So far we’ve seen how to hide syscalls: searching for them in ntdll (Hell’s Gate), in neighboring functions (Tartarus’ Gate), or redirecting through kernel32 (Hell’s Hall). VEH Syscalls does somet...

Hell’s Hall is an indirect syscall technique that executes syscall instructions from system DLLs other than ntdll.dll, typically kernel32.dll. By making the return address appear to originate from ...

Tartarus’ Gate is a dynamic syscall discovery technique that locates syscall numbers in adjacent functions when the target function is hooked. Rather than searching within the function itself, it s...

EDR vendors have spent years hooking NTDLL functions to intercept suspicious API calls. Hell’s Gate, published in 2019, offered a clean answer: skip NTDLL entirely and invoke syscalls directly, ext...

Hi all! I like to reverse and crack stuff, and videogames is probably one of the most fun things to hack. Rules are okay but what would have happened if Neo followed the rules?? Exactly, he would ...

Hi all! Exploiting drivers offers tons of possibilities we couldn’t find in userland so it’s important to learn kernel internals because it will become more important for Windows security. Kernel...