dyncvoke-core 0.1.1

PEB walking, dynamic invoke, and Tartarus Gate indirect syscalls for Dyncvoke
Documentation
  • Coverage
  • 73.53%
    75 out of 102 items documented4 out of 72 items with examples
  • Size
  • Source code size: 138.92 kB This is the summed size of all the files inside the crates.io package for this release.
  • Documentation size: 1.18 MB This is the summed size of all files generated by rustdoc for all configured targets
  • Ø build duration
  • this release: 3s Average build duration of successful builds.
  • all releases: 3s Average build duration of successful builds in releases after 2024-10-23.
  • Links
  • Homepage
  • Repository
  • crates.io
  • Dependencies
  • Versions
  • Owners
  • Whitecat18

PEB walking, export parsing, Tartarus Gate syscalls, and nt_* wrappers.

This is the default dyncvoke backend (feature = "syscall"). The usual entry points are [syscall!], [do_syscall!], [resolve_syscall], [get_module_base_address], and [get_function_address].

Indirect syscalls:

  1. [resolve_syscall] finds the ntdll stub, extracts the SSN (Hell's / Halo's / Tartarus Gate), and locates a syscall; ret gadget.
  2. [syscall!] does that and dispatches in one step.
  3. [do_syscall!] dispatches a cached (ssn, addr) pair with no extra resolution.
use dyncvoke_core::syscall;

let status = syscall!("NtClose", handle).unwrap() as i32;

Module lookup walks PEB->Ldr->InLoadOrderModuleList. It does not call EnumProcessModules or GetModuleHandle.