voidsyscall v1.1.0

Surveillance, persistence & operator tooling

• Screenshot capture (BMP) via win32u direct syscalls
• Keylogger with start/stop/dump sub-commands
• Clipboard unicode read
• Run-key persistence (NtSetValueKey)
• KUSER_SHARED_DATA readouts + hardened SSN resolution
• Hidden agent threads (ThreadHideFromDebugger)
• Unconditional unhook + channel round-robin before every beacon
• Session state persistence (JSON) + stdlib web UI (/api/sessions)
• Version injectable via -ldflags -X main.version
• CI workflow + unit tests (channels, server, agent)
• Removed dead loader package

voidsyscall v1.0.0

voidsyscall v1.0.0

Direct-syscall C2 for Windows. No Win32 API, no external dependencies, stdlib only.

C2 server

• HTTPS listener (self-signed or your own cert supported)
• DNS / ICMP / DoH listeners
• Full REPL: shell, patch, inject, stage, evasion, handles, token, vault, fingerprint, download, upload, ps, killproc, kill, tasks, output, rotate, schedule, unschedule, help
• Per-session key rotation, staged loader (24 KiB chunks), recurring scheduled tasks, result queue with download routing

Agent (Windows implant)

• Beaconing over HTTPS/DNS/ICMP/DoH with jitter
• Tasks: shell, AMSI/ETW patch, polymorphic injection (section mapping / process hollow / APC / module stomp), file transfer, process enum/kill, token ops, VAD & handle enumeration
• Runtime hardening: ntdll hook detection + restore, self PE header erase, call-stack spoofing (ntdll ret gadget), sleep obfuscation (staged buffer ciphered in heap), periodic unhook

Assets

• voidsyscall-server.exe — Windows C2 server
• voidsyscall-agent.exe — Windows implant
• voidsyscall-server-linux-amd64 — Linux C2 server (agent stays Windows-only)
• voidsyscall-agent-config.example.json — agent config template
• SHA256SUMS — checksums

Module

go get github.com/VoidSecSoftwares/voidsyscall@v1.0.0