← Back to Dashboard

SilentMoonwalk

// Dynamic Call Stack Spoofing Masterclass

8
Modules
C++
Language
x64
Architecture
3
Difficulty Tiers

Master fully dynamic call stack spoofing through ROP-based stack desynchronization. Learn how SilentMoonwalk fabricates synthetic stack frames that pass RtlVirtualUnwind validation, deceiving EDR call stack inspection. By klezVirus.

01 Beginner

EDR Call Stack Telemetry

How EDRs inspect thread stacks, kernel callbacks, ETW stack walking, and why call stacks are the new frontline.

 02 Beginner

x64 Stack Frames & Unwinding

RSP, RBP, RUNTIME_FUNCTION, UNWIND_INFO, and how RtlVirtualUnwind reconstructs call chains.

 03 Beginner

ROP Fundamentals

Return-Oriented Programming concepts, gadgets, chains, and why ROP is the engine behind stack spoofing.

 04 Intermediate

Stack Desynchronization Theory

Separating logical execution from physical stack layout. The core SilentMoonwalk innovation explained.

 05 Intermediate

Gadget Discovery & Selection

Scanning ntdll and kernel32 for JMP RBX, ADD RSP, and POP/RET gadgets with strict usability criteria.

 06 Intermediate

Synthetic Frame Construction

Building fake RUNTIME_FUNCTION entries and crafting unwind codes that satisfy RtlVirtualUnwind validation.

 07 Advanced

The Full Spoof Engine

SilentMoonwalk's complete algorithm: frame fabrication, ROP chain assembly, and syscall dispatch.

 08 Advanced

Detection & Countermeasures

CFG, CET/shadow stacks, stack validation heuristics, and comparison with ThreadStackSpoofer and Draugr.

References & Resources