Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".

The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls

A modern zero-allocation C++23 library for working with low-level Windows within user-space. Iteration over loaded modules via PEB, EAT iteration, lazy imports, syscalls, and more.

Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low level).

Shellcode loader written in C and Assembly utilizing direct or indirect syscalls to evade UM EDR hooks

This code example allows you to create a malware.exe sample that can be run in the context of a system service, and could be used for local privilege escalation in the context of an unquoted service path, etc. The payload itself can be remotely hosted, downloaded via the wininet library and then executed via direct system calls.

An advanced C++ framework for WoW64 Heaven’s Gate + Indirect Syscall, X64 Hell's Gate, and EDR evasion. Seamlessly load 64-bit kernel32 and bypass user-land hooks.

BypassETWDirectSyscallShellcodeLoader is a robust C++14 application designed for secure and stealthy shellcode execution. It incorporates advanced anti-debugging and anti-sandboxing techniques to evade detection and analysis, making it suitable for penetration testing and security research.

Thread Hijacking malware using direct/indirect syscalls, ntdll and low level utilities, undetected by Windows Defender and BitDefender

Dll injection using direct System Calls, undetected by Windows Defender & Bitdefender

Stealth DLL injector using direct syscalls with Halo's Gate SSN recovery. Bypasses EDR hooks including NtProtectVirtualMemory by using RWX allocation. Inspired by GoSneak.

Trojan that uses direct System Calls to inject shellcode into a target process, undetected by Windows Defender & Bitdefender

Bypassing all EDR hooks while maintaining the cleanest callstack of all time with proxy calls and an exception handler.

Direct NT Syscall Framework -- Bypass ALL userland hooks via direct syscalls. Hell's Gate, Halos Gate, Tartarus Gate. Assembly + Python.

Hell's Gate (Direct System Call)

Simple Implementation of a Driver for Detecting Techniques like SysWhispers, HellsGate & IndirectSyscalls

Single-header direct syscall library for Windows x64. HellsGate + HalosGate SSN resolution, RX stub pool, zero ntdll dependency after init.

A lightweight anti-malware PoC that detects and blocks malware using direct syscalls via windows instrumentation callbacks.