repository·master·Indexed 22 days ago
https://github.com/am0nsec/hellsgateA C-based research and educational implementation of the Hell's Gate VX technique. It provides a methodology for mapping NTDLL functions to system call numbers using DJB2 hashes and the VX_TABLE structure to bypass standard API hooks via direct syscall invocation.
A custom implementation of a memory copy function (VxMoveMemory) that handles both forward and backward copies based on the relative positions of the source and destination pointers. This is used to move payload data into allocated memory.
PVOID VxMoveMemory(
_Inout_ PVOID dest,
_In_ const PVOID src,
_In_ SIZE_T len
);This function populates a VX_TABLE_ENTRY by searching the Export Address Table (EAT) of a module (typically NTDLL) for a function name that matches the provided dwHash.
Once a name match is found via the DJB2 hash, the function performs a 'quick and dirty' check to ensure the function is a valid syscall stub and not a hook. It specifically looks for the pattern:
MOV R10, RCXMOV RCX, <syscall_number>It then extracts the wSystemCall (the syscall number) from the instruction bytes.
BOOL GetVxTableEntry(
_In_ PVOID pModuleBase,
_In_ PIMAGE_EXPORT_DIRECTORY pImageExportDirectory,
_In_ PVX_TABLE_ENTRY pVxTableEntry
);When constructing a VX_TABLE, use the following DJB2 hashes to identify the required NTDLL functions:
| Function | DJB2 Hash |
|---|---|
NtAllocateVirtualMemory | 0xf5bd373480a6b89b |
NtCreateThreadEx | 0x64dc7db288c5015f |
NtProtectVirtualMemory | 0x858bcb1046fb6a37 |
NtWaitForSingleObject | 0xc6a2fa174e551bcb |
HellDescent function is an external symbol that acts as a wrapper for executing NTDLL functions. It is used in conjunction with HellsGate to perform actual operations like memory allocation or thread creation using the extracted VX table entries.The HellsGate function is an external symbol used to execute a system call directly using a previously extracted system call number. This bypasses standard API hooks by jumping straight to the syscall instruction within the NTDLL function stub.
Signature:
extern VOID HellsGate(WORD wSystemCall);
The VX (Virtual eXecution) technique relies on two primary structures to map NTDLL functions to their corresponding system call numbers without using traditional API calls.
VX_TABLE_ENTRY: Represents a single function entry. It contains the memory address (pAddress), a DJB2 hash of the function name (dwHash), and the extracted system call number (wSystemCall).VX_TABLE: A collection of VX_TABLE_ENTRY structures for specific NTDLL functions required by the payload, typically including NtAllocateVirtualMemory, NtProtectVirtualMemory, NtCreateThreadEx, and NtWaitForSingleObject.typedef struct _VX_TABLE_ENTRY {
PVOID pAddress;
DWORD64 dwHash;
WORD wSystemCall;
} VX_TABLE_ENTRY, * PVX_TABLE_ENTRY;
typedef struct _VX_TABLE {
VX_TABLE_ENTRY NtAllocateVirtualMemory;
VX_TABLE_ENTRY NtProtectVirtualMemory;
VX_TABLE_ENTRY NtCreateThreadEx;
VX_TABLE_ENTRY NtWaitForSingleObject;
} VX_TABLE, * PVX_TABLE;