VC Inside Quick Call NT Series Function Example method

The following code is only tested in Win7 x64 and can quickly call NT functions

The original purpose of the study was only for a stable universal ring3 inline Hook Bypass

FUNADDR + 5 Except the method, if you have other methods or ideas, welcome to exchange guidance!

Microsoft Windows [version 6.1.7601]
Copyright (c) Microsoft Corporation. All rights reserved.

#include <Windows.h> #include <stdio.h>long __declspec (naked) ntcall (DWORD Functionindex,dword Classindex ,...) {__asm{push Ebpmov Ebp,espmov eax,functionindexmov ecx,classindexlea edx,[ebp+0x10]call fs:[0xC0]add esp,0x4leaveretn }} #define Ntterminateprocess (Processhandle,exitstatus) ntcall (0x29,0x0,processhandle,exitstatus) #define Ntusersendinput (ninputs,pinput,cbsize) ntcall (0x1082,0x0,ninputs,pinput,cbsize) #define NTDELETEFILE ( objectattributes) Ntcall (0x0b2,0x0,objectattributes) #define Ntreadvirtualmemory (Processhandle,baseaddress,buffer , Numberofbytestoread,numberofbytesread) Ntcall (0x3c,0x0,processhandle,baseaddress,buffer,numberofbytestoread, Numberofbytesread) #define Ntwritevirtualmemory (Processhandle,baseaddress,buffer,numberofbytestowrite, Numberofbyteswritten) Ntcall (0x37,0x0,processhandle,baseaddress,buffer,numberofbytestowrite, Numberofbyteswritten) #define NTOPENPROCESS (Processhandle,desiredaccess,objectattributes,clientid) NtCall (0x23, 0x0,processhandle,desiredaccess,obJectattributes,clientid) #define NtClose (Handle) ntcall (0x0c,0x0,handle) #define NTWAITFORSINGLEOBJECT (ObjectHandle , alertable,timeout) Ntcall (0x1,0x0d,objecthandle,alertable,timeout) #define Ntdelayexecution (Alertable, Delayinterval) Ntcall (0x31,0x6,alertable,delayinterval) #define Ntprotectvirtualmemory (processhandle,baseaddress, numberofbytestoprotect,newaccessprotection,oldaccessprotection) Ntcall (0x4d,0x0,processhandle,baseaddress, numberofbytestoprotect,newaccessprotection,oldaccessprotection) #define Ntallocatevirtualmemory (ProcessHandle, Baseaddress,zerobits,regionsize,allocationtype,protectiontype) Ntcall (0x15,0x0,processhandle,baseaddress, Zerobits,regionsize,allocationtype,protectiontype) #define Ntfreevirtualmemory (processhandle,baseaddress, Regionsize,freetype) Ntcall (0x1b,0x0,processhandle,baseaddress,regionsize,freetype) int main () {printf (" Terminating self in one second\n "); Sleep (100); Ntterminateprocess (GetCurrentProcess (), -1);p rintf ("You should never see this message\n"); GetChar (); reTurn 0;} 

Ntcall The first parameter please refer to:

; __stdcall zwterminateprocess (x, x) public [email protected][email protected] proc neararg_0= byte ptr  4mov     eax, 29h        ; Ntterminateprocessxor     ecx, Ecxlea     edx, [Esp+arg_0]call    large DWORD ptr fs:0c0hadd     ESP, 4RETN    8[ Email protected] ENDP; Sp-analysis failed

VC Inside Quick Call NT Series Function Example method