Giter VIP home page Giter VIP logo

hwsyscalls's Introduction

HWSyscalls

image image

This project was co-authored by

Dec0ne idov31

Description

HWSyscalls is a new method to execute indirect syscalls using 3 main components:

  • Hardware breakpoints and Vectored Exception Handler to control the flow of execution.

  • HalosGate is used to find syscall numbers and addresses.

  • Creating a synthetic trampoline on kernel32 with hardware breakpoints.

HWSyscalls is provided as an easy-to-include library that can be added to any project that wants to use indirect syscalls without triggering EDRs or AVs detections based on the current indirect syscalls detection.

Indirect syscalls is a popular method that is used in different variations to call system calls from ntdll, however, the main issue with calling syscalls from ntdll is in its core: A weird access from a program directly to ntdll, without going through any previous dll. HWSyscalls is built upon the core idea of indirect syscalls but with a solution to this problem by combining hardware breakpoints functionality to create the synthetic trampoline in kernel32 and HalosGate to get the SSNs.

To make it easy, a normal indirect syscalls flow looks like this:

indirect_syscalls

While ours looks like this:

hwsyscalls_flow

For further information, check out our blog post (COMING SOON).

โš ๏ธ Warning: This project is a work in progress. The current version causes the stack to be unwindable. For more information regarding stack unwinding please check this blog post on MSDN and @KlezVirus's explanation in this blog post.

Usage

To use the project, you will need to include the HWSyscalls.h and call InitHWSyscalls to find the required gadgets and initialize the exception handler. At the end of your program's execution, call DeinitHWSyscalls to remove the exception handler.

#include "HWSyscalls.h"

typedef NTSTATUS(WINAPI* NtOpenProcess_t)(
	OUT          PHANDLE            ProcessHandle,
	IN           ACCESS_MASK        DesiredAccess,
	IN           POBJECT_ATTRIBUTES ObjectAttributes,
	IN OPTIONAL  PCLIENT_ID         ClientId);

void main() {

    // Initialize the exception handler and find the required gadgets.
    if (!InitHWSyscalls())
        return;
    
    // ...

    // Execute your function!
    NtOpenProcess_t pNtOpenProcess = (NtOpenProcess_t)PrepareSyscall((char*)("NtOpenProcess"));
    NTSTATUS status = pNtOpenProcess(&targetHandle, PROCESS_ALL_ACCESS, &object, &clientID);

    // ...

    // Removing the exception handler.
    DeinitHWSyscalls();

}

The debug verbosity can be turned on or off by changing the HWSYSCALLS_DEBUG definition in HWSyscalls.h

#pragma once
#include <windows.h>
#include <inttypes.h>
#include <stdio.h>

#pragma region Defines

#define HWSYSCALLS_DEBUG 0 // 0 disable, 1 enable
#define UP -32
//...

Setup

To compile this project you will need Visual Studio 2019 and forward. It is important to note that this project was made only for x64 environments and needs to be compiled without optimization. You can disable it from Project Settings -> C/C++ -> Optimization -> Optimization (Disabled /Od).

Example

example

Acknowledgments

hwsyscalls's People

Contributors

dec0ne avatar

Stargazers

 avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.