Skip to content

Commit 6719656

Browse files
authored
Merge pull request #2 from micREsoft/development
Merge 'development' branch with 'master' branch
2 parents 920b9d1 + 59952ac commit 6719656

70 files changed

Lines changed: 1327 additions & 744 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.github/workflows/build.yml

Lines changed: 172 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,172 @@
1+
name: "Build Allycs v2.0.0"
2+
3+
permissions:
4+
contents: write
5+
packages: write
6+
7+
on:
8+
push:
9+
branches: [ main, master ]
10+
pull_request:
11+
branches: [ main, master ]
12+
workflow_dispatch:
13+
14+
jobs:
15+
build:
16+
runs-on: windows-latest
17+
18+
steps:
19+
- name: Checkout Code
20+
uses: actions/checkout@v4
21+
22+
- name: Setup MSBuild
23+
uses: microsoft/setup-msbuild@v1.3
24+
25+
- name: Setup vcpkg
26+
uses: lukka/run-vcpkg@v11
27+
with:
28+
vcpkgDirectory: '${{ github.workspace }}/vcpkg'
29+
vcpkgGitCommitId: '7e19f3c64cb636ee21f41bfe8558a6dfaae6236f'
30+
vcpkgJsonGlob: 'vcpkg.json'
31+
runVcpkgInstall: '--triplet=x64-windows-static --x-wait-for-lock'
32+
33+
- name: Set Vcpkg Environment
34+
run: |
35+
echo "VCPKG_ROOT=${{ github.workspace }}/vcpkg" >> $env:GITHUB_ENV
36+
echo "VcpkgRoot=${{ github.workspace }}/vcpkg" >> $env:GITHUB_ENV
37+
echo "VCPKG_DEFAULT_TRIPLET=x64-windows-static" >> $env:GITHUB_ENV
38+
echo "CMAKE_WARN_UNUSED_CLI_VARS=OFF" >> $env:GITHUB_ENV
39+
echo "VCPKG_CMAKE_CONFIGURE_OPTIONS=-DCMAKE_WARN_UNUSED_CLI_VARS=OFF" >> $env:GITHUB_ENV
40+
41+
- name: Setup Vcpkg Binary Caching
42+
uses: actions/cache@v4
43+
with:
44+
path: |
45+
${{ github.workspace }}/vcpkg/installed
46+
${{ github.workspace }}/vcpkg/packages
47+
key: vcpkg-${{ hashFiles('**/vcpkg.json') }}-${{ runner.os }}-x64-windows-static
48+
restore-keys: |
49+
vcpkg-${{ hashFiles('**/vcpkg.json') }}-${{ runner.os }}-
50+
vcpkg-${{ runner.os }}-
51+
52+
- name: Integrate Vcpkg with MSBuild
53+
run: |
54+
& "${{ github.workspace }}/vcpkg/vcpkg.exe" integrate install
55+
56+
- name: Verify SysCaller Dependencies
57+
run: |
58+
Write-Host "Checking SysCaller dependencies..."
59+
60+
# Check if SysCaller.lib exists
61+
if (Test-Path "sdk\SysCaller\lib\SysCaller.lib") {
62+
Write-Host "SysCaller.lib found!"
63+
Get-Item "sdk\SysCaller\lib\SysCaller.lib" | Select-Object Name, Length, LastWriteTime
64+
} else {
65+
Write-Host "SysCaller.lib not found!"
66+
exit 1
67+
}
68+
69+
# Check if SysCaller headers exist
70+
if (Test-Path "sdk\SysCaller\include\syscaller.h") {
71+
Write-Host "SysCaller headers found!"
72+
} else {
73+
Write-Host "SysCaller headers not found!"
74+
exit 1
75+
}
76+
77+
# Check if SysCaller.dll exists (for runtime)
78+
if (Test-Path "sdk\SysCaller\lib\SysCaller.dll") {
79+
Write-Host "SysCaller.dll found!"
80+
} else {
81+
Write-Host "SysCaller.dll not found, this is needed at runtime!"
82+
}
83+
84+
- name: Build Solution (Release x64)
85+
run: |
86+
Write-Host "Building Release x64..."
87+
Write-Host "VcpkgRoot: $env:VcpkgRoot"
88+
Write-Host "VCPKG_ROOT: $env:VCPKG_ROOT"
89+
90+
msbuild "Allycs.sln" /p:Configuration=Release /p:Platform=x64 /p:VcpkgEnabled=true /p:VcpkgEnableManifest=true /p:VcpkgUseStatic=true /p:VcpkgTriplet=x64-windows-static /p:VcpkgRoot="$env:VcpkgRoot"
91+
92+
- name: Copy SysCaller DLL (Release)
93+
run: |
94+
Write-Host "Copying SysCaller.dll for Release build..."
95+
$outputDir = "build\x64\Release"
96+
97+
if (Test-Path "sdk\SysCaller\lib\SysCaller.dll") {
98+
Copy-Item "sdk\SysCaller\lib\SysCaller.dll" $outputDir
99+
Write-Host "Copied SysCaller.dll to Release build"
100+
} else {
101+
Write-Host "SysCaller.dll not found. Allycs will not run properly!"
102+
}
103+
104+
- name: Verify Executables Exist
105+
run: |
106+
$releaseExists = Test-Path "build\x64\Release\Allycs.exe"
107+
108+
if ($releaseExists) {
109+
Write-Host "Allycs.exe (Release) Built Successfully!"
110+
Get-Item "build\x64\Release\Allycs.exe" | Select-Object Name, Length, LastWriteTime
111+
} else {
112+
Write-Host "Allycs.exe (Release) not found!"
113+
Get-ChildItem -Recurse -Name "*.exe" | ForEach-Object { Write-Host "Found: $_" }
114+
exit 1
115+
}
116+
117+
- name: List Build Directory Contents
118+
run: |
119+
Write-Host "Build Directory Contents:"
120+
if (Test-Path "build\x64\Release") {
121+
Write-Host "Release Directory:"
122+
Get-ChildItem "build\x64\Release" | Select-Object Name, Length, LastWriteTime
123+
}
124+
125+
- name: Upload Build Artifacts (Release)
126+
uses: actions/upload-artifact@v4
127+
with:
128+
name: "Allycs-v2.0.0"
129+
path: build/x64/Release/
130+
retention-days: 30
131+
132+
- name: Create Release Package
133+
if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master')
134+
run: |
135+
$version = "v2.0.0"
136+
$zipName = "Allycs-$version.zip"
137+
138+
New-Item -ItemType Directory -Path "release-package" -Force
139+
140+
# Copy Release files
141+
Copy-Item "build\x64\Release\Allycs.exe" "release-package\"
142+
Copy-Item "build\x64\Release\SysCaller.dll" "release-package\"
143+
144+
# Create the zip file
145+
Compress-Archive -Path "release-package\*" -DestinationPath $zipName -Force
146+
147+
Write-Host "Created Release Package: $zipName"
148+
Get-Item $zipName | Select-Object Name, Length
149+
150+
- name: Upload Release Package
151+
if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master')
152+
uses: actions/upload-artifact@v4
153+
with:
154+
name: "Release v2.0.0"
155+
path: Allycs-v2.0.0.zip
156+
retention-days: 90
157+
158+
- name: Create GitHub Release
159+
if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master')
160+
uses: softprops/action-gh-release@v1
161+
with:
162+
tag_name: v2.0.0
163+
name: "Allycs v2.0.0"
164+
body: |
165+
## Allycs v2.0.0
166+
167+
**Build Date:** ${{ github.event.head_commit.timestamp }}
168+
**Commit:** ${{ github.sha }}
169+
**Platform:** Windows x64 (64-bit)
170+
files: Allycs-v2.0.0.zip
171+
env:
172+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Allycs.vcxproj

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<?xml version="1.0" encoding="utf-8"?>
1+
<?xml version="1.0" encoding="utf-8"?>
22
<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
33
<ItemGroup Label="ProjectConfigurations">
44
<ProjectConfiguration Include="Debug|Win32">
@@ -126,18 +126,19 @@
126126
<WarningLevel>Level3</WarningLevel>
127127
<Optimization>Disabled</Optimization>
128128
<PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
129-
<AdditionalIncludeDirectories>GeneratedFiles\$(ConfigurationName);GeneratedFiles;C:\Users\devil\source\repos\Allycs\sdk\SysCaller\include;C:\Users\devil\source\repos\Allycs\src\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
129+
<AdditionalIncludeDirectories>$(PROJECTDIR)sdk\SysCaller\include;$(PROJECTDIR)src\include;$(VCPKG_ROOT)\installed\x64-windows-static\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
130130
<MultiProcessorCompilation>true</MultiProcessorCompilation>
131131
<LanguageStandard>stdcpp20</LanguageStandard>
132132
<RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
133133
<WholeProgramOptimization>false</WholeProgramOptimization>
134+
<DisableSpecificWarnings>4005</DisableSpecificWarnings>
134135
</ClCompile>
135136
<Link>
136137
<SubSystem>Windows</SubSystem>
137138
<GenerateDebugInformation>true</GenerateDebugInformation>
138-
<AdditionalDependencies>SysCaller.lib;%(AdditionalDependencies)</AdditionalDependencies>
139+
<AdditionalDependencies>SysCaller.lib;distorm.lib;tinyxml2.lib;%(AdditionalDependencies)</AdditionalDependencies>
139140
<AdditionalManifestDependencies>type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='*' publicKeyToken='6595b64144ccf1df' </AdditionalManifestDependencies>
140-
<AdditionalLibraryDirectories>C:\Users\devil\source\repos\Allycs\sdk\SysCaller\lib;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
141+
<AdditionalLibraryDirectories>$(PROJECTDIR)sdk\SysCaller\lib;$(VCPKG_ROOT)\installed\x64-windows-static\lib;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
141142
</Link>
142143
</ItemDefinitionGroup>
143144
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
@@ -179,23 +180,24 @@
179180
<IntrinsicFunctions>true</IntrinsicFunctions>
180181
<PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
181182
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
182-
<AdditionalIncludeDirectories>GeneratedFiles\$(ConfigurationName);GeneratedFiles;C:\Users\devil\source\repos\Allycs\sdk\SysCaller\include;C:\Users\devil\source\repos\Allycs\src\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
183+
<AdditionalIncludeDirectories>$(PROJECTDIR)sdk\SysCaller\include;$(PROJECTDIR)src\include;$(VCPKG_ROOT)\installed\x64-windows-static\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
183184
<MinimalRebuild>false</MinimalRebuild>
184185
<LanguageStandard>stdcpp20</LanguageStandard>
185186
<MultiProcessorCompilation>true</MultiProcessorCompilation>
187+
<DisableSpecificWarnings>4005</DisableSpecificWarnings>
186188
</ClCompile>
187189
<Link>
188190
<SubSystem>Windows</SubSystem>
189191
<EnableCOMDATFolding>true</EnableCOMDATFolding>
190192
<OptimizeReferences>true</OptimizeReferences>
191-
<AdditionalDependencies>SysCaller.lib;%(AdditionalDependencies)</AdditionalDependencies>
193+
<AdditionalDependencies>SysCaller.lib;distorm.lib;tinyxml2.lib;%(AdditionalDependencies)</AdditionalDependencies>
192194
<AdditionalManifestDependencies>type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='*' publicKeyToken='6595b64144ccf1df' </AdditionalManifestDependencies>
193195
<EntryPointSymbol>
194196
</EntryPointSymbol>
195197
<ModuleDefinitionFile>
196198
</ModuleDefinitionFile>
197199
<GenerateMapFile>false</GenerateMapFile>
198-
<AdditionalLibraryDirectories>C:\Users\devil\source\repos\Allycs\sdk\SysCaller\lib;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
200+
<AdditionalLibraryDirectories>$(PROJECTDIR)sdk\SysCaller\lib;$(VCPKG_ROOT)\installed\x64-windows-static\lib;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
199201
<GenerateDebugInformation>false</GenerateDebugInformation>
200202
</Link>
201203
</ItemDefinitionGroup>
@@ -234,6 +236,10 @@
234236
<ClCompile Include="src\core\TreeImportExport.cpp" />
235237
</ItemGroup>
236238
<ItemGroup>
239+
<ClInclude Include="sdk\SysCaller\include\Resolver\PebUtils.h" />
240+
<ClInclude Include="sdk\SysCaller\include\Resolver\Resolver.h" />
241+
<ClInclude Include="sdk\SysCaller\include\Resolver\ResolverBase.h" />
242+
<ClInclude Include="sdk\SysCaller\include\syscaller_config.h" />
237243
<ClInclude Include="src\app\resource.h" />
238244
<ClInclude Include="src\include\gui\AboutGui.h" />
239245
<ClInclude Include="src\include\core\ApiReader.h" />
@@ -300,4 +306,4 @@
300306
<UserProperties RESOURCE_FILE="MainGui.rc" />
301307
</VisualStudio>
302308
</ProjectExtensions>
303-
</Project>
309+
</Project>

README.md

Lines changed: 41 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,15 @@
55

66
## About
77

8-
**Allycs** is a modernized Scylla rebuild using [SysCaller](https://github.com/SysCallerSDK/SysCaller) for native syscall powered PE import reconstruction. It avoids traditional API hooks by directly invoking syscalls, making it useful for stealthy dumping.
8+
**Allycs** is a modernized Scylla rebuild using [SysCaller](https://github.com/SysCallerSDK/SysCaller) for native syscall powered PE import reconstruction. It avoids traditional API hooks by invoking syscalls through indirect calls, making it useful for stealthy dumping.
99

1010
---
1111

1212
## Features
1313

1414
Whats new:
1515
- (SysCaller only supports x64)
16-
- Native syscall usage (WinAPI-less execution)
16+
- Native syscall usage via indirect calls (WinAPI-less execution)
1717
- Added "Dont Compact Raw Data"
1818
- Removed alot of bloat
1919
- Powered by [SysCaller SDK](https://github.com/SysCallerSDK/SysCaller)
@@ -41,51 +41,51 @@ vcpkg install distorm:x64-windows-static tinyxml2:x64-windows-static wtl:x64-win
4141

4242
### Step 1. Build Requires Syscalls via SysCaller
4343

44-
1. Download and open the [Bind.exe](https://github.com/micREsoft/SysCaller/releases) (PY BuildTools are deprecated)
44+
1. Download and open the [Bind.exe](https://github.com/micREsoft/SysCaller/releases) (PY BuildTools are deprecated)
4545

46-
2. Ensure the following syscall stubs are selected under the Integrity Tab:
46+
2. Go to settings and under the "General" tab there should be the following sections "Bindings, Syscall Mode". Under those sections enable Bindings and Indirect Syscall Mode.
47+
48+
> Allycs now uses indirect syscalls! If you want to go back to using direct syscalls or inline syscalls you will have to modify the source code.
49+
50+
> Indirect syscalls provide better stability across Windows versions by dynamically resolving syscall numbers at runtime, avoiding hardcoded syscall numbers that change between Windows builds.
51+
52+
3. Ensure the following syscall stubs are selected under the Integrity Tab:
4753

4854
```plaintext
49-
SysAllocateVirtualMemoryEx
50-
SysClose
51-
SysCreateSection
52-
SysCreateThreadEx
53-
SysDuplicateObject
54-
SysFreeVirtualMemory
55-
SysGetContextThread
56-
SysMapViewOfSection
57-
SysOpenProcess
58-
SysOpenSymbolicLinkObject
59-
SysOpenThread
60-
SysProtectVirtualMemory
61-
SysQueryInformationFile
62-
SysQueryInformationProcess
63-
SysQueryInformationThread
64-
SysQueryObject
65-
SysQuerySymbolicLinkObject
66-
SysQuerySystemInformation
67-
SysQueryVirtualMemory
68-
SysResumeProcess
69-
SysResumeThread
70-
SysSetContextThread
71-
SysSetInformationThread
72-
SysSuspendProcess
73-
SysSuspendThread
74-
SysTerminateProcess
75-
SysUnmapViewOfSection
76-
SysWriteVirtualMemory
55+
SysIndirectAllocateVirtualMemoryEx
56+
SysIndirectClose
57+
SysIndirectCreateThreadEx
58+
SysIndirectFreeVirtualMemory
59+
SysIndirectOpenProcess
60+
SysIndirectOpenSymbolicLinkObject
61+
SysIndirectProtectVirtualMemory
62+
SysIndirectQueryInformationProcess
63+
SysIndirectQuerySymbolicLinkObject
64+
SysIndirectQuerySystemInformation
65+
SysIndirectQueryVirtualMemory
66+
SysIndirectResumeProcess
67+
SysIndirectSetInformationThread
68+
SysIndirectSuspendProcess
69+
SysIndirectTerminateProcess
70+
SysIndirectUnmapViewOfSection
7771
```
7872

79-
3. After that run the Validation/Compatibility checks.
80-
81-
4. **Important**: When building SysCaller use the default (non obfuscated) stubs in Release mode.
73+
5. **Important**: When building SysCaller use the default (non obfuscated) stubs in Release mode.
8274
Obfuscated stubs currently work only in Debug mode, due to unresolved configuration conflicts in Allycs.
8375

84-
5. Now open SysCaller.sln via Visual Studio 2022
76+
6. Now open SysCaller.sln via Visual Studio 2022
8577

86-
6. Set build to `Release` if using default stubs, `Debug` if using obfuscated stubs, and C++ standard to **C++20** (If not already)
78+
7. Set build to `Release` if using default stubs, `Debug` if using obfuscated stubs, C++ standard to **C++20**, and set the output to .dll (If not already)
79+
80+
8. Go to syscaller_config.h and make sure the following are uncommented and set as preprocessor defs:
81+
82+
```cpp
83+
#define SYSCALLER_INDIRECT
84+
#define SYSCALLER_BINDINGS
85+
#define SYSCALLER_RESOLVER_PEB_LDR
86+
```
8787

88-
7. Build the project to generate `SysCaller.lib`
88+
9. Build the project to generate `SysCaller.dll` and `SysCaller.lib`
8989

9090
---
9191

@@ -95,6 +95,7 @@ Obfuscated stubs currently work only in Debug mode, due to unresolved configurat
9595

9696
```
9797
SysCaller.lib → sdk/SysCaller/lib
98+
SysCaller.dll → path/to/exe
9899
SysFunctions.h → sdk/SysCaller/include/Sys
99100
```
100101
@@ -103,7 +104,7 @@ Obfuscated stubs currently work only in Debug mode, due to unresolved configurat
103104
### Step 3. Build Allycs
104105
105106
- Open `Allycs.sln` in Visual Studio 2022
106-
- Set to `x64` & `Release` Mode if not already
107+
- Set to `x64` & `Release` Mode (if not using obfuscated stubs )
107108
- Build the `Allycs` project
108109
- Output binary: `build\x64\Release\Allycs.exe`
109110
@@ -179,4 +180,4 @@ The author assumes no responsibility for any misuse or damage caused by this sof
179180

180181
<p align="center">
181182
<i>Built on the foundation of Scylla. Reinforced with native syscalls.</i>
182-
</p>
183+
</p>

0 commit comments

Comments
 (0)