# klezVirus/SysWhispers3

SysWhispers on Steroids - AV/EDR evasion via direct system calls.

Repository: https://github.com/klezVirus/SysWhispers3
Canonical: https://ross.abutalabs.com/products/syswhispers3
Language: Python
License: Apache-2.0
License Family: permissive
Last push: 2024-07-31T05:24:06+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 1640, "days_push": 763, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1653, forks 207 (observed 2026-08-28T04:05:17.128889+00:00)

## What it is
SysWhispers3 is a Python command-line tool that generates header and assembly (ASM) file pairs for direct system calls to the Windows kernel (ntoskrnl.exe). It is designed to help security researchers and red teamers bypass user-mode API hooking used by antivirus (AV) and endpoint detection and response (EDR) products.

## Use cases
- generate direct syscall stubs to bypass EDR user-mode hooks
- evade antivirus detection by calling Windows kernel functions directly
- create header and assembly files for Windows syscalls in C/C++ implants
- randomize syscall jumps to avoid static signature detection
- support x86, x64, and WoW64 architectures for syscall evasion
- integrate syscall generation into a red team toolchain or C2 framework

## When to choose
- developing Windows implants or offensive security tools that need to bypass user-mode API hooking
- performing red team engagements where EDR/AV evasion via direct syscalls is required
- needing support for x86, x64, and WoW64 architectures with advanced syscall techniques like egg-hunting or randomized jumps
- building on top of or integrating with the Inceptor framework

## When to avoid
- you need a general-purpose Windows development toolkit unrelated to security research or offensive operations
- you are targeting non-Windows platforms, as the tool is Windows-specific
- you need a fully supported, production-ready tool with extensive documentation and community support
- you are looking for defensive security tooling rather than offensive/evasion capabilities

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, cryptography, developer-tools
- domain: security, penetration-testing, reverse-engineering, developer-tools, windows
- platform: windows, python, cli
- tags: edr-evasion, av-evasion, direct-syscalls, shellcode, red-team, offensive-security, malware-development, ntoskrnl, userland-hooking, code-generation, assembly, x86, x64, wow64, egg-hunter, inceptor

## Member repositories
- klezVirus/SysWhispers3 (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:17.128889+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:44:58.066007+00:00, confidence not recorded.
  - readme: https://github.com/klezVirus/SysWhispers3 (fetched 2026-08-28T04:05:17.128889+00:00, sha 841b5ce003b3)
- Data as of 2026-08-30T08:39:29.467469+00:00.