Merge pull request #1 from Artur2/add-another-hells-gate-example

Add another example below obsolete of Hells Gate
This commit is contained in:
matthieu-hackwitharts
2023-03-06 09:08:16 +01:00
committed by GitHub
+2
View File
@@ -508,6 +508,8 @@ Code sample : // to add
To avoid using hardcoded syscalls, Hell's Gate (Hells Gates ?) retrieve them dynamically by parsing EAT (compare memory bytes to syscall opcodes). The original Poc has been made by the great VX-Underground team, and can be found here : https://papers.vx-underground.org/papers/Windows/Evasion%20-%20Systems%20Call%20and%20Memory%20Evasion/Dynamically%20Retrieving%20SYSCALLs%20-%20Hells%20Gate.7z
Another one example : https://github.com/am0nsec/HellsGate
## Heavens Gate
Use Wow64 to inject 64 bits payload in 32 bits loader. Can be useful to bypass some AV/EDRs because Wow64 will avoid you to be catch in userland.