← Back to Dashboard

Draugr

// Synthetic Stack Frame Evasion

8
Modules
C++
Language
ASM
Assembly
BOF
Format

Master synthetic call stack construction for EDR evasion. Learn how Beacon Object Files, x64 stack unwinding metadata, JMP RBX gadgets, and indirect syscalls combine to make shellcode calls look like legitimate Windows thread initialization. By NtDallas.

01 Beginner

EDR Call Stack Analysis

How EDRs walk the call stack, detect unbacked memory, and why shellcode API calls look suspicious to kernel callbacks.

 02 Beginner

Beacon Object Files (BOFs)

What BOFs are, how Cobalt Strike loads them, in-process execution, and the BOF API. Why Draugr is a BOF.

 03 Beginner

x64 Stack Unwinding

RUNTIME_FUNCTION, UNWIND_INFO, UNWIND_CODEs, RtlVirtualUnwind, and how Windows navigates the call stack without frame pointers.

 04 Intermediate

SSN Resolution & Indirect Syscalls

Syscall stub pattern matching, neighbor-based fallback for hooked stubs, and jumping to the syscall instruction in ntdll.

 05 Intermediate

The Spoof Assembly Routine

Stub.s walkthrough: register preservation, stack argument copying, and the five-phase execution model from init to cleanup.

 06 Advanced

Synthetic Frame Construction

Building fake frames for BaseThreadInitThunk and RtlUserThreadStart. UNWIND_CODE parsing, frame size calculation, and three-layer stack layout.

 07 Advanced

Gadgets, Fixup & Clean Return

JMP [RBX] gadget discovery in kernelbase.dll, the PRM structure, fixup routine, and seamless return to the caller.

 08 Advanced

Full Chain, Detection & Ecosystem

End-to-end flow, Intel CET/Shadow Stacks, BeaconGate integration, Eden UDRL, and comparison with ThreadStackSpoofer, SilentMoonWalk, and WithSecure.

References & Resources