AtomicSyscall

用于 Windows 系统调用调查的工具和 PoC。

AtomicSyscall

HeavensGate

此目录用于 Heaven's Gate 技术。参见 README.md

SyscallDumper

返回顶部

项目

该工具用于从 ntdll.dll 或 win32u.dll 转储 Windows 系统调用：``` C:\Tools>SyscallDumper.exe -h

SyscallDumper - Tool to dump syscall.

Usage: SyscallDumper.exe [Options] [INPUT_DLL_1] [INPUT_DLL_2]

    -h, --help   : Displays this help message.
    -d, --dump   : Flag to dump syscall from ntdll.dll or win32u.dll.
    -D, --diff   : Flag to take diff between 2 dlls.
    -f, --format : Specifies output format. "c" for C/C++, "cs" for CSharp, "py" for Python.
    -n, --number : Specifies syscall number to lookup in decimal or hex format.
    -o, --output : Specifies output file (e.g. "-o result.txt").
    -s, --search : Specifies search filter (e.g. "-s createfile").
    INPUT_DLL_1  : Specifies path of ntdll.dll or win32u.dll. Older one in diffing.
    INPUT_DLL_2  : Specifies path of ntdll.dll or win32u.dll. Newer one in diffing.

若要从 ntdll.dll 或 win32u.dll 转储系统调用号，请使用 `-d`（`--dump`）选项。
如果未指定源 DLL，该工具将从 `C:\Windows\System32\ntdll.dll` 和 `C:\Windows\System32\win32u.dll` 转储系统调用号：```
C:\Tools>SyscallDumper.exe -d

[*] No target is specified.
[>] Dumping from system default ntdll.dll and win32u.dll.
[>] Loading C:\Windows\System32\ntdll.dll.
[+] C:\Windows\System32\ntdll.dll is loaded successfully.
    [*] Architecture : AMD64
    [*] Image Name   : ntdll.dll
[+] Got 463 syscall(s).
[>] Loading C:\Windows\System32\win32u.dll.
[+] C:\Windows\System32\win32u.dll is loaded successfully.
    [*] Architecture : AMD64
    [*] Image Name   : win32u.dll
[+] Got 1258 syscall(s).

[Syscall Table from C:\Windows\System32\ntdll.dll]

---------------------------------------------------------------------------------
| Syscall Name                                          | Number | Number (hex) |
---------------------------------------------------------------------------------
| NtAcceptConnectPort                                   | 2      | 0x0002       |
| NtAccessCheck                                         | 0      | 0x0000       |

--snip--

| NtWriteVirtualMemory                                  | 58     | 0x003A       |
| NtYieldExecution                                      | 70     | 0x0046       |
---------------------------------------------------------------------------------

[*] Found 463 syscall(s).


[Syscall Table from C:\Windows\System32\win32u.dll]

-----------------------------------------------------------------------------------
| Syscall Name                                            | Number | Number (hex) |
-----------------------------------------------------------------------------------
| NtBindCompositionSurface                                | 4373   | 0x1115       |
| NtCloseCompositionInputSink                             | 4374   | 0x1116       |

--snip--

| NtValidateCompositionSurfaceHandle                      | 5350   | 0x14E6       |
| NtVisualCaptureBits                                     | 5351   | 0x14E7       |
-----------------------------------------------------------------------------------

[*] Found 1258 syscall(s).

如果你想从转储结果中筛选系统调用名称，可以使用 -s (--search) 选项。并且你可以使用 -o (--output) 选项将结果保存到文件，如下所示：``` C:\Tools>SyscallDumper.exe -d C:\SyscallSamples\1809x64\ntdll.dll -s token -o result.txt

[>] Loading C:\SyscallSamples\1809x64\ntdll.dll. [+] C:\SyscallSamples\1809x64\ntdll.dll is loaded successfully. [] Architecture : AMD64 [] Image Name : ntdll.dll [+] Got 462 syscall(s). [>] Trying to save results. [*] Output File Path : c:\Tools\result.txt [+] Results are saved successfully.

c:\Tools>type result.txt [Syscall Table from C:\SyscallSamples\1809x64\ntdll.dll]

| Syscall Name | Number | Number (hex) |

| NtAdjustGroupsToken | 107 | 0x006B | | NtAdjustPrivilegesToken | 65 | 0x0041 | | NtAdjustTokenClaimsAndDeviceGroups | 108 | 0x006C | | NtCompareTokens | 155 | 0x009B | | NtCreateLowBoxToken | 172 | 0x00AC | | NtCreateToken | 191 | 0x00BF | | NtCreateTokenEx | 192 | 0x00C0 | | NtDuplicateToken | 66 | 0x0042 | | NtFilterToken | 222 | 0x00DE | | NtFilterTokenEx | 223 | 0x00DF | | NtImpersonateAnonymousToken | 246 | 0x00F6 | | NtOpenProcessToken | 290 | 0x0122 | | NtOpenProcessTokenEx | 48 | 0x0030 | | NtOpenThreadToken | 36 | 0x0024 | | NtOpenThreadTokenEx | 47 | 0x002F | | NtQueryInformationToken | 33 | 0x0021 | | NtQuerySecurityAttributesToken | 339 | 0x0153 | | NtSetInformationToken | 404 | 0x0194 |

[] Found 18 syscall(s). [] Filter String : "token"

使用 `-n`（`--number`）选项，您可以按系统调用号码查找系统调用名称，如下所示。
如果您想以十六进制格式指定系统调用号码，应以 "0x" 开头。```
C:\Tools>SyscallDumper.exe -d C:\dev\SyscallSamples\21H1x64\ntdll.dll -n 85

[>] Loading C:\dev\SyscallSamples\21H1x64\ntdll.dll.
[+] C:\dev\SyscallSamples\21H1x64\ntdll.dll is loaded successfully.
    [*] Architecture : AMD64
    [*] Image Name   : ntdll.dll
[+] Got 470 syscall(s).

[Syscall Table from C:\dev\SyscallSamples\21H1x64\ntdll.dll]

----------------------------------------
| Syscall Name | Number | Number (hex) |
----------------------------------------
| NtCreateFile | 85     | 0x0055       |
----------------------------------------

[*] Found 1 syscall(s).


C:\Tools>SyscallDumper.exe -d C:\dev\SyscallSamples\21H1x64\ntdll.dll -n 0x55

[>] Loading C:\dev\SyscallSamples\21H1x64\ntdll.dll.
[+] C:\dev\SyscallSamples\21H1x64\ntdll.dll is loaded successfully.
    [*] Architecture : AMD64
    [*] Image Name   : ntdll.dll
[+] Got 470 syscall(s).

[Syscall Table from C:\dev\SyscallSamples\21H1x64\ntdll.dll]

----------------------------------------
| Syscall Name | Number | Number (hex) |
----------------------------------------
| NtCreateFile | 85     | 0x0055       |
----------------------------------------

[*] Found 1 syscall(s).

如果你想更改输出格式，请使用 -f (--format) 选项。目前支持 C/C++ (c)、CSharp (cs) 和 Python (py)：``` C:\Tools>SyscallDumper.exe -d C:\dev\SyscallSamples\Win11Arm64\ntdll-arm64.dll -f c

[>] Loading C:\dev\SyscallSamples\Win11Arm64\ntdll-arm64.dll. [+] C:\dev\SyscallSamples\Win11Arm64\ntdll-arm64.dll is loaded successfully. [] Architecture : ARM64 [] Image Name : ntdll.dll [+] Got 486 syscall(s).

[Syscall Table from C:\dev\SyscallSamples\Win11Arm64\ntdll-arm64.dll]

enum NT_SYSCALLS { NtAcceptConnectPort = 2, NtAccessCheck = 0, NtAccessCheckAndAuditAlarm = 41,

--snip--

NtWriteVirtualMemory = 58,
NtYieldExecution = 70

}

[*] Found 486 syscall(s).

C:\Tools>SyscallDumper.exe -d C:\dev\SyscallSamples\Win11Arm64\ntdll-arm64.dll -f cs

[Syscall Table from C:\dev\SyscallSamples\Win11Arm64\ntdll-arm64.dll]

public enum NT_SYSCALLS { NtAcceptConnectPort = 2, NtAccessCheck = 0, NtAccessCheckAndAuditAlarm = 41,

--snip--

NtWriteVirtualMemory = 58,
NtYieldExecution = 70

}

[*] Found 486 syscall(s).

C:\Tools>SyscallDumper.exe -d C:\dev\SyscallSamples\Win11Arm64\ntdll-arm64.dll -f py

[Syscall Table from C:\dev\SyscallSamples\Win11Arm64\ntdll-arm64.dll]

g_NtSyscalls = { "NtAcceptConnectPort": 2, "NtAccessCheck": 0, "NtAccessCheckAndAuditAlarm": 41, "NtAccessCheckByType": 99, "NtAccessCheckByTypeAndAuditAlarm": 89,

--snip--

要比较两个 DLL 的 syscall 表之间的差异，请按如下方式使用 `-D`（`--diff`）选项：```
C:\Tools>SyscallDumper.exe -D C:\dev\SyscallSamples\1809x64\win32u.dll C:\dev\SyscallSamples\1903x64\win32u.dll

[>] Trying to take diff.
    [*] Old File : C:\dev\SyscallSamples\1809x64\win32u.dll
    [*] New File : C:\dev\SyscallSamples\1903x64\win32u.dll
[>] Loading C:\dev\SyscallSamples\1809x64\win32u.dll.
[+] C:\dev\SyscallSamples\1809x64\win32u.dll is loaded successfully.
    [*] Architecture : AMD64
    [*] Image Name   : win32u.dll
[+] Got 1242 syscall(s).
[>] Loading C:\dev\SyscallSamples\1903x64\win32u.dll.
[+] C:\dev\SyscallSamples\1903x64\win32u.dll is loaded successfully.
    [*] Architecture : AMD64
    [*] Image Name   : win32u.dll
[+] Got 1258 syscall(s).

################################################
#               DELETED SYSCALLS               #
################################################

-------------------------------------------------------------------
| Syscall Name                            | Number | Number (hex) |
-------------------------------------------------------------------
| NtDCompositionCreateSharedVisualHandle  | 4391   | 0x1127       |
| NtGdiDdDDINetDispStopSessions           | 4608   | 0x1200       |
| NtGdiDdDDISetDisplayPrivateDriverFormat | 4664   | 0x1238       |
| NtMITCoreMsgKGetConnectionHandle        | 4907   | 0x132B       |
| NtMITCoreMsgKSend                       | 4909   | 0x132D       |
| NtMITSynthesizeMouseWheel               | 4919   | 0x1337       |
| NtMITWaitForMultipleObjectsEx           | 4922   | 0x133A       |
| NtUserGetPointerFrameArrivalTimes       | 5105   | 0x13F1       |
-------------------------------------------------------------------

[*] Deleted 8 syscall(s).


################################################
#               MODIFIED SYSCALLS              #
################################################

----------------------------------------------------------------------------------------
| Syscall Name                                       | Number       | Number (hex)     |
----------------------------------------------------------------------------------------
| NtDxgkEndTrackedWorkload                           | 4435 -> 4436 | 0x1153 -> 0x1154 |
| NtDxgkGetAvailableTrackedWorkloadIndex             | 4436 -> 4437 | 0x1154 -> 0x1155 |

--snip--

| NtValidateCompositionSurfaceHandle                 | 5334 -> 5350 | 0x14D6 -> 0x14E6 |
| NtVisualCaptureBits                                | 5335 -> 5351 | 0x14D7 -> 0x14E7 |
----------------------------------------------------------------------------------------

[*] Modified 623 syscall(s).


################################################
#                 NEW SYSCALLS                 #
################################################

-----------------------------------------------------------------------------------
| Syscall Name                                            | Number | Number (hex) |
-----------------------------------------------------------------------------------
| NtDCompositionCreateSharedResourceHandle                | 4391   | 0x1127       |
| NtDxgkDispMgrOperation                                  | 4435   | 0x1153       |

--snip--

| NtUserSetMagnificationDesktopMagnifierOffsetsDWMUpdated | 5283   | 0x14A3       |
| NtUserSetProcessMousewheelRoutingMode                   | 5293   | 0x14AD       |
-----------------------------------------------------------------------------------

[*] Added 24 syscall(s).

SyscallPoCs

返回顶部

项目

本项目旨在研究攻击者如何解析并执行 Windows 系统调用。所有 PoC 均尝试通过 NtQuerySystemInformation 系统调用来列出内核模块。

SyscallResolvers

返回顶部

项目

本项目旨在帮助学习内存中系统调用号解析技术的工作原理：

下图展示了在已安装防病毒软件的环境中，Hell's Gate 与 Halo's Gate 之间的差异。 Hell's Gate 技术不适用于已被修补的 NtCreateProcessEx 函数。另一方面，Halo's Gate 技术适用于已被修补的 NtCreateProcessEx 函数：

在某些已安装防病毒软件的机器上，部分 ntdll.dll 代码会被挂钩，如下面的调试器输出所示：``` 0:001> u ntdll!ntcreateprocessex ntdll!NtCreateProcessEx: 00007fffb33ef700 e9930a1800 jmp 00007fffb3570198 00007fffb33ef705 cc int 3 00007fffb33ef706 cc int 3 00007fffb33ef707 cc int 3 00007fffb33ef708 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (000000007ffe0308)],1 00007fffb33ef710 7503 jne ntdll!NtCreateProcessEx+0x15 (00007fffb33ef715) 00007fffb33ef712 0f05 syscall 00007fff`b33ef714 c3 ret

但是由 `NtCreateUserProcess` 或 `NtCreateProcessEx` 创建的进程在初始状态下仅加载未挂钩的 ntdll.dll。
我们可以通过扫描挂起的初始进程内存来确认这一点。
挂起的进程无法附加调试器，因此我编写了一个小工具 [ProcMemScan](https://github.com/daem0nc0re/TangledWinExec/tree/main/ProcMemScan)。
为了测试这一点，我实现了 `-d` 标志，它可以在 syscall 号检测后将初始进程暂停到 InitialProcessResolver：```
PS C:\Dev> .\InitialProcessResolver.exe -n ntcreateprocessex -d

[>] Trying to create initial process.
[+] Initial process is created successfully.
    [*] Process Name : svchost
    [*] Process ID   : 1336
[>] Trying to dump Nt API address.
[*] ntdll.dll @ 0x00007FFFB3350000
[+] Got 491 entries (Architecure: AMD64).
[+] NtCreateProcessEx @ 0x00007FFFB33EF700
[+] Syscall number for NtCreateProcessEx is 77 (0x4D).
[*] Debug break. To exit this program, hit [ENTER] key.

我们可以从输出中确认 NtCreateProcessEx 的系统调用号为 77，而由 InitialProcessResolver 创建的 svchost 进程为 1336。通过使用 ProcMemScan 扫描该 svchost，我们可以看到 svchost 进程仅加载了 ntdll.dll，如下所示：``` PS C:\Dev> .\ProcMemScan.exe -p 1336 -l

[>] Trying to get target process memory information. [*] Target process is 'svchost' (PID : 1336). [+] Got target process memory information.

          Base           Size State       Protect                    Type        Mapped

0x0000000000000000 0x000000007FFE0000 0x000000007FFE1000 0x000000007FFED000 0x000000007FFEE000 0x000000BD69C00000 0x000000BD69C28000 0x000000BD69C2B000 0x000000BD69E00000 0x000000BD69E79000 0x000000BD69E7C000 0x000000BD69E80000 0x00000203669F0000 0x0000020366A10000 0x0000020366A2F000 0x00007DF530790000 0x00007DF530791000 0x00007DF5307A0000 0x00007DF5307A1000 0x00007DF5307B0000 0x00007DF532417000 0x00007DF532419000 0x00007DF53257E000 0x00007DF53257F000 0x00007FED053CE000 0x00007FED053CF000 0x00007FF50F00C000 0x00007FF50F00E000 0x00007FF52E057000 0x00007FF52F47D000 0x00007FF52F486000 0x00007FF5307B0000 0x00007FF7A1730000 0x00007FF7A1731000 0x00007FF7A1738000 0x00007FF7A173C000 0x00007FF7A173D000 0x00007FF7A173E000 0x00007FF7A173F000 0x00007FF7A1741000 0x00007FFFB3350000 0x00007FFFB3351000 0x00007FFFB3481000 0x00007FFFB34CE000 0x00007FFFB34DA000 0x00007FFFB34E9000 0x00007FFFB34EA000 0x00007FFFB34ED000 0x00007FFFB3564000 0x7FFE0000 MEM_FREE PAGE_NOACCESS NONE N/A 0x1000 MEM_COMMIT PAGE_READONLY MEM_PRIVATE N/A 0xC000 MEM_FREE PAGE_NOACCESS NONE N/A 0x1000 MEM_COMMIT PAGE_READONLY MEM_PRIVATE N/A 0xBCE9C12000 MEM_FREE PAGE_NOACCESS NONE N/A 0x28000 MEM_RESERVE NONE MEM_PRIVATE N/A 0x3000 MEM_COMMIT PAGE_READWRITE MEM_PRIVATE N/A 0x1D5000 MEM_RESERVE NONE MEM_PRIVATE N/A 0x79000 MEM_RESERVE NONE MEM_PRIVATE N/A 0x3000 MEM_COMMIT PAGE_READWRITE, PAGE_GUARD MEM_PRIVATE N/A 0x4000 MEM_COMMIT PAGE_READWRITE MEM_PRIVATE N/A 0x145FCB70000 MEM_FREE PAGE_NOACCESS NONE N/A 0x20000 MEM_COMMIT PAGE_READWRITE MEM_PRIVATE N/A 0x1F000 MEM_COMMIT PAGE_READONLY MEM_MAPPED N/A 0x7BF1C9D61000 MEM_FREE PAGE_NOACCESS NONE N/A 0x1000 MEM_COMMIT PAGE_EXECUTE_READ MEM_PRIVATE N/A 0xF000 MEM_FREE PAGE_NOACCESS NONE N/A 0x1000 MEM_COMMIT PAGE_READONLY MEM_MAPPED N/A 0xF000 MEM_FREE PAGE_NOACCESS NONE N/A 0x1C67000 MEM_RESERVE NONE MEM_MAPPED N/A 0x2000 MEM_COMMIT PAGE_NOACCESS MEM_MAPPED N/A 0x165000 MEM_RESERVE NONE MEM_MAPPED N/A 0x1000 MEM_COMMIT PAGE_NOACCESS MEM_MAPPED N/A 0x1F7D2E4F000 MEM_RESERVE NONE MEM_MAPPED N/A 0x1000 MEM_COMMIT PAGE_READONLY MEM_MAPPED N/A 0x809C3D000 MEM_RESERVE NONE MEM_MAPPED N/A 0x2000 MEM_COMMIT PAGE_READONLY MEM_MAPPED N/A 0x1F049000 MEM_RESERVE NONE MEM_MAPPED N/A 0x1426000 MEM_COMMIT PAGE_NOACCESS MEM_MAPPED N/A 0x9000 MEM_COMMIT PAGE_READONLY MEM_MAPPED N/A 0x132A000 MEM_RESERVE NONE MEM_MAPPED N/A 0x270F80000 MEM_FREE PAGE_NOACCESS NONE N/A 0x1000 MEM_COMMIT PAGE_READONLY MEM_IMAGE C:\Windows\System32\svchost.exe 0x7000 MEM_COMMIT PAGE_EXECUTE_READ MEM_IMAGE C:\Windows\System32\svchost.exe 0x4000 MEM_COMMIT PAGE_READONLY MEM_IMAGE C:\Windows\System32\svchost.exe 0x1000 MEM_COMMIT PAGE_WRITECOPY MEM_IMAGE C:\Windows\System32\svchost.exe 0x1000 MEM_COMMIT PAGE_READONLY MEM_IMAGE C:\Windows\System32\svchost.exe 0x1000 MEM_COMMIT PAGE_WRITECOPY MEM_IMAGE C:\Windows\System32\svchost.exe 0x2000 MEM_COMMIT PAGE_READONLY MEM_IMAGE C:\Windows\System32\svchost.exe 0x811C0F000 MEM_FREE PAGE_NOACCESS NONE N/A 0x1000 MEM_COMMIT PAGE_READONLY MEM_IMAGE C:\Windows\System32\ntdll.dll 0x130000 MEM_COMMIT PAGE_EXECUTE_READ MEM_IMAGE C:\Windows\System32\ntdll.dll 0x4D000 MEM_COMMIT PAGE_READONLY MEM_IMAGE C:\Windows\System32\ntdll.dll 0xC000 MEM_COMMIT PAGE_WRITECOPY MEM_IMAGE C:\Windows\System32\ntdll.dll 0xF000 MEM_COMMIT PAGE_READONLY MEM_IMAGE C:\Windows\System32\ntdll.dll 0x1000 MEM_COMMIT PAGE_READWRITE MEM_IMAGE C:\Windows\System32\ntdll.dll 0x3000 MEM_COMMIT PAGE_WRITECOPY MEM_IMAGE C:\Windows\System32\ntdll.dll 0x77000 MEM_COMMIT PAGE_READONLY MEM_IMAGE C:\Windows\System32\ntdll.dll 0x4CA8C000 MEM_FREE PAGE_NOACCESS NONE N/A

[*] Completed.

PS C:\Dev>

而 `NtCreateProcessEx` 的代码未被挂钩：```
PS C:\Dev> .\ProcMemScan.exe -p 1336 -d -b 0x00007FFFB33EF700 -r 20

[>] Trying to dump target process memory.
[*] Target process is 'svchost' (PID : 1336).
[+] Got target process memory.
    [*] BaseAddress       : 0x00007FFFB33EF000
    [*] AllocationBase    : 0x00007FFFB3350000
    [*] RegionSize        : 0x92000
    [*] AllocationProtect : PAGE_EXECUTE_WRITECOPY
    [*] State             : MEM_COMMIT
    [*] Protect           : PAGE_EXECUTE_READ
    [*] Type              : MEM_IMAGE
    [*] Mapped File Path  : C:\Windows\System32\ntdll.dll
    [*] Hexdump (0x20 Bytes):

                           00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

        00007FFFB33EF700 | 4C 8B D1 B8 4D 00 00 00-F6 04 25 08 03 FE 7F 01 | L.Ñ,M... ö.%.._..
        00007FFFB33EF710 | 75 03 0F 05 C3 CD 2E C3-0F 1F 84 00 00 00 00 00 | u...AI.A ........


[*] Completed.

PS C:\Dev>

Get-SyscallNumber.ps1

返回顶部

脚本

在此脚本中，实现了以下 3 个函数：

Get-ModuleHandle ：顾名思义，此函数像 GetModuleHandle API 一样解析已加载模块的基址。
Get-ProcAddress ：顾名思义，此函数像 GetProcAddress API 一样解析导出函数的地址。
Get-SyscallNumber ：此函数使用 Hell's Gate 或 Halo's Gate 技术解析系统调用号。

如果你想解析如 ntdll.dll 之类的模块基址，请将模块名称设置为第 1 个参数或使用 -ModuleName 选项：``` PS C:> Import-Module C:\dev\Get-SyscallNumber.ps1 PS C:> Get-ModuleHandle ntdll.dll 140720055189504 PS C:> (140720055189504).ToString("X16") 00007FFBF0E70000 PS C:> Get-ModuleHandle -ModuleName kernel32.dll 140720022028288 PS C:> (140720022028288).ToString("X16") 00007FFBEEED0000 PS C:>

要解析模块中的导出函数地址，请为 `Get-ProcAddress` 函数设置模块的基地址和导出函数名。
模块的基地址应通过第 1 个参数或 `-Module` 选项指定。
导出函数名应通过第 2 个参数或 `-ProcName` 选项指定，如下所示：```
PS C:\> $ntdll = Get-ModuleHandle -ModuleName ntdll.dll
PS C:\> Get-ProcAddress $ntdll NtCreateToken
140720055839008
PS C:\> (140720055839008).ToString("X16")
00007FFBF0F0E920
PS C:\> Get-ProcAddress -ProcName ntcreatetoken -Module $ntdll
140720055839008
PS C:\>

如果你想知道系统调用号，请将系统调用名称设置为第一个参数，或为Get-SyscallNumber函数设置-SyscallName选项：``` PS C:> Get-SyscallNumber ntcreateuserprocess Syscall Number : 0xC8 200 PS C:> Get-SyscallNumber -SyscallName ntcreateprocessex Syscall Number : 0x4D 77 PS C:>

![getsyscallnumber.png](https://assets.kitploit.com/production/public/readmes/47889/69eabff97f4b9a8ce6562654c3f7014317bd25f0003f16eb2e7882e05ffff624.png)


## 参考

[返回顶部](#atomicsyscall)

### 基础知识

* [https://jhalon.github.io/utilizing-syscalls-in-csharp-1/](https://jhalon.github.io/utilizing-syscalls-in-csharp-1/)

* [https://jhalon.github.io/utilizing-syscalls-in-csharp-2/](https://jhalon.github.io/utilizing-syscalls-in-csharp-2/)

* [https://github.com/jhalon/SharpCall](https://github.com/jhalon/SharpCall)

### Heaven's Gate
* [https://wbenny.github.io/2018/11/04/wow64-internals.html](https://wbenny.github.io/2018/11/04/wow64-internals.html)

* [https://medium.com/@fsx30/hooking-heavens-gate-a-wow64-hooking-technique-5235e1aeed73](https://medium.com/@fsx30/hooking-heavens-gate-a-wow64-hooking-technique-5235e1aeed73)

* [https://mark.rxmsolutions.com/through-the-heavens-gate/](https://mark.rxmsolutions.com/through-the-heavens-gate/)

* [https://speakerdeck.com/aaaddress1/rebuild-the-heavens-gate-from-32-bit-hell-back-to-heaven-wonderland](https://speakerdeck.com/aaaddress1/rebuild-the-heavens-gate-from-32-bit-hell-back-to-heaven-wonderland)

* [http://blog.rewolf.pl/blog/?p=102](http://blog.rewolf.pl/blog/?p=102)

* [https://www.mandiant.com/resources/blog/wow64-subsystem-internals-and-hooking-techniques](https://www.mandiant.com/resources/blog/wow64-subsystem-internals-and-hooking-techniques)

* [https://www.malwaretech.com/2014/02/the-0x33-segment-selector-heavens-gate.html](https://www.malwaretech.com/2014/02/the-0x33-segment-selector-heavens-gate.html)

* [https://int0h.wordpress.com/2009/12/24/the-power-of-wow64/](https://int0h.wordpress.com/2009/12/24/the-power-of-wow64/)

* [https://modexp.wordpress.com/2015/11/19/dllpic-injection-on-windows-from-wow64-process/](https://modexp.wordpress.com/2015/11/19/dllpic-injection-on-windows-from-wow64-process/)

### Hell's Gate

* [https://vxug.fakedoma.in/papers/VXUG/Exclusive/HellsGate.pdf](https://vxug.fakedoma.in/papers/VXUG/Exclusive/HellsGate.pdf)

* [https://github.com/am0nsec/HellsGate](https://github.com/am0nsec/HellsGate)


### Halo's Gate

* [https://blog.sektor7.net/#!res/2021/halosgate.md](https://blog.sektor7.net/#!res/2021/halosgate.md)


### 致谢

[返回顶部](#atomicsyscall)

感谢你们的研究和博客文章：

* Paul Laîné ([@am0nsec](https://twitter.com/am0nsec))

* smelly__vx ([@smelly__vx](https://twitter.com/smelly__vx))

* reenz0h ([@sektor7net](https://twitter.com/sektor7net))

* Jack Halon ([@jack_halon](https://twitter.com/jack_halon))

PhysicalResolvePoC	该 PoC 直接从 `C:\Windows\System32\ntdll.dll` 解析 `NtQuerySystemInformation` 的系统调用号。
HellsGatePoC	该 PoC 通过 Hell's Gate 技术解析 `NtQuerySystemInformation` 的系统调用号。
HalosGatePoC	该 PoC 通过 Halo's Gate 技术解析 `NtQuerySystemInformation` 的系统调用号。

HellsGateResolver	该 PoC 通过 Hell's Gate 技术解析 ntdll.dll 中的系统调用号。不适用于已被防病毒产品修补的函数。
HalosGateResolver	该 PoC 通过 Halo's Gate 技术解析 ntdll.dll 中的系统调用号。
InitialProcessResolver	该 PoC 通过由 `NtCreateUserProcess` 创建的初始进程解析 ntdll.dll 中的系统调用号。
KnownDllsResolver	该 PoC 使用 `\KnownDlls\ntdll.dll` 解析 ntdll.dll 中的系统调用号。

AtomicSyscall

最受欢迎

AtomicSyscall

Table Of Contents

HeavensGate

SyscallDumper

| Syscall Name | Number | Number (hex) |

SyscallPoCs

SyscallResolvers

Get-SyscallNumber.ps1