SysWhispers3 Documentation

To use the generated files in a Visual Studio project:

1. Copy the generated .h, .c, and .asm files into your project folder.
2. In Visual Studio, go to Project → Build Customizations... and enable MASM.
3. In the Solution Explorer, add the .h and .c/.asm files to the project.
4. Right-click the .asm file, select Properties, and set the Item Type to Microsoft Macro Assembler.

To install SysWhispers3, clone the repository from GitHub and navigate to the directory. You will need Python installed to run the generator.

C:\> git clone https://github.com/klezVirus/SysWhispers3.git
C:\> cd SysWhispers3
C:\> python .\syswhispers.py --help

Common Errors

• Type redefinitions: If syscalls.h causes errors, it may be because a typedef is already defined in your project. Use a more specific --preset instead of all, or manually remove the conflicting typedef from syscalls.h.
• error A2084:constant value too large: This is a compilation error in the assembly. Regenerate the stubs using the script.

Debugging Tools

• Use -v (--verbose) to see troubleshooting output during the generation process.
• Use -d (--debug) to insert a software breakpoint in the syscall stub, which is useful when debugging with WinDbg.

Use these commands for standard x64 implementations using the embedded method (default).

Export all functions (with Windows version compatibility):

py .\syswhispers.py --preset all -o syscalls_all

Export common functions only:

py .\syswhispers.py --preset common -o syscalls_common

Export specific functions (e.g., memory protection/writing):

py .\syswhispers.py --functions NtProtectVirtualMemory,NtWriteVirtualMemory -o syscalls_mem

SysWhispers3 provides advanced methods to bypass detection (e.g., RIP validation or syscall marking).

32-bit mode with Jumper method:

py .\syswhispers.py --preset all -o syscalls_all -m jumper --arch x86

32-bit mode using WOW64 (specific functions):

py .\syswhispers.py --functions NtProtectVirtualMemory,NtWriteVirtualMemory -o syscalls_mem --arch x86 --wow64

Egg-Hunter method (to bypass 'mark of the syscall'):

py .\syswhispers.py --preset common -o syscalls_common -m egg_hunter

Jumper/Randomized method (to bypass dynamic RIP validation) using MinGW:

py .\syswhispers.py --preset all -o syscalls_all -m jumper -c mingw

For Linux environments using MinGW, use the provided Makefile.mingw.

Makefile.mingw:

CC_x64 := x86_64-w64-mingw32-gcc
CC_x86 := i686-w64-mingw32-gcc
OPTIONS := -masm=intel -Wall

program:
  $(CC_x64) syscalls.c program.c -o program.x64.exe $(OPTIONS)
  $(CC_x86) syscalls.c program.c -o program.x86.exe $(OPTIONS)

To compile:

make -f Makefile.mingw