Refactored assembly, added NASM support, Added 32-Bit Support (Wow64 & x86 Native)

README.md

@@ -45,13 +45,13 @@ py .\syswhispers.py --functions NtProtectVirtualMemory,NtWriteVirtualMemory -o s
 
 ```
 PS C:\Projects\SysWhispers2> py .\syswhispers.py --preset common --out-file syscalls_common
-
+                                                 
                   .                         ,--. 
 ,-. . . ,-. . , , |-. o ,-. ,-. ,-. ,-. ,-.    / 
 `-. | | `-. |/|/  | | | `-. | | |-' |   `-. ,-'  
 `-' `-| `-' ' '   ' ' ' `-' |-' `-' '   `-' `--- 
-     /|                     |  @Jackson_T                 
-    `-'                     '  @modexpblog, 2021
+     /|                     |  @Jackson_T        
+    `-'                     '  @modexpblog, 2021 
 
 SysWhispers2: Why call the kernel when you can whisper?
 
@@ -60,7 +60,10 @@ Common functions selected.
 Complete! Files written to:
         syscalls_common.h
         syscalls_common.c
-        syscalls_common_stubs.asm
+        syscalls_common_x86stubs.asm
+        syscalls_common_x64stubs.asm
+        syscalls_common_x86stubs.nasm
+        syscalls_common_x64stubs.nasm
 ```
 
 ### Before-and-After Example of Classic `CreateRemoteThread` DLL Injection
@@ -142,12 +145,81 @@ Using the `--preset common` switch will create a header/ASM pair with the follow
 1. Copy the generated H/C/ASM files into the project folder.
 2. In Visual Studio, go to *Project* → *Build Customizations...* and enable MASM.
 3. In the *Solution Explorer*, add the .h and .c/.asm files to the project as header and source files, respectively.
-4. Go to the properties of the ASM file, and set the *Item Type* to *Microsoft Macro Assembler*.
-5. Ensure that the project platform is set to x64. 32-bit projects are not supported at this time.
+4. Go to the properties of the x86 ASM file.
+5. Select *All Configurations* from the *Configurations* drop-down.
+6. Select *Win32* from the Platform drop-down.
+7. Set the following options:
+    - *Excluded From Build* = *No*
+    - *Content* = *Yes*
+    - *Item Type* = *Microsoft Macro Assembler*
+8. Click *Apply*
+9. Select *x64* from the *Platform* drop-down.
+10. Set the following options:
+    - *Excluded From Build* = *Yes*
+    - *Content* = *Yes*
+    - *Item Type* = *Microsoft Macro Assembler*
+11. Click *Apply*, then *OK*.
+12. Go to the properties of the x64 ASM file.
+13. Select *All Configurations* from the *Configurations* drop-down.
+14. Select *Win32* from the Platform drop-down.
+15. Set the following options:
+    - *Excluded From Build* = *Yes*
+    - *Content* = *Yes*
+    - *Item Type* = *Microsoft Macro Assembler*
+16. Click *Apply*
+17. Select *x64* from the *Platform* drop-down.
+18. Set the following options:
+    - *Excluded From Build* = *No*
+    - *Content* = *Yes*
+    - *Item Type* = *Microsoft Macro Assembler*
+19. Click *Apply*, then *OK*.
+
+## Compiling with MinGW and NASM
+
+The following examples demonstrate how to compile the above example programs as EXE and DLLs using MinGW and the NASM assembler:
+
+### x86 Example EXE
+
+```
+i686-w64-mingw32-gcc -c main.c syscalls.c -Wall -shared
+nasm -f win32 --prefix _ -o syscallsx86stubs.o syscallsx86stubs.nasm
+i686-w64-mingw32-gcc *.o -o temp.exe
+i686-w64-mingw32-gcc-strip -s temp.exe -o example.exe
+rm -rf *.o temp.exe
+```
+
+### x86 Example DLL with Exports
+
+```
+i686-w64-mingw32-gcc -c dllmain.c syscalls.c -Wall -shared
+nasm -f win32 --prefix _ -o syscallsx86stubs.o syscallsx86stubs.nasm
+i686-w64-mingw32-dllwrap --def dllmain.def *.o -o temp.dll
+i686-w64-mingw32-gcc-strip -s temp.dll -o example.dll
+rm -rf *.o temp.dll
+```
+
+### x64 Example EXE
+
+```
+x86_64-w64-mingw32-gcc -m64 -c main.c syscalls.c -Wall -shared
+nasm -f win64 -o syscallsx64stubs.o syscallsx64stubs.nasm
+x86_64-w64-mingw32-gcc *.o -o temp.exe
+x86_64-w64-mingw32-gcc-strip -s temp.exe -o example.exe
+rm -rf *.o temp.exe
+```
+
+### x64 Example DLL with Exports
+
+```
+x86_64-w64-mingw32-gcc -m64 -c dllmain.c syscalls.c -Wall -shared
+nasm -f win64 -o syscallsx64stubs.o syscallsx64stubs.nasm
+x86_64-w64-mingw32-gcc-dllwrap --def dllmain.def *.o -o temp.dll
+x86_64-w64-mingw32-gcc-strip -s temp.dll -o example.dll
+rm -rf *.o temp.dll
+```
 
 ## Caveats and Limitations
 
-- Only 64-bit Windows is supported at this time.
 - System calls from the graphical subsystem (`win32k.sys`) are not supported.
 - Tested on Visual Studio 2019 (v142) with Windows 10 SDK.
 

data/base.c

@@ -24,7 +24,11 @@ BOOL SW2_PopulateSyscallList(void)
     // Return early if the list is already populated.
     if (SW2_SyscallList.Count) return TRUE;
 
+#ifdef _WIN64
     PSW2_PEB Peb = (PSW2_PEB)__readgsqword(0x60);
+#else
+    PSW2_PEB Peb = (PSW2_PEB)__readfsdword(0x30);
+#endif
     PSW2_PEB_LDR_DATA Ldr = Peb->Ldr;
     PIMAGE_EXPORT_DIRECTORY ExportDirectory = NULL;
     PVOID DllBase = NULL;

example-output/Syscalls.c

@@ -19,12 +19,16 @@ DWORD SW2_HashSyscall(PCSTR FunctionName)
     return Hash;
 }
 
-BOOL SW2_PopulateSyscallList()
+BOOL SW2_PopulateSyscallList(void)
 {
     // Return early if the list is already populated.
     if (SW2_SyscallList.Count) return TRUE;
 
+#ifdef _WIN64
     PSW2_PEB Peb = (PSW2_PEB)__readgsqword(0x60);
+#else
+    PSW2_PEB Peb = (PSW2_PEB)__readfsdword(0x30);
+#endif
     PSW2_PEB_LDR_DATA Ldr = Peb->Ldr;
     PIMAGE_EXPORT_DIRECTORY ExportDirectory = NULL;
     PVOID DllBase = NULL;
@@ -79,7 +83,7 @@ BOOL SW2_PopulateSyscallList()
     SW2_SyscallList.Count = i;
 
     // Sort the list by address in ascending order.
-    for (DWORD i = 0; i < SW2_SyscallList.Count - 1; i++)
+    for (i = 0; i < SW2_SyscallList.Count - 1; i++)
     {
         for (DWORD j = 0; j < SW2_SyscallList.Count - i - 1; j++)
         {

example-output/Syscalls.h

@@ -1,59 +1,59 @@
-#pragma once
-
-// Code below is adapted from @modexpblog. Read linked article for more details.
-// https://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams
-
-#ifndef SW2_HEADER_H_
-#define SW2_HEADER_H_
-
-#include <Windows.h>
-
-#define SW2_SEED 0x874DD416
-#define SW2_ROL8(v) (v << 8 | v >> 24)
-#define SW2_ROR8(v) (v >> 8 | v << 24)
-#define SW2_ROX8(v) ((SW2_SEED % 2) ? SW2_ROL8(v) : SW2_ROR8(v))
-#define SW2_MAX_ENTRIES 500
-#define SW2_RVA2VA(Type, DllBase, Rva) (Type)((ULONG_PTR) DllBase + Rva)
-
-// Typedefs are prefixed to avoid pollution.
-
-typedef struct _SW2_SYSCALL_ENTRY
-{
-    DWORD Hash;
-    DWORD Address;
-} SW2_SYSCALL_ENTRY, *PSW2_SYSCALL_ENTRY;
-
-typedef struct _SW2_SYSCALL_LIST
-{
-    DWORD Count;
-    SW2_SYSCALL_ENTRY Entries[SW2_MAX_ENTRIES];
-} SW2_SYSCALL_LIST, *PSW2_SYSCALL_LIST;
-
-typedef struct _SW2_PEB_LDR_DATA {
-	BYTE Reserved1[8];
-	PVOID Reserved2[3];
-	LIST_ENTRY InMemoryOrderModuleList;
-} SW2_PEB_LDR_DATA, *PSW2_PEB_LDR_DATA;
-
-typedef struct _SW2_LDR_DATA_TABLE_ENTRY {
-	PVOID Reserved1[2];
-	LIST_ENTRY InMemoryOrderLinks;
-	PVOID Reserved2[2];
-	PVOID DllBase;
-} SW2_LDR_DATA_TABLE_ENTRY, *PSW2_LDR_DATA_TABLE_ENTRY;
-
-typedef struct _SW2_PEB {
-	BYTE Reserved1[2];
-	BYTE BeingDebugged;
-	BYTE Reserved2[1];
-	PVOID Reserved3[2];
-	PSW2_PEB_LDR_DATA Ldr;
-} SW2_PEB, *PSW2_PEB;
-
-DWORD SW2_HashSyscall(PCSTR FunctionName);
-BOOL SW2_PopulateSyscallList();
-EXTERN_C DWORD SW2_GetSyscallNumber(DWORD FunctionHash);
-
+#pragma once
+
+// Code below is adapted from @modexpblog. Read linked article for more details.
+// https://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams
+
+#ifndef SW2_HEADER_H_
+#define SW2_HEADER_H_
+
+#include <Windows.h>
+
+#define SW2_SEED 0x49501764
+#define SW2_ROL8(v) (v << 8 | v >> 24)
+#define SW2_ROR8(v) (v >> 8 | v << 24)
+#define SW2_ROX8(v) ((SW2_SEED % 2) ? SW2_ROL8(v) : SW2_ROR8(v))
+#define SW2_MAX_ENTRIES 500
+#define SW2_RVA2VA(Type, DllBase, Rva) (Type)((ULONG_PTR) DllBase + Rva)
+
+// Typedefs are prefixed to avoid pollution.
+
+typedef struct _SW2_SYSCALL_ENTRY
+{
+    DWORD Hash;
+    DWORD Address;
+} SW2_SYSCALL_ENTRY, *PSW2_SYSCALL_ENTRY;
+
+typedef struct _SW2_SYSCALL_LIST
+{
+    DWORD Count;
+    SW2_SYSCALL_ENTRY Entries[SW2_MAX_ENTRIES];
+} SW2_SYSCALL_LIST, *PSW2_SYSCALL_LIST;
+
+typedef struct _SW2_PEB_LDR_DATA {
+	BYTE Reserved1[8];
+	PVOID Reserved2[3];
+	LIST_ENTRY InMemoryOrderModuleList;
+} SW2_PEB_LDR_DATA, *PSW2_PEB_LDR_DATA;
+
+typedef struct _SW2_LDR_DATA_TABLE_ENTRY {
+	PVOID Reserved1[2];
+	LIST_ENTRY InMemoryOrderLinks;
+	PVOID Reserved2[2];
+	PVOID DllBase;
+} SW2_LDR_DATA_TABLE_ENTRY, *PSW2_LDR_DATA_TABLE_ENTRY;
+
+typedef struct _SW2_PEB {
+	BYTE Reserved1[2];
+	BYTE BeingDebugged;
+	BYTE Reserved2[1];
+	PVOID Reserved3[2];
+	PSW2_PEB_LDR_DATA Ldr;
+} SW2_PEB, *PSW2_PEB;
+
+DWORD SW2_HashSyscall(PCSTR FunctionName);
+BOOL SW2_PopulateSyscallList(void);
+EXTERN_C DWORD SW2_GetSyscallNumber(DWORD FunctionHash);
+
 typedef struct _UNICODE_STRING
 {
 	USHORT Length;
@@ -88,15 +88,17 @@ typedef struct _WNF_TYPE_ID
 	GUID TypeId;
 } WNF_TYPE_ID, *PWNF_TYPE_ID;
 
-typedef struct _IO_STATUS_BLOCK
+typedef enum _PS_CREATE_STATE
 {
-	union
-	{
-		NTSTATUS Status;
-		VOID*    Pointer;
-	};
-	ULONG_PTR Information;
-} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
+	PsCreateInitialState,
+	PsCreateFailOnFileOpen,
+	PsCreateFailOnSectionCreate,
+	PsCreateFailExeFormat,
+	PsCreateFailMachineMismatch,
+	PsCreateFailExeName,
+	PsCreateSuccess,
+	PsCreateMaximumStates
+} PS_CREATE_STATE, *PPS_CREATE_STATE;
 
 typedef enum _KCONTINUE_TYPE
 {
@@ -107,17 +109,15 @@ typedef enum _KCONTINUE_TYPE
 	KCONTINUE_LAST
 } KCONTINUE_TYPE;
 
-typedef enum _PS_CREATE_STATE
+typedef struct _IO_STATUS_BLOCK
 {
-	PsCreateInitialState,
-	PsCreateFailOnFileOpen,
-	PsCreateFailOnSectionCreate,
-	PsCreateFailExeFormat,
-	PsCreateFailMachineMismatch,
-	PsCreateFailExeName,
-	PsCreateSuccess,
-	PsCreateMaximumStates
-} PS_CREATE_STATE, *PPS_CREATE_STATE;
+	union
+	{
+		NTSTATUS Status;
+		VOID*    Pointer;
+	};
+	ULONG_PTR Information;
+} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
 
 typedef struct _SYSTEM_HANDLE_INFORMATION
 {
@@ -4046,4 +4046,16 @@ EXTERN_C NTSTATUS NtContinueEx(
 	IN PCONTEXT ContextRecord,
 	IN PKCONTINUE_ARGUMENT ContinueArgument);
 
+EXTERN_C NTSTATUS RtlCreateUserThread(
+	IN HANDLE ProcessHandle,
+	IN PSECURITY_DESCRIPTOR SecurityDescriptor OPTIONAL,
+	IN BOOLEAN CreateSuspended,
+	IN ULONG StackZeroBits,
+	IN OUT PULONG StackReserved,
+	IN OUT PULONG StackCommit,
+	IN PVOID StartAddress,
+	IN PVOID StartParameter OPTIONAL,
+	OUT PHANDLE ThreadHandle,
+	OUT PCLIENT_ID ClientID);
+
 #endif