HellsGate

Windows x64 C/MASM proof of concept for Hell's Gate. It hashes selected names from the loaded ntdll export table, scans syscall stubs to recover syscall numbers, then invokes NtAllocateVirtualMemory, NtProtectVirtualMemory, NtCreateThreadEx, and NtWaitForSingleObject through an assembly syscall stub. The upstream sample accepts no command-line arguments and runs a hard-coded test byte sequence in memory belonging to the current process; it is not a remote-process injector or a general shellcode-path loader. Direct syscalls can bypass some user-mode inline hooks on these calls, but do not guarantee EDR evasion; kernel and endpoint telemetry may still observe the behavior.