Syscalls directas (Hell's Gate)

loader.exe -f beacon.bin

Load shellcode using direct ntdll syscalls instead of hooked APIs: EDRs that hook userland do not see the call.

Run it when the EDR hooks ntdll APIs (most in userland: CrowdStrike, Defender, SentinelOne) and you want NtAllocateVirtualMemory/NtWriteVirtualMemory/NtCreateThreadEx without going through hooks. Hell's Gate resolves SSNs at runtime by reading the machine's own ntdll, without hardcoded numbers.

If the EDR uses kernel callbacks, direct syscalls do not evade detection of behavior (RWX memory, shellcode write, thread creation). SSNs change between Windows builds: a loader with hardcoded numbers breaks when changing builds. Do not use it if you do not control the target build.