← Back to Dashboard

LayeredSyscall

// VEH Syscall Evasion Masterclass

8
Modules
C++
Language
x64
Architecture
3
Difficulty Tiers

Master indirect syscall execution with legitimate call stack generation. Learn how Vectored Exception Handling, hardware breakpoints, and CPU trap flags combine to bypass EDR user-land hooks. By WKL-Sec (White Knight Labs).

01 Beginner

EDR Hooks & The Detection Problem

How EDRs hook ntdll syscall stubs, the three detection layers (remapping, direct syscall, call stack), and why indirect syscalls aren't enough.

 02 Beginner

Syscall Internals & SSN Resolution

The x64 syscall stub, System Service Numbers, and the MDSec Exception Directory method for dynamic SSN resolution.

 03 Beginner

Windows Exception Handling & VEH

SEH vs VEH, exception dispatch flow, vectored handlers, and how to intercept and manipulate CPU context at exception time.

 04 Intermediate

Hardware Breakpoints & Debug Registers

Dr0–Dr7 debug registers, setting execution breakpoints from VEH handlers, and the advantages over INT3 software breakpoints.

 05 Intermediate

The Dual-Handler Architecture

AddHwBp and HandlerHwBp — two VEH handlers working in concert. The ACCESS_VIOLATION trigger, breakpoint installation, and state machine design.

 06 Advanced

Call Stack Construction via Trap Flag

Single-stepping through a legitimate API with the CPU trap flag. The three-condition algorithm for finding a suitable ntdll stack frame.

 07 Advanced

Argument Marshalling & Syscall Execution

Context swapping, R10/RAX emulation, extended argument copying (5th–12th), and clean return via Dr1 breakpoint.

 08 Advanced

Full Chain, Detection & Prior Art

End-to-end execution flow, detection surface analysis, comparison with HellsGate/SysWhispers/HWSyscalls, and the complete wrapped API list.

References & Resources