Status: Active Investigation | Focus: Persistent Managed Environments and Shadow OS

This repository documents findings on Shadow Management architectures across modern operating systems. The research focuses on how hidden network drives, Unicode obfuscation, and hardware-level bridges (such as vehicle CAN bus systems) are used to maintain persistence through factory resets and forensic wipes.

Chapter 1 Document

• The cursh Wrapper: Bypassing Recovery Layers.
• Homoglyph Loops: Using Unicode for I/O recursion.
• Photo Ref A: UEFI Discrepancies in Boot Sequence.

Chapter 2 Document

• HID Profile Spoofing: Unauthorized Account Creation.
• Wi-Fi Direct Managed Images: Loading remote OS layers as local.

Chapter 3 Document

• Ghost Drives: Hijacking system-reserved partitions.
• Name Swapping: Manipulating Kernel Mount Logs.

• OS: Kali Linux, macOS (Managed), iOS.
• Hardware: Flipper Zero, CAN Bus Adapters, Vehicle Navigation Gateways.
• Methods: Memory Corruption (CVE-2026-20700), Privilege Escalation.

"All drives and operating systems with hidden management and most likely network drives booting as local drive but name swapping or Unicode control or localization to stay hidden."

Contact: Keytan Strong | kxs208@shsu.edu Keytanstrong@gmail.com