# NimGetSyscallStub | Get Fresh Syscalls From A Fresh Ntdll.Dll Copy

**URL:** <https://onehack.st/t/nimgetsyscallstub-get-fresh-syscalls-from-a-fresh-ntdll-dll-copy/222483>\
**Category:** Tools & Scripts\
**Tags:** tools, programming, freebies\
**Created:** [August 14, 2022, 9:10pm UTC](https://onehack.st/t/nimgetsyscallstub-get-fresh-syscalls-from-a-fresh-ntdll-dll-copy/222483 "2022-08-14T21:10:35Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![NoBody](https://onehack.st/user_avatar/onehack.st/nobody/32/163880_2.png) [@NoBody](https://onehack.st/u/NoBody)\
**Post date:** [August 14, 2022, 9:10pm UTC](https://onehack.st/t/nimgetsyscallstub-get-fresh-syscalls-from-a-fresh-ntdll-dll-copy/222483/1 "2022-08-14T21:10:36Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/f/9/f97513da2b689cdb7ec0fac22021671cc4e65303.png)

# NimGetSyscallStub

Get fresh Syscalls from a fresh ntdll.dll copy. This code can be used as an alternative to the already published awesome tools [NimlineWhispers](https://github.com/ajpc500/NimlineWhispers) and [NimlineWhispers2](https://github.com/ajpc500/NimlineWhispers2) by [@ajpc500](https://twitter.com/ajpc500) or [ParallelNimcalls](https://github.com/frkngksl/ParallelNimcalls).

The advantage of grabbing Syscalls dynamically is, that the signature of the Stubs is not included in the file and you don’t have to worry about changing Windows versions.

To compile the shellcode execution template run the following:

```auto
nim c -d:release ShellcodeInject.nim

```

The result should look like this:

[![alt text](https://github.com/S3cur3Th1sSh1t/NimGetSyscallStub/raw/main/PoC.PNG)](https://github.com/S3cur3Th1sSh1t/NimGetSyscallStub/raw/main/PoC.PNG)

## GitHub:

> **[GitHub - S3cur3Th1sSh1t/NimGetSyscallStub: Get fresh Syscalls from a fresh ntdll.dll copy](https://github.com/S3cur3Th1sSh1t/NimGetSyscallStub)**
>
> Get fresh Syscalls from a fresh ntdll.dll copy