AtomicSyscall

أدوات وPoCs للتحقيق في استدعاءات نظام Windows.

جدول المحتويات

• AtomicSyscall
  • HeavensGate
  • SyscallDumper
  • SyscallPoCs
  • SyscallResolvers
  • Get-SyscallNumber.ps1
  • المراجع
  • شكر وتقدير

HeavensGate

هذا الدليل مخصص لتقنية Heaven's Gate. انظر README.md

SyscallDumper

العودة إلى الأعلى

المشروع

هذه الأداة مخصصة لتفريغ استدعاءات نظام Windows من ntdll.dll أو win32u.dll:``` C:\Tools>SyscallDumper.exe -h

SyscallDumper - Tool to dump syscall.

Usage: SyscallDumper.exe [Options] [INPUT_DLL_1] [INPUT_DLL_2]

    -h, --help   : Displays this help message.
    -d, --dump   : Flag to dump syscall from ntdll.dll or win32u.dll.
    -D, --diff   : Flag to take diff between 2 dlls.
    -f, --format : Specifies output format. "c" for C/C++, "cs" for CSharp, "py" for Python.
    -n, --number : Specifies syscall number to lookup in decimal or hex format.
    -o, --output : Specifies output file (e.g. "-o result.txt").
    -s, --search : Specifies search filter (e.g. "-s createfile").
    INPUT_DLL_1  : Specifies path of ntdll.dll or win32u.dll. Older one in diffing.
    INPUT_DLL_2  : Specifies path of ntdll.dll or win32u.dll. Newer one in diffing.

لتفريغ أرقام استدعاءات النظام من ntdll.dll أو win32u.dll، استخدم الخيار `-d` (`--dump`).
إذا لم تحدد DLL المصدر، تقوم هذه الأداة بتفريغ أرقام استدعاءات النظام من `C:\Windows\System32\ntdll.dll` و `C:\Windows\System32\win32u.dll`:```
C:\Tools>SyscallDumper.exe -d

[*] No target is specified.
[>] Dumping from system default ntdll.dll and win32u.dll.
[>] Loading C:\Windows\System32\ntdll.dll.
[+] C:\Windows\System32\ntdll.dll is loaded successfully.
    [*] Architecture : AMD64
    [*] Image Name   : ntdll.dll
[+] Got 463 syscall(s).
[>] Loading C:\Windows\System32\win32u.dll.
[+] C:\Windows\System32\win32u.dll is loaded successfully.
    [*] Architecture : AMD64
    [*] Image Name   : win32u.dll
[+] Got 1258 syscall(s).

[Syscall Table from C:\Windows\System32\ntdll.dll]

---------------------------------------------------------------------------------
| Syscall Name                                          | Number | Number (hex) |
---------------------------------------------------------------------------------
| NtAcceptConnectPort                                   | 2      | 0x0002       |
| NtAccessCheck                                         | 0      | 0x0000       |

--snip--

| NtWriteVirtualMemory                                  | 58     | 0x003A       |
| NtYieldExecution                                      | 70     | 0x0046       |
---------------------------------------------------------------------------------

[*] Found 463 syscall(s).


[Syscall Table from C:\Windows\System32\win32u.dll]

-----------------------------------------------------------------------------------
| Syscall Name                                            | Number | Number (hex) |
-----------------------------------------------------------------------------------
| NtBindCompositionSurface                                | 4373   | 0x1115       |
| NtCloseCompositionInputSink                             | 4374   | 0x1116       |

--snip--

| NtValidateCompositionSurfaceHandle                      | 5350   | 0x14E6       |
| NtVisualCaptureBits                                     | 5351   | 0x14E7       |
-----------------------------------------------------------------------------------

[*] Found 1258 syscall(s).

إذا كنت تريد تصفية اسم استدعاء النظام من نتيجة التفريغ، استخدم الخيار -s (--search). ويمكنك حفظ النتيجة في ملف باستخدام الخيار -o (--output) كما يلي:``` C:\Tools>SyscallDumper.exe -d C:\SyscallSamples\1809x64\ntdll.dll -s token -o result.txt

[>] Loading C:\SyscallSamples\1809x64\ntdll.dll. [+] C:\SyscallSamples\1809x64\ntdll.dll is loaded successfully. [] Architecture : AMD64 [] Image Name : ntdll.dll [+] Got 462 syscall(s). [>] Trying to save results. [*] Output File Path : c:\Tools\result.txt [+] Results are saved successfully.

c:\Tools>type result.txt [Syscall Table from C:\SyscallSamples\1809x64\ntdll.dll]

---

| Syscall Name | Number | Number (hex) |

| NtAdjustGroupsToken | 107 | 0x006B | | NtAdjustPrivilegesToken | 65 | 0x0041 | | NtAdjustTokenClaimsAndDeviceGroups | 108 | 0x006C | | NtCompareTokens | 155 | 0x009B | | NtCreateLowBoxToken | 172 | 0x00AC | | NtCreateToken | 191 | 0x00BF | | NtCreateTokenEx | 192 | 0x00C0 | | NtDuplicateToken | 66 | 0x0042 | | NtFilterToken | 222 | 0x00DE | | NtFilterTokenEx | 223 | 0x00DF | | NtImpersonateAnonymousToken | 246 | 0x00F6 | | NtOpenProcessToken | 290 | 0x0122 | | NtOpenProcessTokenEx | 48 | 0x0030 | | NtOpenThreadToken | 36 | 0x0024 | | NtOpenThreadTokenEx | 47 | 0x002F | | NtQueryInformationToken | 33 | 0x0021 | | NtQuerySecurityAttributesToken | 339 | 0x0153 | | NtSetInformationToken | 404 | 0x0194 |

[] Found 18 syscall(s). [] Filter String : "token"

باستخدام خيار `-n` (`--number`)، يمكنك البحث عن اسم استدعاء النظام عبر رقم استدعاء النظام كما يلي.
إذا أردت تحديد رقم استدعاء النظام بصيغة سداسية عشرية، فيجب أن يبدأ بـ "0x".```
C:\Tools>SyscallDumper.exe -d C:\dev\SyscallSamples\21H1x64\ntdll.dll -n 85

[>] Loading C:\dev\SyscallSamples\21H1x64\ntdll.dll.
[+] C:\dev\SyscallSamples\21H1x64\ntdll.dll is loaded successfully.
    [*] Architecture : AMD64
    [*] Image Name   : ntdll.dll
[+] Got 470 syscall(s).

[Syscall Table from C:\dev\SyscallSamples\21H1x64\ntdll.dll]

----------------------------------------
| Syscall Name | Number | Number (hex) |
----------------------------------------
| NtCreateFile | 85     | 0x0055       |
----------------------------------------

[*] Found 1 syscall(s).


C:\Tools>SyscallDumper.exe -d C:\dev\SyscallSamples\21H1x64\ntdll.dll -n 0x55

[>] Loading C:\dev\SyscallSamples\21H1x64\ntdll.dll.
[+] C:\dev\SyscallSamples\21H1x64\ntdll.dll is loaded successfully.
    [*] Architecture : AMD64
    [*] Image Name   : ntdll.dll
[+] Got 470 syscall(s).

[Syscall Table from C:\dev\SyscallSamples\21H1x64\ntdll.dll]

----------------------------------------
| Syscall Name | Number | Number (hex) |
----------------------------------------
| NtCreateFile | 85     | 0x0055       |
----------------------------------------

[*] Found 1 syscall(s).

إذا أردت تغيير تنسيق الإخراج، استخدم الخيار -f (--format). حاليًا، يتم دعم C/C++ (c) وCSharp (cs) وPython (py):``` C:\Tools>SyscallDumper.exe -d C:\dev\SyscallSamples\Win11Arm64\ntdll-arm64.dll -f c

[>] Loading C:\dev\SyscallSamples\Win11Arm64\ntdll-arm64.dll. [+] C:\dev\SyscallSamples\Win11Arm64\ntdll-arm64.dll is loaded successfully. [] Architecture : ARM64 [] Image Name : ntdll.dll [+] Got 486 syscall(s).

[Syscall Table from C:\dev\SyscallSamples\Win11Arm64\ntdll-arm64.dll]

enum NT_SYSCALLS { NtAcceptConnectPort = 2, NtAccessCheck = 0, NtAccessCheckAndAuditAlarm = 41,

--snip--

NtWriteVirtualMemory = 58,
NtYieldExecution = 70

}

[*] Found 486 syscall(s).