voidsyscall

English | 简体中文 | 조선어 | Русский

Zero WinAPI. Every NT primitive resolved at runtime from ntdll in memory — SYSCALL instructions issued directly via Plan9 assembly stubs, no import table, no ntdll usermode hooks touched. C2 over HTTPS / DNS / ICMP, AES-256-GCM per message. Windows native. Linux builds. macOS builds.

This is not a syscall wrapper library. It's a full implant framework where every operation — from injecting code to reading files to persisting in the registry — goes through raw Nt* syscalls resolved at boot from the current ntdll export table. No WinAPI calls exist in the binary. Nothing for an EDR to hook at usermode.

---

What's inside

Syscall engine

• Runtime SSN resolution: PEB → LDR → ntdll base → PE export table → djb2 hash match → prologue scan for B8 xx xx 00 00 0F 05 (direct) or 4C 8B D1 B8 xx xx 00 00 0F 05 (Hells Gate). Every function name is hashed at compile time — no plaintext strings in the binary.
• Direct syscall: Plan9 asm (asm_amd64.s) loads the SSN into EAX, sets 7 args by hand, executes SYSCALL. Return via RAX/RDX.
• Indirect syscall: Locates a 0F 05 C3 gadget (syscall;ret) inside ntdll, calls through it. The CPU trap lands inside ntdll — call stack shows ntdll frames, not implant frames. No usermode hook survives.
• SSN fingerprint: Dumps all resolved SSNs from the current ntdll build, generates a fingerprint hash. Export as hex, import on another machine. Detects build mismatches before they burn you.
• Unhook: Locks .text to RWX, copies original bytes from the disk- mapped ntdll, restores protection, flushes icache, nukes SSN cache. Every usermode hook placed by any EDR is gone.

Injection — 4 methods, polymorphic rotation

The agent rotates through injection techniques automatically. Each call uses a different method — no two injections look the same in forensics.

Method	How it works	Why it's stealthy
Section mapping	NtCreateSection → NtMapViewOfSection (remote) → NtCreateThreadEx	No RWX allocation in VAD. Section is file-backed. Memory scanners see PAGE_EXECUTE_READ, not PAGE_EXECUTE_READWRITE.
Process hollow	NtCreateUserProcess (suspended) → NtSuspendProcess → zero image base → alloc + write shellcode → NtSetContextThread (RIP = shellcode) → NtResumeProcess	Process appears as legitimate svchost.exe in taskmgr. Only memory contents differ.
APC queuing	Enumerate threads via NtQuerySystemInformation → NtOpenThread → NtQueueApcThread	No new thread created. No new TEB. No new stack allocation. Fires when thread enters alertable wait.
Module stomping	Alloc in target → write minimal PE header + shellcode → NtCreateThreadEx at entry point	Module list shows a plausible DLL name. PE header is valid enough to fool module enumeration.

Anti-analysis — 13+ detection methods

Runs all checks, returns a scored threat report. Auto-destruct on Critical.

Check	Method
VM detection	CPUID leaf 0x40000000 hypervisor signature scan (VMware, VirtualBox, Hyper-V, KVM, Xen, QEMU, Parallels) + leaf 0x40000001 fallback
Sandbox detection	CPU count, registry artifacts (VMware Tools, VBox Guest Additions, VMware/VBox services), sandbox process scan (30+ known names: wireshark, procmon, x64dbg, ida, etc.)
Debugger detection	PEB.BeingDebugged, PEB.NtGlobalFlag, heap debug flags, ProcessDebugPort, ProcessDebugObjectHandle, ProcessDebugFlags, hardware breakpoint DR0-7, timing single-step check
Timing anomaly	RDTSC-based: 50 samples of NtQuerySystemInformation latency, mean/stddev, flag if >10% of samples exceed 3σ variance. Catches instrumentation overhead.
PEB evasion	Patches BeingDebugged, NtGlobalFlag, ProcessHeap flags, DebugPort, ThreadHideFromDebugger — all via GS segment reads + NtWriteVirtualMemory. No API calls.

Token operations

All via Nt* syscalls, no WinAPI.

• EnablePrivilege(index) — set any privilege by LUID
• EnableAllTokenPrivileges() — 20 privileges at once (Debug, Impersonate, TCB, Backup, Restore, etc.)
• GetProcessTokenIntegrityLevel() — query mandatory integrity
• StealProcessToken(pid) — open + duplicate another process token
• ImpersonateThread() / RevertToSelf()

VAD operations

• EnumVirtualMemory() — walk all virtual regions via NtQueryVirtualMemory
• FindWritableExecRegions() — find PAGE_EXECUTE_READWRITE committed regions
• HideRegion() — set PAGE_NOACCESS to hide memory from scanners
• UnhideRegion() — restore original protection

File I/O — all Nt* syscalls

NtCreateFile → NtReadFile / NtWriteFile → NtClose. Zero CreateFileA, ReadFile, WriteFile, or DeleteFileW calls. ReadFileContents(), WriteFileContents(), DeleteFileNt(), FileExists().

Registry persistence — all Nt* syscalls

NtCreateKey → NtSetValueKey. AddRunKeyPersistence(), RemoveRunKeyPersistence(). No RegCreateKeyEx, RegSetValueEx, or any Advapi32 calls.

Handle operations

• EnumerateSystemHandles() — all open handles in the system via NtQuerySystemInformation(SystemHandleInformation)
• FindEDRHandles() — matches owner PIDs against 30+ known EDR process names (MsSense, CrowdStrike, Sentinel, Cylance, Carbon Black, etc.)
• CloseEDRHandles() — closes monitoring handles the EDR placed in your process
• IsProcessMonitored() — boolean check: are we being watched?

Memory encryption

• Vault: In-memory XOR cipher with auto re-keying on a timer. Plaintext never stored raw. Re-key decrypts → generates new key → re-encrypts. Forensic heap dumps between re-key intervals get garbage.
• SecureDelete: 3-pass wipe (random → zeros → ones → zeros) before NtFreeVirtualMemory.
• StackEncrypt: Encrypt stack-allocated buffers before return. Stack frame reuse makes forensics unreliable.

AMSI / ETW / evasion patches

• PatchAMSI() — AmsiScanBuffer → MOV EAX, 0; RET
• PatchETW() — EtwEventWrite → RET
• PatchNtTraceEvent() — NtTraceEvent → RET
• PatchDbgUiRemoteBreakin() — thread breakin → RET
• PatchInstrumentationCallbacks() — ThreadHideFromDebugger

C2 channels

Channel	Wire format	Prereqs
HTTPS	binary POST, custom framing, randomized UA/path	TLS cert
DNS	<idx>-<total>-<base32> subdomain, TXT response	DNS resolution
ICMPv4	payload in echo request/reply ID+seq	raw socket (root/Admin)

All channels implement the Channel interface. Adding NTP, DoH, or TURN means implementing the interface — zero agent changes.

Crypto

AES-256-GCM per-message AEAD. Unique 12-byte nonce per message. Per-implant keyring. Passphrase-based key derivation available. 3 tests, all passing.

---

Layout