Intro to Syscalls for Windows Malware

This session features eversinc33 giving an intro to syscalls implementations for Windows malware.
This is a recording from the Prelude Discord Live Stream Series.
Click here to join the Prelude Discord: / discord

[@Red4mber]

Damn, that's by far the best explanation i've seen on the subject

[@alienJIZ1990]

Wow, excellent presentation! This topic/attack vector is not nearly covered enough. The space needs more people who understand this and you explained it extremely well

[@halfbelf5923]

Thank you for explaination. It was useful for me :) I'm coding on c# maybe 2-3 years and I decide to learn something new about malware etc. but only in this guide I found useful techniques.

[@joyemoticon]

Wow! I could not have asked for a better topic. Exactly what I was wanting to learn!

[@Preludeorg]

Glad to hear this. Huge thanks to eversinc33

[@CyberCelt.]

This is a fantastic intro, thanks a lot

[@Preludeorg]

Glad you enjoyed - all the credit to eversinc33!

[@lovedoraemon2390]

thanks, this is very clear to understand.

[@rnrbeast]

Very good explanations, thanks for sharing this

[@eversinc33]

I just wanna provide some additional info that I missed to give in the talk, but I feel that should be addressed:
1) The Nt* and Zw* functions, which I call syscalls here, are technically just stdcall wrappers around the actual syscall instruction. The terminology is confusing and many people refer to them as syscalls, but technically they are just wrappers that enable the syscalls to easily be called from C/C++.
2) When I refer to the usage of GetModuleHandle and GetProcAddress with Nt*/Zw* functions as being suspicious, that is also only partly true. Many legitimate programs, including standard windows binaries, use these calls with Nt*/Zw* functions. What might be suspicious here is the type of APIs you are importing, e.g. if those are known to be used for code injection, not the usage of GetProcAddress/GetModuleHandle itself.

[@Preludeorg]

🖤

[@detective5253]

great slide explaination out there. could you please focus more on the practical side? it's gonna be interesting if you dive deep into red team simulation tactics and malware development using C++ and C# for dealing with system calls if possible.

[@Preludeorg]

Thanks for the encouraging words. We'll keep this in mind!

[@yurim9917]

👏👏👏

[@cvport8155]

Please make more vd for advanced techniques red team and pivoting and dev malware bypass EDR

[@Preludeorg]

We'll keep this in mind for future content! Thanks for watching.

[@fakeacount1479]

hey prelude, can you make video about making your own malware in c++ and testing it in virus total to get 0 detections😮😊

[@Preludeorg]

Hey fake acount1 - we'll consider the request 😏

[@fakeacount1479]

@@Preludeorg ok.