A lightweight C++ PoC for indirect native calls on Windows on ARM64
winarm64-svc is a Windows on ARM64 (WoA) research project for resolving native routines and calling ntdll.dll Native API stubs through a custom ARM64 assembly caller.
- Manually reads TEB / PEB to dynamically retrieve module base addresses.
- Manually parses PE export tables to resolve function addresses.
- Locates the real
SVCinstruction address from ARM64ntdll.dllstubs. - Calls ARM64 function addresses with a custom assembly caller.
If you are interested in this project or want to learn more about the implementation details, please refer to the design documents: doc/README.md