Developer knowledge network ยท moderated exchange

Komunitas Kode Tidak Dapat Diandalkan

Riset Pengembang, Rekayasa Terbalik & Komunitas Pengkodean

Knowledge indexHidup
4Categories
919Threads
2.8KPostingan
Subforum Papan peringkat Masuk ke Posting
Guide

Direct Syscall invocation (NtProtectVirtualMemory) in x64 assembly

x64_assembler
Assembly Guru
MEMBER
Reputasi: 99
Tanggal Bergabung: Sep 2022
Postingan: 14
Terima kasih: 16
1 bulan yang lalu ยท Jul 20, 2026 7:07 PM
#1

Bypassing userland hooks on VirtualProtect by executing syscalls directly:

ASM
.code
; NTSTATUS Syscall_NtProtectVirtualMemory(HANDLE ProcessHandle, PVOID* BaseAddress, PSIZE_T RegionSize, ULONG NewProtect, PULONG OldProtect)
Syscall_NtProtectVirtualMemory proc
    mov r10, rcx             ; Syscall convention moves RCX -> R10
    mov eax, 50h             ; Syscall number for NtProtectVirtualMemory (Win 10/11)
    syscall
    ret
Syscall_NtProtectVirtualMemory endp
end

Executes kernel transition directly without jumping through hooked ntdll.dll stub!

kernel_komrade
Driver Dev
MEMBER
Reputasi: 145
Tanggal Bergabung: Feb 2019
Postingan: 26
Terima kasih: 45
1 bulan yang lalu ยท Jul 20, 2026 9:07 PM
#2

To support different Windows builds dynamically, read the syscall number (SSN) from ntdll.dll export by parsing mov eax, SSN instruction bytes.

vtable_slayer
Senior Reverser
MEMBER
Reputasi: 215
Tanggal Bergabung: Mar 2018
Postingan: 86
Terima kasih: 61
1 bulan yang lalu ยท Jul 21, 2026 7:13 AM
#3

Direct syscalls bypass 100% of userland EDR API hooks.