Rusty Syscalls - A direct or indirect Syscall library in Rust using the FreshyCalls/SysWhispers technique
The Rust version of Freshycalls
or Syswhispers 1 or 2 or 3
diverges in its approach from the C/C++/Python versions. While it shares similar techniques, this project doesn't generate header/ASM files or output like them. Instead, it functions as a library. Inspired by a friend @janoglezcampos (@httpyxel), I created this project to explore the FreshyCalls/SysWhispers technique that rust_syscalls
doesn't employ.
Cargo.toml
file by setting the git repository or local path and choosing the direct or indirect system call feature by setting _DIRECT_
or _INDIRECT_
as a feature. Please note you can only choose direct _DIRECT_
or _INDIRECT_
not both.[dependencies]
syscalls = { path = "../syscalls-rs/syscalls", features = ["_DIRECT_"] }
[dependencies]
syscalls = { path = "../syscalls-rs/syscalls", features = ["_INDIRECT_"] }
use syscalls;
SSN
and/or syscall
instruction from ntdll.dll
even if functions are hooked and call any function using direct and/or indirect syscall
. Note that when calling a function using the syscall
macro the string will be obfuscated by hashing (NtClose
in this example).unsafe { syscall!("NtClose", process_handle) };