Developer knowledge network ยท moderated exchange

Onbetrouwbare Code-gemeenschap

Ontwikkelaarsonderzoek, reverse engineering en coderingsgemeenschap

Knowledge indexLive
4Categories
919Threads
2.8KBerichten
Subforums Leiderbord Log in om te posten
Guide

Direct Syscall invocation (NtProtectVirtualMemory) in x64 assembly

x64_assembler
Assembly Guru
MEMBER
Vertegenwoordiger: 99
Datum van deelname: Sep 2022
Berichten: 14
Bedankt: 16
1 maanden geleden ยท Jul 20, 2026 7:07 PM
#1

Bypassing userland hooks on VirtualProtect by executing syscalls directly:

ASM
.code
; NTSTATUS Syscall_NtProtectVirtualMemory(HANDLE ProcessHandle, PVOID* BaseAddress, PSIZE_T RegionSize, ULONG NewProtect, PULONG OldProtect)
Syscall_NtProtectVirtualMemory proc
    mov r10, rcx             ; Syscall convention moves RCX -> R10
    mov eax, 50h             ; Syscall number for NtProtectVirtualMemory (Win 10/11)
    syscall
    ret
Syscall_NtProtectVirtualMemory endp
end

Executes kernel transition directly without jumping through hooked ntdll.dll stub!

kernel_komrade
Driver Dev
MEMBER
Vertegenwoordiger: 145
Datum van deelname: Feb 2019
Berichten: 26
Bedankt: 45
1 maanden geleden ยท Jul 20, 2026 9:07 PM
#2

To support different Windows builds dynamically, read the syscall number (SSN) from ntdll.dll export by parsing mov eax, SSN instruction bytes.

vtable_slayer
Senior Reverser
MEMBER
Vertegenwoordiger: 215
Datum van deelname: Mar 2018
Berichten: 86
Bedankt: 61
1 maanden geleden ยท Jul 21, 2026 7:13 AM
#3

Direct syscalls bypass 100% of userland EDR API hooks.