Listen to this Post
The article explores the undocumented concept of System Call Providers in Windows 11, which allows intercepting system calls at the kernel level. This mechanism differs significantly from the alternative system call handlers in Windows 10, now made more complex by Microsoft. The research clarifies key structures involved in the process, though challenges remain with PatchGuard and HyperGuard protections.
Read the full article here:
Windows 11 Alternate Syscalls Deep Dive
You Should Know: Practical System Call Interception Techniques
Key Structures & Functions
1. `PsRegisterAltSystemCallHandler` – Registers an alternative system call handler.
2. `KiSystemCall64` – The default system call dispatcher in x64 Windows.
3. `KeServiceDescriptorTable` – Contains pointers to system call routines (SSDT).
Code Snippet: Hooking System Calls
NTSTATUS HookSyscall(ULONG SyscallNumber, PVOID NewHandler) {
__try {
PVOID SSDT = KeServiceDescriptorTable->ServiceTableBase;
PVOID Original = SSDT[bash];
SSDT[bash] = NewHandler;
return STATUS_SUCCESS;
} __except(EXCEPTION_EXECUTE_HANDLER) {
return GetExceptionCode();
}
}
Steps to Intercept Syscalls
1. Locate `KeServiceDescriptorTable` (often exported in `ntoskrnl.exe`).
- Disable WP (Write Protection) bit in CR0 to modify kernel memory:
cli mov eax, cr0 and eax, ~0x10000 mov cr0, eax
3. Replace the syscall entry in the SSDT.
4. Restore WP bit:
mov eax, cr0 or eax, 0x10000 mov cr0, eax sti
Bypassing PatchGuard
- Dynamic SSDT swapping (switching between original/modified tables).
- Using hypervisor-assisted hooks (via HyperGuard evasion).
What Undercode Say
Windows 11’s System Call Providers introduce new complexities for kernel-mode developers, requiring deeper reverse engineering to bypass security mechanisms like PatchGuard. Practical exploitation involves:
– SSDT manipulation (x64).
– CR0 register tweaking for memory writes.
– Hypervisor-assisted hooking for stealth.
Related Linux Syscall Hacking
List syscalls on Linux ausyscall --dump Hook syscalls using `ptrace` strace -e trace=open,read,write ./target_program Kernel module syscall hijacking echo 0 > /proc/sys/kernel/kptr_restrict
Windows Commands for Analysis
Check loaded kernel modules driverquery /v Dump SSDT (WinDbg) dx KeServiceDescriptorTable
Expected Output:
A functional syscall hook that intercepts NtReadFile or similar, verified via WinDbg or Process Monitor.
Prediction
Microsoft will further obfuscate syscall mechanisms in future Windows versions, pushing security research towards hypervisor-based introspection and hardware-assisted virtualization for rootkit detection. Expect more VBS (Virtualization-Based Security) enhancements.
References:
Reported By: Yazid Benjamaa – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
