GhostSys: CET-Compliant Windows Syscalls

Hacker News

Windows 11 enforces Control-flow Enforcement Technology (CET), which breaks many classical syscall stubs and ROP chains used in red teaming. I spent the last few months investigating whether attackers can still invoke syscalls in a CET-compliant way without tripping EDRs , and how defenders can close those gaps. Within GhostSys, I formalized a post-CET syscall threat model, Five CET-compliant syscall invocation techniques (Ghost Syscalls, RBP Pivot, Speculative Probe, KCT Smuggle, eBPF JIT) with 12,000-call evaluation, 0 CET violations, no detections across three EDRs You will also find defender-focused recommendations. Check it out! Note > Some techniques within GhostSys are known - its supposed to be a systematic, reproducible study of CET-compliant syscall invocation and detection coverage, not cutting edge (eBPF jit had a similiar talk, SickCodes DEF CON talk), Specter vuln has been seen in the Pafish++, but not turned towards syscall hook detection. Gadget scanning is essentially a much more rigorous SysWhispers + Halos Gate.

Visit product View on Hacker NewsSep 19, 2025

Share card

Actual performance

2points

Did not reach leaderboard

Launch Intel predictions

Analyze your own launch →

Indie HackersFits the IH revenue-focused audience · Missing: supports, reddit linkedin, podcasting

62%62% predicted probability of success on Indie Hackers, based on ML models trained on real launch data.

best fitHighest predicted score across all platforms for this description.

TrustMRRFits verified-revenue profile · Strong signals: month, way · Missing: mobile apps, ios, personal

55%55% predicted probability of success on TrustMRR, based on ML models trained on real launch data.

Product HuntOn track for Day 1 leaderboard · Strong signals: model, code · Missing: mac, agents, macos

54%54% predicted probability of success on Product Hunt, based on ML models trained on real launch data.

Hacker NewsStrong engagement from HN community · Strong signals: lua, 000, io · Missing: https docs, excited, just released

53%53% predicted probability of success on Hacker News, based on ML models trained on real launch data.

nativeThis product was originally launched on this platform.

AppSumoMay struggle as an AppSumo deal · Strong signals: host, calls · Missing: plus, platform, intuitive

41%41% predicted probability of success on AppSumo, based on ML models trained on real launch data.

BetaListMay not resonate with beta-testers · Missing: web3, chat, crypto

17%17% predicted probability of success on BetaList, based on ML models trained on real launch data.

Acquire.comPre-revenue stage for this audience · Missing: arr, mrr, revenue

17%17% predicted probability of success on Acquire.com, based on ML models trained on real launch data.

Incorrect prediction on native model

Similar products

Compliant SBOM Management per US Senate Directive33%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Compliant SBOM Management per US Senate Directive

Hacker News2

Sudo for Windows45%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Sudo for Windows

Hacker News58

GnuCOBOL on Windows – From Compilation to HelloWorld47%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

GnuCOBOL on Windows – From Compilation to HelloWorld

Hacker News8

ff is a Windows wrapper for fzf34%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

ff is a Windows wrapper for fzf

Hacker News2

i3 for Windows45%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

i3 for Windows

Hacker News3

2FAGuard – TOTP Authenticator for Windows42%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

2FAGuard – TOTP Authenticator for Windows

Hacker News4

Periodic Fire Drills in Windows51%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Periodic Fire Drills in Windows

Hacker News1

WinDisplay – BetterDisplay for Windows44%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

WinDisplay – BetterDisplay for Windows

Hacker News2

flickr downloadr for Windows45%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

flickr downloadr for Windows

Hacker News2

Statsify – Graphite and StatsD for Windows45%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Statsify – Graphite and StatsD for Windows

Hacker News4

Browse all products Analyze your launch