Developer knowledge network · moderated exchange

Społeczność UnreliableCode

Badania programistów, inżynieria wsteczna i społeczność programistów

Knowledge indexNa żywo
4Categories
919Threads
2.8KPosty
Podfora Tabela liderów Zaloguj się, aby opublikować
Guide

Direct Syscall invocation (NtProtectVirtualMemory) in x64 assembly

x64_assembler
Assembly Guru
MEMBER
Rozpustnik: 99
Data dołączenia: Sep 2022
Posty: 14
Dzięki: 16
1 miesięcy temu · Jul 20, 2026 7:07 PM
#1

Bypassing userland hooks on VirtualProtect by executing syscalls directly:

ASM
.code
; NTSTATUS Syscall_NtProtectVirtualMemory(HANDLE ProcessHandle, PVOID* BaseAddress, PSIZE_T RegionSize, ULONG NewProtect, PULONG OldProtect)
Syscall_NtProtectVirtualMemory proc
    mov r10, rcx             ; Syscall convention moves RCX -> R10
    mov eax, 50h             ; Syscall number for NtProtectVirtualMemory (Win 10/11)
    syscall
    ret
Syscall_NtProtectVirtualMemory endp
end

Executes kernel transition directly without jumping through hooked ntdll.dll stub!

kernel_komrade
Driver Dev
MEMBER
Rozpustnik: 145
Data dołączenia: Feb 2019
Posty: 26
Dzięki: 45
1 miesięcy temu · Jul 20, 2026 9:07 PM
#2

To support different Windows builds dynamically, read the syscall number (SSN) from ntdll.dll export by parsing mov eax, SSN instruction bytes.

vtable_slayer
Senior Reverser
MEMBER
Rozpustnik: 215
Data dołączenia: Mar 2018
Posty: 86
Dzięki: 61
1 miesięcy temu · Jul 21, 2026 7:13 AM
#3

Direct syscalls bypass 100% of userland EDR API hooks.