Crate dyncvoke_core 

PEB walking, export parsing, Tartarus Gate syscalls, and nt_* wrappers.

This is the default dyncvoke backend (feature = "syscall"). The usual entry points are syscall!, do_syscall!, resolve_syscall, get_module_base_address, and get_function_address.

Indirect syscalls:

1. resolve_syscall finds the ntdll stub, extracts the SSN (Hell’s / Halo’s / Tartarus Gate), and locates a syscall; ret gadget.
2. syscall! does that and dispatches in one step.
3. do_syscall! dispatches a cached (ssn, addr) pair with no extra resolution.

use dyncvoke_core::syscall;

let status = syscall!("NtClose", handle).unwrap() as i32;

Module lookup walks PEB->Ldr->InLoadOrderModuleList. It does not call EnumProcessModules or GetModuleHandle.

Re-exports

pub use sys::extract_ssn;

pub use sys::get_syscall_address;

pub use sys::resolve_syscall;

pub use sys::SyscallError;

Modules

peb

In-process PEB / LDR walk. Avoids EnumProcessModules / GetModuleBaseNameW.

sys

Tartarus Gate SSN resolution and syscall-instruction location.

Macros

do_syscallx86-64

Low-level escape hatch when you already have a resolved (ssn, addr).

dynamic_invoke

Dynamically calls an exported function from the specified module.

syscallx86-64

Resolve a Zw/Nt syscall by name (Tartarus Gate) and dispatch via the variadic Hell’s Hall gateway.

Structs

OBJECT_ATTRIBUTES

PROCESS_BASIC_INFORMATION

UNICODE_STRING

Constants

INVALID_HANDLE_VALUE

Functions

GetCurrentProcess^⚠

add_vectored_exception_handler

Dynamically calls AddVectoredExceptionHandler.

breakpoint_handler^⚠x86-64

This function acts as an Exception Handler, and should be combined with a hardware breakpoint.

call_module_entry_point

Calls the module’s entry point with the option DLL_ATTACH_PROCESS.

close_handle

Closes a HANDLE object.

create_file_a

Dynamically calls CreateFileA. On success, it returns a valid handle to the specified file. Otherwise, a null handle is returned.

create_file_mapping_w

Dynamically calls CreateFileMappingW.

do_syscall^⚠x86-64

Hell’s Hall variadic syscall dispatcher.

enum_process_modules

Dynamically calls EnumProcessModules.

fork

Call NtCreateUserProcess to fork the current process. Inheritable objects are inherited by the child process (PROCESS_CREATE_FLAGS_INHERIT_FROM_PARENT).

free_library

Frees the loaded dll. The function expects the module’s base address.

get_api_mapping

get_file_size

Dynamically calls GetFileSize. It returns either the specified file size (success) or 0 (an error ocurred).

get_function_address

Retrieves the address of an exported function from the specified module.

get_function_address_by_ordinal

Retrieves the address of an exported function from the specified module by its ordinal.

get_last_error

Read TEB.LastErrorValue (gs:[0x68] x64 / fs:[0x34] x86).

get_module_base_address

Retrieves the base address of a module loaded in the current process.

get_module_base_address_h

Hash-based module lookup. Pass the djb2 hash of the lowercased ascii name (compute via peb::hash_name). The plaintext never lands in .rdata.

get_module_base_name_w

Dynamically calls GetModuleBaseNameW.

get_module_file_name_ex_w

Dynamically calls GetModuleBaseNameW.

get_module_handle_ex_a

Dynamically calls GetModuleHandleExA.

get_system_info

Dynamically calls GetSystemInfo.

hook_function

Patch src_address with a trampoline to dst_address. Original bytes are stored so unhook_function can restore them.

ldr_get_procedure_address

Retrieves the address of an exported function from the specified module either by its name or by its ordinal number.

load_library_a

Dynamically calls LoadLibraryA.

load_library_a_tp

Uses the Thread Pool to call LoadLibraryA.

local_alloc

Dynamically calls LocalAlloc.

map_view_of_file

Dynamically calls MapViewOfFile.

nt_allocate_virtual_memoryx86-64

Dynamically calls NtAllocateVirtualMemory.

nt_create_section

Dynamically calls NtCreateSection.

nt_create_thread_exx86-64

Dynamically calls NtCreateThreadEx.

nt_create_user_process

Dynamically calls NtCreateUserProcess.

nt_map_view_of_section

Dynamically calls NtMapViewOfSection.

nt_open_file

Dynamically calls NtOpenFile.

nt_open_processx86-64

Dynamically calls NtOpenProcess.

nt_protect_virtual_memoryx86-64

Dynamically calls NtProtectVirtualMemory.

nt_query_information_file

Dynamically calls NtQueryInformationFile.

nt_query_information_process

Dynamically calls NtQueryInformationProcess.

nt_query_information_thread

Dynamically calls NtQueryInformationThread.

nt_read_virtual_memory

Dynamically calls NtReadVirtualMemory.

nt_sleep_millis

Block the current thread for ms milliseconds via NtDelayExecution.

nt_write_virtual_memoryx86-64

Dynamically calls NtWriteVirtualMemory.

open_process

Opens a HANDLE to a process.

open_thread

Opens a HANDLE to a thread.

rollback_transaction

Dynamically calls RollbackTransaction.

rtl_adjust_privilege

Dynamically calls RtlAdjustPrivilege.

rtl_init_unicode_string

Dynamically calls RtlInitUnicodeString.

rtl_zero_memory

Dynamically calls RtlZeroMemory.

set_hardware_breakpointx86-64

It sets a hardware breakpoint on a certain memory address.

set_unhandled_exception_filter

Dynamically calls SetUnhandledExceptionFilter.

tls_alloc

Dynamically calls TlsAlloc.

tls_get_value

Dynamically calls TlsGetValue.

tls_set_value

Dynamically calls TlsSetValue.

unhook_function

Restore bytes previously overwritten by hook_function.

unmap_view_of_file

Dynamically calls UnmapViewOfFile.

use_hardware_breakpointsx86-64

Enables or disables the use of exception handlers in combination with hardware breakpoints.

virtual_free

Dynamically calls VirtualFree.

virtual_query_ex

Dynamically calls VirtualQueryEx.

Type Aliases

HANDLE

HINSTANCE