Pre-requisites
Need an assembly file that makes syscalls to Win32 API functions directly, instead of going through ntdll.dll.
SysWhispers2 helps generate the assembly file.
Working
After generating the assembly file,
- Search for a process by name and retrieve its Process ID (PID)
- Allocate RWX region into remote process using direct syscall.
- Write Shellcode into allocated memory using direct syscall.
- Execute the shellcode using direct syscall.