[ĐĮΜĘ]

Exactly what the title states.

https://github.com/RtlDallas/Jomungand

[Kayfoxz]

interesting share, pretty cool, hq as always Dime

[Tentco]

Some selective EDR's might hook VirtualAlloc even though it's indirectly calling them(not sure).
Maybe this won't run properly on other win version due to syscall number being different then arch in syscalls_stub.asm.
Saving as RC4/AES encrypted bytes inside file with compile-time string encryption instead of reading from file will also make it handy.
The Hardware breakpoint thing is clean(HWBP) I was thinking about something kinda similar like catching segfault and continuing with exception or filling with NOP's on certain jmp's.
Most EDR's blacklisted calls are available here - https://malapi.io/
Thought I would share in case someone doesn't know.