Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

x0reaxeax/SysCook64

Open more actions menu

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

4 Commits
4 Commits
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

SysCook64 - Cooking thread contexts for fun and profit

What is this?

This is a PoC technique for indirect syscall execution, by suspending, altering and resuming a thread.
The target thread's context is modified in order to land on a syscall instruction in NTDLL (we're doing NtAllocateVirtualMemory), with registers and stack prepared for syscall execution.
There's no need for syscall stubs, since all the arguments are written directly to the target's thread context, while it's suspended.

Demo

YouTube

Releases

Used by

Contributors

Languages

Morty Proxy This is a proxified and sanitized view of the page, visit original site.