c_syscalls

KO | EN

gitlite — search

#python #ai #golang #rust #deep-learning #linux #docker #macos #nodejs #windows #vue #security #ios #open-source

(★ 35)

https://github.com/janoglezcampos/c_syscalls with the ASM rewritten by myself for Visual Studio's Compiler.

c_syscalls Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# C_SYSCALLS

Single stub direct and indirect syscalling with runtime SSN resolving for windows.

---
Included writeup PDF link: [https://redops.at/en/blog/direct-syscalls-vs-indirect-syscalls](https://redops.at/en/blog/direct-syscalls-vs-indirect-syscalls)
---

## Features:
* Single stub
* One single line for all your syscalls
* Direct or Indirect sycalls
* x86_64, WOW64 and x86 native support
  
---

## How to use:
* Call `Syscall(<function>, <args>)`
    > `NTSTATUS status = Syscall(NT_CLOSE, handle);`

---

## Notes:
* Reimplementation of the ssn fetching method used here is recommended, the one showed in this repo is really simple and can present problems with certains AV/EDRs, more complex methods has been showed before, and implementing them is out of scope in this project.
* For doing this, modifications to the GetSsn() function is needed, maintining its definition.

---

**Thanks to [SysWhispers3](https://github.com/klezVirus/SysWhispers3) for being a strong pilar on the development of this library, and [Foliage](https://github.com/SecIdiot/FOLIAGE) for the implementation of the dbj2 hash, module/function addr resolving implementation and types definitions**

c_syscalls

c_syscalls Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

c_syscalls

c_syscalls Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README