CyberSecurityUP-SysWhispers4

admin/CyberSecurityUP-SysWhispers4

Fork 0

mirror of https://github.com/CyberSecurityUP/SysWhispers4 synced 2026-06-08 10:47:52 +00:00

Commit Graph

Author	SHA1	Message	Date
CyberSecurityUP	300ce4b597	fix(update_syscall_table): handle j00ru's human-readable CSV header format j00ru/windows-syscalls updated both x64 and x86 CSVs to use human-readable column headers ("Windows 10 (1903)", "Windows NT 4.0 (SP3)") instead of the dotted version strings ("10.0.19041.1") the script assumed. Changes: - Replace _version_to_build() with _parse_header_col() that handles both the human-readable format and legacy dotted strings as a fallback - Add VER_MAP: unified label→(build_key, display_label) covering all 82 columns across x64 (XP SP1 → Win11 25H2) and x86 (NT 3.1 → Win10 22H2) - Win10/Win11 columns use actual build numbers (19041, 22000, 26100…) for cross-arch consistency; legacy columns use descriptive keys (xp_sp2, 7_sp1) - Add data/syscalls_nt_x86.json (513 Nt* functions, NT 3.1 → Win10 22H2) - Refresh data/syscalls_nt_x64.json (506 functions, XP SP1 → Win11 25H2) with correct Win11 / Server 2022/2025 build keys Fixes: ValueError: invalid literal for int() with base 10: 'Windows NT 3' Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-22 22:18:01 -03:00
CyberSecurityUP	562c115e6c	Initial release: SysWhispers4 — advanced Windows syscall stub generator - 5 SSN resolution methods: Static, FreshyCalls, Hell's Gate, Halo's Gate, Tartarus' Gate - 4 invocation methods: Embedded (direct), Indirect, Randomized (RDTSC entropy), Egg hunt - Architecture support: x64, x86, WoW64, ARM64 (SVC #0 / w8) - Compiler support: MSVC (MASM ml64.exe), MinGW (GAS inline asm), Clang - XOR SSN encryption at rest (randomized key per generation) - ETW user-mode bypass (ntdll!EtwEventWrite patch) - Call-stack spoofing trampoline (ntdll return address) - PEB-walk ntdll resolution (no Win32 API calls) - EAT parsing with DJB2 compile-time hashes (no string comparisons) - Fix: rdtsc clobbers rdx (arg2) in randomized stub — save rdx→r11 before rdtsc - 48 NT functions across 5 presets (common, injection, evasion, token, all) - j00ru syscall table update script (26 Windows builds Win7–Win11 24H2) - Comprehensive README with SW1/SW2/SW3/SW4 feature comparison matrix Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-22 22:07:23 -03:00

Author

SHA1

Message

Date

CyberSecurityUP

300ce4b597

fix(update_syscall_table): handle j00ru's human-readable CSV header format

j00ru/windows-syscalls updated both x64 and x86 CSVs to use human-readable
column headers ("Windows 10 (1903)", "Windows NT 4.0 (SP3)") instead of
the dotted version strings ("10.0.19041.1") the script assumed.

Changes:
- Replace _version_to_build() with _parse_header_col() that handles both
  the human-readable format and legacy dotted strings as a fallback
- Add VER_MAP: unified label→(build_key, display_label) covering all 82
  columns across x64 (XP SP1 → Win11 25H2) and x86 (NT 3.1 → Win10 22H2)
- Win10/Win11 columns use actual build numbers (19041, 22000, 26100…) for
  cross-arch consistency; legacy columns use descriptive keys (xp_sp2, 7_sp1)
- Add data/syscalls_nt_x86.json (513 Nt* functions, NT 3.1 → Win10 22H2)
- Refresh data/syscalls_nt_x64.json (506 functions, XP SP1 → Win11 25H2)
  with correct Win11 / Server 2022/2025 build keys

Fixes: ValueError: invalid literal for int() with base 10: 'Windows NT 3'

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-22 22:18:01 -03:00

CyberSecurityUP

562c115e6c

Initial release: SysWhispers4 — advanced Windows syscall stub generator

- 5 SSN resolution methods: Static, FreshyCalls, Hell's Gate, Halo's Gate, Tartarus' Gate
- 4 invocation methods: Embedded (direct), Indirect, Randomized (RDTSC entropy), Egg hunt
- Architecture support: x64, x86, WoW64, ARM64 (SVC #0 / w8)
- Compiler support: MSVC (MASM ml64.exe), MinGW (GAS inline asm), Clang
- XOR SSN encryption at rest (randomized key per generation)
- ETW user-mode bypass (ntdll!EtwEventWrite patch)
- Call-stack spoofing trampoline (ntdll return address)
- PEB-walk ntdll resolution (no Win32 API calls)
- EAT parsing with DJB2 compile-time hashes (no string comparisons)
- Fix: rdtsc clobbers rdx (arg2) in randomized stub — save rdx→r11 before rdtsc
- 48 NT functions across 5 presets (common, injection, evasion, token, all)
- j00ru syscall table update script (26 Windows builds Win7–Win11 24H2)
- Comprehensive README with SW1/SW2/SW3/SW4 feature comparison matrix

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-22 22:07:23 -03:00

2 Commits