IORI_Loader - Bypass EDRs

Description

FUD advanced Loader implementing dynamic indirect syscall with syscall number and syscall instruction Unhooking with Halosgate technic. Shellcode in UUIDs format to avoid static analysis, syscall instructions and syscall number don't exist in the binary opcode which makes it avoid static analysis and they get resolved at run time. also it gets the API addresses from the PEB by offsets and the comparison is done by hashing.

Credits / References

@smelly__vx & @am0nsec ( Creators/Publishers of the Hells Gate technique )

• https://github.com/am0nsec/HellsGate
• The Original Paper

Reenz0h from @SEKTOR7net (Creator of the HalosGate technique )

• https://blog.sektor7.net/#!res/2021/halosgate.md
• https://institute.sektor7.net/rto-win-evasion