HallWatch: Usermode indirect syscall detection
Source Reddit Malware
Discussion
HallWatch is a user-mode detection tool designed to identify indirect syscalls by patching the syscall instruction itself to trigger breakpoints. It targets modern syscall bypass techniques such as Hell's Hall, Tartarus' Gate, RecycledGate, and VEH syscalls that evade traditional user-mode hooks. The tool is currently a research proof-of-concept and aims to provide lightweight syscall detection for system libraries in Windows environments.
r/Malware (opens in a new tab)u/AhmedMinegames0 points0 comments
Hello everyone! I built a C++ usermode detector for indirect syscalls called HallWatch.
GitHub: https://github.com/Zypherion-Technologies/HallWatch
Most usermode detections hook the start of Nt* stubs in ntdll. Modern techniques like Hell's Hall, Tartarus' Gate, RecycledGate, and VEH syscalls can bypass those hooks by jumping directly to the syscall instruction.
HallWatch takes a different approach: instead of patching the stub prologue, it patches the syscall instruction itself:
0F 05 -> CC 05
Any execution path that reaches the syscall byte triggers an INT3 breakpoint, allowing the detector to inspect the caller, validate the SSN, unwind the stack, and redirect execution through a private trampoline.
It also includes detection for Hell's Gate and shadow ntdll mappings by scanning executable memory for syscall stubs.
Still a research project / PoC. it is impossible to fully detect syscalls in user-mode without some kind of debugger or tracer stepping over the code to monitor everything, but this is still a good light-weight technique to do so for system libraries.
But I'd still love feedback from people interested in Windows internals, EDRs and malware analysis to see how we could improve it.