LayeredSyscall: Two-Layer Handler Architecture

Execution Flow Application Code NULL dereference → Exception triggered (or chosen trigger: INT 3, UD2, etc.) LAYER 1: Detection Handler ✓ Initial exception fires ✓ Scan ntdll, find syscall gadget ✓ Set Dr0 breakpoint (syscall) ✓ Set Dr1 breakpoint (return instruction) ✓ Resume execution normally LAYER 2: Execution Handler ✓ Breakpoint triggers inside ntdll ✓ Enable Trap Flag (instruction trace) ✓ Monitor RIP within ntdll ✓ Before RET: inject syscall via CONTEXT.Rip ✓ Spoof stack frames to hide origin Stack Frame Result Application Code (0x00400000) MessageBoxA (kernel32) ntdll internals + Syscall (0x7ffc****)

Layer 1: Detection

Setup phase. Triggered by initial exception. We prepare breakpoints and scan for the syscall gadget without modifying normal execution flow.

Layer 2: Execution

Execution phase. Triggered when execution reaches our monitored breakpoints inside ntdll. We hijack and inject the syscall from legitimate system code context.