Record · corpus.blog/posts/01a08778-e061-7066-a991-c10231fa88a2

Hells Hollow: A new SSDT Hooking technique

fluxsec.red · published 28 July 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at fluxsec.red Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 19
Words captured: 2,469

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://github.com/0xflux/Hells-Hollow

github.com

Alt Syscalls for Windows 11 Read at the source ↗

fluxsec.red

https://www.microsoft.com/en-us/security/blog/2021/01/11/new-surface-pcs-enable-virtualization-based-security-vbs-by-default-to-empower-customers-to-do-more-securely/

microsoft.com

EDR Evasion ETW patching in Rust Read at the source ↗

fluxsec.red

https://whiteknightlabs.com/2021/12/11/bypassing-etw-for-fun-and-profit/

whiteknightlabs.com

https://www.binarly.io/blog/design-issues-of-modern-edrs-bypassing-etw-based-solutions

binarly.io

https://github.com/Xacone

github.com

https://github.com/valinet/ssde/

github.com

https://github.com/0xcpu/WinAltSyscallHandler/tree/master

github.com

https://xacone.github.io/BestEdrOfTheMarketV3.html

xacone.github.io

https://www.adlice.com/kernelmode-rootkits-part-1-ssdt-hooks/

adlice.com

https://www.cert-ist.com/public/en/SO_detail?format=html&code=201210_article

cert-ist.com

https://x.com/sixtyvividtails

x.com

https://www.github.com/0xflux/Hells-Hollow/

github.com

https://www.vergiliusproject.com/kernels/x64/windows-11/24h2/_KTRAP_FRAME

vergiliusproject.com

https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/etw/traceapi/event/index.htm

geoffchappell.com

https://chromium.googlesource.com/external/github.com/DynamoRIO/drmemory/+/refs/heads/master/wininc/ntexapi.h

chromium.googlesource.com

https://github.com/microsoft/rust_win_etw/tree/main/examples/hello_world

github.com

https://x.com/0xfluxsec

x.com