C++ self-Injecting dropper based on various EDR evasion techniques.
-
Updated
Feb 11, 2024 - C
#
indirect-syscall
Here are 21 public repositories matching this topic...
Reflective x64 PE/DLL Loader implemented using Dynamic Indirect Syscalls
-
Updated
Oct 8, 2024 - C++
A Rust port of LayeredSyscall — performs indirect syscalls while generating legitimate API call stack frames by abusing VEH.
-
Updated
Oct 31, 2024 - Rust
ApexLdr is a DLL Payload Loader written in C
malware loader threadpool shellcode-loader av-evasion av-bypass red-teaming dll-unhooking dll-sideloading indirect-syscall
-
Updated
Jul 17, 2024 - C
Clean Indirect Syscalls with Hook Evasion & Return Address Spoofing.
-
Updated
Apr 30, 2026 - C
Usermode detector that catches indirect syscalls. Traps Hell's Hall, Tartarus' Gate, RecycledGate, and VEH syscalls & Many more.
-
Updated
Jun 15, 2026 - C++
SysWhispers & HellsGate successor, executing protected Indirect & Direct syscalls in EDR protected settings
anticheat offensive-security detours syscall red-team ntdll windows-internals anti-debug lotl syscall-hooking hooking-framework edr-evasion hook-bypass indirect-syscall syscall-proxy winternals
-
Updated
May 25, 2026 - Rust
Stealth Windows keylogger.
windows cybersecurity keylogger stealth offensive-security malware-development redteam-tools edr-evasion indirect-syscall
-
Updated
Jan 11, 2026 - C++
Indirect Syscall invocation via thread hijacking
-
Updated
May 5, 2023 - C
NTAPI hook bypass with (semi) legit stack trace
windows x86 av-evasion redteam antihooking av-bypass edr-bypass detection-evasion hook-bypass indirect-syscall
-
Updated
May 9, 2023 - C
Shellcode Loader Library.
malware loader dll-injection shellcode-loader av-evasion dll-hooking dll-hijacking redteam av-bypass red-teaming indirect-syscall
-
Updated
Sep 21, 2025
Transparently call NTAPI via Halo's Gate with indirect syscalls.
-
Updated
Apr 26, 2024 - C
A generic x64 indirect syscall template for RED TEAM OPSEC
-
Updated
Feb 3, 2025 - C
A shellcode loader powered by a web panel.
-
Updated
Mar 11, 2025 - C++
Header-only Windows x64 indirect syscall library. Zero CRT, zero IAT, VEH anti-BP, AMSI/ETW bypass, W^X memory, per-call dynamic stubs.
windows cpp x64 header-only evasion syscall red-team anti-debugging security-research amsi-bypass no-crt indirect-syscall etw-bypass peb-walk
-
Updated
Apr 15, 2026 - C++
Implementation and documentation of establishing a reverse shell using only indirect syscalls
malware shellcode malware-analysis malware-research offensive-security malware-development red-team shellcode-loader malware-detection black-hat shellcode-development shellcode-injection indirect-syscall indirect-syscalls
-
Updated
Apr 24, 2026
-
Updated
Aug 7, 2025 - C
This is stands as a research blog and exercise in payload development. The exact technique talked through is via Remote Thread.
malware shellcode malware-analysis malware-research offensive-security malware-development red-team shellcode-loader malware-detection black-hat shellcode-development shellcode-injection indirect-syscall indirect-syscalls
-
Updated
Apr 8, 2026 - C
Invoke Shellcode through Indirect Syscalls inside PowerShell
powershell malware malware-analysis malware-research powershell-script offensive-security malware-development red-team powershell-module malware-detection black-hat indirect-syscall indirect-syscalls
-
Updated
Apr 17, 2026 - PowerShell
Improve this page
Add a description, image, and links to the indirect-syscall topic page so that developers can more easily learn about it.
Add this topic to your repo
To associate your repository with the indirect-syscall topic, visit your repo's landing page and select "manage topics."