Better Readme

README.md

@@ -2,18 +2,85 @@
 
 ![superdeye](superd.png)
 
-SuperdEye is the implementation of TartarusGate by trickster0 in pure Go and Go Assembler.
+SuperdEye is the implementation of HellHall (a revised version of TartarusGate) in pure Go and Go Assembler.
 
-The purpose is to scan hooked NTDLL and retreive the Syscall number to then do an indirect Syscall with it, thus allowing the bypass of AV/EDR that put hooks on functions.
+The purpose is to scan hooked NTDLL and retrieve the Syscall number to then do an indirect Syscall with it, thus allowing the bypass of AV/EDR that put hooks on functions.
 
 ## Usage
 
+Just import the package and use it !
+
+The SuperdEye package exposes the `SuperSyscall` that can be used to do Indirect syscall.
+
+```go
+import (
+	"fmt"
+	"unsafe"
+
+	"github.com/almounah/superdeye"
+)
+...
+
+	NTSTATUS, err = superdeye.SuperdSyscall("NtCreateThreadEx", uintptr(unsafe.Pointer(&hThread)), uintptr(0x1FFFFF), uintptr(0), handleProcess, pBaseAddress, uintptr(0), uintptr(0), uintptr(0), uintptr(0), uintptr(0), uintptr(0))
+	if err != nil {
+        fmt.Println("Syscall Was not executed due. Likely the Syscall was not found or a bug...")
+		fmt.Println(err.Error())
+	}
+	fmt.Println("Syscall NtCreateThreadEx Made with NTSTATUS ", NTSTATUS)
+
+```
+
+For better usability, some syscall are already wrapped to be compatible with the official `golang.org/x/sys/windows` package. 
+
+```go
+import (
+	"fmt"
+	"unsafe"
+
+	"github.com/almounah/superdeye"
+	"golang.org/x/sys/windows"
+)
+...
+	pBaseAddress, NTSTATUS, err := superdeye.NtAllocateVirtualMemory(windows.Handle(handleProcess), uintptr(0), uintptr(len(payloadClearText)), windows.MEM_COMMIT|windows.MEM_RESERVE, windows.PAGE_EXECUTE_READWRITE)
+	if err != nil {
+        fmt.Println("Syscall Was not executed due. Likely the Syscall was not found or a bug...")
+		fmt.Println(err.Error())
+	}
+	fmt.Println("Syscall NtAllocateVirtualMemory Made with NTSTATUS ", NTSTATUS)
+...
+```
+
+More Syscalls will be made compatible with the official windows package in the future (Contributions are welcome in `superdwrapper.go`)
+
 ## Examples
 
+Full examples are given in `examples/`
+
+## What does it do ?
+
+It is the implementation of TartarusGate by trickster0 and HellHall by mrd0x and NUL0x4C in Go.
+
+Basically, a hooked NTDLL will be scanned. Once the target function is found, in case it is hooked by an AV or an EDR, a scan of the neighboors above and below will be made until a clean syscall is found. This will allow the calculation of the target function ssn. 
+
+Once the ssn is found, an indirect syscall will be constructed.
+
+I tried illustrating the principle with the following diagram.
+
+![superdeye](tartarusgatehellhall.png)
+
+
+## Other Similar Tools in Go
+
+Other notable tools that are worth noting are [BananaPhone](https://github.com/C-Sto/BananaPhone/tree/master) and [acheron](https://github.com/f1zm0/acheron).
+
+BananaPhone uses a similar aproach to HellHall and TartarusGate but does not search far in the neighbor. Plus the syscall is direct. BananaPhone is the equivalent of the HellGate project in Go.
+
+Acheron on the other hand, use a totally different aproach than HellGate and HellHall (and TartarusGate). Basically, at the beginning Acheron scan all the NTDLL, sort all the function's hashes by address. The ssn is then deduced by simply calculating the index of the function in the address list. In Acheron the syscall is an indirect one. Acheron is the equivalent of the SysWhisper3 project in Go.
+
 ## Side Story: Why the name SuperdEye
 
 In [Mushoku Tensei](https://myanimelist.net/anime/39535/Mushoku_Tensei__Isekai_Ittara_Honki_Dasu) the Superd is a tribal Demonic Race from the Demon Continent. They have green emerald Hair and a third Eye on their forehead that let them perceive mana not detectable by others.
 
 The superd tribe are hated by Demons and Human alike due to historical reason. A Superd is hated and feared for just being a Superd.
 
-I named this project SuperdEye as it let you perceive syscall number and do indirect syscall, much like having a Superd Eye will let you detect mana and fight the enemy.
+I named this project SuperdEye as it let you percieve syscall number and do indirect syscall, much like having a Superd Eye will let you detect mana and fight the enemy.

examples/getSSN/README.md

@@ -1,12 +0,0 @@
-# GetSSN
-
-A small play script that can be run in windows.
-
-You give is the Syscall name and it returns the syscall number using the Hell Hall and Tartarus Gate method (not syswhisper).
-
-
-To build cd into this directory and do:
-
-```
-go build -ldflags="-s -w" -trimpath
-```

examples/getSSN/getSSN.go

@@ -1,25 +0,0 @@
-package main
-
-import (
-	"fmt"
-
-	"github.com/almounah/superdeye/internal/manalocator"
-	"github.com/almounah/superdeye/internal/utils/helper"
-)
-
-func main() {
-	ntdllHandle := helper.GetNTDLLAddress()
-
-	for true {
-		fmt.Println("Enter Syscall Name: ")
-		var syscallName string
-		fmt.Scanln(&syscallName)
-		syscallTool, err := manalocator.LookupSSNAndTrampoline(syscallName, ntdllHandle)
-		if err != nil {
-			fmt.Println("Messed up ...")
-			fmt.Println(err)
-		} else {
-			fmt.Println("SSN for ", syscallName, " is ", syscallTool.Ssn)
-		}
-	}
-}

examples/getSSN/go.mod

@@ -1,7 +0,0 @@
-module getSSN
-
-replace github.com/almounah/superdeye => ../../
-
-go 1.23.1
-
-require github.com/almounah/superdeye v0.0.0-20241204234944-560d015c29d7 // indirect

examples/getSSN/go.sum

@@ -1,2 +0,0 @@
-github.com/almounah/superdeye v0.0.0-20241204234944-560d015c29d7 h1:JKCi5e2jhkjMdBuhAkJbQLI8EGPV/qzVz9XORbdM/+s=
-github.com/almounah/superdeye v0.0.0-20241204234944-560d015c29d7/go.mod h1:0r5yCZ6Pmaa0FYN0Qr+yCx81T0H2OE6mG7AI/vb1FBo=

examples/selfInject/README.md

@@ -10,10 +10,10 @@ It uses SuperdEye with syscalls only.
 
 The code is commented a little. It shows the two use cases, where the syscall is predefined in SuperdEye and the case the Syscall is not predefined by SuperdEye.
 
-To build cd into this directory and do:
+To build, cd into this directory and do:
 
 ```
-go build -ldflags="-s -w" -trimpath
+GOOS=windows GOARCH=amd64 GO111MODULE=on go build -ldflags="-s -w" -trimpath
 ```
 
 ![superdeye](selfinject.png)

internal/superdsyscall/superdsyscall.s

@@ -2,9 +2,9 @@
 
 #define maxargs 16
 
-// Superd Syscall is taken from acheron
-// acheron was taken from BananaPhone
-// BananaPhone was taken from go official syscall :p
+// Superd Syscall is taken from acheron syscall
+// acheron was inspired from BananaPhone
+// BananaPhone was inspired from go official syscall :p
 
 
 // func execIndirectSyscall(ssn uint16, trampoline uintptr, argh ...uintptr) uint32