FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

vvswift/Shellcode-Injector: PoC shellcode injector using clean syscalls to bypass user-mode hooks in ntdll.dll · GitHub

/ Shellcode-Injector Public
BranchesTags

Repository files navigation

Shellcode Injector

Proof of concept shellcode injector that uses clean syscalls to bypass user-mode hooks in ntdll

Goals

  • Activity obfuscation
  • Inject shellcode into a target process via raw syscalls
  • Bypass common user-mode hooks on Win32 APIs LoadLibrary, VirtualAlloc, WriteProcessMemory
  • Auto generate & embed a shellcode payload that downloads and executes a PE file

How It Works

  1. Leverages the Windows Thread Pool API to hide the call stack:
    • The syscall appears to originate from a trusted region inside ntdll!TpWorker rather than from our code.
  2. No direct native API calls are made; instead, the injector jumps to syscall stubs discovered in ntdll.

Project Files

Path Purpose
include/PEB.h Struct definitions for PEB / TEB / LDR_MODULE
include/Callbacks.h Prototypes & argument structs for the three syscalls
Callbacks.asm NASM routines: locate raw syscall stubs → unpack args → syscall; ret
Shellcode.h.template DSL Intel syntax between SHELLCODE_START / END markers
generate_shellcode_header.py Assembles the DSL → overwrites Shellcode.h with a byte array
main.cpp C++ wrapper: EnableDebugPrivilege, SSN lookup, Thread Pool callbacks, wrappers for
NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx
Makefile Automation:
1 Generate Shellcode.h
2 Assemble ASM routines
3 Compile & link → injector.exe

Technologies & Dependencies

  • Windows x64 – MSVC / Visual Studio Build Tools
  • NASM -f win64
  • Python 3 + Keystone-engine pip install keystone-engine

Build & Run

  1. Install NASM, MSVC, Python + Keystone beforehand

  2. Generate Shellcode.h from the template python generate_shellcode_header.py Shellcode.h.template Shellcode.h

  3. Build everything make

  4. Launch the injector injector.exe

🚫 Disclaimer

This repository is provided for educational purposes only and intended for authorized security research. Use of these materials in unauthorized or illegal activities is strictly prohibited.

About

PoC shellcode injector using clean syscalls to bypass user-mode hooks in ntdll.dll

Topics

assemblycode-injectiondll-injectiondll-injectorhookingloadlibrarymalware-analysismemory-injectionpackerpebprocess-injectionreverse-engineeringshellcodeshellcode-injectionwindows-apiwindows-internals

Resources

Readme
Activity

Stars

15 stars

Watchers

1 watching

Forks

3 forks
Report repository

Releases

Packages

Contributors

Languages

Back | FazBrowse Home | New Git URL