Syscalls-Syswhisphers
What is it?
This post’s source file is empty — it’s a placeholder for the SysWhispers-generated syscall stubs. SysWhispers is a tool that generates C/ASM code for making direct syscalls without going through ntdll, bypassing EDR hooks. The generated output (SysWhispers.h, SysWhispers.c, SysWhispers.asm) would be included in the project alongside this file.
How it works (the tool, not the empty file)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
SysWhispers command (from the comment in Syscalls-ProcessInjection):
python syswhispers.py
-a x64
-c msvc
-m jumper_randomized
-f NtAllocateVirtualMemory,NtProtectVirtualMemory,
NtWriteVirtualMemory,NtCreateThreadEx
-o SysWhispers
Generates:
SysWhispers.h → function declarations + structs
SysWhispers.c → SSN (Syscall Service Number) resolution
SysWhispers.asm → hand-written assembly stubs
SSN resolution (how SysWhispers finds syscall numbers at runtime):
ntdll export table is sorted by address
Syscall numbers are assigned in that order
Sort ntdll exports by VA → position = syscall number
e.g. NtAllocateVirtualMemory at position 0x18 → SSN = 0x18
Note: SSN values differ per Windows version and patch level
"jumper_randomized" method:
Instead of: mov r10, rcx; mov eax, SSN; syscall
Uses: call a random nearby ntdll stub address
that has the syscall instruction
(indirect call to an existing syscall site)
Advantage: the syscall instruction itself is in ntdll's code,
not in your binary — harder to detect via
"syscall not in ntdll" heuristics
Usage in code (after including SysWhispers output):
NtAllocateVirtualMemory(hProcess, &pAddress, ...);
→ resolves SSN → executes syscall directly
→ EDR hook in ntdll never touched
The distinction between this and the Syscalls-ProcessInjection post: that post uses GetProcAddress to get the NT function addresses (still calling through ntdll, so hooks apply). This post — with the SysWhispers-generated stubs — would call into the kernel directly via the syscall instruction, completely bypassing ntdll. The stubs resolve the correct SSN at runtime rather than using hardcoded numbers, making them work across Windows versions.
syscall-syswhisphers.c
1