voidsyscall

Zero WinAPI. Every NT primitive resolved at runtime from ntdll in memory — SYSCALL instructions issued directly via Plan9 assembly stubs, no import table, no ntdll usermode hooks touched. C2 over HTTPS / DNS / ICMP, AES-256-GCM per message. Windows native. Linux builds. macOS builds.

This is not a syscall wrapper library. It's a full implant framework where every operation — from injecting code to reading files to persisting in the registry — goes through raw Nt* syscalls resolved at boot from the current ntdll export table. No WinAPI calls exist in the binary. Nothing for an EDR to hook at usermode.

What's inside

Syscall engine

• Runtime SSN resolution: PEB → LDR → ntdll base → PE export table → djb2 hash match → prologue scan for B8 xx xx 00 00 0F 05 (direct) or 4C 8B D1 B8 xx xx 00 00 0F 05 (Hells Gate). Every function name is hashed at compile time — no plaintext strings in the binary.
• Direct syscall: Plan9 asm (asm_amd64.s) loads the SSN into EAX, sets 7 args by hand, executes SYSCALL. Return via RAX/RDX.
• Indirect syscall: Locates a 0F 05 C3 gadget (syscall;ret) inside ntdll, calls through it. The CPU trap lands inside ntdll — call stack shows ntdll frames, not implant frames. No usermode hook survives.
• SSN fingerprint: Dumps all resolved SSNs from the current ntdll build, generates a fingerprint hash. Export as hex, import on another machine. Detects build mismatches before they burn you.
• Unhook: Locks .text to RWX, copies original bytes from the disk- mapped ntdll, restores protection, flushes icache, nukes SSN cache. Every usermode hook placed by any EDR is gone.

Injection — 4 methods, polymorphic rotation

The agent rotates through injection techniques automatically. Each call uses a different method — no two injections look the same in forensics.

Anti-analysis — 13+ detection methods

Runs all checks, returns a scored threat report. Auto-destruct on Critical.

Token operations

All via Nt* syscalls, no WinAPI.

• EnablePrivilege(index) — set any privilege by LUID
• EnableAllTokenPrivileges() — 20 privileges at once (Debug, Impersonate, TCB, Backup, Restore, etc.)
• GetProcessTokenIntegrityLevel() — query mandatory integrity
• StealProcessToken(pid) — open + duplicate another process token
• ImpersonateThread() / RevertToSelf()

VAD operations

• EnumVirtualMemory() — walk all virtual regions via NtQueryVirtualMemory
• FindWritableExecRegions() — find PAGE_EXECUTE_READWRITE committed regions
• HideRegion() — set PAGE_NOACCESS to hide memory from scanners
• UnhideRegion() — restore original protection

File I/O — all Nt* syscalls

NtCreateFile → NtReadFile / NtWriteFile → NtClose. Zero CreateFileA, ReadFile, WriteFile, or DeleteFileW calls. ReadFileContents(), WriteFileContents(), DeleteFileNt(), FileExists().

Registry persistence — all Nt* syscalls

NtCreateKey → NtSetValueKey. AddRunKeyPersistence(), RemoveRunKeyPersistence(). No RegCreateKeyEx, RegSetValueEx, or any Advapi32 calls.

Handle operations

• EnumerateSystemHandles() — all open handles in the system via NtQuerySystemInformation(SystemHandleInformation)
• FindEDRHandles() — matches owner PIDs against 30+ known EDR process names (MsSense, CrowdStrike, Sentinel, Cylance, Carbon Black, etc.)
• CloseEDRHandles() — closes monitoring handles the EDR placed in your process
• IsProcessMonitored() — boolean check: are we being watched?

Memory encryption

• Vault: In-memory XOR cipher with auto re-keying on a timer. Plaintext never stored raw. Re-key decrypts → generates new key → re-encrypts. Forensic heap dumps between re-key intervals get garbage.
• SecureDelete: 3-pass wipe (random → zeros → ones → zeros) before NtFreeVirtualMemory.
• StackEncrypt: Encrypt stack-allocated buffers before return. Stack frame reuse makes forensics unreliable.

AMSI / ETW / evasion patches

• PatchAMSI() — AmsiScanBuffer → MOV EAX, 0; RET
• PatchETW() — EtwEventWrite → RET
• PatchNtTraceEvent() — NtTraceEvent → RET
• PatchDbgUiRemoteBreakin() — thread breakin → RET
• PatchInstrumentationCallbacks() — ThreadHideFromDebugger

C2 channels

All channels implement the Channel interface. Adding NTP, DoH, or TURN means implementing the interface — zero agent changes.

Crypto

AES-256-GCM per-message AEAD. Unique 12-byte nonce per message. Per-implant keyring. Passphrase-based key derivation available. 3 tests, all passing.

Layout

voidsyscall/
  syscallwin/          Direct/indirect NT syscalls + evasion
    asm_amd64.s        Syscall/IndirectSyscall/ReadGSBase/SetGSBase/asm_cpuid/asm_rdtsc
    resolve.go         PEB→LDR→ntdll walk, PE export parse, SSN cache, prologue scan
    stubs.go           ~25 Nt* wrappers, DirectSyscall, IndirectSyscallByHash
    hash.go            djb2 hash (string + UTF-16 pointer)
    constants.go       MEM_*, PAGE_*, THREAD_*, TOKEN_*, OBJ_*, REG_*, FILE_*, STATUS_*
    unhook.go          UnhookNtdll, SelfDel
    peb.go             PEB patching (BeingDebugged, NtGlobalFlag, Heap, DebugPort)
    token.go           Privilege escalation, token theft, impersonation
    vad.go             VAD enumeration, hide/unhide regions
    files.go           File I/O via Nt* syscalls
    registry.go        Registry persistence via Nt* syscalls
    fingerprint.go     SSN dump, build fingerprint, hex export/import
    inject_advanced.go 4 injection methods: section mapping, hollow, APC, module stomp
    antianalysis.go    VM/sandbox/debug/timing detection, scored threat report
    handles.go         System handle enumeration, EDR handle killer
    memcrypt.go        Vault (re-keying XOR), SecureDelete, StackEncrypt, WipeMemory
  syscallnix/          Linux/darwin raw syscalls
  patches/             AMSI, ETW, NtTraceEvent, DbgUiRemoteBreakin, InstrumentationCallbacks
  loader/              CreateThread/APC/module-stomp injection
  channels/            HTTP, DNS (TXT), ICMP — Channel interface
  crypto/              AES-256-GCM, envelope, passphrase variant (3 tests)
  server/              SessionManager, Task Queue, interactive REPL
  agent/               Config, beacon loop, 10 task handlers
  cmd/server/main.go   CLI with REPL
  cmd/agent/main.go    Windows-only entrypoint

Build

GOOS=windows GOARCH=amd64 go build -ldflags="-s -w" -o voidsyscall-agent.exe   ./cmd/agent
GOOS=windows GOARCH=amd64 go build -ldflags="-s -w" -o voidsyscall-server.exe  ./cmd/server
GOOS=linux   GOARCH=amd64 go build -ldflags="-s -w" -o server-linux            ./cmd/server
GOOS=darwin  GOARCH=arm64 go build -ldflags="-s -w" -o server-darwin           ./cmd/server

Obfuscation with garble:

GOOS=windows GOARCH=amd64 garble -literals -tiny build -ldflags="-s -w" \
    -o voidsyscall-agent.exe ./cmd/agent

Usage

Server

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes
./voidsyscall-server.exe --cert cert.pem --key key.pem --https-port 443

Agent

./voidsyscall-agent.exe -c agent/example-config.json

Task protocol

SSN resolution internals

1. ReadGSBase (asm) → GS:[0x60] → TEB
2. TEB+0x60 → PEB. PEB+0x18 → Ldr
3. Walk InMemoryOrderModuleList → match ntdll.dll via djb2 hash
4. Base → IMAGE_DOS_HEADER → e_lfanew → IMAGE_NT_HEADERS → DataDirectory[0] = Export Table
5. Walk AddressOfNames[], djb2 each, match target
6. Resolve ordinal → AddressOfFunctions[ordinal] → function address
7. Scan prologue for B8 xx xx 00 00 0F 05 (direct), B8 xx xx 00 00 C3 (early-ret), or 4C 8B D1 B8 xx xx 00 00 0F 05 (Hells Gate)

No function names in binary. Only djb2 hashes. The syscall instruction bypasses every usermode hook.

Agent task handlers

TaskShell       // exec via cmd.exe
TaskInject      // polymorphic: section/hollow/APC/stomp
TaskPatch       // AMSI/ETW/both
TaskEvasion     // PEB patches + VM/sandbox/debug/timing detection
TaskHandles     // enumerate + kill EDR monitoring handles
TaskFingerprint // dump SSN build fingerprint
TaskToken       // privilege escalation + impersonation
TaskVault       // encrypted in-memory storage
TaskSleep       // jitter-aware sleep
TaskExit        // clean shutdown

Status

Shipped: Beacon loop, task queue, 3 C2 channels, 4 injection methods, 10+ evasion checks, handle enumeration/closure, token manipulation, VAD ops, file I/O, registry persistence, SSN fingerprinting, memory encryption, AMSI/ETW patching, AES-GCM crypto, session management, interactive REPL. 3 crypto tests pass. go build clean on Windows.

Not yet: Linux autonomous agent (builds exist, no agent logic), session key rotation, staged loader, NTP/DoH channels, persistence scheduling.

Acknowledgments

• carved4/go-native-syscall
• Enelg52/OffensiveGo
• am0nsec/HellsGate
• f1zm0/acheron
• Sliver C2

License

MIT — LICENSE