mirror of
https://github.com/JoasASantos/SysWhispers4
synced 2026-06-06 15:54:32 +00:00
562c115e6c
- 5 SSN resolution methods: Static, FreshyCalls, Hell's Gate, Halo's Gate, Tartarus' Gate - 4 invocation methods: Embedded (direct), Indirect, Randomized (RDTSC entropy), Egg hunt - Architecture support: x64, x86, WoW64, ARM64 (SVC #0 / w8) - Compiler support: MSVC (MASM ml64.exe), MinGW (GAS inline asm), Clang - XOR SSN encryption at rest (randomized key per generation) - ETW user-mode bypass (ntdll!EtwEventWrite patch) - Call-stack spoofing trampoline (ntdll return address) - PEB-walk ntdll resolution (no Win32 API calls) - EAT parsing with DJB2 compile-time hashes (no string comparisons) - Fix: rdtsc clobbers rdx (arg2) in randomized stub — save rdx→r11 before rdtsc - 48 NT functions across 5 presets (common, injection, evasion, token, all) - j00ru syscall table update script (26 Windows builds Win7–Win11 24H2) - Comprehensive README with SW1/SW2/SW3/SW4 feature comparison matrix Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>