> For the complete documentation index, see [llms.txt](https://codex-7.gitbook.io/codexs-terminal-window/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://codex-7.gitbook.io/codexs-terminal-window/red-team/red-team-dev/loader-dev/indirect-syscalls.md).

# Indirect syscalls

WORK IN PROGRESS

### Detecting Direct Syscalls

Currently, the techniques of detecting syscalls are as follows:

* Search the binary or memory for the syscall, ret; instructions
  * Find code used to perform direct syscalls
* Monitor for syscall instructions not originating from the memory range of NTDLL
  * Detect the use of direct syscalls

### Evading these detections

To evade these detections, we need to avoid 2 things:

* Containing the syscall, ret; instructions
* Calling them from outside the memory space of NTDLL

![](/files/2TcvpbKQLjByuveH1KRk)

There is a way to perform our syscalls while "playing by" these detection rules, without the need to spoof or hide anything.

We can call the syscall, ret; combination from NTDLL itself!

* Locate an unhooked syscall, ret; in NTDLL memory range
* Jump to it

![](/files/Db8djizuVIxAUCez9jk0)

No source code will be provided for this technique, but if/when I do produce a working PoC I will do a short demo on this page. (maybe video comparison with traditional syscalls?)

### Related blogposts

<https://klezvirus.github.io/RedTeaming/AV_Evasion/NoSysWhisper/> <-- this blogpost is good if you want to understand syscall techniques in more depth