SysWhispers

SysWhispers SysWhispers 通过生成头文件/汇编文件来帮助实现规避，这些文件可供植入体用于直接发起系统调用。 支持从 Windows XP 到 Windows 10 19042 20H2 的所有核心系统调用。示例生成文件位于 example-output/ 文件夹中。 简介 各类安全产品会在用户态 API 中放置钩子，从而能够将执行流程重定向到其引擎并检测可疑行为。ntdll.dll 中执行系统调用的函数仅由若干汇编指令组成，因此在自己的植入体中重新实现这些函数可以绕过那些安全产品钩子的触发。此技术由 @Cn33liz 推广，他的博客文章提供了更详细的技术细节，值得一...

Shhhloader - SysWhispers Shellcode Loader

Shhhloader is a SysWhispers Shellcode Loader that is currently a Work in Progress. It takes raw shellcode as input and compiles a C++ stub that has been integrated with SysWhispers in order to bypass AV/EDR. The included python builder will work on any Linux system that has Mingw-w64 installed. T...

SysWhispers - AV/EDR Evasion Via Direct System Calls

SysWhispers helps with evasion by generating header/ASM files implants can use to make direct system calls. All core syscalls are supported from Windows XP to 10. Example generated files available in example-output/. Introduction Various security products place hooks in user-mode APIs which allow...