klezVirus / klezVirus/SysWhispers3

Improvement suggestions

Open
#18 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
1.7k
Forks
207
PR merge metrics
No merged PRs in 30d

Description

Hi,

Please consider the following improvements:

1. If one does not use anything else but these definitions, NTSTATUS will be missing, you can just add:

```
#ifndef SW3_HEADER_H_
#define SW3_HEADER_H_

#include

#ifndef _NTDEF_
typedef _Return_type_success_(return >= 0) LONG NTSTATUS;
typedef NTSTATUS* PNTSTATUS;
#endif
```

2. If one needs to use another definition set like [phnt](https://github.com/winsiderss/phnt), the definitions will clash at compile time. My suggestion is to rename the structures/definitions with a prefix like:

```
typedef struct _SW3_SYSTEM_HANDLE
{
ULONG ProcessId;
BYTE ObjectTypeNumber;
BYTE Flags;
USHORT Handle;
PVOID Object;
ACCESS_MASK GrantedAccess;
} SW3_SYSTEM_HANDLE, *PSW3SYSTEM_HANDLE;
```

Same for functions (there is no reason we cannot name them as we wish):

```
EXTERN_C NTSTATUS Sw3NtCreateProcess(
OUT PHANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN HANDLE ParentProcess,
IN BOOLEAN InheritObjectTable,
IN HANDLE SectionHandle OPTIONAL,
IN HANDLE DebugPort OPTIONAL,
IN HANDLE ExceptionPort OPTIONAL);
```

This would prevent the "already defined" compiling issue. Perhaps add a flag like `--custom-prefix` which would prefix the functions/structured/definitions as the user specifies.

3. Instead of the current initial see, you might want to consider using [xoshiro prng](https://prng.di.unimi.it/).

Thanks!

Contributor guide

No contributing guide indexed for this repository

Research direction

No file or test is named. Start by locating the generator entry points for NTSTATUS, emitted structures and functions, PRNG selection, and command-line options; done requires an agreed scope for the three suggestions and generated output that avoids definition clashes.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, python
Domain
cli, security, tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.