Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".
-
Updated
Jan 19, 2024 - C
Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".
The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls
Malleable shellcode loader written in C and Assembly utilizing direct or indirect syscalls for evading EDR hooks
shellcode loader that uses indirect syscalls written in D Lang The loader bypasses user-mode hooks by resolving system calls manually from NTDLL using a hash-based method.
Add a description, image, and links to the indirect-syscalls topic page so that developers can more easily learn about it.
To associate your repository with the indirect-syscalls topic, visit your repo's landing page and select "manage topics."