syscalls-rs

Rust port of syscalls-cpp: a policy-based framework for crafting undetectable/protected Windows syscalls (x86 / x64).

You mix and match three policies at compile time:

Allocator	What it uses
Section	NtCreateSection + SEC_NO_CHANGE
Heap	RtlCreateHeap(HEAP_CREATE_ENABLE_EXECUTE)
Memory	NtAllocateVirtualMemory (RW → RX)

Stub generator	What it emits
Direct	Self-contained syscall instruction
Gadget (x64)	Jumps to a syscall; ret gadget found in ntdll
Exception	Triggers ud2; resolves via a vectored exception handler

Parser	How it finds syscall numbers
Directory	x64: walks .pdata ordered by RVA; x86: sorts Zw* exports
Signature	Scans function prologues with hook detection

Quick start

use core::ffi::c_void;use syscalls_rs::prelude::*;use syscalls_rs::shared::{current_process,NTSTATUS};use syscalls_rs::syscall_id;typeNtAlloc = unsafeextern"system"fn(isize,*mut*mutc_void,usize,*mutusize,u32,u32,) -> NTSTATUS;let mgr:SectionDirectManager = Manager::new();assert!(mgr.initialize());let inv = mgr.invoke(syscall_id!("NtAllocateVirtualMemory")).unwrap();let f:NtAlloc = unsafe{ inv.as_fn()};

Features

• no_hash — use String syscall keys instead of compile-time u64 hashes (mirrors -DSYSCALLS_NO_HASH).

Requirements

• Windows x86 or x64 target
• Rust 1.75+ (for the const fn features used in hash.rs)

License

MIT (same as upstream).