InlineWhispers3 is an updated version of InlineWhispers2, designed to work with Indirect System Calls in Cobalt Strike's Beacon Object Files (BOFs) using SysWhispers3. This tool helps changing SysWhispers3 generated files to be BOF compatible.

How to set this up and run this?

At the moment of writing this, the latest SysWhispers3 commit is 31cfc93, from Dec 23, 2023

# Clone the repo to your device
git clone https://github.com/tdeerenberg/InlineWhispers3
cd InlineWhispers3

# Generate stubs with SysWhispers3
cd SysWhispers3/
python3 syswhispers.py -p all -a x64 -m jumper -o syscalls_all

# Make SysWhispers3 output BOF compatible
cd ..
python3 InlineWhispers3.py --aio

This generates the required syscalls.c/h files and then runs InlineWhispers3 to make the files compatible with BOFs.

The --aio flag is optional and merges all output files into one .h file, which can also be used instead of using syscalls.c, syscalls.h, and syscalls-asm.h

How to use indirect syscalls in your BOF

Import syscalls.h, syscalls.c, and syscalls-asm.h (or only syscalls-aio.h) in your project and include syscalls.c (or syscalls-aio.h) in your C code to start using syscalls.

An example BOF for reference (creates a new process using NtCreateProcessEx):

#include <windows.h>
#include "beacon.h"
#include "syscalls.c"

void go(char* args, int length) {
    HANDLE hProcess;
    OBJECT_ATTRIBUTES oa = {sizeof(oa)};

    NTSTATUS status = Sw3NtCreateProcessEx(&hProcess, PROCESS_ALL_ACCESS, &oa, 
        (HANDLE)(LONG_PTR)-1, 0, NULL, NULL, NULL, 0);

    if (status == 0) {
        BeaconPrintf(CALLBACK_OUTPUT, "[+] NtCreateProcessEx successful");
    } else {
        BeaconPrintf(CALLBACK_ERROR, "[-] NtCreateProcessEx failed: 0x%X\n", status);
        return;
    }
}

Credits

@klezVirus for SysWhispers3
@Sh0ckFR for InlineWhispers2
@outflanknl for the first version of InlineWhispers and their informative blog post about it
The Cyber Security Community for all the articles and resources