README

Delphi-IndirectSyscall

Overview

IndirectSyscall is a Delphi-based demonstration of indirect syscall execution techniques. It implements a method to execute native Windows syscalls while evading common detection mechanisms by security products.

How It Works

The project consists of three main components:

1. Structure Definitions (structs.pas)

Contains Windows data structures needed for low-level operations, particularly:

• Process Environment Block (PEB) structures
• Module information structures
• API Set namespace structures
• Other Windows internals structures

2. Syscall Implementation (syscalls.pas)

Provides a dynamic syscall execution mechanism:

• Defines Windows NT syscall function prototypes
• Implements a system for dynamic setting of syscall numbers
• Uses inline assembly to execute syscalls by jumping to existing syscall instructions

3. Main Program (IndirectSyscall.dpr)

Orchestrates the process:

• Locates ntdll.dll via PEB traversal (avoiding GetModuleHandle)
• Identifies all Zw functions and their syscall instructions
• Determines syscall numbers by sorting functions by address
• Decrypts an embedded payload (shellcode)
• Executes the payload using indirect syscalls:
  • Allocates memory with ZwAllocateVirtualMemory
  • Writes the payload with ZwWriteVirtualMemory
  • Makes memory executable with ZwProtectVirtualMemory
  • Executes the payload with ZwCreateThreadEx

Security Evasion Techniques

This demonstration implements several security evasion techniques:

1. Direct PEB Access - Bypasses monitored API calls
2. Dynamic Syscall Resolution - Avoids hardcoded syscall numbers
3. Indirect Syscall Execution - Jumps to existing syscall instructions
4. XOR-Encrypted Payload - Prevents static detection
5. Random Syscall Entry Points - Adds execution variability

Technical Implementation

The core mechanism works by:

1. Finding the memory address of ntdll.dll without calling GetModuleHandle
2. Scanning the export directory to locate all Zw functions
3. Finding the syscall instruction (0F 05 C3) within each function
4. Sorting functions by address to determine their syscall numbers
5. Using a special assembly construct to call syscalls by jumping to existing instructions

Example of the dynamic syscall mechanism:

mov r10, rcx       ; First parameter moves to r10 (x64 calling convention)
mov eax, SSN       ; Load dynamic system service number
jmp qword ptr [SYSCALLADDR] ; Jump to syscall instruction in ntdll

Educational Purpose

This code is provided for educational purposes to demonstrate:

• Windows internal structures like the PEB
• How syscalls are implemented in Windows
• Techniques used to evade security monitoring
• Low-level assembly programming in Delphi

Usage Notes

This is a demonstration tool intended for security professionals, researchers, and those learning about Windows internals. The techniques demonstrated could potentially be misused; therefore, use responsibly and only in controlled environments.

Legal Disclaimer

This code is provided for educational purposes only. Users are responsible for ensuring that their use of this code complies with applicable laws and regulations.