Install and run
Shieldbreaker.

01 · Overview

How it works

Shieldbreaker measures how quickly a destructive process can be detected, attributed, and stopped inside a deliberately restricted test environment.

1. 01

   Generate a sealed test area

   The harness creates a fresh directory beneath your local Windows temporary folder and fills it with disposable test files.

2. 02

   Launch controlled workloads

   Known destructive and benign workers operate only inside that generated directory. Their process IDs are retained for scoring, not detection.

3. 03

   Detect and attribute activity

   Filesystem monitoring spots destructive activity while concurrent handle inspection attempts to identify the responsible process.

4. 04

   Contain and report

   The prototype terminates the first independently attributed destructive lab worker, then reports timing and accuracy measurements.

02 · Compatibility

Supported operating systems

macOS, Linux, Windows on ARM, and 32-bit Windows builds are not currently available. The harness depends on Windows filesystem and process APIs.

03 · Setup

Installation

1. 1

   Download the executable

   Download the latest Windows x64 release from GitHub, then save shieldbreaker.exe to a dedicated folder such as C:\Tools\Shieldbreaker.

2. 2

   Verify the checksum

   In PowerShell, calculate the SHA-256 checksum and compare it with the checksum published alongside that GitHub release.

   Get-FileHash .\shieldbreaker.exe -Algorithm SHA256

3. 3

   Review Windows security prompts

   The unsigned research build may trigger Microsoft Defender SmartScreen. Do not bypass a warning unless the checksum matches and you trust the download source.

04 · First run

Run the experiment

Open PowerShell in the download folder and run:

.\shieldbreaker.exe 1000 1 2 0

The arguments are: generated files, destructive actors, benign actors, and milliseconds between deletions. Start with the values above.

05 · Important

Know the safety boundary

The prototype contains the first independently attributed lab worker. It does not yet promise complete protection against real malware or every simultaneous destructive actor.