docs: record third-party provenance, citation, and author name

Add THIRD-PARTY-NOTICES.md with the reuse basis (upstream license, author
permission, or reimplemented reproducer/technique) for each leak component
adapted from third-party proof-of-concept code, and note that basis in the
five affected component headers.

Add CITATION.cff for GitHub's "Cite this repository" entry and a README
"Citing" section with matching BibTeX; repoint the README license section at
the notices file. Set the author name to "Brendan Coles" in LICENSE,
CITATION.cff, README, and the kasld(1) / ksymoff(1) AUTHOR lines.

Author: bcoles

CITATION.cff

@@ -0,0 +1,18 @@
+cff-version: 1.2.0
+message: "If you use KASLD, please cite it as below."
+title: "KASLD: Kernel Address Space Layout Derandomization"
+abstract: >-
+  Recovers the Linux kernel's virtual and physical memory layout — primarily
+  the kernel text base — from a local process, to defeat KASLR.
+type: software
+authors:
+  - given-names: "Brendan"
+    family-names: "Coles"
+repository-code: "https://github.com/bcoles/kasld"
+url: "https://github.com/bcoles/kasld"
+license: MIT
+# Cite the latest release, not the in-development VERSION (master is x.y.z-dev).
+# `make bump-version` updates these two lines on release; `tests/check-version`
+# requires the cited version to be a real release (never a -dev string).
+version: "0.3.0"
+date-released: "2026-06-19"

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2019 bcoles
+Copyright (c) 2019 Brendan Coles
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -206,7 +206,36 @@ make cross
 
 ## License
 
-KASLD is MIT licensed. It incorporates modified third-party code
-snippets and proof-of-concept code; those snippets may carry different
-license terms. See the reference URLs in each file's comment header
-for credits and license details.
+KASLD is MIT licensed (see [LICENSE](LICENSE)). Some leak components adapt
+third-party proof-of-concept code or implement a technique first published by
+others; each such file credits its original author and source in its header,
+and [THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md) lists each with its license
+or reuse basis (upstream license, author permission, or technique/reproducer
+material reimplemented here).
+
+## Citing KASLD
+
+KASLD is MIT licensed — attribution is not required for use, but if you
+reference it in research, tooling, exploits, or writing, a citation or link is
+appreciated:
+
+> **KASLD: Kernel Address Space Layout Derandomization**, Brendan Coles,
+> https://github.com/bcoles/kasld
+
+BibTeX:
+
+```bibtex
+@software{kasld,
+  title   = {KASLD: Kernel Address Space Layout Derandomization},
+  author  = {Coles, Brendan},
+  url     = {https://github.com/bcoles/kasld},
+  version = {0.3.0},
+  year    = {2026}
+}
+```
+
+GitHub also shows a *"Cite this repository"* button from
+[CITATION.cff](CITATION.cff). For an unreleased build from `master`, cite the
+specific commit and the date accessed — e.g. `bcoles/kasld@<commit>`
+(accessed YYYY-MM-DD) — since `-dev` version strings are not unique to a single
+commit.

THIRD-PARTY-NOTICES.md

@@ -0,0 +1,26 @@
+# Third-party notices
+
+KASLD is licensed under the MIT License (see [LICENSE](LICENSE)). Most of the
+code is original. Some leak components adapt third-party proof-of-concept code,
+and some implement a technique first published by others; each such component
+credits its origin in its file header. This file collects those credits with
+the source and reuse basis for each.
+
+| Component | Original author(s) | Source | Basis for reuse |
+|---|---|---|---|
+| `kernelsnitch` | IAIK, Graz University of Technology | https://github.com/IAIK/KernelSnitch | Upstream is MIT — honored; attribution retained. |
+| `echoload` | Claudio Canella, Michael Schwarz, Martin Haubenwallner, Martin Schwarzl, Daniel Gruss | https://github.com/cc0x1f/store-to-leak-forwarding | Used with the authors' permission. |
+| `databounce` | Claudio Canella, Michael Schwarz, Martin Haubenwallner, Martin Schwarzl, Daniel Gruss | https://github.com/cc0x1f/store-to-leak-forwarding | Used with the authors' permission. |
+| `qemu_tcg_iret` | @_leave07 and @prosti | https://kqx.io/post/qemu-nday/ | Used with the authors' permission. |
+| `perf_event_open` | lizzie | https://blog.lizzie.io/kaslr-and-perf.html | Adapted with the author's knowledge; substantially reworked since. |
+| `entrybleed` | Will (William Liu) | https://www.willsroot.io/2022/12/entrybleed.html | Adapted with the author's knowledge (the EntryBleed paper references KASLD). |
+| `proc_kallsyms` | spender (Brad Spengler) | https://grsecurity.net/~spender/exploits/exploit.txt | Rewritten; used with the author's knowledge. |
+| `mincore` | Jann Horn | https://bugs.chromium.org/p/project-zero/issues/detail?id=1431 | Adapted from the author's minimal bug reproducer (CVE-2017-16994) and reimplemented. |
+| `bcm_msg_head_struct` | Norbert Slusarek | https://www.openwall.com/lists/oss-security/2021/06/15/1/2 | Adapted from the author's minimal bug reproducer (CVE-2021-34693) and reimplemented. |
+| `sysfs_kernel_notes_xen` | Nassim-Asrir (@p1k4l4) | https://github.com/Nassim-Asrir/ZDI-24-020 | Technique credit; reimplemented in KASLD's own code. |
+| `prefetch` | Daniel Gruss et al. (technique); Will (timing asm) | https://gruss.cc/files/prefetch.pdf ; EntryBleed | Implements the published technique; adapts the EntryBleed timing asm. |
+| `zombieload` | ZombieLoad authors (Michael Schwarz, Moritz Lipp, et al., IAIK) | https://github.com/IAIK/ZombieLoad | Implements the published technique in KASLD's own code (`src/include/sidechannel.h`). |
+
+Each component's full credit and reference URLs are in its file header under
+`src/components/`. Upstream licenses, where they exist, are honored;
+adaptations used with permission are noted above.

man/kasld.1

@@ -205,4 +205,4 @@ The guides under
 .I <prefix>/share/doc/kasld/
 cover usage, exploitation, and the inference engine in depth.
 .SH AUTHOR
-KASLD is maintained by bcoles <bcoles@gmail.com>.
+KASLD is maintained by Brendan Coles <bcoles@gmail.com>.

man/ksymoff.1

@@ -204,4 +204,4 @@ only when the symbol source is an ELF file.
 .BR nm (1),
 .BR readelf (1)
 .SH AUTHOR
-KASLD is maintained by bcoles <bcoles@gmail.com>.
+KASLD is maintained by Brendan Coles <bcoles@gmail.com>.

src/components/bcm_msg_head_struct.c

@@ -5,6 +5,7 @@
 //
 // Mostly taken from original PoC by Norbert Slusarek:
 // https://www.openwall.com/lists/oss-security/2021/06/15/1/2
+// The original was a minimal proof-of-concept reproducer; reimplemented here.
 //
 // Leak primitive:
 //   Data leaked:      kernel stack pointer (uninitialized struct padding)

src/components/databounce.c

@@ -47,6 +47,9 @@
 // https://github.com/cc0x1f/store-to-leak-forwarding-there-and-back-again
 // https://i.blackhat.com/asia-20/Friday/asia-20-Canella-Store-To-Leak-Forwarding-There-And-Back-Again-wp.pdf
 //
+// The store-to-leak reference code (cc0x1f) is used with the authors'
+// permission.
+//
 // KASLD_BUILD_NO_OPTIMIZE: built -O0 (Makefile) so the optimizer cannot reorder
 // or elide the timing / cache-probe / speculation measurements this technique
 // relies on; a per-function no-opt attribute is not a reliable substitute.

src/components/echoload.c

@@ -50,6 +50,9 @@
 // https://github.com/cc0x1f/store-to-leak-forwarding-there-and-back-again
 // https://i.blackhat.com/asia-20/Friday/asia-20-Canella-Store-To-Leak-Forwarding-There-And-Back-Again-wp.pdf
 //
+// The store-to-leak reference code (cc0x1f) is used with the authors'
+// permission.
+//
 // KASLD_BUILD_NO_OPTIMIZE: built -O0 (Makefile) so the optimizer cannot reorder
 // or elide the timing / cache-probe / speculation measurements this technique
 // relies on; a per-function no-opt attribute is not a reliable substitute.

src/components/kernelsnitch.c

@@ -46,6 +46,8 @@
 // References:
 // https://lukasmaar.github.io/papers/ndss25-kernelsnitch.pdf
 // https://github.com/IAIK/KernelSnitch
+//
+// The IAIK/KernelSnitch reference code is MIT licensed; attribution retained.
 // ---
 // <bcoles@gmail.com>