rust-mordor-rs is a Rust library that demonstrates the Hell's Gate family of direct syscall resolution techniques, written for authorized red teamers and defenders studying EDR hooking behavior.
| Tool | gmh5225/rust-mordor-rs — Rust implementation of Hell's Gate, Halo's Gate, Tartarus' Gate, FreshyCalls and SysWhispers2 syscall resolution techniques |
| Category | Direct syscall / API unhooking research library (Rust, Windows) |
| Primary Use | Educational exploration of how syscall stubs in ntdll.dll can be resolved dynamically, used by authorized red teams and defenders studying EDR evasion internals |
| Safe Use | For use exclusively in authorized penetration tests, malware research labs, and defensive engineering work on systems you own or have written permission to test |
| Telemetry Note | Direct syscalls bypass user-mode hooks, but the behavior itself — parsing ntdll.dll exports and executing syscall instructions from non-ntdll memory — is a well-known detection primitive that EDR telemetry and kernel callbacks can observe |
rust-mordor-rs is a Rust-language library by gmh5225 that collects several of the best-known direct syscall resolution techniques into a single codebase: Hell's Gate, Halo's Gate, Tartarus' Gate, FreshyCalls, and the SysWhispers2 approach to stub discovery. The author named the project Mordor because the various "Gates" reminded them of the Black Gate from Tolkien's fiction, and the repo leans into that theme with imagery of the gate itself. With 32 stars, an MIT license, and development clearly marked as in progress, this is best understood as an educational and research artifact rather than a finished operator tool — the TODO list openly states that usage documentation, friendlier APIs, and syscall macros are still pending. For professionals studying Windows internals or EDR evasion theory, having all five techniques expressed in one systems language like Rust is the primary value proposition.
The README begins with a genuinely useful primer on hooking, which frames why these techniques exist at all. It describes Inline Hooking, where the first bytes of a function's assembly are replaced with a jmp instruction to redirect execution, and Import Address Table (IAT) hooking, where a function pointer in the IAT lookup table is swapped to redirect calls. Both are the standard mechanisms by which antivirus (AV), endpoint detection and response (EDR), and even anti-cheat (AC) products interpose themselves between applications and the operating system. Understanding this interposition is the conceptual foundation for everything else in the repository, and the README credits Kyle Mistele's beginner guide to EDR evasion for the illustrative diagram included in the repo.
At the core of the project is Hell's Gate, described in the README as a technique that searches ntdll.dll for a characteristic byte sequence — 4c8bd1b8 — that corresponds to the assembly pair mov r10, rcx followed by mov eax, <syscall>. This is the syscall stub, and locating it allows a program to extract the syscall number and store it in a memory table for direct invocation of native APIs. The documented limitation is significant and worth internalizing: Hell's Gate requires access to a clean, unhooked ntdll.dll. If the target function has been hooked by a security product, the signature match fails and the technique breaks. This is the canonical arms-race dynamic that the subsequent "Gates" were designed to address.
Halo's Gate extends its predecessor with a simple but elegant observation documented in the README: because syscall numbers in ntdll.dll exports are allocated incrementally, a hooked function's syscall ID can be derived by examining its neighboring functions and adjusting the calculation. The hook detection heuristic is checking whether the first byte of the export is e9, the opcode for a relative jmp. If that byte is present, the code walks adjacent stubs to infer the obscured number rather than reading it directly. From a defensive analysis standpoint, this is a useful fact — it explains why simply hooking one Nt function is insufficient protection, since the syscall number can be reconstructed from the surrounding export layout.
Tartarus' Gate handles a subtler case the README explains well: not every EDR hooks at the very start of a function. Some place their jmp immediately after the mov r10, rcx instruction, which breaks Halo's Gate assumptions. Tartarus' Gate therefore also searches for the byte sequence 4c8bd1e9, representing mov r10, rcx followed by jmp <address>. The README further references a method called Veles' Reek from SEKTOR7 training material: when all functions in view are hooked, one can find an unhooked stub and work outward, resolving each number sequentially from syscall ID 0. Together these three techniques form a progression that any analyst writing detections for syscall abuse should be able to recite.
The second half of the project covers stub discovery approaches that avoid byte-signature matching entirely. FreshyCalls walks the Export Directory of ntdll.dll, collects functions starting with Nt (excluding Ntdll itself), and sorts them by address — the lowest address corresponds to syscall number 0, the next to 1, and so on, a fact the README encourages verifying in x64dbg or WinDbg. SysWhispers2 does the same but enumerates Zw-prefixed exports instead, which works because, as the README quotes from Microsoft's own documentation, Nt and Zw routines are serviced by the same kernel-mode system routine and behave identically when called from user mode. The included debugger screenshots in the repo illustrate that equivalence concretely.
The README also contextualizes the wider SysWhispers lineage. SysWhispers1 selected syscall numbers based on OS version information, which made its output version-sensitive. SysWhispers2 replaced that with the runtime Zw enumeration already described. SysWhispers3 adds x86/WoW64 support, syscall instruction replacement using an EGG placeholder for dynamic substitution, direct jumps to syscalls in x86/x64 modes, and direct jumps to random syscalls. rust-mordor-rs does not claim to implement all of these; it positions itself alongside them, and its TODO notes the author is still deciding whether to remain a library or evolve into a generator that emits output files the way the SysWhispers family does.
The reference section is unusually thorough and functions as a curated reading list for the entire direct-syscall subdiscipline: the original HellsGate work by @RtlMateusz and @am0nsec, the SEKTOR7 Halo's Gate writeup, trickster0's TartarusGate, MDSec's foundational post on bypassing user-mode hooks, crummie5's FreshyCalls, jthuraisamy's SysWhispers and SysWhispers2, klezVirus's SysWhispers3, and blog analyses by Alice Climent-Pommeret and Kelzvirus. The README also credits janoglezcampos/rust_syscalls as prior Rust work in the space, which signals honest attribution rather than silent reimplementation.
For authorized red team operators, the practical significance of this codebase is educational consolidation: instead of reading five separate C implementations across five repositories, a professional can study one Rust implementation where the techniques share plumbing. Rust as a language choice is itself interesting for this domain — its lack of a runtime, strong memory-safety guarantees, and relatively uncommon presence in offensive tooling historically produced different compiler signatures than C-based equivalents, though the README does not make any detection-evasion claims about the language and neither should the reader assume any.
For defenders, the value runs in the opposite direction: every technique documented here is also a detection engineering input. Processes that read ntdll.dll from disk or parse another process's loaded copy, sequences of syscall instructions executing from memory regions that are not backed by ntdll.dll, and export-directory enumeration of Nt/Zw functions are all observable behaviors. Kernel-side telemetry in particular remains largely indifferent to user-mode hook bypass, which is precisely why vendors have moved detection logic below the user-kernel boundary. Studying rust-mordor-rs is a compact way to understand both what attackers gain and what traces remain.
The project's honest incompleteness is worth stating plainly: there is no usage documentation yet, the API may change, and the library-versus-generator question is unresolved. Anyone pulling the repo with git clone https://github.com/gmh5225/rust-mordor-rs should treat it as a study reference for Windows syscall internals and EDR evasion theory, suitable for lab environments, authorized engagements with clear scope, and defensive research into how these well-documented techniques actually behave in memory. It is not a turnkey tool, and at 32 stars with active TODO items it is very much a living experiment — which is exactly what makes it interesting to read.
gmh5225/rust-mordor-rs.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.