> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/red-team/dev/syscalls.md).

# Syscalls

* <https://alice.climent-pommeret.red/posts/a-syscall-journey-in-the-windows-kernel/>
* <https://alice.climent-pommeret.red/posts/direct-syscalls-hells-halos-syswhispers2/>
* <https://www.solomonsklash.io/syscalls-for-shellcode-injection.html>
* <https://jmpesp.me/malware-analysis-syscalls-example/>
* <https://klezvirus.github.io/RedTeaming/AV_Evasion/NoSysWhisper/>
* <https://labs.cognisys.group/posts/Combining-Indirect-Dynamic-Syscalls-and-API-Hashing/>
* <https://hadess.io/edr-evasion-techniques-using-syscalls/>

## SharpCall

* <https://jhalon.github.io/utilizing-syscalls-in-csharp-1/>
* <https://jhalon.github.io/utilizing-syscalls-in-csharp-2/>
* <https://github.com/jhalon/SharpCall>

## HellsGate

* <https://redops.at/en/blog/exploring-hells-gate>
* <https://xakep.ru/2023/08/08/hells-gate/>

## RecycledGate / TartarusGate

* <https://labs.nettitude.com/blog/creating-an-opsec-safe-loader-for-red-team-operations/>
* <https://github.com/thefLink/RecycledGate>
* <https://github.com/nettitude/Tartarus-TpAllocInject>