wizardcalls 2.0.0

An indirect syscall code generation utility for C/C++ windows impants

About

Wizardcalls is a code generation utility for C/C++ based implants targeting windows. Using wizardcalls, developers can quickly create a template containing desired syscalls for use in an implant via wizardcalls command line or scripting interfaces.

Limitations

At this time, wizardcalls is only intended for use in Windows development environments. Linux is not currently supported but this feature is not off the table in the future.

Wizardcalls only supports x64 based implants at this time. x86 support could be added in the future.

Installation

Wizardcalls can be installed manually from this repository or from PyPi.

Manual Installation

git clone https://github.com/wizardy0ga/wizardcalls
pip install .\wizardcalls

Install via PyPi

pip install wizardcalls

Bugs, Feature & Other Requests

Feel free to open an issue for an issue for things like bugs & feature requests.

Documentation

Module

Using wizardcalls from the command line
Using wizardcalls in a script

Template

Using the wizardcalls source code in your implant

Tutorials

Writing an injector with wizardcalls
Writing a compilation script for the injector with wizardcalls

Basic Usage

This section describes how wizardcalls can be used by developers. Wizardcalls offers two interfaces for developer usage, in a script & on the command line. The sections below provide a brief overview of both interfaces. See the linked documentation above for more inforamtion.

Command Line

After installation, developers can interact with wizardcalls from the commandline via the wizardcalls command. The image below shows the current options available for building the template. Wizardcalls only requires the --syscalls argument for usage. See the command line documentation for more information.

Scripting

Hashycalls offers an interface for developers to automate their implant's build routine via the WizardCalls object. More information can be found in the scipting documentation.

WizardCalls(
    syscalls                 = [ 'NtAllocateVirtualMemory','NtFreeVirtualMemory','NtWriteVirtualMemory','NtCreateThreadEx','NtWaitForSingleObject' ]
    , syscall_list_name      = 'pSyscallz'
    , hash_seed              = 10000
    , globals                = True
    , hash_algo              = 'djb2'
    , randomize_jump_address = True
    , debug                  = True
)