.1 If You Have a Pre-Built Driver If you already have a signed `Sentinels.sys`: 1. Place it next to `Mithra.UI.exe` (or any executable that uses `SentinelDriverInstaller`) 2. Skip to [Step 4 Installation](#step-3b-install-the-driver-via-senteldriverinstaller) ### 3.2 Building the Driver from Source (Advanced) > **Warning:** Building a kernel driver requires the WDK and a code-signing certificate. Unsigned drivers will not load on x64 Windows with Secure Boot enabled. 1. Open the driver project in Visual Studio (with WDK installed) 2. Build the `Sentinels.sys` kernel driver in `Release|x64` 3. Sign the driver: - **Test signing** (development only): ```powershell MakeCert /r /pe /ss PrivateCertStore /n "CN=MithraTestCert" MithraTest.cer signtool sign /a /v /s PrivateCertStore /n "CN=MithraTestCert" /t http://timestamp.digicert.com Sentinels.sys ``` - Enable test signing mode: `bcdedit /set testsigning on` (reboot required) - **Production signing**: Submit the driver to the Windows Hardware Developer Center for Microsoft attestation signing ### 3.3 Install the Driver via SentinelDriverInstaller The `SentinelDriverInstaller` class manages the driver lifecycle through the Windows Service Control Manager (SCM): ```csharp // Install and start the driver (requires Administrator!) SentinelDriverInstaller.InstallAndStart(@"C:\Path\To\Sentinels.sys"); // Check if the driver is running bool isRunning = SentinelDriverInstaller.IsRunning(); // Stop and uninstall SentinelDriverInstaller.StopAndUninstall(); ``` **What it does internally:** 1. Verifies the caller is running as Administrator 2. Opens the SCM with `SC_MANAGER_ALL_ACCESS` 3. Creates a kernel driver service (`SERVICE_KERNEL_DRIVER`, demand start) 4. Starts the service 5. The device `\\.\Sentinels` becomes available for IOCTL communication ### 3.4 Manual Driver Installation (Alternative) If you prefer `sc.exe`: ```powershell # Run as Administrator sc create Sentinels type= kernel binPath= "C:\Path\To\Sentinels.sys" sc start Sentinels # Verify sc query Sentinels # Stop and remove sc stop Sentinels sc delete Sentinels ``` --- ## Step 4 Administrator Privileges & Launch ### 4.1 Why Administrator Is Required Mithra requires elevated privileges for multiple security-critical operations: | Operation | Why Admin Is Needed | |-----------|-------------------| | Loading the kernel driver | `OpenSCManager` requires `SC_MANAGER_ALL_ACCESS` | | `DebugActiveProcess` | Attaching a debugger to freeze processes requires `SeDebugPrivilege` | | `MiniDumpWriteDump` | Reading another process's memory requires `PROCESS_VM_READ` | | WMI `Win32_DeviceGuard` | WDAC status queries need elevated WMI access | | AMSI pointer resolution | `DynamicMethod` IL emission with `Ldsflda` needs elevated trust | | ETW Security logging | The `MithraCore-Security` ETW provider needs registration | | Secure reboot | `InitiateHealingSequence` triggers a system reboot | ### 4.2 Launching as Administrator **Option A Visual Studio:** 1. Right-click `Mithra.UI` in Solution Explorer **Properties** 2. Go to **Security** Enable ClickOnce security settings 3. Check "This is a full trust application" 4. Build and run VS will prompt for elevation **Option B App Manifest (recommended for production):** Add to `Mithra.UI/app.manifest`: ```xml <requestedExecutionLevel level="requireAdministrator" uiAccess="false" /> ``` **Option C Manual:** ```powershell # Run MithraCore CLI as admin Start-Process -Verb RunAs -FilePath "MithraCore.exe" -ArgumentList "monitor" # Run Mithra.UI as admin Start-Process -Verb RunAs -FilePath "Mithra.UI.exe" ``` ### 4.3 Verify Administrator Status MithraCore's `SentinelDriverInstaller.EnsureAdministrator()` checks at startup: ```csharp using (WindowsIdentity identity = WindowsIdentity.GetCurrent()) { WindowsPrincipal principal = new WindowsPrincipal(identity); if (!principal.IsInRole(WindowsBuiltInRole.Administrator)) throw new UnauthorizedAccessException("Mithra requires Administrator privileges."); } ``` --- ## Step 5 Running the Application ### 5.1 MithraCore CLI (Sub-OS Sensor Engine) MithraCore runs as a console application with 4 commands: ```powershell # Security check verify WDAC enforcement and AMSI status MithraCore.exe check # Process monitor start WMI process creation monitoring (Ctrl+C to stop) MithraCore.exe monitor # Incident response contain, dump, and heal a suspicious process MithraCore.exe incident 1234 # Performance benchmark measure IsEnabled() cost MithraCore.exe perf ``` **What each command does:** - **`check`**: Queries WDAC status via WMI (`Win32_DeviceGuard`) with Registry fallback. Checks AMSI bypass state via the `AmsiMonitor.IsAmsiDisabled()` helper. If AMSI is bypassed, the program exits immediately with a critical alert. - **`monitor`**: Starts `InternalAgent` which subscribes to WMI `Win32_ProcessStartTrace` events. Every process creation is logged via ETW (`MithraCore-Security` event source) and fed into the telemetry pipeline. - **`incident <PID>`**: Executes the full incident response sequence: 1. `ContainThreat(pid)` Attaches a debugger via `DebugActiveProcess` to freeze the process 2. `AcquireEvidence(pid, dumpPath)` Writes a full memory dump via `MiniDumpWriteDump` to `C:\Temp\` 3. `InitiateHealingSequence()` Triggers a secure reboot (the only reliable way to clear kernel rootkits) - **`perf`**: Benchmarks the zero-allocation telemetry hot path to verify sub-microsecond overhead. ### 5.2 Mithra.Orchestrator (ML Decision Engine) ```powershell Mithra.Orchestrator.exe ``` The Orchestrator: 1. Starts a `HeartbeatMonitor` that pings the driver every 500ms via `IOCTL.RollbackMemory(0)` 2. If 3 consecutive heartbeats fail, the monitor stops and triggers an alert 3. Listens for Ctrl+C for graceful shutdown (disposes monitor, flushes logs) 4. In production, it receives 12-float feature vectors from MithraCore, runs them through the 3-model ONNX ensemble, and: - **Score 0.500.87** Soft containment via `IncidentResponder` - **Score 0.87** Hard hypervisor page isolation via `Mithra.Driver` ### 5.3 Mithra.UI (Dashboard) ```powershell Mithra.UI.exe ``` The UI dashboard: 1. On launch, attempts to connect to `\\.\Sentinels` via `SentinelDriverClient` 2. Starts `TelemetryCollector` polling at 100ms intervals 3. Displays driver status (ONLINE/OFFLINE) 4. Provides buttons: - **Refresh** Lists all running processes in the dropdown - **Scan** Delegates to MemoryScope for deep analysis - **Snapshot** Captures a memory snapshot via `MakeSnapshot` IOCTL - **Heal** Restores a previous snapshot via `RestoreSnapshot` IOCTL 5. Features a cobalt-background, neon-cyan themed interface with: - Process selector dropdown - Risk score / Mimicry / Suspicious activity meters - Event log feed (max 1000 entries) - Threat heatmap visualization - Spectrograph panel ### 5.4 Mithra.Harness (Training Data Collection) ```powershell # Collect telemetry data for ML training Mithra.Harness.exe --collect --output ./data/new_samples.csv # Run the full training harness with synthetic threats Mithra.Harness.exe --run --synthetic ``` --- ## 6. Safety & Security Considerations ### 6.1 What NOT to Do - **Never run Mithra.UI without the driver loaded** the UI will show "Driver: OFFLINE" and all driver-dependent buttons will be disabled - **Never modify the IOCTL codes** in `SentinelsDefinitions.cs` without matching changes to the kernel driver's `sentinels.h` - **Never disable test signing** on a machine running an unsigned driver the driver will fail to load - **Never attempt to patch kernel memory directly** the codebase explicitly blocks this ("Direct kernel patching is unsafe and blocked by PatchGuard") - **Never run MithraCore's `incident` command on a critical system process** (PID 4 = System, PID 0 = Idle) it will freeze them ### 6.2 Security Capabilities (Do Not Disable) These are the core security sensors. The structural audit explicitly does **not** alter or disable any of these: | Capability | Component | What It Detects | |-----------|-----------|-----------------| | **AMSI** | `AmsiMonitor.cs` | AMSI bypass via `Ldsflda` pointer to `amsiInitFailed` | | **WDAC** | `WdacVerifier.cs` | WDAC not enforced (WMI + Registry fallback) | | **ETW** | `SecurityEventSource.cs` | Structured security events via `MithraCore-Security` provider | | **EPT** | `EptRingBuffer.cs` | Extended Page Table fault metrics (hypervisor Ring -1) | | **Hypervisor** | `SentinelsVmm.efi` | VMX-based page isolation for hard containment | | **WMI** | `InternalAgent.cs` | Process creation velocity monitoring | ### 6.3 Safe Operating Environment - Run Mithra on a **dedicated analysis machine** or VM, not your primary workstation - Ensure **Secure Boot** is enabled for driver integrity - Keep **Windows Defender** active Mithra complements Defender but with higher credentials... - Store memory dumps securely they contain full process memory including potential credentials - The `C:\Temp\` dump directory should be on an encrypted volume ### 6.4 Zero-Allocation Performance Guarantees MithraCore's telemetry hot path is designed for **zero managed heap allocations**: - `AmsiMonitor.TryGetAmsiState()` uses `AggressiveInlining` and direct pointer dereference - `SecurityEventSource` uses ETW's `WriteEvent` with pre-allocated strings - `ZeroAllocErrorHandler` catches and logs errors without allocating exception objects on the hot path - `MemoryManager` uses `Span<T>` and `ArrayPool<T>` for buffer reuse ### 6.5 Audit Trail All security events are logged via ETW (`MithraCore-Security` provider): - `AuditCheck(name, passed)` routine integrity checks - `SecurityAlert(alertId, message)` threat detections - `AmsiBypassDetected(source)` AMSI tampering - `WdacStatus(status)` WDAC policy changes - `AmsiCheckInitFailed()` AMSI initialization failure View ETW logs: ```powershell # View MithraCore security events logman query -ets | findstr MithraCore # Start an ETW trace session logman start MithraTrace -p MithraCore-Security -o MithraTrace.etl -ets # ... reproduce issue ... logman stop MithraTrace -ets # Analyze tracerpt MithraTrace.etl ``` --- ## 7. Detailed Application Narrative ### The Problem Mithra Solves Traditional EDR platforms operate entirely in user space (Ring 3) or at the kernel level (Ring 0). Both layers are vulnerable to sophisticated attacks: - **Ring 0 (kernel)** rootkits can hook system calls, hide processes, and evade detection by patching kernel structures. Modern attackers use techniques like process hollowing, token impersonation, and direct kernel object manipulation (DKOM) to bypass Ring 0 defenses. - **Ring 3 (user mode)** monitoring can be disabled by terminating the EDR agent, injecting code into it, or manipulating the telemetry pipeline before it reaches the analysis engine. The fundamental problem is that defenders and attackers operate on the **same privilege level** whoever controls Ring 0 controls the game. ### Mithra's Breakthrough: Ring -1 Containment Mithra's core innovation is the **SentinelsVmm hypervisor** a UEFI-loaded Type 1 hypervisor that operates at **Ring -1** (VMX root mode on Intel VT-x). This gives Mithra a privilege level **below** the operating system kernel: ``` Ring -1 (VMX Root) Mithra Hypervisor (SentinelsVmm) Ring 0 (Kernel) Sentinels Driver + Windows Kernel Ring 3 (User) MithraCore, Mithra.UI, target processes ``` At Ring -1, Mithra can: 1. **Monitor Extended Page Tables (EPT)** every memory page access by the guest OS passes through the hypervisor's EPT, making it impossible for kernel rootkits to hide memory modifications 2. **Isolate malicious pages** when the ML engine scores a process as 0.87, the hypervisor can mark its pages as non-executable at the EPT level, effectively containing the threat **below** the kernel where no malware can tamper with it 3. **Capture forensic snapshots** memory snapshots taken at Ring -1 are tamper-proof; the guest cannot modify them even with kernel-level access ### The Telemetry Pipeline MithraCore serves as the **primary sensor layer**. It continuously samples the system through multiple channels simultaneously: **1. WMI Process Monitoring (`InternalAgent`)** - Subscribes to `Win32_ProcessStartTrace` events - Tracks process creation velocity (bursts of process creation indicate malware propagation) - Maintains a per-process finite state machine (`ProcessFsm`) that transitions through: Normal SuspendedCreated CrossProcessMemoryOp Injected Terminated **2. AMSI Integrity Audit (`AmsiMonitor`)** - Uses IL emission (`DynamicMethod` + `Ldsflda`) to obtain a direct native pointer to `System.Management.Automation.AmsiUtils.amsiInitFailed` - Reads the live boolean value with **zero managed allocations** via unsafe pointer dereference - If AMSI is disabled (by an attacker), MithraCore immediately fires a critical alert and can terminate - The new `IsAmsiDisabled()` helper wraps `TryGetAmsiState()` for backward compatibility with UI and Orchestrator callers **3. WDAC Enforcement Verification (`WdacVerifier`)** - Queries `Win32_DeviceGuard` via WMI to check `UserModeCodeIntegrityPolicyEnforcementStatus` - Falls back to Registry (`HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy`) if WMI is unavailable - Reports: Disabled, AuditMode, Enforced, or Unknown **4. ETW Structured Logging (`SecurityEventSource`)** - Uses `EventSource` to write events to the Windows ETW subsystem - The `MithraCore-Security` provider is registered with the OS and can be consumed by any ETW consumer (Log Analytics, Splunk, etc.) - Zero-allocation error handling ensures the telemetry hot path never triggers GC pauses **5. EPT Fault Metrics (via Hypervisor)** - When the SentinelsVmm hypervisor is active, `EptRingBuffer` captures EPT violation events - These metrics feed into the ML feature vector alongside user-space telemetry - EPT faults indicate suspicious memory access patterns that are invisible to Ring 0 ### The ML Decision Engine The 12 telemetry indicators are packed into a **12-float feature vector** by `MLBridge.cs`: ``` [was_suspended, cross_mem_ops, peb_changed, token_lowered, thread_resume, image_base_changed, entry_point_changed, handle_duplicates, remote_allocations, thread_injections, memory_write_ops, integrity_level] ``` This vector is scored by a **3-member ONNX ensemble** three independently trained neural networks with different random seeds for diversity. The ensemble approach reduces false positives because all three models must agree on a threat: - **Score < 0.50**: Benign no action - **Score 0.500.87**: Suspicious **soft containment** via `IncidentResponder` - The suspicious process is frozen using `DebugActiveProcess` - A full memory dump is captured for forensic analysis - A secure reboot is initiated to clear any kernel-level compromise - **Score 0.87**: Malicious **hard isolation** via hypervisor page isolation - The Sentinels driver marks the process's EPT pages as non-executable - The process cannot execute any code, effectively neutralizing it - Memory is preserved for forensic snapshotting ### The UI Dashboard Mithra.UI provides real-time situational awareness with a **cobalt-and-neon themed interface**: - **Process selector**: Lists all running processes with PID and name - **Risk meters**: Three real-time gauges showing Risk Score, Mimicry Index, and Suspicious Activity level - **Event feed**: Timestamped log of all security events (max 1000 entries, oldest auto-trimmed) - **Threat heatmap**: Visual representation of process memory anomaly density - **Spectrograph panel**: Real-time frequency analysis of telemetry event velocity - **Driver status**: Clear ONLINE/OFFLINE indicator with color-coded feedback **Key UI actions:** - **Snapshot**: Captures a memory snapshot of the selected process via the `IOCTL_MAKE_SNAPSHOT` IOCTL (0x222004) - **Heal**: Restores the last known-good snapshot via `IOCTL_RESTORE_SNAPSHOT` (0x222010), rolling back any malicious modifications - **Scan**: Delegates to the MemoryScope analysis library for deep inspection ### Technology Advancements Achieved **1. Zero-Allocation Telemetry** MithraCore's hot path (AMSI check, ETW logging, error handling) is designed to run without any managed heap allocations. This means: - No GC pauses during high-frequency telemetry sampling - Predictable latency for security-critical detection - The `PerformanceValidator` benchmarks this to verify sub-microsecond overhead **2. IL-Level AMSI Monitoring** Rather than calling `AmsiScanBuffer` (which malware can hook), MithraCore emits IL bytecode at runtime to read the **raw memory address** of the `amsiInitFailed` static field. This is a novel approach it doesn't rely on any API call that an attacker could intercept. **3. EPT-Based Containment** Traditional EDR can terminate or quarantine processes, but kernel-level malware can resist these actions. Mithra's hypervisor operates at Ring -1, where the guest OS has no visibility. By marking pages as non-executable at the EPT level, Mithra can freeze malicious code even if the kernel is compromised. **4. Shadow Memory Rollback** The Sentinels driver maintains shadow copies of process memory snapshots. When a process is found to be compromised, `RestoreSnapshot` writes back the original memory image, effectively "healing" the process. This is more granular than killing and restarting it preserves process state while removing the malicious modifications. **5. Ensemble ML with Production ONNX Pipeline** The 3-model ensemble is trained in Python (TensorFlow/Keras), converted to ONNX, and served via `Microsoft.ML.OnnxRuntime` in the Orchestrator. This gives: - Framework-agnostic model portability - Hardware-accelerated inference (ONNX Runtime uses MKL-DNN/cuDNN) - Ensemble diversity through different random seeds and early stopping **6. Hypervisor-Enhanced Telemetry Vector** The `MLBridge.cs` feature vector uniquely combines **user-space indicators** (AMSI, WDAC, WMI) with **Ring -1 hypervisor metrics** (EPT fault counts, page isolation events). This cross-layer correlation enables detection of attacks that are invisible to any single layer. ### Use Cases | Scenario | How Mithra Responds | |----------|-------------------| | Process hollowing | FSM detects: suspended creation cross-process memory write thread injection. ML scores 0.87 EPT isolation | | AMSI bypass | `AmsiMonitor` detects `amsiInitFailed = true` immediate critical alert process termination | | WDAC tampering | `WdacVerifier` detects enforcement drop from Enforced to AuditMode SecurityAlert fired | | Kernel rootkit | EPT monitoring detects unauthorized memory page modifications shadow rollback heals affected pages | | Mass process creation | WMI monitor tracks creation velocity if abnormal, feeds into ML soft containment of spawning process | | Memory-resident malware | Snapshot/Heal cycle: capture clean state detect anomaly restore clean snapshot via `RestoreSnapshot` IOCTL | --- ## 8. Troubleshooting ### Build Errors | Error | Cause | Fix | |-------|-------|-----| | CS0117 `AmsiMonitor.IsAmsiDisabled` | Missing helper method | Ensure audit fix applied method now wraps `TryGetAmsiState` | | CS0234/CS0246 in Mithra.UI | Missing project references | Verify `Mithra.UI.csproj` has all 4 `ProjectReference` entries | | CS0246 `PageInfo` | Type not found | Ensure `Mithra.Common.csproj` includes `PageInfo.cs` | | CS1061 `MLContext.Dispose()` | MLContext not disposable | Audit fix removes invalid calls verify MLBridge.cs is updated | | CS0117 `SentinelsIoctl.RestoreSnapshot` | Missing IOCTL constant | Ensure `SentinelsDefinitions.cs` has all 6 `const uint` definitions | | NuGet restore fails for MithraCore | packages.config legacy style | Run `nuget restore Mithra.sln` or `msbuild -t:Restore` | ### Runtime Errors | Error | Cause | Fix | |-------|-------|-----| | "Cannot open Sentinels device" | Driver not loaded | Run `SentinelDriverInstaller.InstallAndStart()` or `sc start Sentinels` | | "Access Denied" | Not running as Administrator | Right-click Run as Administrator, or add `requireAdministrator` manifest | | "Failed to open Service Control Manager" | Non-admin or SCM blocked | Ensure UAC elevation; check group policy `SeCreateGlobalPrivilege` | | Driver status OFFLINE in UI | Driver service stopped | Check `sc query Sentinels`; verify `Sentinels.sys` exists and is signed | | ML prediction timeout | Model not loaded or slow | Check `ModelPath` in `MLBridgeOptions`; increase `PredictionTimeoutMs` | | HeartbeatMonitor stops after 3 failures | Driver unresponsive | Check driver logs; verify device handle not closed; restart driver service | | Memory dump fails | `OpenProcess` returns 0 | Ensure `SeDebugPrivilege` is enabled (automatic with Administrator) | ### Driver Issues ```powershell # Check if driver is running sc query Sentinels # View driver installation log Get-WinEvent -LogName System | Where-Object {$_.ProviderName -eq "Sentinels"} | Select-Object -First 10 # Verify test signing is enabled (development only) bcdedit /enum | findstr testsigning # Enable test signing (reboot required) bcdedit /set testsigning on # Reboot, then: sc start Sentinels ``` --- ## Quick Start Checklist ``` 1. Install Visual Studio 2022 + .NET Framework 4.8 Developer Pack 2. Install Python 3.10+ with ML dependencies 3. Open Mithra.sln in Visual Studio 4. Restore NuGet Packages 5. Run train_pipeline.py to train ML models 6. Run convert_to_onnx.py to convert to ONNX 7. Copy ONNX models + scaler to Mithra.Orchestrator/Models/ 8. Build Solution (Release|x64) 9. Install Sentinels.sys driver (as Administrator) 10. Launch Mithra.UI.exe (as Administrator) 11. Verify "Driver: ONLINE" in the dashboard 12. Run MithraCore.exe check to verify security posture 13. Start Mithra.Orchestrator.exe for ML scoring ``` --- *This guide covers the Mithra EDR platform created by: Justin Linwood Ross (December 2025-August 2026).* ]]> Programming Justin_52 https://www.daniweb.com/programming/threads/545363/mithra-edr-platform-for-those-building-hypervisors-and-training-using-py Shadcn is Trending ? https://www.daniweb.com/programming/threads/545304/shadcn-is-trending Mon, 10 Aug 2026 10:58:35 +0000 Working in reactjs since 5 years nowdays I have mostly web devs using shadcn is it great ? Working in reactjs since 5 years nowdays I have mostly web devs using shadcn is it great ?

]]> Programming SanjayJoshi https://www.daniweb.com/programming/threads/545304/shadcn-is-trending code to implement such calculation of 46,821 × 58,37 https://www.daniweb.com/programming/threads/545238/code-to-implement-such-calculation-of-46-821-58-37 Thu, 23 Jul 2026 14:23:14 +0000 Is there an efficient algorithmic implementation of this multiplication technique? I recently came across a grid-based method for multiplying large numbers using a lattice of digit products summed along diagonals with carry propagation and I'm curious whether this has been implemented computationally, and where it might have practical ... Is there an efficient algorithmic implementation of this multiplication technique?

I recently came across a grid-based method for multiplying large numbers using a lattice of digit products summed along diagonals with carry propagation and I'm curious whether this has been implemented computationally, and where it might have practical value beyond a teaching tool.

As a concrete example: multiplying 46,821 58,379 using this method. I found a short visual walkthrough of the process here, which shows the diagonal-summing step clearly: https://www.youtube.com/watch?v=WuTXZhIYMJQ

A few things I'd love input on:

Has this been implemented in any programming language / library, and does it offer any computational advantage over standard schoolbook multiplication?
Is this used anywhere in practice education, mental math training, or elsewhere beyond being a visualization of the same underlying arithmetic?

Appreciate any pointers or resources.

]]> Programming Joshua_54 https://www.daniweb.com/programming/threads/545238/code-to-implement-such-calculation-of-46-821-58-37