Decoupling Syscall Resolution from Invocation via PEB Scanning to Evade Call-Stack Telemetry

Offensive Security
,
1

Hey. I’m a developer focused on Windows internals, offensive C programming, and red team tooling. I’ve been building an open-source C evasion framework called SindriKit to study how we can apply better software architecture to maldev.

So, while direct syscalls (and resolvers like Hell’s Gate) used to be the gold standard, modern EDRs burned them via call-stack telemetry during the kernel transition.

The issue I ran into is that most public exploits tightly couple their SSN resolution with their execution stubs. If I needed to pivot to indirect syscalls to go through NTDLL, I had to rewrite the core logic.

Instead of hardcoding the execution, I rebuilt the pipeline to completely separate finding the SSN from executing it:

// Resolve SSN
snd_syscall_set_resolver(snd_syscall_resolve_ssn_scan);

// Invoke via Gadget
snd_syscall_set_invoker(snd_syscall_indirect_invoke_asm);
snd_syscall_set_gadget_finder(snd_syscall_find_gadget_scan);

// Next would be calling your reflective loader, injection... whatever

To make the indirect invocation work, I needed a legitimate syscall; ret (x64) or sysenter (x86) gadget. So I implemented snd_syscall_find_gadget_scan. It walks the PEB, locates the loaded ntdll.dll in memory, and extracts the gadget’s memory.

I’ve pushed this to GitHub as v1.2.0, but I’m looking for peer review from the RE and malware dev guys here:

  1. For those who have written custom PEB walkers, have you run into stability issues locating the syscall; ret gadgets dynamically on older Windows builds? Using this native memory approach?
  2. I wrote custom x64 MASM stubs to handle the 16-byte stack alignment before making the indirect jump. Are there cleaner ways to enforce this alignment purely in inline C without dropping to external .asm files?

The full source code, architecture docs, and PoCs are available here for review: GitHub - youssefnoob003/SindriKit: A foundational C library for building operationally credible offensive capabilities · GitHub

Disclaimer: This framework is built strictly for educational research and authorized red team engagements.

1 Like