Using Sysplant as a CLI tool

This project can be used as a simple command line tool.

Installation

Requirements: Pyton 3.8+

This is a python project that will generate NIM/C/etc... source code (bit weird hu ?! :grin:). So you can use it inside your python project as an external module or directly on your device as a tool.
Install the project as you would do for any GitHub project.

git clone https://github.com/x42en/sysplant && cd sysplant
poetry shell
./main.py -h

Usage

This tool comes with various options that should be self-explanatory using the standard -h flag

$ ./main.py -h
usage: main.py [-h] [--debug | --verbose | --quiet] {list,generate} ...

..:: SysPlant - Your Syscall Factory ::..

positional arguments:
  {list,generate}

optional arguments:
  -h, --help       show this help message and exit

Output options:
  --debug          Display all DEBUG messages upon execution
  --verbose        Display all INFO messages upon execution
  --quiet          Remove all messages upon execution

By now only two actions are supported list (that will parse file or directory to find NtFunction usage) and generate that will generate a syscall hooking file to import into your project

List action

In order to use the list action you could check the associated help ./main.py list -h

$ ./main.py list -h
usage: main.py list [-h] path

positional arguments:
  path        Path to search for NtFunction, could be a file or a directory

optional arguments:
  -h, --help  show this help message and exit

Generate action

In order to use the generate action you could check the associated help ./main.py generate -h

$ ./main.py generate -h
usage: main.py generate [-h] [-x86 | -wow | -x64] [-nim | -c] [-p {all,donut,common} | -f FUNCTIONS] [-x] -o OUTPUT {hell,halo,tartarus,freshy,syswhispers,syswhispers3,canterlot,custom} ...

positional arguments:
  {hell,halo,tartarus,freshy,syswhispers,syswhispers3,canterlot,custom}

optional arguments:
  -h, --help            show this help message and exit
  -x, --scramble        Randomize internal function names to evade static analysis
  -o OUTPUT, --output OUTPUT
                        Output path for NIM generated file

Architecture options:
  -x86                  Set mode to 32bits
  -wow                  Set mode to WoW64 (execution of 32bits on 64bits)
  -x64                  Set mode to 64bits (Default True)

Language options:
  -nim                  Generate NIM code (Default: true)
  -c                    Generate C code

Syscall options:
  -p {all,donut,common}, --preset {all,donut,common}
                        Preset functions to generate (Default: common)
  -f FUNCTIONS, --functions FUNCTIONS
                        Comma-separated functions

Examples

Here are some usage examples that will generate common NtFunctions only.
This tool is not restricted to them, please READ THE DOC

Hell's Gate generation

$ ./main.py generate -o syscall hell

Halo's Gate generation

$ ./main.py generate -o syscall halo

Tartarus's Gate generation

$ ./main.py generate -o syscall tartarus

FreshyCall generation

$ ./main.py generate -o syscall freshy

Syswhispers2 like generation

$ ./main.py generate -o syscall syswhispers

Syswhispers3 like generation

$ ./main.py generate -o syscall syswhispers3

Canterlot's Gate generation

$ ./main.py generate -o syscall canterlot

Custom generation

$ ./main.py generate -o syscall custom -i canterlot -m direct

Generate C Code using Canterlot's Gate for Donut functions

$ ./main.py generate -c -o syscall -p donut canterlot

Real world Injection

A simple example (launching calc.exe) is accessible using inject.nim.
1. Be sure to install winim library first: nimble install winim 2. Generate the syscall.nim file with ./main.py -o example/syscall.nim canterlot 3. Compile the injection template file with nim c -d=release -d=danger -d=strip --opt=size -d=mingw --app=console --cpu=amd64 --out=app.exe example/inject.nim on Linux (be sure to have mingw installed) 4. Copy the app.exe generated on your Windows device.

Documentation

The API documentation and associated options is available here

Happy Hacking :beach: !