# hanzla2006/process-injection-with-indirect-syscalls-and-tartarus-gate architecture

> Architecture diagram of the GitHub repository hanzla2006/process-injection-with-indirect-syscalls-and-tartarus-gate, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/hanzla2006/process-injection-with-indirect-syscalls-and-tartarus-gate
- Repository: https://github.com/hanzla2006/process-injection-with-indirect-syscalls-and-tartarus-gate

## Overview

This is a Windows x64 process-injection research program. Its workflow accepts a target PID, reads the current thread’s PEB to locate ntdll, resolves syscall numbers and legitimate syscall instruction addresses, then uses an assembly-mediated indirect syscall path to perform the injection and start a remote thread. The README documents the Tartarus Gate fallback for hooked stubs. The sampled C excerpt is partial, so the injection calls are represented at the payload-orchestrator level rather than as an asserted sequence of individual native calls.

Main entry points: [`indirectSyscalls/indirectSyscalls.c`](https://github.com/hanzla2006/process-injection-with-indirect-syscalls-and-tartarus-gate/blob/main/indirectSyscalls/indirectSyscalls.c) (CLI coordinator), [`indirectSyscalls/indirectSyscallStubs.asm`](https://github.com/hanzla2006/process-injection-with-indirect-syscalls-and-tartarus-gate/blob/main/indirectSyscalls/indirectSyscallStubs.asm) (Indirect syscall stub), [`indirectSyscalls/structs.h`](https://github.com/hanzla2006/process-injection-with-indirect-syscalls-and-tartarus-gate/blob/main/indirectSyscalls/structs.h) (PEB/TEB layouts)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_coord["Coordination"]
  node_main["CLI coordinator<br/>[indirectSyscalls.c]"]
end

subgraph group_resolve["Syscall Resolution"]
  node_teb["TEB access<br/>[indirectSyscalls.c]"]
  node_export_parse["Export parsing<br/>[indirectSyscalls.c]"]
  node_hash["Name hashing<br/>[indirectSyscalls.c]"]
  node_table["VX table resolver<br/>[indirectSyscalls.c]"]
  node_tartarus["Neighbor recovery<br/>[indirectSyscalls.c]"]
end

subgraph group_inject["Injection"]
  node_payload["Injection payload<br/>[indirectSyscalls.c]"]
  node_indirect["Indirect syscall stub"]
end

subgraph group_internal["Native Internals"]
  node_pe_structs["PEB/TEB layouts<br/>[structs.h]"]
end

node_user(("PID user"))
node_ntdll["Loaded ntdll"]
node_windows["Windows kernel"]
node_target["Target process"]

node_user -->|"provides PID"| node_main
node_main -->|"reads TEB"| node_teb
node_teb -->|"uses layouts"| node_pe_structs
node_teb -->|"locates module"| node_ntdll
node_main -->|"parses exports"| node_export_parse
node_export_parse -->|"reads image"| node_ntdll
node_main -->|"resolves calls"| node_table
node_table -->|"hashes names"| node_hash
node_table -->|"recovers hooked stubs"| node_tartarus
node_tartarus -->|"scans neighboring stubs"| node_ntdll
node_main -->|"invokes payload"| node_payload
node_payload -->|"dispatches syscalls"| node_indirect
node_indirect -->|"jumps to syscall"| node_ntdll
node_indirect -->|"enters kernel"| node_windows
node_payload -->|"injects and starts thread"| node_target

click node_main "https://github.com/hanzla2006/process-injection-with-indirect-syscalls-and-tartarus-gate/blob/main/indirectSyscalls/indirectSyscalls.c"
click node_payload "https://github.com/hanzla2006/process-injection-with-indirect-syscalls-and-tartarus-gate/blob/main/indirectSyscalls/indirectSyscalls.c"
click node_teb "https://github.com/hanzla2006/process-injection-with-indirect-syscalls-and-tartarus-gate/blob/main/indirectSyscalls/indirectSyscalls.c"
click node_pe_structs "https://github.com/hanzla2006/process-injection-with-indirect-syscalls-and-tartarus-gate/blob/main/indirectSyscalls/structs.h"
click node_export_parse "https://github.com/hanzla2006/process-injection-with-indirect-syscalls-and-tartarus-gate/blob/main/indirectSyscalls/indirectSyscalls.c"
click node_hash "https://github.com/hanzla2006/process-injection-with-indirect-syscalls-and-tartarus-gate/blob/main/indirectSyscalls/indirectSyscalls.c"
click node_table "https://github.com/hanzla2006/process-injection-with-indirect-syscalls-and-tartarus-gate/blob/main/indirectSyscalls/indirectSyscalls.c"
click node_tartarus "https://github.com/hanzla2006/process-injection-with-indirect-syscalls-and-tartarus-gate/blob/main/indirectSyscalls/indirectSyscalls.c"
click node_indirect "https://github.com/hanzla2006/process-injection-with-indirect-syscalls-and-tartarus-gate/blob/main/indirectSyscalls/indirectSyscallStubs.asm"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_main,node_user toneBlue
class node_teb,node_export_parse,node_hash,node_table,node_tartarus toneAmber
class node_payload,node_indirect toneMint
class node_pe_structs toneRose
class node_ntdll,node_windows,node_target toneIndigo
```

## Components

### Coordination

- [CLI coordinator](https://github.com/hanzla2006/process-injection-with-indirect-syscalls-and-tartarus-gate/blob/main/indirectSyscalls/indirectSyscalls.c): `indirectSyscalls/indirectSyscalls.c`

### Syscall Resolution

- [TEB access](https://github.com/hanzla2006/process-injection-with-indirect-syscalls-and-tartarus-gate/blob/main/indirectSyscalls/indirectSyscalls.c): `indirectSyscalls/indirectSyscalls.c`
- [Export parsing](https://github.com/hanzla2006/process-injection-with-indirect-syscalls-and-tartarus-gate/blob/main/indirectSyscalls/indirectSyscalls.c): `indirectSyscalls/indirectSyscalls.c`
- [Name hashing](https://github.com/hanzla2006/process-injection-with-indirect-syscalls-and-tartarus-gate/blob/main/indirectSyscalls/indirectSyscalls.c): `indirectSyscalls/indirectSyscalls.c`
- [VX table resolver](https://github.com/hanzla2006/process-injection-with-indirect-syscalls-and-tartarus-gate/blob/main/indirectSyscalls/indirectSyscalls.c): `indirectSyscalls/indirectSyscalls.c`
- [Neighbor recovery](https://github.com/hanzla2006/process-injection-with-indirect-syscalls-and-tartarus-gate/blob/main/indirectSyscalls/indirectSyscalls.c): `indirectSyscalls/indirectSyscalls.c`

### Injection

- [Injection payload](https://github.com/hanzla2006/process-injection-with-indirect-syscalls-and-tartarus-gate/blob/main/indirectSyscalls/indirectSyscalls.c): `indirectSyscalls/indirectSyscalls.c`
- [Indirect syscall stub](https://github.com/hanzla2006/process-injection-with-indirect-syscalls-and-tartarus-gate/blob/main/indirectSyscalls/indirectSyscallStubs.asm): `indirectSyscalls/indirectSyscallStubs.asm`

### Native Internals

- [PEB/TEB layouts](https://github.com/hanzla2006/process-injection-with-indirect-syscalls-and-tartarus-gate/blob/main/indirectSyscalls/structs.h): `indirectSyscalls/structs.h`

### Other components

- **PID user**
- **Loaded ntdll**
- **Windows kernel**
- **Target process**

## Connections

- PID user → CLI coordinator: provides PID
- CLI coordinator → TEB access: reads TEB
- TEB access → PEB/TEB layouts: uses layouts
- TEB access → Loaded ntdll: locates module
- CLI coordinator → Export parsing: parses exports
- Export parsing → Loaded ntdll: reads image
- CLI coordinator → VX table resolver: resolves calls
- VX table resolver → Name hashing: hashes names
- VX table resolver → Neighbor recovery: recovers hooked stubs
- Neighbor recovery → Loaded ntdll: scans neighboring stubs
- CLI coordinator → Injection payload: invokes payload
- Injection payload → Indirect syscall stub: dispatches syscalls
- Indirect syscall stub → Loaded ntdll: jumps to syscall
- Indirect syscall stub → Windows kernel: enters kernel
- Injection payload → Target process: injects and starts thread