Syscall原理及其地狱之门家族代码详解<\/h1>

1. Syscall基础原理<\/h2>

1.1 什么是Syscall<\/h3>
系统调用(Syscall)是用户空间程序与内核空间交互的标准接口，允许用户态程序请求内核服务，如文件操作、进程控制、网络通信等。<\/p>

1.2 Syscall工作流程<\/h3>

用户态准备参数<\/strong>：将系统调用号和参数放入特定寄存器<\/li>
触发中断\/特殊指令<\/strong>：通过int 0x80<\/code>(传统)、sysenter<\/code>\/syscall<\/code>(现代)等方式进入内核<\/li>
内核处理<\/strong>：内核根据调用号查找系统调用表，执行对应函数<\/li>

返回用户态<\/strong>：将结果通过寄存器返回给用户程序<\/li> <\/ol> 1.3 不同架构下的Syscall调用方式<\/h3> 架构<\/th> 调用指令<\/th> 调用号寄存器<\/th> 参数寄存器<\/th> 返回寄存器<\/th> <\/tr> <\/thead> x86<\/td> int 0x80<\/td> eax<\/td> ebx, ecx, edx...<\/td> eax<\/td> <\/tr> x86_64<\/td> syscall<\/td> rax<\/td> rdi, rsi, rdx...<\/td> rax<\/td> <\/tr> ARM<\/td> svc 0<\/td> r7<\/td> r0-r6<\/td> r0<\/td> <\/tr> ARM64<\/td> svc 0<\/td> x8<\/td> x0-x6<\/td> x0<\/td> <\/tr> <\/tbody> <\/table> 2. 地狱之门(Hell's Gate)技术原理<\/h2> 2.1 技术背景<\/h3> 地狱之门是一种绕过EDR(终端检测与响应)监控的技术，通过直接调用系统服务表(SSDT)中的函数指针来规避用户态hook。<\/p> 2.2 关键技术点<\/h3> 动态获取SSDT地址<\/strong>：通过PEB(进程环境块)和PE头解析获取ntdll.dll基址<\/li> 解析导出表<\/strong>：定位Nt*\/Zw*函数<\/li> 读取前32字节<\/strong>：获取系统调用号和可能的SSDT索引<\/li> 直接调用<\/strong>：绕过用户态hook直接进入内核<\/li> <\/ol> 2.3 技术优势<\/h3> 绕过用户态API监控<\/li> 避免触发EDR的用户态hook检测<\/li> 可动态适应不同Windows版本<\/li> <\/ul> 3. 地狱之门家族代码实现<\/h2> 3.1 基本实现步骤<\/h3> \/\/ 1. 获取ntdll.dll基址 <\/span><\/span><\/span><\/span>HMODULE GetNtdllBase<\/span>() { <\/span><\/span> PPEB peb =<\/span> (PPEB)__readgsqword(0x60<\/span>); \/\/ x64 PEB位置 <\/span><\/span><\/span><\/span> PPEB_LDR_DATA ldr =<\/span> peb-><\/span>Ldr; <\/span><\/span> PLIST_ENTRY list =<\/span> ldr-><\/span>InMemoryOrderModuleList.Flink; <\/span><\/span> <\/span><\/span> while<\/span> (list !=<\/span> &<\/span>ldr-><\/span>InMemoryOrderModuleList) { <\/span><\/span> PLDR_DATA_TABLE_ENTRY entry =<\/span> CONTAINING_RECORD(list, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks); <\/span><\/span> if<\/span> (wcsstr(entry-><\/span>FullDllName.Buffer, L<\/span>"ntdll.dll"<\/span>)) { <\/span><\/span> return<\/span> (HMODULE)entry-><\/span>DllBase; <\/span><\/span> } <\/span><\/span> list =<\/span> list-><\/span>Flink; <\/span><\/span> } <\/span><\/span> return<\/span> NULL; <\/span><\/span>} <\/span><\/span> <\/span><\/span>\/\/ 2. 解析导出表获取函数地址 <\/span><\/span><\/span><\/span>PVOID GetSyscallAddress<\/span>(HMODULE ntdllBase, LPCSTR funcName) { <\/span><\/span> PIMAGE_DOS_HEADER dosHeader =<\/span> (PIMAGE_DOS_HEADER)ntdllBase; <\/span><\/span> PIMAGE_NT_HEADERS ntHeaders =<\/span> (PIMAGE_NT_HEADERS)((DWORD_PTR)ntdllBase +<\/span> dosHeader-><\/span>e_lfanew); <\/span><\/span> PIMAGE_EXPORT_DIRECTORY exportDir =<\/span> (PIMAGE_EXPORT_DIRECTORY)((DWORD_PTR)ntdllBase +<\/span> <\/span><\/span> ntHeaders-><\/span>OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress); <\/span><\/span> <\/span><\/span> PDWORD functions =<\/span> (PDWORD)((DWORD_PTR)ntdllBase +<\/span> exportDir-><\/span>AddressOfFunctions); <\/span><\/span> PDWORD names =<\/span> (PDWORD)((DWORD_PTR)ntdllBase +<\/span> exportDir-><\/span>AddressOfNames); <\/span><\/span> PWORD ordinals =<\/span> (PWORD)((DWORD_PTR)ntdllBase +<\/span> exportDir-><\/span>AddressOfNameOrdinals); <\/span><\/span> <\/span><\/span> for<\/span> (DWORD i =<\/span> 0<\/span>; i <<\/span> exportDir-><\/span>NumberOfNames; i++<\/span>) { <\/span><\/span> LPCSTR name =<\/span> (LPCSTR)((DWORD_PTR)ntdllBase +<\/span> names[i]); <\/span><\/span> if<\/span> (strcmp(name, funcName) ==<\/span> 0<\/span>) { <\/span><\/span> return<\/span> (PVOID)((DWORD_PTR)ntdllBase +<\/span> functions[ordinals[i]]); <\/span><\/span> } <\/span><\/span> } <\/span><\/span> return<\/span> NULL; <\/span><\/span>} <\/span><\/span> <\/span><\/span>\/\/ 3. 提取系统调用号 <\/span><\/span><\/span><\/span>DWORD ExtractSyscallNumber<\/span>(PVOID funcAddr) { <\/span><\/span> BYTE*<\/span> code =<\/span> (BYTE*<\/span>)funcAddr; <\/span><\/span> <\/span><\/span> \/\/ x64典型模式: mov eax, SSN <\/span><\/span><\/span><\/span> if<\/span> (code[0<\/span>] ==<\/span> 0xB8<\/span> &&<\/span> code[3<\/span>] ==<\/span> 0x00<\/span> &&<\/span> code[4<\/span>] ==<\/span> 0x00<\/span>) { <\/span><\/span> return<\/span> *<\/span>(DWORD*<\/span>)(code +<\/span> 1<\/span>); <\/span><\/span> } <\/span><\/span> return<\/span> 0<\/span>; <\/span><\/span>} <\/span><\/span><\/code><\/pre>3.2 地狱之门家族变种<\/h3> Halo's Gate<\/strong>：针对Windows 10 1809及更高版本的改进<\/li> Tartarus' Gate<\/strong>：添加了间接调用和混淆技术<\/li> FreshyCalls<\/strong>：动态生成syscall存根<\/li> <\/ol> 4. 防御与检测<\/h2> 4.1 EDR检测方法<\/h3> 用户态hook验证<\/strong>：检查关键API是否被hook<\/li> 异常调用链检测<\/strong>：监控非标准syscall调用路径<\/li> 行为分析<\/strong>：检测直接syscall调用行为模式<\/li> <\/ol> 4.2 对抗技术<\/h3> 动态SSN获取<\/strong>：避免硬编码系统调用号<\/li> 调用栈欺骗<\/strong>：伪造合法的调用栈<\/li> 间接syscall<\/strong>：通过合法模块跳转<\/li> <\/ol> 5. 实际应用示例<\/h2> 5.1 直接syscall调用NtAllocateVirtualMemory<\/h3> typedef<\/span> NTSTATUS<\/span>(NTAPI*<\/span> NtAllocateVirtualMemory_t)( <\/span><\/span> HANDLE ProcessHandle, <\/span><\/span> PVOID*<\/span> BaseAddress, <\/span><\/span> ULONG_PTR ZeroBits, <\/span><\/span> PSIZE_T RegionSize, <\/span><\/span> ULONG AllocationType, <\/span><\/span> ULONG Protect); <\/span><\/span> <\/span><\/span>void<\/span> DirectSyscallExample<\/span>() { <\/span><\/span> HMODULE ntdll =<\/span> GetNtdllBase(); <\/span><\/span> PVOID funcAddr =<\/span> GetSyscallAddress(ntdll, "NtAllocateVirtualMemory"<\/span>); <\/span><\/span> DWORD ssn =<\/span> ExtractSyscallNumber(funcAddr); <\/span><\/span> <\/span><\/span> PVOID baseAddr =<\/span> NULL; <\/span><\/span> SIZE_T size =<\/span> 0x1000<\/span>; <\/span><\/span> <\/span><\/span> __asm<\/span> { <\/span><\/span> mov r10, rcx \/\/ x64 syscall参数约定 <\/span><\/span><\/span><\/span> mov eax, ssn \/\/ 系统调用号 <\/span><\/span><\/span><\/span> syscall <\/span><\/span> mov [baseAddr], rax \/\/ 结果 <\/span><\/span><\/span><\/span> } <\/span><\/span>} <\/span><\/span><\/code><\/pre>6. 总结<\/h2> 地狱之门技术代表了现代恶意软件对抗EDR检测的一种高级技术，通过深入理解Windows系统调用机制和PE结构，实现了对安全产品的有效规避。防御方需要从多维度构建检测能力，包括用户态hook验证、调用链分析和行为监控等。<\/p>

架构<\/th>	调用指令<\/th>	调用号寄存器<\/th>	参数寄存器<\/th>	返回寄存器<\/th> <\/tr> <\/thead>
x86<\/td>	int 0x80<\/td>	eax<\/td>	ebx, ecx, edx...<\/td>	eax<\/td> <\/tr>
x86_64<\/td>	syscall<\/td>	rax<\/td>	rdi, rsi, rdx...<\/td>	rax<\/td> <\/tr>
ARM<\/td>	svc 0<\/td>	r7<\/td>	r0-r6<\/td>	r0<\/td> <\/tr>
ARM64<\/td>	svc 0<\/td>	x8<\/td>	x0-x6<\/td>	x0<\/td> <\/tr> <\/tbody> <\/table> 2. 地狱之门(Hell's Gate)技术原理<\/h2> 2.1 技术背景<\/h3> 地狱之门是一种绕过EDR(终端检测与响应)监控的技术，通过直接调用系统服务表(SSDT)中的函数指针来规避用户态hook。<\/p> 2.2 关键技术点<\/h3> 动态获取SSDT地址<\/strong>：通过PEB(进程环境块)和PE头解析获取ntdll.dll基址<\/li> *解析导出表<\/strong>：定位Nt\/Zw函数<\/li>* 读取前32字节<\/strong>：获取系统调用号和可能的SSDT索引<\/li> 直接调用<\/strong>：绕过用户态hook直接进入内核<\/li> <\/ol> 2.3 技术优势<\/h3> 绕过用户态API监控<\/li> 避免触发EDR的用户态hook检测<\/li> 可动态适应不同Windows版本<\/li> <\/ul> 3. 地狱之门家族代码实现<\/h2> 3.1 基本实现步骤<\/h3> \/\/ 1. 获取ntdll.dll基址 <\/span><\/span><\/span><\/span>HMODULE GetNtdllBase<\/span>() { <\/span><\/span> PPEB peb =<\/span> (PPEB)__readgsqword(0x60<\/span>); \/\/ x64 PEB位置 <\/span><\/span><\/span><\/span> PPEB_LDR_DATA ldr =<\/span> peb-><\/span>Ldr; <\/span><\/span> PLIST_ENTRY list =<\/span> ldr-><\/span>InMemoryOrderModuleList.Flink; <\/span><\/span> <\/span><\/span> while<\/span> (list !=<\/span> &<\/span>ldr-><\/span>InMemoryOrderModuleList) { <\/span><\/span> PLDR_DATA_TABLE_ENTRY entry =<\/span> CONTAINING_RECORD(list, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks); <\/span><\/span> if<\/span> (wcsstr(entry-><\/span>FullDllName.Buffer, L<\/span>"ntdll.dll"<\/span>)) { <\/span><\/span> return<\/span> (HMODULE)entry-><\/span>DllBase; <\/span><\/span> } <\/span><\/span> list =<\/span> list-><\/span>Flink; <\/span><\/span> } <\/span><\/span> return<\/span> NULL; <\/span><\/span>} <\/span><\/span> <\/span><\/span>\/\/ 2. 解析导出表获取函数地址 <\/span><\/span><\/span><\/span>PVOID GetSyscallAddress<\/span>(HMODULE ntdllBase, LPCSTR funcName) { <\/span><\/span> PIMAGE_DOS_HEADER dosHeader =<\/span> (PIMAGE_DOS_HEADER)ntdllBase; <\/span><\/span> PIMAGE_NT_HEADERS ntHeaders =<\/span> (PIMAGE_NT_HEADERS)((DWORD_PTR)ntdllBase +<\/span> dosHeader-><\/span>e_lfanew); <\/span><\/span> PIMAGE_EXPORT_DIRECTORY exportDir =<\/span> (PIMAGE_EXPORT_DIRECTORY)((DWORD_PTR)ntdllBase +<\/span> <\/span><\/span> ntHeaders-><\/span>OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress); <\/span><\/span> <\/span><\/span> PDWORD functions =<\/span> (PDWORD)((DWORD_PTR)ntdllBase +<\/span> exportDir-><\/span>AddressOfFunctions); <\/span><\/span> PDWORD names =<\/span> (PDWORD)((DWORD_PTR)ntdllBase +<\/span> exportDir-><\/span>AddressOfNames); <\/span><\/span> PWORD ordinals =<\/span> (PWORD)((DWORD_PTR)ntdllBase +<\/span> exportDir-><\/span>AddressOfNameOrdinals); <\/span><\/span> <\/span><\/span> for<\/span> (DWORD i =<\/span> 0<\/span>; i <<\/span> exportDir-><\/span>NumberOfNames; i++<\/span>) { <\/span><\/span> LPCSTR name =<\/span> (LPCSTR)((DWORD_PTR)ntdllBase +<\/span> names[i]); <\/span><\/span> if<\/span> (strcmp(name, funcName) ==<\/span> 0<\/span>) { <\/span><\/span> return<\/span> (PVOID)((DWORD_PTR)ntdllBase +<\/span> functions[ordinals[i]]); <\/span><\/span> } <\/span><\/span> } <\/span><\/span> return<\/span> NULL; <\/span><\/span>} <\/span><\/span> <\/span><\/span>\/\/ 3. 提取系统调用号 <\/span><\/span><\/span><\/span>DWORD ExtractSyscallNumber<\/span>(PVOID funcAddr) { <\/span><\/span> BYTE<\/span> code =<\/span> (BYTE<\/span>)funcAddr; <\/span><\/span> <\/span><\/span> \/\/ x64典型模式: mov eax, SSN <\/span><\/span><\/span><\/span> if<\/span> (code[0<\/span>] ==<\/span> 0xB8<\/span> &&<\/span> code[3<\/span>] ==<\/span> 0x00<\/span> &&<\/span> code[4<\/span>] ==<\/span> 0x00<\/span>) { <\/span><\/span> return<\/span> <\/span>(DWORD<\/span>)(code +<\/span> 1<\/span>); <\/span><\/span> } <\/span><\/span> return<\/span> 0<\/span>; <\/span><\/span>} <\/span><\/span><\/code><\/pre>3.2 地狱之门家族变种<\/h3> Halo's Gate<\/strong>：针对Windows 10 1809及更高版本的改进<\/li> Tartarus' Gate<\/strong>：添加了间接调用和混淆技术<\/li> FreshyCalls<\/strong>：动态生成syscall存根<\/li> <\/ol> 4. 防御与检测<\/h2> 4.1 EDR检测方法<\/h3> 用户态hook验证<\/strong>：检查关键API是否被hook<\/li> 异常调用链检测<\/strong>：监控非标准syscall调用路径<\/li> 行为分析<\/strong>：检测直接syscall调用行为模式<\/li> <\/ol> 4.2 对抗技术<\/h3> 动态SSN获取<\/strong>：避免硬编码系统调用号<\/li> 调用栈欺骗<\/strong>：伪造合法的调用栈<\/li> 间接syscall<\/strong>：通过合法模块跳转<\/li> <\/ol> 5. 实际应用示例<\/h2> 5.1 直接syscall调用NtAllocateVirtualMemory<\/h3> typedef<\/span> NTSTATUS<\/span>(NTAPI<\/span> NtAllocateVirtualMemory_t)( <\/span><\/span> HANDLE ProcessHandle, <\/span><\/span> PVOID<\/span> BaseAddress, <\/span><\/span> ULONG_PTR ZeroBits, <\/span><\/span> PSIZE_T RegionSize, <\/span><\/span> ULONG AllocationType, <\/span><\/span> ULONG Protect); <\/span><\/span> <\/span><\/span>void<\/span> DirectSyscallExample<\/span>() { <\/span><\/span> HMODULE ntdll =<\/span> GetNtdllBase(); <\/span><\/span> PVOID funcAddr =<\/span> GetSyscallAddress(ntdll, "NtAllocateVirtualMemory"<\/span>); <\/span><\/span> DWORD ssn =<\/span> ExtractSyscallNumber(funcAddr); <\/span><\/span> <\/span><\/span> PVOID baseAddr =<\/span> NULL; <\/span><\/span> SIZE_T size =<\/span> 0x1000<\/span>; <\/span><\/span> <\/span><\/span> __asm<\/span> { <\/span><\/span> mov r10, rcx \/\/ x64 syscall参数约定 <\/span><\/span><\/span><\/span> mov eax, ssn \/\/ 系统调用号 <\/span><\/span><\/span><\/span> syscall <\/span><\/span> mov [baseAddr], rax \/\/ 结果 <\/span><\/span><\/span><\/span> } <\/span><\/span>} <\/span><\/span><\/code><\/pre>6. 总结<\/h2> 地狱之门技术代表了现代恶意软件对抗EDR检测的一种高级技术，通过深入理解Windows系统调用机制和PE结构，实现了对安全产品的有效规避。防御方需要从多维度构建检测能力，包括用户态hook验证、调用链分析和行为监控等。<\/p>

Syscall原理及其地狱之门家族代码详解<\/h1>

1. Syscall基础原理<\/h2>

1.1 什么是Syscall<\/h3> 系统调用(Syscall)是用户空间程序与内核空间交互的标准接口，允许用户态程序请求内核服务，如文件操作、进程控制、网络通信等。<\/p>

2. 地狱之门(Hell's Gate)技术原理<\/h2>

2.1 技术背景<\/h3> 地狱之门是一种绕过EDR(终端检测与响应)监控的技术，通过直接调用系统服务表(SSDT)中的函数指针来规避用户态hook。<\/p>

3. 地狱之门家族代码实现<\/h2>

4. 防御与检测<\/h2>

5. 实际应用示例<\/h2>

1.1 什么是Syscall<\/h3>
系统调用(Syscall)是用户空间程序与内核空间交互的标准接口，允许用户态程序请求内核服务，如文件操作、进程控制、网络通信等。<\/p>

2.1 技术背景<\/h3>
地狱之门是一种绕过EDR(终端检测与响应)监控的技术，通过直接调用系统服务表(SSDT)中的函数指针来规避用户态hook。<\/p>