klezVirus / klezVirus/SysWhispers3
Improvement suggestions
- Dominant language
- Python
- Stars
- 1.7k
- Forks
- 207
- PR merge metrics
- No merged PRs in 30d
Description
Hi,
Please consider the following improvements:
1. If one does not use anything else but these definitions, NTSTATUS will be missing, you can just add:
```
#ifndef SW3_HEADER_H_
#define SW3_HEADER_H_
#include
#ifndef _NTDEF_
typedef _Return_type_success_(return >= 0) LONG NTSTATUS;
typedef NTSTATUS* PNTSTATUS;
#endif
```
2. If one needs to use another definition set like [phnt](https://github.com/winsiderss/phnt), the definitions will clash at compile time. My suggestion is to rename the structures/definitions with a prefix like:
```
typedef struct _SW3_SYSTEM_HANDLE
{
ULONG ProcessId;
BYTE ObjectTypeNumber;
BYTE Flags;
USHORT Handle;
PVOID Object;
ACCESS_MASK GrantedAccess;
} SW3_SYSTEM_HANDLE, *PSW3SYSTEM_HANDLE;
```
Same for functions (there is no reason we cannot name them as we wish):
```
EXTERN_C NTSTATUS Sw3NtCreateProcess(
OUT PHANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN HANDLE ParentProcess,
IN BOOLEAN InheritObjectTable,
IN HANDLE SectionHandle OPTIONAL,
IN HANDLE DebugPort OPTIONAL,
IN HANDLE ExceptionPort OPTIONAL);
```
This would prevent the "already defined" compiling issue. Perhaps add a flag like `--custom-prefix` which would prefix the functions/structured/definitions as the user specifies.
3. Instead of the current initial see, you might want to consider using [xoshiro prng](https://prng.di.unimi.it/).
Thanks!
Contributor guide
No contributing guide indexed for this repository
Research direction
No file or test is named. Start by locating the generator entry points for NTSTATUS, emitted structures and functions, PRNG selection, and command-line options; done requires an agreed scope for the three suggestions and generated output that avoids definition clashes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, python
- Domain
- cli, security, tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100