justasmasiulis / inline_syscall

Inline syscalls made easy for windows on clang

inline_syscall

Header only library that allows you to generate direct syscall instructions in an optimized, inlineable and easy to use manner.

How to use

All you have to do is copy over the header files and call the initialization function init_syscalls_list before using the INLINE_SYSCALL(function_pointer) and INLINE_SYSCALL_T(function_type) macros.

// This header contains the initialization function.
// If you already initialized, inline_syscall.hpp contains all you need.
#include "inline_syscall/include/in_memory_init.hpp"

// Needs to be called once at startup before INLINE_SYSCALL is used.
jm::init_syscalls_list();

// Usage of the main macro INLINE_SYSCALL
void* allocation = nullptr;
SIZE_T size      = 0x1000;
NTSTATUS status  = INLINE_SYSCALL(NtAllocateVirtualMemory)((HANDLE)-1, &allocation, 0, &size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);

What code does it generate

As one of the main goals of this library is to be as optimized as possible here is the output of an optimized build.

mov qword ptr [rsp+30h], 0                  ; void* allocation = nullptr
mov qword ptr [rsp+28h], 1000h              ; SIZE_T size      = 0x1000;
mov eax, dword ptr [entry (07FF683157004h)] ; syscall id is loaded
lea rdx, [rsp+30h]                          ; BaseAddress     = &allocation
lea r9, [rsp+28h]                           ; RegionSize      = &size
mov r10, 0FFFFFFFFFFFFFFFFh                 ; ProcessHandle   = -1
xor r8d,r8d                                 ; ZeroBits        = 0
sub rsp,40h                                 ; preparing stack
mov qword ptr [type],3000h                  ; AllocationType  = MEM_RESERVE | MEM_COMMIT
mov qword ptr [protect], 4                  ; Protect         = PAGE_READWRITE
syscall                                     ; syscall instruction itself
add rsp,40h                                 ; restoring stack

FAQ

• Q: What are the main uses of this? A: Obfuscation and hook avoidance.
• Q: Why would I use this over some other library? A: The code this generates can be inlined and it is optimized for every single parameter count as much as possible.
• Q: Why can't this work on MSVC? A: MSVC doesn't support GCC style inline assembly which can be properly optimized and worked on by compiler.
• Q: Why can't this work on GCC? A: Contrary to MSVC, GCC is too good at optimizing inline assembly and as such breaks my code that tries to be somewhat generic.

Creating your own initialization function

This library enables you to create your own custom initialization routines that are more resilent against missing syscalls or acquire syscall ids in some other way.

JM_INLINE_SYSCALL_ENTRY_TYPE can be defined with your own syscall entry type that needs to be constructible from a hash. By default syscall_entry_small is used, but syscall_entry_full is also shipped.

If you want to use the provided INLINE_SYSCALL macro you will need to use the provided jm::hash function.

To acquire the start of syscall entries you need to call jm::syscall_entries() and iterate untill you hit a zero entry.

inline_syscall's Issues

PEzor

https://iwantmore.pizza/posts/PEzor.html
I hava this problem
T_T
T_T
T_T
In file included from test.cpp:2:
In file included from ./inline_syscall/include/in_memory_init.hpp:20:
In file included from ./inline_syscall/include/inline_syscall.hpp:103:
./inline_syscall/include/inline_syscall.inl:61:28: warning: inline variables are a C++17 extension [-Wc++17-extensions]
"_sysc")]] inline static JM_INLINE_SYSCALL_ENTRY_TYPE entry{ Hash };
^
In file included from test.cpp:2:
./inline_syscall/include/in_memory_init.hpp:178:62: error: use of undeclared identifier '__readgsqword'
const auto peb = reinterpret_cast<const char*>(__readgsqword(0x30) + 0x60);

mingw usage?

hello,

i am trying to use the library with https://github.com/tpoechtrager/wclang in order to compile a PE from linux. i have tried with both clang-6 and clang-8 but i always get the following error:

$ ./x86_64-w64-mingw32-clang++ -Wall --pedantic hello.cpp -o hello.exe
In file included from hello.cpp:8:
In file included from ./inline_syscall/include/in_memory_init.hpp:20:
In file included from ./inline_syscall/include/inline_syscall.hpp:103:
./inline_syscall/include/inline_syscall.inl:61:28: warning: inline variables are a C++17 extension [-Wc++17-extensions]
                "_sysc")]] inline static JM_INLINE_SYSCALL_ENTRY_TYPE entry{ Hash };
                           ^
hello.cpp:18:24: error: implicit instantiation of undefined template 'jm::syscall_function<long long (*)()>'
    NTSTATUS status  = INLINE_SYSCALL(NtAllocateVirtualMemory)((HANDLE)-1, &allocation, 0, &size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
                       ^
./inline_syscall/include/inline_syscall.hpp:26:5: note: expanded from macro 'INLINE_SYSCALL'
    INLINE_SYSCALL_MANUAL(               \
    ^
./inline_syscall/include/inline_syscall.hpp:44:5: note: expanded from macro 'INLINE_SYSCALL_MANUAL'
    ::jm::syscall_function<decltype(function_pointer)> { syscall_id }
    ^
./inline_syscall/include/inline_syscall.hpp:55:11: note: template is declared here
    class syscall_function;
          ^
1 warning and 1 error generated.

The source code of hello.cpp is the following:

#include <winternl.h>
#include <ntstatus.h>
#include <windows.h>
#include <iostream>

// This header contains the initialization function.
// If you already initialized, inline_syscall.hpp contains all you need.
#include "inline_syscall/include/in_memory_init.hpp"

int main() {
    FARPROC NtAllocateVirtualMemory = GetProcAddress(GetModuleHandle("NTDLL.DLL"), "NtAllocateVirtualMemory");
    // Needs to be called once at startup before INLINE_SYSCALL is used.
    jm::init_syscalls_list();

    // Usage of the main macro INLINE_SYSCALL
    void* allocation = nullptr;
    SIZE_T size      = 0x1000;
    NTSTATUS status  = INLINE_SYSCALL(NtAllocateVirtualMemory)((HANDLE)-1, &allocation, 0, &size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
    return 0;
}

any idea on how to fix the template error?

void return type ntapi problem

VOID RtlInitUnicodeString(
        PUNICODE_STRING         DestinationString,
        __drv_aliasesMem PCWSTR SourceString
);

WCHAR path[MAX_PATH] = L"\\??\\\\C:\\Users\\Buntu\\Desktop\\test.txt";
PUNICODE_STRING punicodeString;
INLINE_SYSCALL(RtlInitUnicodeString)(punicodeString, path);

Ntapi with return type NTSTATUS works well, but ntapi with void does not work.

Debug break

Accidently left a debug break here:

inline_syscall/include/inline_syscall.inl

Line 211 in ca4337a

__debugbreak();

error : invalid operand for instruction

int main()
{
    std::uint64_t largeImmidiateValue{ 0x1234567812345678 };
    jm::detail::syscall(0, 0, 0, 0, 0, largeImmidiateValue);//error : invalid operand for instruction
}

I believe it has something to do with the input constraint "rn", because if I change it to "r", then it compiles.