Fixing direct syscall to use new format#795
Merged
bwatters-r7 merged 5 commits intorapid7:masterfrom Apr 3, 2026
Merged
Conversation
Contributor
|
@jbx81-1337 what versions of Windows does this support? I gaether the best test is t get a Meterpreter session, then try to migrate? |
Contributor
Author
|
It should be supporting everything we currently support |
Contributor
Author
|
@bwatters-r7 This should be ready for review / testing |
Contributor
|
Windows 10 x86 1511 |
Contributor
|
I finished testing x86 targets. The only failure is Windows 2003x86. I tried to migrate as |
Contributor
|
I've verified this works on the following x64 builds: Win 11x64 24H2, 25H2, and 26H1 all crash after establishing a session without calling migrate. Tomorrow, I'll look into that and see if there's an issue with Defending being a lying jerk of a liar about being turned off. |
Contributor
|
We are waiting to land this to a temporary branch, correct? |
Contributor
|
@bwatters-r7 the fix i did now should fix the issue you were having. this should disable direct syscalls for systems before 6.1, meaning in theory we can land this to master. you call if you want me to point it to 6.5 just to be more in "peace". I would probably prefer have it in 6.5 as this give us marginally more flexibility research wise, also for future PRs |
There was a problem hiding this comment.
Pull request overview
Updates Meterpreter’s Windows direct-syscall integration to use the newer SyscallStub calling format, and adds an OS-version-based gate (via RtlGetVersion) before enabling direct syscalls.
Changes:
- Switch direct-syscall wrappers to pass an argument array + arg count into the new
SyscallStubsignature. - Add
winapi_ntdll_RtlGetVersionand expose it via theWinApi/MetApifunction table. - Add a Windows version check in
hasDirectSyscallSupport()before initializing/using direct syscalls.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| c/meterpreter/source/metsrv/winapi.h | Exposes winapi_ntdll_RtlGetVersion prototype. |
| c/meterpreter/source/metsrv/winapi.c | Updates syscall wrapper calling convention; adds version detection + gating; implements RtlGetVersion resolver. |
| c/meterpreter/source/metsrv/metapi.c | Extends the exported WinApi ntdll function table initialization to include RtlGetVersion. |
| c/meterpreter/source/common/common_winapi.h | Extends WinApiNtdll with RtlGetVersion function pointer. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Christophe De La Fuente <christophe_delafuente@rapid7.com>
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
related to: rapid7/ReflectiveDLLInjection#21