### Clone and Install SysWhispers3 Source: https://github.com/klezvirus/syswhispers3/blob/master/README.md Clone the repository and navigate to the directory. Use the --help flag to view available commands and features. ```bash C:\> git clone https://github.com/klezVirus/SysWhispers3.git C:\> cd SysWhispers3 C:\> python .\syswhispers.py --help ``` -------------------------------- ### Syscall Recovery Types Example Source: https://context7.com/klezvirus/syswhispers3/llms.txt Demonstrates how to use SyscallRecoveryType to programmatically generate syscalls with different recovery methods. Skips 'egg_hunter' as it requires MSVC. ```python val = SyscallRecoveryType.from_name("jumper") # returns 2 name = SyscallRecoveryType.get_name(2) # returns "jumper" # Programmatic use with SysWhispers from syswhispers import SysWhispers, Arch, Compiler for method_name in SyscallRecoveryType.key_list(): if method_name == "egg_hunter": continue # egg_hunter requires MSVC only sw = SysWhispers( arch=Arch.x64, compiler=Compiler.MSVC, recovery=SyscallRecoveryType.from_name_or_default(method_name) ) sw.generate(["NtTestAlert"], basename=f"out/syscalls_{method_name}") ``` -------------------------------- ### SysWhispers.generate() File Output Source: https://context7.com/klezvirus/syswhispers3/llms.txt Demonstrates the core `generate()` method for creating syscall wrapper files. This example generates the 31-function 'common' preset with verbose output enabled. ```python from syswhispers import SysWhispers, Arch, Compiler, SyscallRecoveryType import os os.makedirs("out", exist_ok=True) sw = SysWhispers( arch=Arch.x64, compiler=Compiler.MSVC, recovery=SyscallRecoveryType.EMBEDDED, verbose=True ) # Generate the 31-function "common" preset sw.generate( function_names=[ "NtCreateProcess", "NtCreateThreadEx", "NtOpenProcess", "NtOpenProcessToken", "NtTestAlert", "NtOpenThread", "NtSuspendProcess", "NtSuspendThread", "NtResumeProcess", "NtResumeThread", "NtGetContextThread", "NtSetContextThread", "NtClose", "NtReadVirtualMemory", "NtWriteVirtualMemory", "NtAllocateVirtualMemory", "NtProtectVirtualMemory", "NtFreeVirtualMemory", "NtQuerySystemInformation", "NtQueryDirectoryFile", "NtQueryInformationFile", "NtQueryInformationProcess", "NtQueryInformationThread", "NtCreateSection", "NtOpenSection", "NtMapViewOfSection", "NtUnmapViewOfSection", "NtAdjustPrivilegesToken", "NtDeviceIoControlFile", "NtQueueApcThread", "NtWaitForMultipleObjects" ], basename="out/syscalls_common" ) # Verbose output: # [+] Complete! Files written to: # out/syscalls_common.h # out/syscalls_common.c # out/syscalls_common-asm.x64.asm ``` -------------------------------- ### Compile Windows Executable with NMake Source: https://github.com/klezvirus/syswhispers3/blob/master/README.md Command to compile the Windows executable using nmake with the provided Makefile. Ensure you have the MSVC build tools installed. ```bash nmake -f Makefile.msvc ``` -------------------------------- ### Jumping/Randomized Jumping SysWhispers (All Functions) Source: https://github.com/klezvirus/syswhispers3/blob/master/README.md Generates syscalls for all functions using the 'jumper' or 'jumper_randomized' method to bypass dynamic RIP validation. This example specifies MinGW as the compiler and sets the output basename to 'syscalls_all'. ```powershell # Jumping/Jumping Randomized SysWhispers, to bypass dynamic RIP validation (all functions) using MinGW as the compiler py .\syswhispers.py --preset all -o syscalls_all -m jumper -c mingw ``` -------------------------------- ### SysWhispers3 Python Script Help Source: https://github.com/klezvirus/syswhispers3/blob/master/README.md Displays the usage instructions and all available command-line arguments for the syswhispers.py script. ```bash C:\>python syswhispers.py -h usage: syswhispers.py [-h] [-p PRESET] [-a {x86,x64}] [-m {embedded,egg_hunter,jumper,jumper_randomized}] [-f FUNCTIONS] -o OUT_FILE [--int2eh] [--wow64] [-v] [-d] SysWhispers3 - SysWhispers on steroids optional arguments: -h, --help show this help message and exit -p PRESET, --preset PRESET Preset ("all", "common") -a {x86,x64}, --arch {x86,x64} Architecture -c {msvc,mingw,all}, --compiler {msvc,mingw,all} Compiler -m {embedded,egg_hunter,jumper,jumper_randomized}, --method {embedded,egg_hunter,jumper,jumper_randomized} Syscall recovery method -f FUNCTIONS, --functions FUNCTIONS Comma-separated functions -o OUT_FILE, --out-file OUT_FILE Output basename (w/o extension) --int2eh Use the old `int 2eh` instruction in place of `syscall` --wow64 Use Wow64 to run x86 on x64 (only usable with x86 architecture) -v, --verbose Enable debug output -d, --debug Enable syscall debug (insert software breakpoint) ``` -------------------------------- ### Generate Syscalls using WOW64 (x86) Source: https://github.com/klezvirus/syswhispers3/blob/master/README.md Generates syscalls for specific functions (NtProtectVirtualMemory, NtWriteVirtualMemory) in x86 architecture, utilizing WOW64 for 32-bit execution on a 64-bit system. The output basename is 'syscalls_mem'. ```powershell # Normal SysWhispers, using WOW64 in 32-bits mode (only specific functions) py .\syswhispers.py --functions NtProtectVirtualMemory,NtWriteVirtualMemory -o syscalls_mem --arch x86 --wow64 ``` -------------------------------- ### Arch and Compiler Enums Usage Source: https://context7.com/klezvirus/syswhispers3/llms.txt Shows how to use Arch and Compiler enums with their `from_string()` factory method for flexible architecture and compiler selection. Generates dual-arch, dual-compiler output. ```python from syswhispers import Arch, Compiler # Arch.from_string accepts multiple aliases Arch.from_string("x86") # Arch.x86 (also: "32", "86", "i386") Arch.from_string("x64") # Arch.x64 (also: "64", "amd64", "x86_64") Arch.from_string("all") # Arch.Any (generates both x86 and x64 ASM files) # Compiler.from_string Compiler.from_string("msvc") # Compiler.MSVC — MASM (.asm) output Compiler.from_string("mingw") # Compiler.MINGW — inline GAS in .c output Compiler.from_string("all") # Compiler.All — both variants, guarded by #ifdef _MSC_VER # Practical usage — generate a dual-arch, dual-compiler output from syswhispers import SysWhispers sw = SysWhispers(arch=Arch.Any, compiler=Compiler.All) sw.generate(["NtClose", "NtOpenProcess"], basename="syscalls_universal") # Produces: # syscalls_universal.h # syscalls_universal.c (contains both MSVC __asm and MinGW asm() blocks) # syscalls_universal-asm.x64.asm # syscalls_universal-asm.x86.asm ``` -------------------------------- ### Runtime Hash-to-Number Resolution (C) Source: https://context7.com/klezvirus/syswhispers3/llms.txt Illustrates the C-level runtime function `SW3_GetSyscallNumber` for resolving syscall numbers from hashes. Shows manual hash computation and direct usage of generated wrappers. ```c #include "syscalls.h" // SW3_GetSyscallNumber is called internally by generated ASM stubs. // Direct usage is only needed for debugging or custom stubs. // Verify the list can be populated (ntdll found via PEB) if (!SW3_PopulateSyscallList()) { // ntdll not found — should never happen on a live Windows process return -1; } // Manually compute the hash for NtAllocateVirtualMemory // (hash is normally embedded directly in the generated ASM) DWORD hash = SW3_HashSyscall("ZwAllocateVirtualMemory"); // Nt* -> Zw* internally DWORD syscall_number = SW3_GetSyscallNumber(hash); // syscall_number == position of NtAllocateVirtualMemory in the sorted Zw* list // (e.g., 0x18 on Windows 10 20H2 x64) // Normal usage: just call the generated wrapper directly PVOID base = NULL; SIZE_T size = 0x1000; NTSTATUS status = NtAllocateVirtualMemory( (HANDLE)-1, // NtCurrentProcess() &base, 0, &size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE ); // status == STATUS_SUCCESS (0x00000000) on success // base points to the newly allocated page ``` -------------------------------- ### Compile 64-bit Windows Executable with MSVC Source: https://github.com/klezvirus/syswhispers3/blob/master/README.md Makefile for compiling a 64-bit Windows executable using MSVC. This includes assembling the ASM file, compiling the C source, and linking the final executable. ```makefile OPTIONS = -Zp8 -c -nologo -Gy -Os -O1 -GR- -EHa -Oi -GS- LIBS = libvcruntime.lib libcmt.lib ucrt.lib kernel32.lib program: ML64 /c syscalls-asm.x64.asm /link /NODEFAULTLIB /RELEASE /MACHINE:X64 cl.exe $(OPTIONS) syscalls.c program.c link.exe /OUT:program.x64.exe -nologo $(LIBS) /MACHINE:X64 -subsystem:console -nodefaultlib syscalls-asm.x64.obj syscalls.obj program.obj ``` -------------------------------- ### Export All Functions (x64) Source: https://github.com/klezvirus/syswhispers3/blob/master/README.md Generates syscalls for all supported functions with compatibility for all Windows versions. The output basename is set to 'syscalls_all'. ```powershell # Export all functions with compatibility for all supported Windows versions (see example-output/). py .\syswhispers.py --preset all -o syscalls_all ``` -------------------------------- ### Compile 64/32-bit Windows Executable with MinGW Source: https://github.com/klezvirus/syswhispers3/blob/master/README.md Makefile for compiling both 64-bit and 32-bit Windows executables using MinGW GCC. This command compiles the C source files and links them into separate executables. ```makefile CC_x64 := x86_64-w64-mingw32-gcc CC_x86 := i686-w64-mingw32-gcc OPTIONS := -masm=intel -Wall program: $(CC_x64) syscalls.c program.c -o program.x64.exe $(OPTIONS) $(CC_x86) syscalls.c program.c -o program.x86.exe $(OPTIONS) ``` -------------------------------- ### Compile Windows Executable with Make (MinGW) Source: https://github.com/klezvirus/syswhispers3/blob/master/README.md Command to compile the Windows executable using make with the Makefile.mingw. This is typically used when cross-compiling for Windows on a Linux system. ```bash make -f Makefile.mingw ``` -------------------------------- ### Generate Syscalls in 32-bit Mode (Jumper Method) Source: https://github.com/klezvirus/syswhispers3/blob/master/README.md Generates syscalls for all functions using the 'jumper' method in x86 architecture. The output basename is 'syscalls_all'. ```powershell # Normal SysWhispers, 32-bits mode py .\syswhispers.py --preset all -o syscalls_all -m jumper --arch x86 ``` -------------------------------- ### Compile 32-bit Windows Executable with MSVC Source: https://github.com/klezvirus/syswhispers3/blob/master/README.md Makefile for compiling a 32-bit Windows executable using MSVC. This includes assembling the ASM file, compiling the C source, and linking the final executable. ```makefile OPTIONS = -Zp8 -c -nologo -Gy -Os -O1 -GR- -EHa -Oi -GS- LIBS = libvcruntime.lib libcmt.lib ucrt.lib kernel32.lib program: ML /c syscalls-asm.x86.asm /link /NODEFAULTLIB /RELEASE /MACHINE:X86 cl.exe $(OPTIONS) syscalls.c program.c link.exe /OUT:program.x86.exe -nologo $(LIBS) /MACHINE:X86 -subsystem:console -nodefaultlib syscalls-asm.x86.obj syscalls.obj program.obj ``` -------------------------------- ### Generate Syscall Stubs with SysWhispers3 Source: https://github.com/klezvirus/syswhispers3/blob/master/README.md Use the syswhispers.py script to generate common system call stubs. Specify the preset and output file. The -v flag enables verbose output. ```powershell py .\syswhispers.py --preset common --out-file temp\syscalls_common -v . ,--. ,-. . . ,-. . , , |-. o ,-. ,-. ,-. ,-. ,-. __/ `-. | | `-. |/|/ | | | `-. | | |-' | `-. . \ `-' `-| `-' ' ' ' ' ' `-' |-' `-' ' `-' ''' /| | @Jackson_T `-' ' @modexpblog, 2021 Edits by @klezVirus, 2022 SysWhispers3: Why call the kernel when you can whisper? Common functions selected. Complete! Files written to: temp\syscalls_common.h temp\syscalls_common.c temp\syscalls_common_.asm Press a key to continue... ``` -------------------------------- ### Export Specific Functions Source: https://github.com/klezvirus/syswhispers3/blob/master/README.md Generates syscalls for specified functions, NtProtectVirtualMemory and NtWriteVirtualMemory, with compatibility for all Windows versions. The output basename is 'syscalls_mem'. ```powershell # Export NtProtectVirtualMemory and NtWriteVirtualMemory with compatibility for all versions. py .\syswhispers.py --functions NtProtectVirtualMemory,NtWriteVirtualMemory -o syscalls_mem ``` -------------------------------- ### Egg-Hunting SysWhispers (Common Functions) Source: https://github.com/klezvirus/syswhispers3/blob/master/README.md Generates syscalls for common functions using the 'egg_hunter' method to bypass the 'mark of the syscall'. The output basename is 'syscalls_common'. ```powershell # Egg-Hunting SysWhispers, to bypass the "mark of the sycall" (common function) py .\syswhispers.py --preset common -o syscalls_common -m egg_hunter ``` -------------------------------- ### Enable Debugging Output in SysWhispers3 Source: https://github.com/klezvirus/syswhispers3/blob/master/README.md Use the --verbose flag with the syswhispers.py script to enable troubleshooting output during code generation. This can help diagnose issues with the generation process. ```python py .\syswhispers.py --verbose ``` -------------------------------- ### Insert Software Breakpoint for Debugging Source: https://github.com/klezvirus/syswhispers3/blob/master/README.md Use the --debug flag with the syswhispers.py script to insert a software breakpoint in the syscall stub. This is useful for debugging with WinDbg. ```python py .\syswhispers.py --debug ``` -------------------------------- ### Export Common Functions Source: https://github.com/klezvirus/syswhispers3/blob/master/README.md Generates syscalls for a predefined set of common functions. The output basename is set to 'syscalls_common'. ```powershell # Export just the common functions (see below for list). py .\syswhispers.py --preset common -o syscalls_common ``` === COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.