SIH26148SoftwareBlockchain & Cybersecurity
₹1,50,000 Prize (₹75k Joint)
•Deadline: 20 September 2026
•Submitted Ideas: 0/500
Creation of scripts/functions with new programming language to commence Computer & Network forensic analysis without triggering security solutions
Ministry / Organization: National Technical Research Organisation (NTRO)
Technical Complexity
9/10
Dataset Accessibility
6/10
36h Hackathon Viability
7/10
Step 0 • Zero-Jargon Layman Summary
“You are building a stealthy, custom programming language and toolkit that allows forensic experts to analyze computers without being blocked by antivirus software. It works by constantly changing its own code structure and using advanced techniques to hide its presence from security systems.”
The DecodeX PS Decoder™
Deconstructed Problem Blueprint
Step 1
WHAT TO BUILD?
A custom programming language (JOCKY) and a CI/CD-integrated framework that generates polymorphic, file-less forensic scripts capable of bypassing modern EDR/AV solutions.
Step 2
WHO IS IT FOR?
National Technical Research Organisation (NTRO) and elite cybersecurity forensic teams.
Step 3
WHY DOES IT EXIST?
Modern security software is too aggressive, often blocking legitimate forensic tools. This creates a 'blind spot' where investigators cannot analyze compromised systems because the security tools themselves prevent the necessary deep-system inspection.
Step 4
INPUT → PROCESS → OUTPUT ARCHITECTURE PIPELINE
01 • Inputs & Telemetry
Forensic task parameters, target system metadata, and custom scripts written in JOCKY syntax.
02 • Processing & AI Core
LLVM-based compilation, polymorphic code mutation, CI/CD pipeline obfuscation, and in-memory execution via direct syscalls or BYOVD.
03 • Actionable Deliverables
Forensic reports, system state snapshots, and network traffic logs delivered via secure, disguised cloud channels.
Step 5
CONSTRAINTS
- Must be cross-platform (Windows/Ubuntu).
- Must avoid standard API calls that trigger EDR alerts.
- Must operate in-memory without dropping files to disk.
- Must use domain fronting or legitimate cloud APIs for C2 communication.
Step 6
JURY METRICS
- Detection rate by top-tier AV/EDR (e.g., CrowdStrike, Defender, SentinelOne).
- Success rate of in-memory execution.
- Code mutation entropy (uniqueness of generated binaries).
- Latency of forensic data exfiltration.
Step 7
CORE BOTTLENECK
Implementing a custom LLVM frontend that generates valid, executable machine code while simultaneously applying polymorphic transformations that don't crash the target process.
Why You Should Choose This PS (Pros)
- High-impact, high-complexity problem that demonstrates deep system-level knowledge.
- Clear, measurable success criteria (bypass vs. blocked).
- Strong alignment with national security requirements.
Challenges & Risks to Watch (Cons)
- Extremely high learning curve for kernel-level programming.
- Risk of being flagged as 'malware' by university or hackathon network security.
- Requires advanced knowledge of compiler design and OS internals.
Hackathon Blueprint
Recommended Tech Stack & Grand Finale Features
Frontend & Mobile
React.jsTailwind CSSMonaco Editor for JOCKY IDE
Backend & APIs
Go (for high-performance agents)Python (for CI/CD orchestration)
AI / ML & Models
Custom LLVM passes for code mutationHeuristic-based obfuscation engines
Database & Cloud
PostgreSQLRedis
Killer Features to Impress the SIH Jury
Automated 'Anti-Forensic' detection: The tool detects if it is being analyzed by a sandbox and self-terminates.
Dynamic API Unhooking: Automatically restores original system calls to bypass EDR monitoring.
Visual Forensic Dashboard: Real-time mapping of system artifacts and network connections via a secure web interface.
View Official SIH 2026 Portal Raw Text▼
•Background Modern antivirus solutions restrict proprietary software from executing or creating custom scripts designed to analyze the system for deep forensic system analysis. They rely heavily on behavioral heuristics, static signature matching, common compiler outputs (like standard MSVC or GCC artifacts), typical API call sequences and kernel-level monitoring to intercept activities. However, a significant paradigm shift may occur when programmers adopt sophisticated software engineering practices—specifically continuous integration and continuous deployment (CI/CD).
•Description Creating 'Next-Gen' programming language framework, named as 'JOCKY' using cross-platform compiler (windows & ubuntu) which enables systematic creation of scripts for analyzing malicious activities and also provide the complete digital forensics of the computer or network. By utilizing this specific new developed programming language, the framework will not be hindered by any of the existing anti-virus in the environment. This framework should include various scripts/functions which combined with automated polymorphic engines, custom encryption, and multi-vector in-memory execution via native components or Bring your own vulnerable driver (BYOVD) techniques. Framework also able to handle multiple system analysis simultaneously using central management interface. The traffic b/w management interface and client should be routed through trusted cloud infrastructure or content delivery networks (CDNs) using domain fronting or legitimate cloud APIs.
•Expected Solution The scope of the problem is to create scripts/functions in the proprietary programming language (named JOCKY) which enables the user to detect the adversaries:
1.Independent programming Language
-Programming language or custom Language-independent intermediate representation (LLVM) frontend alters basic control-flow graphs, token generation, and binary structures, rendering signature-based detection ineffective.
2.Polymorphism in scripts/function generated
-Rather than manually packing a binary, the scripts/function in framework uses a continuous delivery pipeline. Every iteration automatically passes through integrated obfuscators, variable-encryption routines, and polymorphic engines. This ensures that every deployment instance possesses unique hashes, modified entry points, and altered import tables, neutralizing traditional file-reputation databases.
3.Living-off-the-Land & BYOVD Execution
-The scripts/functions in framework should avoid standard, noisy API calls for core operations like persistence, privilege escalation, and network routing (SOCKS5). Instead, it relies on:
A.In-Memory Execution: Utilizing multiple distinct file-less techniques (e.g., process hollowing, reflective DLL injection, API unhooking, direct system calls, or thread execution hijacking) to run secondary script entirely within the memory space of trusted processes.
B.Kernel-Level Subversion: Detection of legitimate or vulnerable third-party drivers (BYOVD) to disable EDR callbacks or manipulate kernel structures directly, blinding security agents running in user or kernel space.