shedskin, artifact bundle

Files for the lead post. Each one is a raw research artifact; sanitize before quoting.

• chain-probe.c, chain-probe.exe, native three-arm probe used for the 2026-10-29 provider-chain capture
• provider-chain-run.ps1, PowerShell wrapper for the probe
• provider-chain-2026-10-29.log, raw capture (arm A/B/C result values + oracle controls)
• amsi-dev-provider.c, AmsiDevProvider.dll, register-dev-provider.ps1, the iter19 CRT-free AMSI provider used to produce the arm-B 32769 result
• pwsh-appname-2026-10-29.log, captured ETW event-1101 appname field from live pwsh.exe 7.4.21
• shedskin-cycle-launcher.ps1, the XOR-obfuscated outer-pass launcher that produced the live end-to-end P1/P2/P3 cycle
• end-to-end-cycle-2026-10-29.log, raw transcript of the Mimikatz-pattern BLOCK (pre-shedskin) to EXEC (post-shedskin) differential, EICAR controls fire 32768 both ends
• universal-sig-matrix-2026-10-29.log, 5-payload x 9-appname x 2-encoding cross matrix on current Defender; definitive negative control for the universal-bypass question (EICAR + Rastamouse one-liner fire everywhere; AMSI Test Sample GUID does not fire at all)
• etw-pre-post-launcher.ps1, logman-based ETW capture across the shedskin boundary in one PID
• etw-pre-post-2026-10-29.log, Defender’s own event-1101 verdicts: Mimikatz-pattern through swapped context reads scanResult=1 while EICAR through the same context reads 32768 (bypass + scope ceiling in the same capture)
• direct-scan-reproduction-note-2026-10-29.log, honest FP correction: direct AmsiScanBuffer does NOT reproduce the C3 PowerShell_X-DET row on current sig; the IEX differential remains the authoritative receipt