Architecture Support

Platform and compiler compatibility for x64, x86, WoW64, ARM64, and various toolchains

Supported Architectures

SysWhispers4 supports 4 different processor architectures with varying feature sets across Windows platforms:

x64

64-bit x86-64. Full feature support. Default target.

x86

32-bit x86. Embedded + Egg Hunt only.

WoW64

32-bit process on 64-bit Windows. Heaven’s Gate transition.

ARM64

Windows on ARM (Snapdragon). Embedded method only.

Architecture Comparison

Architecture	Syscall Instruction	SSN Register	Invocation Methods	Resolution Methods
x64	syscall	eax	All 4	All 8
x86	sysenter / int 2Eh	eax	Embedded, Egg	Static, Hell’s Gate, Halo’s Gate
WoW64	syscall (64-bit)	eax	All 4	All 8
ARM64	svc #0	w8	Embedded only	Static only

x64 is the recommended and most feature-complete platform. All advanced techniques (randomized indirect, RecycledGate, hardware breakpoints, etc.) are x64-only.

x64: Full Feature Set

The primary target platform with complete support for all SysWhispers4 capabilities.

Syscall Mechanics

; x64 syscall stub:
mov r10, rcx               ; Windows x64 fastcall: arg1 in rcx → r10
mov eax, 0x18              ; SSN for NtAllocateVirtualMemory
syscall                    ; Transition to kernel (RCX preserved)
ret

Key characteristics:

• Uses AMD64/Intel64 syscall instruction (0F 05)
• SSN in eax register
• Arguments in rcx, rdx, r8, r9 (fastcall) → kernel expects r10, rdx, r8, r9
• Return value in rax (NTSTATUS)

Invocation Method Support

Method	x64 Support	Notes
Embedded	✅ Full	Direct syscall in your code
Indirect	✅ Full	Jumps to ntdll syscall;ret gadgets
Randomized	✅ Full	Pool of 64 gadgets, RDTSC entropy
Egg Hunt	✅ Full	Runtime egg replacement

Resolution Method Support

Method	x64 Support	Notes
Static	✅ Full	Embedded j00ru table
Hell’s Gate	✅ Full	Opcode parsing from ntdll
Halo’s Gate	✅ Full	Neighbor scan ±8 stubs
Tartarus’ Gate	✅ Full	Hook detection + ±16 scan
FreshyCalls	✅ Full	Sort by VA (default)
SyscallsFromDisk	✅ Full	Clean ntdll from \KnownDlls\
RecycledGate	✅ Full	FreshyCalls + validation
HW Breakpoint	✅ Full	DR registers + VEH

Usage

# Default is x64:
python syswhispers.py --preset common

# Explicit x64:
python syswhispers.py --preset injection --arch x64

x86: 32-bit Legacy

32-bit x86 Windows support with limited feature set.

Syscall Mechanics

; x86 syscall stub (Windows XP–7):
mov eax, 0x18              ; SSN
mov edx, 0x7FFE0300        ; SharedUserData!SystemCallStub
call DWORD PTR [edx]       ; Indirect call to sysenter or int 2Eh
ret

; x86 modern (Windows 8+):
mov eax, 0x18
call DWORD PTR fs:[0xC0]   ; TEB.WOW32Reserved → syscall dispatcher
ret

Key characteristics:

• Varies by Windows version (int 2Eh → sysenter → hybrid)
• SSN in eax
• Arguments on stack (stdcall)
• Less reliable than x64 due to Windows version variance

Limited Support

x86 support is limited to basic invocation methods. Advanced techniques (indirect, randomized, advanced resolution) are x64-only.

Feature Category	x86 Support
Invocation	Embedded, Egg Hunt only
Resolution	Static, Hell’s Gate, Halo’s Gate only
Obfuscation	✅ Full
Evasion helpers	✅ Full (ETW, AMSI, unhooking, etc.)

Usage

python syswhispers.py --preset common --arch x86

WoW64: 32-bit on 64-bit Windows

32-bit process running on 64-bit Windows kernel. Uses Heaven’s Gate to switch to 64-bit mode and execute native 64-bit syscalls.

How Heaven’s Gate Works

; WoW64 stub (32-bit code transitioning to 64-bit):
push 0x33                  ; 64-bit code segment
call $+5                   ; Get EIP
add DWORD PTR [esp], 5     ; Calculate 64-bit entry
retf                       ; Far return → switch to 64-bit mode

; Now in 64-bit mode:
mov r10d, ecx              ; 64-bit registers available
mov eax, 0x18              ; SSN
syscall                    ; 64-bit syscall
retf                       ; Return to 32-bit mode

Benefits:

• Bypasses WoW64 translation layer (wow64.dll, wow64cpu.dll)
• Direct 64-bit syscalls from 32-bit process
• Full x64 feature set available

WoW64 mode gives you all x64 capabilities (indirect, randomized, RecycledGate, etc.) from a 32-bit PE. Useful for legacy compatibility with modern evasion.

Usage

python syswhispers.py --preset injection --arch wow64

ARM64: Windows on ARM

Windows 11 on ARM64 processors (Snapdragon, M1 via emulation, etc.).

Syscall Mechanics

; ARM64 syscall stub:
mov w8, #0x18              ; SSN in w8 register
svc #0                     ; Supervisor call (syscall equivalent)
ret

Key characteristics:

• Uses ARM64 svc #0 instruction (Supervisor Call)
• SSN in w8 register (32-bit subset of x8)
• Arguments in x0–x7 (ARM64 calling convention)
• Limited toolchain support (MSVC ARM64 only)

Limited Support

ARM64 support is experimental and limited to static embedded syscalls only. No dynamic resolution or advanced invocation methods.

Feature	ARM64 Support
Invocation	Embedded only
Resolution	Static table only
Compiler	MSVC ARM64 only
Obfuscation	❌ Not supported
Evasion helpers	❌ Not supported

Usage

python syswhispers.py --preset common --arch arm64 --resolve static --method embedded

Compiler Support

SysWhispers4 supports 3 compiler toolchains with different assembly syntax requirements:

MSVC

Microsoft Visual Studio. MASM syntax. Default.

MinGW

GCC for Windows. GAS inline assembly.

Clang

LLVM Clang. GAS inline assembly.

MSVC (Microsoft Visual Studio)

Assembly format: MASM (Microsoft Macro Assembler)

Generated files:

• SW4Syscalls.asm — standalone ASM file

Build setup:

1. Add all files to Visual Studio project
2. Project → Build Customizations → masm (.targets) ✅
3. Build normally

Usage:

python syswhispers.py --preset common --compiler msvc

MinGW / GCC

Assembly format: GAS (GNU Assembler) inline assembly in C

Generated files:

• SW4Syscalls_stubs.c — GAS __asm__ blocks

Build:

x86_64-w64-mingw32-gcc -masm=intel \
    example.c SW4Syscalls.c SW4Syscalls_stubs.c \
    -o example.exe -lntdll

Usage:

python syswhispers.py --preset common --compiler mingw

Clang

Assembly format: GAS inline assembly (same as MinGW)

Build:

clang -target x86_64-pc-windows-gnu -masm=intel \
    example.c SW4Syscalls.c SW4Syscalls_stubs.c \
    -o example.exe -lntdll

Usage:

python syswhispers.py --preset common --compiler clang

Cross-Compilation Matrix

Compiler	x64	x86	WoW64	ARM64
MSVC	✅	✅	✅	✅
MinGW	✅	✅	✅	❌
Clang	✅	✅	✅	⚠️ Experimental

For maximum compatibility, use MSVC on x64. This combination supports all features and is the most tested.

Choosing the Right Architecture

When to Use x64

• Modern Windows systems (Windows 10/11, Server 2016+)
• Maximum feature set required (indirect, randomized, RecycledGate)
• Production red team tools
• Default choice for most use cases

When to Use x86

• Legacy Windows systems (XP, Vista, 7)
• 32-bit-only environments
• Simple embedded syscalls sufficient

When to Use WoW64

• 32-bit PE required for compatibility (legacy apps, DLL injection)
• x64 evasion features needed from 32-bit context
• Hybrid environments (32-bit payload on 64-bit system)

When to Use ARM64

• Windows on ARM devices (Surface Pro X, etc.)
• Testing/research only (limited production use)
• Static syscalls sufficient (no advanced features needed)

Platform Limitations Summary

Limitation	Affected Architectures	Workaround
No indirect invocation	x86, ARM64	Use x64 or WoW64
No dynamic resolution	ARM64	Use static table
No obfuscation	ARM64	Use x64
Compiler-specific syntax	All	Use --compiler flag
MASM build configuration	MSVC (all arch)	Enable in project settings

Learn More

Invocation Methods

Detailed comparison of embedded, indirect, randomized, and egg hunt techniques.

SSN Resolution Methods

Overview of all 8 syscall number resolution strategies.

Command Reference

Complete CLI documentation including --arch and --compiler flags.

Integration Guides

Step-by-step integration for MSVC, MinGW, and Clang toolchains.