klezVirus/SysWhispers3

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1653 stars · 207 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

SysWhispers3 is a Python command-line tool that generates header and assembly (ASM) file pairs for direct system calls to the Windows kernel (ntoskrnl.exe). It is designed to help security researchers and red teamers bypass user-mode API hooking used by antivirus (AV) and endpoint detection and response (EDR) products.

Use cases

• generate direct syscall stubs to bypass EDR user-mode hooks
• evade antivirus detection by calling Windows kernel functions directly
• create header and assembly files for Windows syscalls in C/C++ implants
• randomize syscall jumps to avoid static signature detection
• support x86, x64, and WoW64 architectures for syscall evasion
• integrate syscall generation into a red team toolchain or C2 framework

When to choose

• developing Windows implants or offensive security tools that need to bypass user-mode API hooking
• performing red team engagements where EDR/AV evasion via direct syscalls is required
• needing support for x86, x64, and WoW64 architectures with advanced syscall techniques like egg-hunting or randomized jumps
• building on top of or integrating with the Inceptor framework

When to avoid

• you need a general-purpose Windows development toolkit unrelated to security research or offensive operations
• you are targeting non-Windows platforms, as the tool is Windows-specific
• you need a fully supported, production-ready tool with extensive documentation and community support
• you are looking for defensive security tooling rather than offensive/evasion capabilities

Facets

cli-tool · maturity active

security cryptography developer-tools security penetration-testing reverse-engineering developer-tools windows windows python cli edr-evasion av-evasion direct-syscalls shellcode red-team offensive-security malware-development ntoskrnl userland-hooking code-generation assembly x86 x64 wow64 egg-hunter inceptor

Member repositories

For agents

markdown · JSON · MCP: product_card(name="klezVirus/SysWhispers3")