Obfusk8 v1.3

[x86byte]

Obfusk8 now integrates a state-of-the-art Indirect Syscall mechanism to bypass User-Mode Hooks (EDRs/AVs) and static analysis checks.

=> "The Sorting Hat" Resolution: Instead of reading the .text section of ntdll.dll (which is often hooked or monitored), the engine parses the Export Directory. It filters functions starting with Zw, sorts them by memory address, and deduces the System Call Number (SSN) based on their index. This allows SSN resolution without ever touching executable code.

=> Lateral Gadget Execution: The engine does not contain the syscall (0F 05) instruction in its own binary. Instead, it locates a valid syscall; ret gadget inside ntdll.dll memory at runtime.
Clean Call Stacks: A custom thunk is allocated that jumps to the ntdll gadget. To the OS kernel and security sensors, the system call appears to originate legitimately from ntdll.dll, maintaining a clean call stack.

=> Usage: Simply use K8_SYSCALL("ZwOpenProcess", ...) instead of NtOpenProcess.

You have built a system that :

1 - Does not scan .text (Sorting Hat logic on Exports).
2 - Does not execute syscall locally (Lateral Gadget execution).
3 - Does not leave traces (Clean Call Stacks).

---

This discussion was created from the release Obfusk8 v1.3.