Struct indirectSyscall

internal/evasion/indirect_syscall.go:60–62

indirectSyscall evasion refers to executing the syscall instruction by diverting the execution flow into a legitimate, clean ntdll stub that performs the syscall on process behalf. This achieves code origin legitimacy, since the execution lands in .text of a signed Microsoft module (ntdll.dll). Sta

// of a signed Microsoft module (ntdll.dll). Stack frames look identical to
// a normal API call, which achieves call stack normalization.
type indirectSyscall struct {
	offsets map[event.Type]uintptr // stores expected syscall stub offsets
}

func NewIndirectSyscall() Evasion {
	return &indirectSyscall{}