# syscall — RSS Amplifier

Recent posts from the 3 feeds in the RSS Amplifier directory that cover syscall.

Page: <https://rssamplifier.com/topics/syscall>  
Feed: <https://rssamplifier.com/topics/syscall.md>

---

## [Reverse engineering what HyperGuard monitors in ntoskrnl](https://fluxsec.red/what-does-hyperguard-skpg-monitor-vtl1-windows-internals-secure-kernel-patch-guard)

_2026-07-26 · Fluxsec.red Blog_

## [Crimes against NTDLL - Implementing Early Cascade Injection](https://fluxsec.red/implementing-early-cascade-injection-rust)

_2026-03-14 · Fluxsec.red Blog_

## [Introducing System Call Integrity Layer](https://fluxsec.red/introducing-system-call-integrity-layer)

_2026-01-17 · Fluxsec.red Blog_

## [Creating a Rust VBS Enclave DLL running in VTL1](https://fluxsec.red/creating-a-rust-application-running-in-vtl1)

_2026-01-15 · Fluxsec.red Blog_

## [Detecting Vectored Exception Handling Squared in an EDR](https://fluxsec.red/detecting-vectored-exception-handling-malware-rust-edr-windows-kernel)

_2026-01-11 · Fluxsec.red Blog_

## [Vectored Exception Handling Squared](https://fluxsec.red/vectored-exception-handling-squared-rust)

_2025-12-27 · Fluxsec.red Blog_

## [Creating a framework in Wyrm C2 to easily configure custom exports of an implant](https://fluxsec.red/creating-implant-dll-exports-wyrm-c2)

_2025-11-23 · Fluxsec.red Blog_

## [Creating a local self signed certificate for localhost testing of Wyrm C2](https://fluxsec.red/wyrm-c2-localhost-self-signed-certificate-windows)

_2025-11-17 · Fluxsec.red Blog_

## [Disassembly notes](https://fluxsec.red/disassembly-notes)

_2025-11-15 · Fluxsec.red Blog_

## [Using Ghidriff to look at heap buffer overflow example](https://fluxsec.red/using-ghidriff-to-examine-heap-buffer-overflow)

_2025-11-01 · Fluxsec.red Blog_

## [Find it on Amazon (Sponsored)](https://crawlproof.com/a/LBhPBTwwkLOJ)

_2025-11-01 · **Sponsored**_

Open the Amazon product listing to see details and availability

## [Timestomping a PE compile timestamp - adversary tradecraft and detection](https://fluxsec.red/timestomping-pe-compile-time)

_2025-10-26 · Fluxsec.red Blog_

## [Improving consistency with EDR DLL Injection via APCs](https://fluxsec.red/improving-EDR-via-windows-driver-apc-injection-rust)

_2025-10-12 · Fluxsec.red Blog_

## [Unpacking the AAD Broker LocalState Cache](https://winternl.com/aad-broker-cache/)

_2025-09-30 · winternl · winternl_

tl;dr: Source: https://github.com/jackullrich/AADBrokerDecrypt Intro The Azure AD Broker (AAD Broker) is a component of Entra ID that orchestrates Azure AD sign-in, device-bound primary refresh token (PRT) handling, and application token issuance exposed by Windows Runtime (WinRT) APIs. In this post, we’ll map the broker’s on-disk cache and show how to unpack its file formats. Additionally, \[…\]

## [Hells Hollow: A new SSDT Hooking technique](https://fluxsec.red/hells-hollow-a-new-SSDT-hooking-technique-with-alt-syscalls-rootkit)

_2025-07-28 · Fluxsec.red Blog_

## [Inside DCHSpy: Analysing Iranian APT MuddyWater free VPN mobile spyware](https://fluxsec.red/analysing-Iranian-APT-MuddyWater-mobile-spyware-free-vpn-comodo)

_2025-07-21 · Fluxsec.red Blog_

## [Rust OPSEC for Malware Development](https://fluxsec.red/rust-opsec-malware-development)

_2025-05-31 · Fluxsec.red Blog_

## [Alt Syscalls for Windows 11](https://fluxsec.red/alt-syscalls-for-windows-11)

_2025-05-11 · Fluxsec.red Blog_

## [Making improvements to the EDR DLL injection](https://fluxsec.red/early-bird-apc-queue-injection)

_2025-04-27 · Fluxsec.red Blog_

## [HUGLO: Hyper-Ultra-Giga Low-Overhead Tracing Profiler for Ruby](https://blog.mattstuchlik.com/2025/04/23/low-overhead-ruby-tracing.html)

_2025-04-23 · Matt Stuchlik_

I’ve built what I think is a pretty neat Ruby tracing profiler. It captures four event streams: Ruby function calls, system calls, thread-state changes, and garbage-collection activity, while adding less than 30 ns of overhead per Ruby function call, low enough for continuous use in large-scale production systems. As far as I know, no other Ruby tracer offers this mix of signals at this cost. If…

## [Full Fat Shellcode](https://winternl.com/full-fat-shellcode/)

_2025-04-10 · winternl · winternl_

GLP-1s need not apply. There may be situations where you wish to conditionally run 32-bit or 64-bit shellcode from the same codebase. One such scenario is if you are bootstrapping some code into an ILONLY assembly. Below is valid x86 and x86-64 code that can be used for that purpose. The interesting bit is how \[…\]

## [Point a Domain, Start a Pit (Sponsored)](https://crawlproof.com/a/7uyiR90ZyhQL)

_2025-04-10 · **Sponsored**_

Point any domain to a blacked-out, poison-green coming-soon page with an email waitlist.

## [Real-time Ransomware Detection Strategy](https://fluxsec.red/considering-ransomware-edr-defence-strategy)

_2025-04-06 · Fluxsec.red Blog_

## [Full spectrum Event Tracing for Windows detection in the kernel against rootkits](https://fluxsec.red/full-spectrum-event-tracing-for-windows-detection-in-the-kernel-against-rootkits)

_2025-03-30 · Fluxsec.red Blog_

## [Reverse engineering undocumented Windows Kernel features to work with the EDR](https://fluxsec.red/reverse-engineering-windows-11-kernel)

_2025-03-04 · Fluxsec.red Blog_

## [Monitoring NTDLL for in memory patching](https://fluxsec.red/monitoring-ntdll-for-memory-patching-etw-hacking-bypass-in-rust-EDR)

_2025-03-02 · Fluxsec.red Blog_

## [Intro and plan for the Sanctum EDR](https://fluxsec.red/sanctum-edr-intro)

_2025-02-07 · Fluxsec.red Blog_

## [Improving the Ghost Hunting implementation for flexibility and speed](https://fluxsec.red/improving-the-ghost-hunting-implementation-for-flexibility)

_2025-02-06 · Fluxsec.red Blog_

## [Hells Gate Rust - EDR Evasion with syscalls](https://fluxsec.red/rust-edr-evasion-hells-gate)

_2025-02-02 · Fluxsec.red Blog_

## [DLL Injection EDR Evasion 1: Hiding an elephant in the closet](https://fluxsec.red/dll-injection-edr-evasion-1)

_2025-02-02 · Fluxsec.red Blog_

## [EDR Evasion ETW patching in Rust](https://fluxsec.red/etw-patching-rust)

_2025-02-02 · Fluxsec.red Blog_

## [EDR Evasion APC Queue Injection in Rust](https://fluxsec.red/apc-queue-injection-rust)

_2025-02-02 · Fluxsec.red Blog_

## [Refer a Friend, Earn Rewards (Sponsored)](https://crawlproof.com/a/N1jXg8p7QkOz)

_2025-02-02 · **Sponsored**_

Earn rewards when friends get the Graphite Business Card through your referral.

## [Reading Event Tracing for Windows Threat Intelligence](https://fluxsec.red/event-tracing-for-windows-threat-intelligence-rust-consumer)

_2025-02-02 · Fluxsec.red Blog_

## [Windows Driver IRQL and acquiring a Driver Mutex](https://fluxsec.red/windows-rust-driver-irql-driver-mutex)

_2024-12-20 · Fluxsec.red Blog_

## [Error logging](https://fluxsec.red/logging-errors-in-rust)

_2024-12-10 · Fluxsec.red Blog_

## [Loader Lock Ownership Semantics](https://winternl.com/loader-lock-ownership-semantics/)

_2024-11-23 · winternl · winternl_

If your career as a programmer has led you here, fear not, there is still time to turn back. I will not tell you to rethink whatever disreputable sequence of instructions you intend to force feed your processor. Nor do I think it would be beneficial to re-evaluate any alternative solutions. No dear reader, I \[…\]

## [Building the Driver Object](https://fluxsec.red/rust-windows-driver-object)

_2024-11-03 · Fluxsec.red Blog_

## [Configuring a Rust Windows driver](https://fluxsec.red/rust-windows-driver-configuration)

_2024-10-20 · Fluxsec.red Blog_

## [Creating a Windows Driver in Rust](https://fluxsec.red/rust-windows-driver)

_2024-10-20 · Fluxsec.red Blog_

## [Fixing a bug in donut](https://winternl.com/fixing-a-bug-in-donut/)

_2024-10-09 · winternl · winternl_

Exploring platform neutral assemblies and CLR internals

## [Str Crypter - Payload string encryption with Rust](https://fluxsec.red/str-crypter)

_2024-10-06 · Fluxsec.red Blog_

## [Rust DLL Search Order Hijacking](https://fluxsec.red/rust-dll-search-order-hijacking)

_2024-10-06 · Fluxsec.red Blog_

## [Why is there a debug directory in my release build?](https://winternl.com/why-is-there-a-debug-directory-in-my-release-build/)

_2024-09-29 · winternl · winternl_

(And other difficult conversations to have with your kids) If you’ve spent some time with MSVC you may have noticed your binary contains an IMAGE\_DEBUG\_DIRECTORY entry — even when building in release mode. This isn’t a new thing and this extra information was introduced in the 2015 release of Visual Studio. In fact, there’s a good \[…\]

## [Injecting syscall faults in Python and Ruby](https://blog.mattstuchlik.com/2024/09/08/injecting-syscall-faults.html)

_2024-09-08 · Matt Stuchlik_

Since syscalls are near the very bottom of any software stack, their misbehavior can be particularly hard to test for. Stuff like running out of disk space, network connections timing out, or bumping into system limits all ultimately manifest as a syscall failing somewhere. If you want your code to be resilient to these kinds of failures, it sure would be nice if you could simulate these…