Windows NT x64 syscall fuzzer
NTCALL64 is a syscall fuzzer for 64-bit Windows NT 6+ (Windows 7 and later), based on the original NtCall by Peter Kosyh.
Its purpose is to port and extend the functionality of NtCall for x64 Windows, enabling researchers to fuzz system call tables (ntoskrnl and optionally win32k) for vulnerabilities and stability issues.
ntcall64.exe -help [-win32k] [-log [-o ]] [-call Id] [-pc Value] [-wt Value] [-sc Value] [-s] [-h]Options:
| Option | Description |
|---|---|
-help |
Show help information |
-win32k |
Fuzz the win32k graphical subsystem service table (aka Shadow SSDT); default is ntoskrnl table |
-log |
Enable logging of call parameters (reduces performance) |
-o Value |
Output log destination (COM port name like COM1, COM2, or file name, default: ntcall64.log if omitted) |
-call Id |
Fuzz only the syscall with the supplied numeric ID (from any table); disables blacklists |
-pc Value |
Set number of passes for each syscall (default: 65536) |
-wt Value |
Set thread wait timeout in seconds (default: 30; if logging, timeout is 240) |
-sc Value |
Start fuzzing from the specified syscall table index (default: 0) |
-h |
Enable heuristics when building syscall parameters |
-s |
Attempt to run program from LocalSystem account |
Examples:
ntcall64.exe -win32k
ntcall64.exe -log -o COM2
ntcall64.exe -win32k -log -pc 1234
ntcall64.exe -call 4097 -log -pc 1000
ntcall64.exe -sNotes:
KiServiceTable) services.-call, blacklists are ignored and the thread timeout is set to infinite.You can blacklist specific services using the badcalls.ini configuration file.
Add service names (case-sensitive) to the appropriate [ntos] or [win32k] section.
Example badcalls.ini (snippet):
…NTCALL64 is written in C with minimal assembler use.
You need Microsoft Visual Studio 2017 or later.
Instructions:
This tool is for research and development. It may crash your system, cause instability, or data loss.
Use only in a controlled environment.
You are responsible for any damage caused by running NtCall64.
Tip:
Before using, set up crash dump settings (see MSDN docs) for easier debugging.
If you find this project interesting, you can buy me a coffee
BTC (Bitcoin): bc1qzkvtpa0053cagf35dqmpvv9k8hyrwl7krwdz84q39mcpy68y6tmqsju0g4
(c) 2016 - 2026 NTCALL64 Project
Original NtCall by Peter Kosyh aka Gloomy (c) 2001, gl00my.chat.ru
No open issues yet, or sync has not completed.