daem0nc0re/atomicsyscallTools and PoCs for Windows syscall investigation.
Windows syscall 조사를 위한 도구 및 PoC.
이 디렉터리는 Heaven's Gate 기법을 위한 것입니다. README.md를 참조하세요.
이 도구는 ntdll.dll 또는 win32u.dll에서 Windows syscall을 덤프하기 위한 것입니다:```
C:\Tools>SyscallDumper.exe -h
SyscallDumper - Tool to dump syscall.
Usage: SyscallDumper.exe [Options] [INPUT_DLL_1] [INPUT_DLL_2]
-h, --help : Displays this help message.
-d, --dump : Flag to dump syscall from ntdll.dll or win32u.dll.
-D, --diff : Flag to take diff between 2 dlls.
-f, --format : Specifies output format. "c" for C/C++, "cs" for CSharp, "py" for Python.
-n, --number : Specifies syscall number to lookup in decimal or hex format.
-o, --output : Specifies output file (e.g. "-o result.txt").
-s, --search : Specifies search filter (e.g. "-s createfile").
INPUT_DLL_1 : Specifies path of ntdll.dll or win32u.dll. Older one in diffing.
INPUT_DLL_2 : Specifies path of ntdll.dll or win32u.dll. Newer one in diffing.
ntdll.dll 또는 win32u.dll에서 syscall 번호를 덤프하려면 `-d`(`--dump`) 옵션을 사용하세요. 소스 DLL을 지정하지 않으면 이 도구는 `C:\Windows\System32\ntdll.dll` 및 `C:\Windows\System32\win32u.dll`에서 syscall 번호를 덤프합니다:```
C:\Tools>SyscallDumper.exe -d
[*] No target is specified.
[>] Dumping from system default ntdll.dll and win32u.dll.
[>] Loading C:\Windows\System32\ntdll.dll.
[+] C:\Windows\System32\ntdll.dll is loaded successfully.
[*] Architecture : AMD64
[*] Image Name : ntdll.dll
[+] Got 463 syscall(s).
[>] Loading C:\Windows\System32\win32u.dll.
[+] C:\Windows\System32\win32u.dll is loaded successfully.
[*] Architecture : AMD64
[*] Image Name : win32u.dll
[+] Got 1258 syscall(s).
[Syscall Table from C:\Windows\System32\ntdll.dll]
---------------------------------------------------------------------------------
| Syscall Name | Number | Number (hex) |
---------------------------------------------------------------------------------
| NtAcceptConnectPort | 2 | 0x0002 |
| NtAccessCheck | 0 | 0x0000 |
--snip--
| NtWriteVirtualMemory | 58 | 0x003A |
| NtYieldExecution | 70 | 0x0046 |
---------------------------------------------------------------------------------
[*] Found 463 syscall(s).
[Syscall Table from C:\Windows\System32\win32u.dll]
-----------------------------------------------------------------------------------
| Syscall Name | Number | Number (hex) |
-----------------------------------------------------------------------------------
| NtBindCompositionSurface | 4373 | 0x1115 |
| NtCloseCompositionInputSink | 4374 | 0x1116 |
--snip--
| NtValidateCompositionSurfaceHandle | 5350 | 0x14E6 |
| NtVisualCaptureBits | 5351 | 0x14E7 |
-----------------------------------------------------------------------------------
[*] Found 1258 syscall(s).
덤프 결과에서 syscall 이름을 필터링하려면 -s (--search) 옵션을 사용하세요.
그리고 -o (--output) 옵션을 사용하여 결과를 파일로 저장할 수 있습니다:```
C:\Tools>SyscallDumper.exe -d C:\SyscallSamples\1809x64\ntdll.dll -s token -o result.txt
[>] Loading C:\SyscallSamples\1809x64\ntdll.dll. [+] C:\SyscallSamples\1809x64\ntdll.dll is loaded successfully. [] Architecture : AMD64 [] Image Name : ntdll.dll [+] Got 462 syscall(s). [>] Trying to save results. [*] Output File Path : c:\Tools\result.txt [+] Results are saved successfully.
c:\Tools>type result.txt [Syscall Table from C:\SyscallSamples\1809x64\ntdll.dll]
[] Found 18 syscall(s). [] Filter String : "token"
`-n`(`--number`) 옵션을 사용하면 syscall 번호로 syscall 이름을 다음과 같이 조회할 수 있습니다.
syscall 번호를 16진수 형식으로 지정하려면 "0x"로 시작해야 합니다.```
C:\Tools>SyscallDumper.exe -d C:\dev\SyscallSamples\21H1x64\ntdll.dll -n 85
[>] Loading C:\dev\SyscallSamples\21H1x64\ntdll.dll.
[+] C:\dev\SyscallSamples\21H1x64\ntdll.dll is loaded successfully.
[*] Architecture : AMD64
[*] Image Name : ntdll.dll
[+] Got 470 syscall(s).
[Syscall Table from C:\dev\SyscallSamples\21H1x64\ntdll.dll]
----------------------------------------
| Syscall Name | Number | Number (hex) |
----------------------------------------
| NtCreateFile | 85 | 0x0055 |
----------------------------------------
[*] Found 1 syscall(s).
C:\Tools>SyscallDumper.exe -d C:\dev\SyscallSamples\21H1x64\ntdll.dll -n 0x55
[>] Loading C:\dev\SyscallSamples\21H1x64\ntdll.dll.
[+] C:\dev\SyscallSamples\21H1x64\ntdll.dll is loaded successfully.
[*] Architecture : AMD64
[*] Image Name : ntdll.dll
[+] Got 470 syscall(s).
[Syscall Table from C:\dev\SyscallSamples\21H1x64\ntdll.dll]
----------------------------------------
| Syscall Name | Number | Number (hex) |
----------------------------------------
| NtCreateFile | 85 | 0x0055 |
----------------------------------------
[*] Found 1 syscall(s).
출력 형식을 변경하려면 -f(--format) 옵션을 사용하세요.
현재 C/C++(c), CSharp(cs) 및 Python(py)이 지원됩니다:```
C:\Tools>SyscallDumper.exe -d C:\dev\SyscallSamples\Win11Arm64\ntdll-arm64.dll -f c
[>] Loading C:\dev\SyscallSamples\Win11Arm64\ntdll-arm64.dll. [+] C:\dev\SyscallSamples\Win11Arm64\ntdll-arm64.dll is loaded successfully. [] Architecture : ARM64 [] Image Name : ntdll.dll [+] Got 486 syscall(s).
[Syscall Table from C:\dev\SyscallSamples\Win11Arm64\ntdll-arm64.dll]
enum NT_SYSCALLS { NtAcceptConnectPort = 2, NtAccessCheck = 0, NtAccessCheckAndAuditAlarm = 41,
--snip--
NtWriteVirtualMemory = 58,
NtYieldExecution = 70
}
[*] Found 486 syscall(s).
C:\Tools>SyscallDumper.exe -d C:\dev\SyscallSamples\Win11Arm64\ntdll-arm64.dll -f cs
[>] Loading C:\dev\SyscallSamples\Win11Arm64\ntdll-arm64.dll. [+] C:\dev\SyscallSamples\Win11Arm64\ntdll-arm64.dll is loaded successfully. [] Architecture : ARM64 [] Image Name : ntdll.dll [+] Got 486 syscall(s).
[Syscall Table from C:\dev\SyscallSamples\Win11Arm64\ntdll-arm64.dll]
public enum NT_SYSCALLS { NtAcceptConnectPort = 2, NtAccessCheck = 0, NtAccessCheckAndAuditAlarm = 41,
--snip--
NtWriteVirtualMemory = 58,
NtYieldExecution = 70
}
[*] Found 486 syscall(s).
C:\Tools>SyscallDumper.exe -d C:\dev\SyscallSamples\Win11Arm64\ntdll-arm64.dll -f py
[>] Loading C:\dev\SyscallSamples\Win11Arm64\ntdll-arm64.dll. [+] C:\dev\SyscallSamples\Win11Arm64\ntdll-arm64.dll is loaded successfully. [] Architecture : ARM64 [] Image Name : ntdll.dll [+] Got 486 syscall(s).
[Syscall Table from C:\dev\SyscallSamples\Win11Arm64\ntdll-arm64.dll]
g_NtSyscalls = { "NtAcceptConnectPort": 2, "NtAccessCheck": 0, "NtAccessCheckAndAuditAlarm": 41, "NtAccessCheckByType": 99, "NtAccessCheckByTypeAndAuditAlarm": 89,
--snip--
2개의 DLL syscall 테이블 간 차이를 구하려면 `-D` (`--diff`) 옵션을 다음과 같이 사용하세요:```
C:\Tools>SyscallDumper.exe -D C:\dev\SyscallSamples\1809x64\win32u.dll C:\dev\SyscallSamples\1903x64\win32u.dll
[>] Trying to take diff.
[*] Old File : C:\dev\SyscallSamples\1809x64\win32u.dll
[*] New File : C:\dev\SyscallSamples\1903x64\win32u.dll
[>] Loading C:\dev\SyscallSamples\1809x64\win32u.dll.
[+] C:\dev\SyscallSamples\1809x64\win32u.dll is loaded successfully.
[*] Architecture : AMD64
[*] Image Name : win32u.dll
[+] Got 1242 syscall(s).
[>] Loading C:\dev\SyscallSamples\1903x64\win32u.dll.
[+] C:\dev\SyscallSamples\1903x64\win32u.dll is loaded successfully.
[*] Architecture : AMD64
[*] Image Name : win32u.dll
[+] Got 1258 syscall(s).
################################################
# DELETED SYSCALLS #
################################################
-------------------------------------------------------------------
| Syscall Name | Number | Number (hex) |
-------------------------------------------------------------------
| NtDCompositionCreateSharedVisualHandle | 4391 | 0x1127 |
| NtGdiDdDDINetDispStopSessions | 4608 | 0x1200 |
| NtGdiDdDDISetDisplayPrivateDriverFormat | 4664 | 0x1238 |
| NtMITCoreMsgKGetConnectionHandle | 4907 | 0x132B |
| NtMITCoreMsgKSend | 4909 | 0x132D |
| NtMITSynthesizeMouseWheel | 4919 | 0x1337 |
| NtMITWaitForMultipleObjectsEx | 4922 | 0x133A |
| NtUserGetPointerFrameArrivalTimes | 5105 | 0x13F1 |
-------------------------------------------------------------------
[*] Deleted 8 syscall(s).
################################################
# MODIFIED SYSCALLS #
################################################
----------------------------------------------------------------------------------------
| Syscall Name | Number | Number (hex) |
----------------------------------------------------------------------------------------
| NtDxgkEndTrackedWorkload | 4435 -> 4436 | 0x1153 -> 0x1154 |
| NtDxgkGetAvailableTrackedWorkloadIndex | 4436 -> 4437 | 0x1154 -> 0x1155 |
--snip--
| NtValidateCompositionSurfaceHandle | 5334 -> 5350 | 0x14D6 -> 0x14E6 |
| NtVisualCaptureBits | 5335 -> 5351 | 0x14D7 -> 0x14E7 |
----------------------------------------------------------------------------------------
[*] Modified 623 syscall(s).
################################################
# NEW SYSCALLS #
################################################
-----------------------------------------------------------------------------------
| Syscall Name | Number | Number (hex) |
-----------------------------------------------------------------------------------
| NtDCompositionCreateSharedResourceHandle | 4391 | 0x1127 |
| NtDxgkDispMgrOperation | 4435 | 0x1153 |
--snip--
| NtUserSetMagnificationDesktopMagnifierOffsetsDWMUpdated | 5283 | 0x14A3 |
| NtUserSetProcessMousewheelRoutingMode | 5293 | 0x14AD |
-----------------------------------------------------------------------------------
[*] Added 24 syscall(s).
이 프로젝트의 목적은 공격자가 Windows syscall을 확인하고 실행하는 방법을 조사하는 것입니다.
모든 PoC는 NtQuerySystemInformation syscall을 사용하여 커널 모듈을 나열하려고 시도합니다.
이 프로젝트의 목적은 인메모리 syscall 번호 확인 기법이 어떻게 작동하는지 학습하는 데 도움을 주는 것입니다:
다음 그림은 안티바이러스 소프트웨어가 설치된 환경에서 Hell's Gate와 Halo's Gate의 차이를 보여줍니다.
Hell's Gate 기법은 패치된 NtCreateProcessEx 함수에서는 작동하지 않습니다.
반면에 Halo's Gate 기법은 패치된 NtCreateProcessEx 함수에서 작동합니다:
일부 안티바이러스 소프트웨어가 설치된 머신에서는 일부 ntdll.dll 코드가 다음과 같은 디버거 출력으로 후킹됩니다:```
0:001> u ntdll!ntcreateprocessex
ntdll!NtCreateProcessEx:
00007fffb33ef700 e9930a1800 jmp 00007fffb3570198
00007fffb33ef705 cc int 3 00007fffb33ef706 cc int 3
00007fffb33ef707 cc int 3 00007fffb33ef708 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (000000007ffe0308)],1 00007fffb33ef710 7503 jne ntdll!NtCreateProcessEx+0x15 (00007fffb33ef715) 00007fffb33ef712 0f05 syscall
00007fff`b33ef714 c3 ret
그러나 `NtCreateUserProcess` 또는 `NtCreateProcessEx`에 의해 생성된 프로세스는 초기 상태에서 후킹되지 않은 ntdll.dll만 로드합니다.
일시 중단된 초기 프로세스 메모리를 스캔하여 이를 확인할 수 있습니다.
일시 중단된 프로세스는 디버거로 연결할 수 없기 때문에 작은 도구 [ProcMemScan](https://github.com/daem0nc0re/TangledWinExec/tree/main/ProcMemScan)을 작성했습니다.
이를 테스트하기 위해 syscall 번호 감지 후 InitialProcessResolver에서 초기 프로세스를 일시 중지할 수 있는 `-d` 플래그를 구현했습니다:```
PS C:\Dev> .\InitialProcessResolver.exe -n ntcreateprocessex -d
[>] Trying to create initial process.
[+] Initial process is created successfully.
[*] Process Name : svchost
[*] Process ID : 1336
[>] Trying to dump Nt API address.
[*] ntdll.dll @ 0x00007FFFB3350000
[+] Got 491 entries (Architecure: AMD64).
[+] NtCreateProcessEx @ 0x00007FFFB33EF700
[+] Syscall number for NtCreateProcessEx is 77 (0x4D).
[*] Debug break. To exit this program, hit [ENTER] key.
출력에서 NtCreateProcessEx의 시스템 콜 번호가 77임을 확인할 수 있으며, InitialProcessResolver에 의해 생성된 svchost 프로세스는 1336입니다. ProcMemScan으로 이 svchost를 스캔하면, svchost 프로세스가 다음과 같이 ntdll.dll만 로드하는 것을 볼 수 있습니다:```
PS C:\Dev> .\ProcMemScan.exe -p 1336 -l
[>] Trying to get target process memory information. [*] Target process is 'svchost' (PID : 1336). [+] Got target process memory information.
Base Size State Protect Type Mapped
0x0000000000000000 0x7FFE0000 MEM_FREE PAGE_NOACCESS NONE N/A 0x000000007FFE0000 0x1000 MEM_COMMIT PAGE_READONLY MEM_PRIVATE N/A 0x000000007FFE1000 0xC000 MEM_FREE PAGE_NOACCESS NONE N/A 0x000000007FFED000 0x1000 MEM_COMMIT PAGE_READONLY MEM_PRIVATE N/A 0x000000007FFEE000 0xBCE9C12000 MEM_FREE PAGE_NOACCESS NONE N/A 0x000000BD69C00000 0x28000 MEM_RESERVE NONE MEM_PRIVATE N/A 0x000000BD69C28000 0x3000 MEM_COMMIT PAGE_READWRITE MEM_PRIVATE N/A 0x000000BD69C2B000 0x1D5000 MEM_RESERVE NONE MEM_PRIVATE N/A 0x000000BD69E00000 0x79000 MEM_RESERVE NONE MEM_PRIVATE N/A 0x000000BD69E79000 0x3000 MEM_COMMIT PAGE_READWRITE, PAGE_GUARD MEM_PRIVATE N/A 0x000000BD69E7C000 0x4000 MEM_COMMIT PAGE_READWRITE MEM_PRIVATE N/A 0x000000BD69E80000 0x145FCB70000 MEM_FREE PAGE_NOACCESS NONE N/A 0x00000203669F0000 0x20000 MEM_COMMIT PAGE_READWRITE MEM_PRIVATE N/A 0x0000020366A10000 0x1F000 MEM_COMMIT PAGE_READONLY MEM_MAPPED N/A 0x0000020366A2F000 0x7BF1C9D61000 MEM_FREE PAGE_NOACCESS NONE N/A 0x00007DF530790000 0x1000 MEM_COMMIT PAGE_EXECUTE_READ MEM_PRIVATE N/A 0x00007DF530791000 0xF000 MEM_FREE PAGE_NOACCESS NONE N/A 0x00007DF5307A0000 0x1000 MEM_COMMIT PAGE_READONLY MEM_MAPPED N/A 0x00007DF5307A1000 0xF000 MEM_FREE PAGE_NOACCESS NONE N/A 0x00007DF5307B0000 0x1C67000 MEM_RESERVE NONE MEM_MAPPED N/A 0x00007DF532417000 0x2000 MEM_COMMIT PAGE_NOACCESS MEM_MAPPED N/A 0x00007DF532419000 0x165000 MEM_RESERVE NONE MEM_MAPPED N/A 0x00007DF53257E000 0x1000 MEM_COMMIT PAGE_NOACCESS MEM_MAPPED N/A 0x00007DF53257F000 0x1F7D2E4F000 MEM_RESERVE NONE MEM_MAPPED N/A 0x00007FED053CE000 0x1000 MEM_COMMIT PAGE_READONLY MEM_MAPPED N/A 0x00007FED053CF000 0x809C3D000 MEM_RESERVE NONE MEM_MAPPED N/A 0x00007FF50F00C000 0x2000 MEM_COMMIT PAGE_READONLY MEM_MAPPED N/A 0x00007FF50F00E000 0x1F049000 MEM_RESERVE NONE MEM_MAPPED N/A 0x00007FF52E057000 0x1426000 MEM_COMMIT PAGE_NOACCESS MEM_MAPPED N/A 0x00007FF52F47D000 0x9000 MEM_COMMIT PAGE_READONLY MEM_MAPPED N/A 0x00007FF52F486000 0x132A000 MEM_RESERVE NONE MEM_MAPPED N/A 0x00007FF5307B0000 0x270F80000 MEM_FREE PAGE_NOACCESS NONE N/A 0x00007FF7A1730000 0x1000 MEM_COMMIT PAGE_READONLY MEM_IMAGE C:\Windows\System32\svchost.exe 0x00007FF7A1731000 0x7000 MEM_COMMIT PAGE_EXECUTE_READ MEM_IMAGE C:\Windows\System32\svchost.exe 0x00007FF7A1738000 0x4000 MEM_COMMIT PAGE_READONLY MEM_IMAGE C:\Windows\System32\svchost.exe 0x00007FF7A173C000 0x1000 MEM_COMMIT PAGE_WRITECOPY MEM_IMAGE C:\Windows\System32\svchost.exe 0x00007FF7A173D000 0x1000 MEM_COMMIT PAGE_READONLY MEM_IMAGE C:\Windows\System32\svchost.exe 0x00007FF7A173E000 0x1000 MEM_COMMIT PAGE_WRITECOPY MEM_IMAGE C:\Windows\System32\svchost.exe 0x00007FF7A173F000 0x2000 MEM_COMMIT PAGE_READONLY MEM_IMAGE C:\Windows\System32\svchost.exe 0x00007FF7A1741000 0x811C0F000 MEM_FREE PAGE_NOACCESS NONE N/A 0x00007FFFB3350000 0x1000 MEM_COMMIT PAGE_READONLY MEM_IMAGE C:\Windows\System32\ntdll.dll 0x00007FFFB3351000 0x130000 MEM_COMMIT PAGE_EXECUTE_READ MEM_IMAGE C:\Windows\System32\ntdll.dll 0x00007FFFB3481000 0x4D000 MEM_COMMIT PAGE_READONLY MEM_IMAGE C:\Windows\System32\ntdll.dll 0x00007FFFB34CE000 0xC000 MEM_COMMIT PAGE_WRITECOPY MEM_IMAGE C:\Windows\System32\ntdll.dll 0x00007FFFB34DA000 0xF000 MEM_COMMIT PAGE_READONLY MEM_IMAGE C:\Windows\System32\ntdll.dll 0x00007FFFB34E9000 0x1000 MEM_COMMIT PAGE_READWRITE MEM_IMAGE C:\Windows\System32\ntdll.dll 0x00007FFFB34EA000 0x3000 MEM_COMMIT PAGE_WRITECOPY MEM_IMAGE C:\Windows\System32\ntdll.dll 0x00007FFFB34ED000 0x77000 MEM_COMMIT PAGE_READONLY MEM_IMAGE C:\Windows\System32\ntdll.dll 0x00007FFFB3564000 0x4CA8C000 MEM_FREE PAGE_NOACCESS NONE N/A
[*] Completed.
PS C:\Dev>
그리고 `NtCreateProcessEx` 코드는 후킹되지 않았습니다:```
PS C:\Dev> .\ProcMemScan.exe -p 1336 -d -b 0x00007FFFB33EF700 -r 20
[>] Trying to dump target process memory.
[*] Target process is 'svchost' (PID : 1336).
[+] Got target process memory.
[*] BaseAddress : 0x00007FFFB33EF000
[*] AllocationBase : 0x00007FFFB3350000
[*] RegionSize : 0x92000
[*] AllocationProtect : PAGE_EXECUTE_WRITECOPY
[*] State : MEM_COMMIT
[*] Protect : PAGE_EXECUTE_READ
[*] Type : MEM_IMAGE
[*] Mapped File Path : C:\Windows\System32\ntdll.dll
[*] Hexdump (0x20 Bytes):
00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00007FFFB33EF700 | 4C 8B D1 B8 4D 00 00 00-F6 04 25 08 03 FE 7F 01 | L.Ñ,M... ö.%.._..
00007FFFB33EF710 | 75 03 0F 05 C3 CD 2E C3-0F 1F 84 00 00 00 00 00 | u...AI.A ........
[*] Completed.
PS C:\Dev>
이 스크립트에는 다음 3가지 함수가 구현되어 있습니다:
Get-ModuleHandle : 이름에서 알 수 있듯이 이 함수는 GetModuleHandle API로 로드된 모듈의 기본 주소를 확인합니다.
Get-ProcAddress : 이름에서 알 수 있듯이 이 함수는 GetProcAddress API로 내보낸 함수의 주소를 확인합니다.
Get-SyscallNumber : 이 함수는 Hell's Gate 또는 Halo's Gate 기법으로 syscall 번호를 확인합니다.
모듈 기본 주소(예: ntdll.dll)를 확인하려면 첫 번째 인수 또는 -ModuleName 옵션에 모듈 이름을 설정하십시오:```
PS C:> Import-Module C:\dev\Get-SyscallNumber.ps1
PS C:> Get-ModuleHandle ntdll.dll
140720055189504
PS C:> (140720055189504).ToString("X16")
00007FFBF0E70000
PS C:> Get-ModuleHandle -ModuleName kernel32.dll
140720022028288
PS C:> (140720022028288).ToString("X16")
00007FFBEEED0000
PS C:>
모듈에서 내보낸 함수의 주소를 확인하려면 `Get-ProcAddress` 함수에 모듈의 기본 주소와 내보낸 함수 이름을 설정합니다.
모듈의 기본 주소는 첫 번째 인수 또는 `-Module` 옵션으로 지정해야 합니다.
내보낸 함수 이름은 두 번째 인수 또는 `-ProcName` 옵션으로 다음과 같이 지정해야 합니다.```
PS C:\> $ntdll = Get-ModuleHandle -ModuleName ntdll.dll
PS C:\> Get-ProcAddress $ntdll NtCreateToken
140720055839008
PS C:\> (140720055839008).ToString("X16")
00007FFBF0F0E920
PS C:\> Get-ProcAddress -ProcName ntcreatetoken -Module $ntdll
140720055839008
PS C:\>
시스템 콜 번호를 알고 싶다면, Get-SyscallNumber 함수의 첫 번째 인자 또는 -SyscallName 옵션에 시스템 콜 이름을 설정하십시오:```
PS C:> Get-SyscallNumber ntcreateuserprocess
Syscall Number : 0xC8
200
PS C:> Get-SyscallNumber -SyscallName ntcreateprocessex
Syscall Number : 0x4D
77
PS C:>
## 참고자료
[맨 위로](#atomicsyscall)
### 기초
* [https://jhalon.github.io/utilizing-syscalls-in-csharp-1/](https://jhalon.github.io/utilizing-syscalls-in-csharp-1/)
* [https://jhalon.github.io/utilizing-syscalls-in-csharp-2/](https://jhalon.github.io/utilizing-syscalls-in-csharp-2/)
* [https://github.com/jhalon/SharpCall](https://github.com/jhalon/SharpCall)
### Heaven's Gate
* [https://wbenny.github.io/2018/11/04/wow64-internals.html](https://wbenny.github.io/2018/11/04/wow64-internals.html)
* [https://medium.com/@fsx30/hooking-heavens-gate-a-wow64-hooking-technique-5235e1aeed73](https://medium.com/@fsx30/hooking-heavens-gate-a-wow64-hooking-technique-5235e1aeed73)
* [https://mark.rxmsolutions.com/through-the-heavens-gate/](https://mark.rxmsolutions.com/through-the-heavens-gate/)
* [https://speakerdeck.com/aaaddress1/rebuild-the-heavens-gate-from-32-bit-hell-back-to-heaven-wonderland](https://speakerdeck.com/aaaddress1/rebuild-the-heavens-gate-from-32-bit-hell-back-to-heaven-wonderland)
* [http://blog.rewolf.pl/blog/?p=102](http://blog.rewolf.pl/blog/?p=102)
* [https://www.mandiant.com/resources/blog/wow64-subsystem-internals-and-hooking-techniques](https://www.mandiant.com/resources/blog/wow64-subsystem-internals-and-hooking-techniques)
* [https://www.malwaretech.com/2014/02/the-0x33-segment-selector-heavens-gate.html](https://www.malwaretech.com/2014/02/the-0x33-segment-selector-heavens-gate.html)
* [https://int0h.wordpress.com/2009/12/24/the-power-of-wow64/](https://int0h.wordpress.com/2009/12/24/the-power-of-wow64/)
* [https://modexp.wordpress.com/2015/11/19/dllpic-injection-on-windows-from-wow64-process/](https://modexp.wordpress.com/2015/11/19/dllpic-injection-on-windows-from-wow64-process/)
### Hell's Gate
* [https://vxug.fakedoma.in/papers/VXUG/Exclusive/HellsGate.pdf](https://vxug.fakedoma.in/papers/VXUG/Exclusive/HellsGate.pdf)
* [https://github.com/am0nsec/HellsGate](https://github.com/am0nsec/HellsGate)
### Halo's Gate
* [https://blog.sektor7.net/#!res/2021/halosgate.md](https://blog.sektor7.net/#!res/2021/halosgate.md)
### 감사의 말
[맨 위로](#atomicsyscall)
연구와 블로그 게시물에 감사드립니다:
* Paul Laîné ([@am0nsec](https://twitter.com/am0nsec))
* smelly__vx ([@smelly__vx](https://twitter.com/smelly__vx))
* reenz0h ([@sektor7net](https://twitter.com/sektor7net))
* Jack Halon ([@jack_halon](https://twitter.com/jack_halon))
| PoC 이름 | 설명 |
|---|
| PhysicalResolvePoC | 이 PoC는 C:\Windows\System32\ntdll.dll에서 NtQuerySystemInformation의 syscall 번호를 단순히 확인합니다. |
| HellsGatePoC | 이 PoC는 Hell's Gate 기법을 사용하여 NtQuerySystemInformation의 syscall 번호를 확인합니다. |
| HalosGatePoC | 이 PoC는 Halo's Gate 기법을 사용하여 NtQuerySystemInformation의 syscall 번호를 확인합니다. |
| PoC 이름 | 설명 |
|---|
| HellsGateResolver | 이 PoC는 Hell's Gate 기법을 사용하여 ntdll.dll의 syscall 번호를 확인합니다. 안티바이러스 제품으로 패치된 함수에는 작동하지 않습니다. |
| HalosGateResolver | 이 PoC는 Halo's Gate 기법을 사용하여 ntdll.dll의 syscall 번호를 확인합니다. |
| InitialProcessResolver | 이 PoC는 NtCreateUserProcess에 의해 생성된 초기 프로세스에서 ntdll.dll의 syscall 번호를 확인합니다. |
| KnownDllsResolver | 이 PoC는 \KnownDlls\ntdll.dll을 사용하여 ntdll.dll의 syscall 번호를 확인합니다. |