direct-syscalls

Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".

The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls

windows syscalls with a single line and a high level of abstraction. has modern cpp20 wrappers and utilities, range-based DLL and export enumeration, wrapper around KUSER_SHARED_DATA. supported compil...

Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low level).

Malleable shellcode loader written in C and Assembly utilizing direct or indirect syscalls for evading EDR hooks

This code example allows you to create a malware.exe sample that can be run in the context of a system service, and could be used for local privilege escalation in the context of an unquoted service p...

BypassETWDirectSyscallShellcodeLoader is a robust C++14 application designed for secure and stealthy shellcode execution. It incorporates advanced anti-debugging and anti-sandboxing techniques to evad...

Dll injection using direct System Calls, undetected by Windows Defender & Bitdefender

Trojan that uses direct System Calls to inject shellcode into a target process, undetected by Windows Defender & Bitdefender

Hell's Gate (Direct System Call)