hanzla2006/process-injection-with-indirect-syscalls-and-tartarus-gate

This is a Windows x64 process-injection research program. Its workflow accepts a target PID, reads the current thread’s PEB to locate ntdll, resolves syscall numbers and legitimate syscall instruction addresses, then uses an assembly-mediated indirect syscall path to perform the injection and start a remote thread. The README documents the Tartarus Gate fallback for hooked stubs. The sampled C excerpt is partial, so the injection calls are represented at the payload-orchestrator level rather than as an asserted sequence of individual native calls.