am0nsec/HellsGate
FreeOriginal C Implementation of the Hell's Gate VX Technique
FreeFree tier
LinksX
About am0nsec/HellsGate
Original C implementation of the Hell's Gate technique for dynamically resolving and calling NTAPI functions via direct system calls, bypassing user-mode API hooks. Includes a companion PDF paper explaining the technique. Created by Paul Laîné (@am0nsec) and smelly__vx (@RtlMateusz). The repository serves as a proof-of-concept and educational resource for understanding direct system call invocation on Windows x64.
Key Features
Dynamically resolves NTAPI functions via direct system calls
Bypasses user-mode API hooks commonly used by EDRs
Provides a C implementation of the Hell's Gate technique
Includes a PDF paper explaining the technique in detail
Lightweight and focused implementation with minimal dependencies
Pros & Cons
Pros
- Effectively bypasses user-mode hooks used by many security products
- Lightweight and focused implementation with no bloat
- Well-documented with a companion paper and comments in code
- Actively maintained with community contributions (1.2k stars, 137 forks)
Cons
- Requires deep understanding of Windows internals and x64 assembly
- Limited to x64 Windows systems (not cross-platform)
- Intended for research and proof-of-concept; not production-ready
- Technique may be detected by advanced kernel-level defenses
Best For
Malware development and researchRed teaming and adversary simulationEvading endpoint detection and response (EDR) systemsEducational purposes for understanding Windows system call mechanisms
FAQ
What is Hell's Gate?
Hell's Gate is a technique for dynamically resolving NTAPI functions and calling them via direct system calls, bypassing user-mode API hooks commonly used by security software.
Is this technique ground-breaking?
The authors explicitly state that they are not claiming it is ground-breaking, as many have used similar techniques for years. It is one example implementation.
What is included in this repository?
The repository contains C source code implementing the Hell's Gate technique and a PDF paper (hells-gate.pdf) that explains the methodology.
Who are the authors?
The implementation and paper were created by Paul Laîné (@am0nsec) and smelly__vx (@RtlMateusz).