SysWhispers

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1828 stars · 266 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

SysWhispers is a Python CLI tool that generates header and assembly files for making direct system calls on Windows, bypassing user-mode API hooks used by AV/EDR products. It supports core ntoskrnl syscalls across Windows XP through Windows 10, with version detection done in assembly via the PEB.

Use cases

• generate direct syscall stubs to bypass EDR user-mode hooks
• create header/ASM files for NtAllocateVirtualMemory and NtWriteVirtualMemory injection
• build an implant that works across multiple Windows versions without RtlGetVersion
• evade AV detection during red team operations
• re-implement ntdll syscall functions in a custom implant

When to choose

• you are a red teamer needing direct syscalls for evasion on Windows
• you want generated header/ASM pairs for any core Windows syscall from XP to Windows 10
• you need multi-version Windows compatibility in a single syscall stub

When to avoid

• you need a defensive tool or EDR detection capability
• you target non-Windows platforms
• you want a maintained tool with recent updates - development appears stalled since 2023

Facets

cli-tool · maturity maintenance

security cli security penetration-testing windows windows cli python red-team edr-evasion direct-syscalls assembly offensive-security windows-internals code-generation

Member repositories

For agents

markdown · JSON · MCP: product_card(name="jthuraisamy/SysWhispers2")