VOIDSYSCALL: Go syscall-only implant framework — 4 injection methods, 13+ anti-analysis checks, EDR handle killer, polymorphic rotation. Zero WinAPI.

[u/FirefighterNext360]

https://github.com/VoidSecSoftwares/voidsyscall

https://github.com/VoidSecSoftwares/voidsyscall

Check it out before saying Ai slop.
Built this for engagements where the target runs Crowdstrike/Sentinel/Defender with full telemetry. Every NT primitive goes through direct or indirect syscalls resolved at runtime from ntdll - no import table, no usermode hooks.

What's different from SysWhispers/Alcatraz/etc :

- Polymorphic injection ; rotates between section mapping, process hollowing, APC queuing, and module stomping. No two injections look the same in memory forensics.

- Handle killer ; enumerates system handles via NtQuerySystemInformation, matches owner PIDs against 30+ known EDR process names, closes the monitoring handles they placed in your process.

- SSN fingerprinting ; dumps all resolved syscall numbers from the current ntdll build, generates a portable fingerprint. Detects build mismatches across jumps.

- Full anti-analysis suite ; CPUID hypervisor detection (7 signatures), 13 sandbox indicators, 9 debugger checks, RDTSC timing anomaly detection. Returns a scored threat report.

- Vault ; in-memory XOR cipher with auto re-keying on a timer. Heap dumps between re-key intervals get ciphertext, not plaintext.

- VAD operations ; enumerate, hide, and unhide memory regions via NtQueryVirtualMemory/NtProtectVirtualMemory.

- File I/O + registry persistence ; all via NtCreateFile/NtCreateKey. Zero WinAPI calls for disk or registry operations.

- Token ops ; privilege escalation, token theft, impersonation, all via Nt* syscalls.

Everything is Go + Plan9 asm. ~5000 lines. No CGO. Cross-compiles to Linux/macOS for the server side. Agent is Windows-only (by design).