Tool to detect syscalls usermode hooks (ntdll.dll) from EDRs/AVs and get dynamically the syscall number.

syshook allows you to detect if a syscall is hooked or not, and retrieve the SSDT index of the syscall using a PATCH and UNPATCH method.

1. A function name is given as an argument (ex. NtReadVirtualMemory).

2. The function address is retrieved using GetProcAddress from ntdll.dll.

3. The function SysCallThePatch is called, but before is prepared the arguments (based on x64 calling convention)

4. Using VirtualProtect and memcpy the function is patched to avoid calling the syscall instruction. The code is the next, and as you can see it does nothing but is used to fill the instructions.

   mov r12d,eax
   mov eax,r12d
   ret

5. The function is called and the eax register is retrieved.

6. Finally, the function is unpached using memcpy and VirtualProtect to restore the original code.

Scan all the Nt and Zw functions from ntdll.dll

./syshook -a

Scan a specific function

./syshook -f NtReadVirtualMemory

# No hooked function
[*] Checking the function ZwAllocateUserPhysicalPagesEx
[*] No hook was found in : ZwAllocateUserPhysicalPagesEx
[*] Syscall number: 74

# Hooked function
[*] Checking the function ZwWriteVirtualMemory
[!] Syscall hooked
[$] Patching the function ZwWriteVirtualMemory
[$] Successfully patched the function ZwWriteVirtualMemory
[$] Unpatching the function ZwWriteVirtualMemory
[$] Successfully unpatched the function ZwWriteVirtualMemory
[*] Syscall number [Dynamic]: 3a

Where the syscall is 3a, should consider that the 3a is not visible because is dynamically calculated. The EDR/AV hooked this function by replacing the syscall instruction by a jmp to some analysis function.