SysWhispers helps with evasion by generating header/ASM files implants can use to make direct system calls. All core syscalls are supported from Windows XP to 10. Example generated files available in example-output/
.
Various security products place hooks in user-mode APIs which allow them to redirect execution flow to their engines and detect for suspicious behavior. The functions in ntdll.dll
that make the syscalls consist of just a few assembly instructions, so re-implementing them in your own implant can bypass the triggering of those security product hooks. This technique was popularized by @Cn33liz and his blog post has more technical details worth reading.
SysWhispers provides red teamers the ability to generate header/ASM pairs for any system call in the core kernel image (ntoskrnl.exe
) across any Windows version starting from XP. The headers will also include the necessary type definitions.
The main implementation difference between this and the Dumpert POC is that this doesn’t call RtlGetVersion
to query the OS version, but instead does this in the assembly by querying the PEB directly. The benefit is being able to call one function that supports multiple Windows versions instead of calling multiple functions each supporting one version.
Installation
git clone https://github.com/jthuraisamy/SysWhispers.git
cd SysWhispers
pip3 install -r .\requirements.txt
py .\syswhispers.py –help
Usage & Examples
#Export all functions with compatibility for all supported Windows versions (see example-output/).
py .\syswhispers.py –preset all -o syscalls_all
#Export just the common functions with compatibility for Windows 7, 8, and 10.
py .\syswhispers.py –preset common -o syscalls_common
#Export NtProtectVirtualMemory and NtWriteVirtualMemory with compatibility for all versions.
py .\syswhispers.py –functions NtProtectVirtualMemory,NtWriteVirtualMemory -o syscalls_mem
#Export all functions with compatibility for Windows 7, 8, and 10.
py .\syswhispers.py –versions 7,8,10 -o syscalls_78X
Common Functions
Using the --preset common
switch will create a header/ASM pair with the following functions: Click to expand function list.
Importing Into Visual Studio
Caveats & Limitations
win32k.sys
) are not supported.Troubleshooting
ModuleNotFoundError
in Python script. pip3 install -r requirements.txt
. syscalls.h
have already been defined. --preset all
is rarely necessary).syscalls.h
. Burrow is an open source tool for burrowing through firewalls, built by teenagers at Hack Club.…
Simple golang webserver that listens for basic auth or post requests and sends a notification…
Nutek Security Platform for macOS and Linux operating systems. Tools for hackers, bug hunters and…
Welcome to SecureSphere Labs, your go-to destination for a curated collection of powerful hacking tools…
All in one Docker-based workstation with hacking tools for Pentesting and offsec Labs by maintained…
Got it! Below is the updated README.md file with instructions for downloading the project on…