callghost 0.1.0

Direct syscall framework for Rust on Windows x86_64. Bypasses usermode API hooks (EDR/AV) via multiple methods.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

use callghost::syscall;

const MEM_COMMIT: u32 = 0x1000;
const MEM_RESERVE: u32 = 0x2000;
const MEM_RELEASE: u32 = 0x8000;
const PAGE_READWRITE: u32 = 0x04;

fn alloc_and_free(label: &str, base: &mut *mut core::ffi::c_void, size: &mut usize, status: i32) {
    println!("  [{label}] NtAllocateVirtualMemory: 0x{:08X}  base={:p}  size={}", status as u32, *base, *size);
    assert_eq!(status, 0, "{label} alloc failed");
    assert!(!base.is_null());

    unsafe { *((*base) as *mut u32) = 0xDEADBEEF; }

    let mut fs: usize = 0;
    let s = syscall!(NtFreeVirtualMemory, -1isize, base, &mut fs, MEM_RELEASE);
    println!("  [{label}] NtFreeVirtualMemory:     0x{:08X}", s as u32);
    assert_eq!(s, 0, "{label} free failed");
}

fn main() {
    println!("CallGhost - Direct Syscall Framework");
    println!("====================================\n");

    // Direct
    let (mut base, mut size): (*mut core::ffi::c_void, usize) = (core::ptr::null_mut(), 4096);
    let s = syscall!(direct, NtAllocateVirtualMemory, -1isize, &mut base, 0usize, &mut size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    alloc_and_free("direct", &mut base, &mut size, s);

    // Indirect
    base = core::ptr::null_mut(); size = 4096;
    let s = syscall!(indirect, NtAllocateVirtualMemory, -1isize, &mut base, 0usize, &mut size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    alloc_and_free("indirect", &mut base, &mut size, s);

    // Perun's Fart
    base = core::ptr::null_mut(); size = 4096;
    let s = syscall!(perunsfart, NtAllocateVirtualMemory, -1isize, &mut base, 0usize, &mut size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    alloc_and_free("perunsfart", &mut base, &mut size, s);

    println!("\nAll methods working.");
}