mirror of
https://github.com/CyberSecurityUP/SysWhispers4
synced 2026-06-08 10:47:52 +00:00
CyberSecurityUP
01c6530084
New SSN Resolution Methods: - SyscallsFromDisk: load clean ntdll from \KnownDlls to bypass ALL hooks - RecycledGate: FreshyCalls + opcode cross-validation (most resilient) - HW Breakpoint: hardware breakpoints + VEH to extract SSN New Evasion Techniques: - AMSI bypass (--amsi-bypass): patches AmsiScanBuffer - ntdll unhooking (--unhook-ntdll): remaps clean .text from KnownDlls - Anti-debugging (--anti-debug): PEB, timing, heap flags, debug port, instrumentation callback checks - Sleep encryption (--sleep-encrypt): Ekko-style XOR .text during sleep Enhanced Obfuscation: - 14 junk instruction variants (up from 4) - Compile-time string encryption helpers - Random variable name generation - CRC32 and FNV-1a hash alternatives New Presets: - stealth: maximum evasion combo (32 functions) - file_ops: NT file I/O operations (7 functions) - transaction: process doppelganging support (7 functions) New NT Functions (64 total, up from 48): - NtOpenSection, NtCreateTransaction, NtRollbackTransaction, NtCommitTransaction, NtSetInformationVirtualMemory, NtCreateEvent, NtSetEvent, NtResetEvent, NtCreateTimer, NtSetTimer, NtTestAlert, NtAlertResumeThread, NtAlertThread, NtWriteFile, NtReadFile, NtDeleteFile Other improvements: - SSN decryption now properly handled in ASM stubs - Enhanced Tartarus' Gate with short JMP (EB) hook detection - FindSection helper for PE section parsing - GetOwnImageBase helper for self-referencing operations Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>