RogueLoader

🚨 Proof of Concept to bypass NTAPI hooking using @maldevacademy's indirect syscalls technique.

---

🔥 Features

1. Indirect Syscall Bypass via HellsHall (Thanks to @maldevacademy)
2. InetSim Detection – detects sandbox and halts execution if triggered
3. API Hashing – for stealthy function resolution
4. IAT Obfuscation – evades static analysis tools
5. Debugger Check – anti-debug trickery
6. XOR-Based Decryption – runtime decryption for payload execution

---

Usage

Encrypt your payload:

XOR.exe <file_path> <key>

Launch the loader:

Loader.exe

---

Screenshot