以下代码仅在Win7 x64测试，可以快速调用NT函数
当初研究的目的也只是为了一个稳定通用的ring3 inline hook bypass
funaddr + 5的方法除外，如果你还有其他方法或思路，欢迎交流指导！
Microsoft Windows [版本 6.1.7601]
版权所有 (c) 2009 Microsoft Corporation。保留所有权利。
#include <Windows.h>
#include <stdio.h>
LONG __declspec(naked) NtCall(DWORD FunctionIndex,DWORD ClassIndex,...)
{
__asm
{
push ebp
mov ebp,esp
mov eax,FunctionIndex
mov ecx,ClassIndex
lea edx,[ebp+0x10]
call fs:[0xC0]
add esp,0x4
leave
retn
}
}
#define NtTerminateProcess(ProcessHandle,ExitStatus) NtCall(0x29,0x0,ProcessHandle,ExitStatus)
#define NtUserSendInput(nInputs,pInput,cbSize) NtCall(0x1082,0x0,nInputs,pInput,cbSize)
#define NtDeleteFile(ObjectAttributes) NtCall(0x0B2,0x0,ObjectAttributes)
#define NtReadVirtualMemory(ProcessHandle,BaseAddress,Buffer,NumberOfBytesToRead,NumberOfBytesRead) NtCall(0x3C,0x0,ProcessHandle,BaseAddress,Buffer,NumberOfBytesToRead,NumberOfBytesRead)
#define NtWriteVirtualMemory(ProcessHandle,BaseAddress,Buffer,NumberOfBytesToWrite,NumberOfBytesWritten) NtCall(0x37,0x0,ProcessHandle,BaseAddress,Buffer,NumberOfBytesToWrite,NumberOfBytesWritten)
#define NtOpenProcess(ProcessHandle,DesiredAccess,ObjectAttributes,ClientId) NtCall(0x23,0x0,ProcessHandle,DesiredAccess,ObjectAttributes,ClientId)
#define NtClose(Handle) NtCall(0x0C,0x0,Handle)
#define NtWaitForSingleObject(ObjectHandle,Alertable,TimeOut) NtCall(0x1,0x0D,ObjectHandle,Alertable,TimeOut)
#define NtDelayExecution(Alertable,DelayInterval) NtCall(0x31,0x6,Alertable,DelayInterval)
#define NtProtectVirtualMemory(ProcessHandle,BaseAddress,NumberOfBytesToProtect,NewAccessProtection,OldAccessProtection) NtCall(0x4D,0x0,ProcessHandle,BaseAddress,NumberOfBytesToProtect,NewAccessProtection,OldAccessProtection)
#define NtAllocateVirtualMemory(ProcessHandle,BaseAddress,ZeroBits,RegionSize,AllocationType,ProtectionType) NtCall(0x15,0x0,ProcessHandle,BaseAddress,ZeroBits,RegionSize,AllocationType,ProtectionType)
#define NtFreeVirtualMemory(ProcessHandle,BaseAddress,RegionSize,FreeType) NtCall(0x1B,0x0,ProcessHandle,BaseAddress,RegionSize,FreeType)
int main()
{
printf("Terminating self in one second\n");
Sleep(100);
NtTerminateProcess(GetCurrentProcess(),-1);
printf("You should never see this message\n");
getchar();
return 0;
}
NtCall第一个参数请参考：
; __stdcall ZwTerminateProcess(x, x) public _ZwTerminateProcess@8 _ZwTerminateProcess@8 proc near arg_0= byte ptr 4 mov eax, 29h ; NtTerminateProcess xor ecx, ecx lea edx, [esp+arg_0] call large dword ptr fs:0C0h add esp, 4 retn 8 _ZwTerminateProcess@8 endp ; sp-analysis failed
