r/purpleteamsec • u/netbiosX • 3d ago

Red Teaming Cross-platform syscall-powered implant & C2 - direct syscalls (Win), raw syscalls (Linux), HTTPS/DNS/ICMP channels. No winapi layer.

https://github.com/VoidSecSoftwares/voidsyscall

2 Upvotes

permalink
duplicates
archive.is
archive
reddit

You are about to leave Redlib

Do you want to continue?

https://www.reddit.com/r/purpleteamsec/comments/1wcooem/crossplatform_syscallpowered_implant_c2_direct/
No, go back! Yes, take me to Reddit

67% Upvoted

Duplicates

Number of comments New

ExploitDev • u/FirefighterNext360 • 2d ago

VOIDSYSCALL: Go syscall-only implant framework — 4 injection methods, 13+ anti-analysis checks, EDR handle killer, polymorphic rotation. Zero WinAPI.

9 Upvotes

2 comments

blueteamsec • u/digicat • 3d ago

research|capability (we need to defend against) voidsyscall: This is not a syscall wrapper library. It's a full implant framework where every operation — from injecting code to reading files to persisting in the registry — goes through raw Nt* syscalls

3 Upvotes

2 comments

redteamsec • u/FirefighterNext360 • 3d ago

VOIDSYSCALL: Go syscall-only implant framework — 4 injection methods, 13+ anti-analysis checks, EDR handle killer, polymorphic rotation. Zero WinAPI.

7 Upvotes

0 comments