search

daem0nc0re / AtomicSyscall

Tools and PoCs for Windows syscall investigation.
BSD 3-Clause "New" or "Revised" License
348 stars 49 forks source link

About havengate #1

Closed rakan-dev closed 1 year ago

rakan-dev commented 1 year ago

This is not actually havengate you just using transmission wow64 address and call it I hope u correct me if I’m wrong

I believe havensgate you can call any function that is in 64bit layer or even call shellcode that is x64

daem0nc0re commented 1 year ago

Thanks for sharing your opinion.

My understanding is that Heaven's Gate means the procedure of transitioning from 32-bit to 64-bit (such as push 0x33; push 0x31323244; retf). The PoC simply demonstrate that syscall can be called without going through SysWOW64's ntdll.dll using Heaven's Gate. I'm working more Heaven's Gate related PoCs (such as shellcode loader and injector) and will release later.

rakan-dev commented 1 year ago

Yes we are in same page about haven’s gate but i think you should rename the project to SyscallWOW64 bcuz haven’s gate is misleading

sorry for bad english not my native language