am0nsec/HellsGate

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1220 stars · 138 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

The original C implementation of the Hell's Gate technique, which resolves Windows system call numbers at runtime to invoke NT APIs directly. It is a reference implementation accompanying a VXUG research paper on evading security monitoring.

Use cases

• resolve syscall numbers dynamically in windows
• bypass edr api hooking for research
• direct syscalls in c for red team tooling
• learn how hells gate technique works
• study windows ntdll syscall resolution

When to choose

• you are researching offensive security techniques or EDR evasion on Windows
• you need a minimal reference implementation of runtime syscall resolution in C

When to avoid

• you need a supported, licensed library for production software
• you are building defensive tooling or benign Windows applications
• you need a maintained project with active development or releases

Facets

library · maturity maintenance

security reverse-engineering security penetration-testing windows windows cpp syscalls malware-research edr-evasion vx-technique offensive-security ntapi

Member repositories

For agents

markdown · JSON · MCP: product_card(name="am0nsec/HellsGate")