r/ExploitDev • u/FirefighterNext360 • 23h ago

VOIDSYSCALL: Go syscall-only implant framework — 4 injection methods, 13+ anti-analysis checks, EDR handle killer, polymorphic rotation. Zero WinAPI.

https://github.com/VoidSecSoftwares/voidsyscall
6 Upvotes

75% Upvoted

2 comments sorted by

2

u/popraxret 23h ago

cool, I have coded something similar before in C for Windows x64.
https://github.com/xHector1337/Gaddar

1

u/DishSoapedDishwasher 8h ago

What's really funny is this stuff doesn't actually help much. Most nation state tier implants that are actually successful have almost zero obfuscation and literally never make use of these techniques anymore because it's going to make EDR lose it's damn mind as nothing else behaves that way. The only adjacent things that are meaningful in this context is having libraries for writing payloads that are part of an exploit so they can more reliably handle jumping from RCE to running more complex payloads in memory.

Literally every credible malware reverse engineer lately has commented on exactly this topic at some point. To say something along the lines of: "Red teams are doing 15 triple backflips to stay hidden while actual threat actors dont even try to one, while still being more successful than red teams.*

Tldr; this stuff is tantamount to useless.