{"adoption": {"forks": 207, "observed_at": "2026-08-28T04:05:17.128889+00:00", "stars": 1653}, "canonical_url": "https://ross.abutalabs.com/products/syswhispers3", "card": {"archived": false, "artifact_type": "cli-tool", "description": "SysWhispers on Steroids - AV/EDR evasion via direct system calls. ", "domain": ["security", "penetration-testing", "reverse-engineering", "developer-tools", "windows"], "enriched": true, "function": ["security", "cryptography", "developer-tools"], "health_score": 20, "homepage": null, "language": "Python", "license": "Apache-2.0", "license_family": "permissive", "maturity": "active", "member_repos": ["klezVirus/SysWhispers3"], "name": "klezVirus/SysWhispers3", "platform": ["windows", "python", "cli"], "pushed_at": "2024-07-31T05:24:06+00:00", "repo": "klezVirus/SysWhispers3", "stars": 1653, "tags": ["edr-evasion", "av-evasion", "direct-syscalls", "shellcode", "red-team", "offensive-security", "malware-development", "ntoskrnl", "userland-hooking", "code-generation", "assembly", "x86", "x64", "wow64", "egg-hunter", "inceptor"], "topics": [], "urls": [], "use_cases": ["generate direct syscall stubs to bypass EDR user-mode hooks", "evade antivirus detection by calling Windows kernel functions directly", "create header and assembly files for Windows syscalls in C/C++ implants", "randomize syscall jumps to avoid static signature detection", "support x86, x64, and WoW64 architectures for syscall evasion", "integrate syscall generation into a red team toolchain or C2 framework"], "what_it_is": "SysWhispers3 is a Python command-line tool that generates header and assembly (ASM) file pairs for direct system calls to the Windows kernel (ntoskrnl.exe). It is designed to help security researchers and red teamers bypass user-mode API hooking used by antivirus (AV) and endpoint detection and response (EDR) products.", "when_to_avoid": ["you need a general-purpose Windows development toolkit unrelated to security research or offensive operations", "you are targeting non-Windows platforms, as the tool is Windows-specific", "you need a fully supported, production-ready tool with extensive documentation and community support", "you are looking for defensive security tooling rather than offensive/evasion capabilities"], "when_to_choose": ["developing Windows implants or offensive security tools that need to bypass user-mode API hooking", "performing red team engagements where EDR/AV evasion via direct syscalls is required", "needing support for x86, x64, and WoW64 architectures with advanced syscall techniques like egg-hunting or randomized jumps", "building on top of or integrating with the Inceptor framework"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/syswhispers3", "repo": "klezVirus/SysWhispers3", "role": "main", "score": 32}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:05:17.128889+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T03:44:58.066007+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "841b5ce003b341abad9166bd8be796239eb3b8eb925e9351427cb942ed59c068", "fetched_at": "2026-08-28T04:05:17.128889+00:00", "kind": "readme", "missing": false, "url": "https://github.com/klezVirus/SysWhispers3"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:05:17.128889+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T03:44:58.066007+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "841b5ce003b341abad9166bd8be796239eb3b8eb925e9351427cb942ed59c068", "fetched_at": "2026-08-28T04:05:17.128889+00:00", "kind": "readme", "missing": false, "url": "https://github.com/klezVirus/SysWhispers3"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T03:44:58.066007+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "841b5ce003b341abad9166bd8be796239eb3b8eb925e9351427cb942ed59c068", "fetched_at": "2026-08-28T04:05:17.128889+00:00", "kind": "readme", "missing": false, "url": "https://github.com/klezVirus/SysWhispers3"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:05:17.128889+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:05:17.128889+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:05:17.128889+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T03:44:58.066007+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "841b5ce003b341abad9166bd8be796239eb3b8eb925e9351427cb942ed59c068", "fetched_at": "2026-08-28T04:05:17.128889+00:00", "kind": "readme", "missing": false, "url": "https://github.com/klezVirus/SysWhispers3"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:05:17.128889+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:05:17.128889+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T03:44:58.066007+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "841b5ce003b341abad9166bd8be796239eb3b8eb925e9351427cb942ed59c068", "fetched_at": "2026-08-28T04:05:17.128889+00:00", "kind": "readme", "missing": false, "url": "https://github.com/klezVirus/SysWhispers3"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:05:17.128889+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:05:17.128889+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:05:17.128889+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T03:44:58.066007+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "841b5ce003b341abad9166bd8be796239eb3b8eb925e9351427cb942ed59c068", "fetched_at": "2026-08-28T04:05:17.128889+00:00", "kind": "readme", "missing": false, "url": "https://github.com/klezVirus/SysWhispers3"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:05:17.128889+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:05:17.128889+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T03:44:58.066007+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "841b5ce003b341abad9166bd8be796239eb3b8eb925e9351427cb942ed59c068", "fetched_at": "2026-08-28T04:05:17.128889+00:00", "kind": "readme", "missing": false, "url": "https://github.com/klezVirus/SysWhispers3"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T03:44:58.066007+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "841b5ce003b341abad9166bd8be796239eb3b8eb925e9351427cb942ed59c068", "fetched_at": "2026-08-28T04:05:17.128889+00:00", "kind": "readme", "missing": false, "url": "https://github.com/klezVirus/SysWhispers3"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T03:44:58.066007+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "841b5ce003b341abad9166bd8be796239eb3b8eb925e9351427cb942ed59c068", "fetched_at": "2026-08-28T04:05:17.128889+00:00", "kind": "readme", "missing": false, "url": "https://github.com/klezVirus/SysWhispers3"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T03:44:58.066007+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "841b5ce003b341abad9166bd8be796239eb3b8eb925e9351427cb942ed59c068", "fetched_at": "2026-08-28T04:05:17.128889+00:00", "kind": "readme", "missing": false, "url": "https://github.com/klezVirus/SysWhispers3"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 0, "longevity": 100, "rhythm": 35}, "computed_at": "2026-09-03T02:20:16.233290+00:00", "flags": ["no_releases"], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 1640, "days_push": 763, "days_rel": null, "gap_med": null, "n_releases_24m": 0}, "score": 32, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}