CLI Reference

Synopsis

sysplant [--debug | --verbose | --quiet] <command> [options]

Global output flags

Commands

sysplant list <path>

Scan all supported source files under <path> for Nt* and Zw* function names.

sysplant list ./src

Searches files with extensions: .h, .hpp, .c, .cpp, .nim, .rs

Returns the set of detected Windows native API function names — useful to build the exact -f list for generate.

sysplant generate [arch] [lang] [preset] [gate] [options]

Generate a syscall stub file.

Architecture flags (optional, default: x64)

Language flags (optional, default: -nim)

Syscall preset / function selection (mutually exclusive)

Scramble flag

Scrambling defeats static signature matching in binary analysis. Each generation with -x produces different internal symbol names. The public Nt* function names are not scrambled.

Output

If -o is omitted, the generated code is printed to stdout.

Gate (positional argument)

The gate selects the iterator and its default method. It is the last positional argument before any gate-specific options.

custom gate options

When using the custom gate, specify the iterator and method explicitly:

Examples

# C header — Canterlot's Gate — common preset
sysplant generate -c -o syscalls canterlot

# NIM output — SysWhispers3 — three specific functions
sysplant generate -nim -f NtOpenProcess,NtWriteVirtualMemory,NtCreateThreadEx \
    -o stubs syswhispers3

# C++ header — Halo's Gate — donut preset — scrambled symbols
sysplant generate -cpp -p donut -x -o donut_stubs halo

# Rust output — custom: canterlot iterator + egg_hunter method — all syscalls
sysplant generate -rust -p all -o full_stubs custom -i canterlot -m egg_hunter

# Print to stdout (no -o)
sysplant generate -c canterlot

# Scan for Nt* functions in a source tree
sysplant list ./implant/src

Real-world injection examples

Working injection examples (launching calc.exe as proof of concept) are provided in the example/ directory of the repository.

NIM

1. Install winim and checksums:

   nimble install winim checksums
   

2. Generate stubs:

   sysplant generate -o example/syscall canterlot
   

3. Compile:

   nim c -d=release -d=danger -d=strip --opt=size -d=mingw \
       --app=console --cpu=amd64 --out=inject.exe example/inject.nim
   

4. Transfer inject.exe to your Windows target.

C

1. Install mingw-w64: sudo apt install mingw-w64
2. Generate stubs:

   sysplant generate -c -o example/syscall canterlot
   

3. Compile:

   x86_64-w64-mingw32-gcc -Wall -s -static -masm=intel \
       example/inject.c -o inject.exe
   

4. Transfer inject.exe to your Windows target.

C++

1. Install mingw-w64: sudo apt install mingw-w64
2. Generate stubs:

   sysplant generate -cpp -o example/syscall canterlot
   

3. Compile:

   x86_64-w64-mingw32-g++ -Wall -s -static -masm=intel \
       example/inject.cpp -o inject.exe
   

4. Transfer inject.exe to your Windows target.

Rust

1. Install cross-compilation toolchain:

   rustup target add x86_64-pc-windows-gnu
   sudo apt install mingw-w64
   

2. Generate stubs:

   sysplant generate -rust -o example/rust-inject/src/syscall.rs canterlot
   

3. Compile:

   cd example/rust-inject
   cargo build --release --target x86_64-pc-windows-gnu
   

4. Transfer the .exe from target/x86_64-pc-windows-gnu/release/ to your Windows target.