BouncyGate

This is a modified version of @zimawhit3's implementation of HellsGate in Nim, with additionally making sure that all syscalls go through NTDLL, by replacing the syscall instructions with a JMP to the syscall instruction in NTDLL that corresponds to the syscall being executed. The syscalls are then used to patch AMSI as a PoC.

See https://eversinc33.github.io/posts/avoiding-direct-syscall-instructions/ for an explanation.

If you would like to learn more about how HellsGate works, you can find smelly__vx's (@RtlMateusz) and am0nsec's (@am0nsec) paper at the Vx-Underground Github.

Install mingw 8.0.0-1, since the newest version has some issues related to relocation that make compilation impossible.

Usage

First, the syscall stub has to be defined:

proc NtProtectVirtualMemory(ProcessHandle: Handle, BaseAddress: PVOID, NumberOfBytesToProtect: PULONG, NewAccessProtection: ULONG, OldAccessProtection: PULONG): NTSTATUS {.asmNoStackFrame.} =
    asm """
        mov r10, rcx
        mov eax, `ntProtectSyscall`
        mov r11, `ntProtectSyscallJumpAddress`
        jmp r11
        ret
    """

Then the syscall number can be resolved at runtime and the syscall can be used afterwards:

var ntProtect = resolve_syscall("NtProtectVirtualMemory")
ntProtectSyscall = ntProtect.wSysCall
ntProtectSyscallJumpAddress = ntProtect.syscallJumpAddress # of course you can play around with the syscall jump addresses here and have it execute with the syscall fron a different function, to obfuscate your call
var status = NtProtectVirtualMemory(GetCurrentProcess(), &cs_addr, &p_len, cast[ULONG](PAGE_EXECUTE_READWRITE), &op)