class syscall_help_map
{
private:
INT process_platrorm = NULL;
PVOID nt_open_secthion = NULL;
PVOID nt_map_view_of_secthion = NULL;
PVOID nt_close = NULL;
PVOID nt_unmap_view_of_secthion = NULL;
INLINE auto init_struct() -> bool
{
if (process_platrorm && nt_open_secthion && nt_map_view_of_secthion && nt_close && nt_unmap_view_of_secthion)
return TRUE;
process_platrorm = get_proc_info::get_process_platform();
nt_open_secthion = LI_FN(NtOpenSection).nt_cached();
nt_map_view_of_secthion = LI_FN(NtMapViewOfSection).nt_cached();
nt_close = LI_FN(NtClose).nt_cached();
nt_unmap_view_of_secthion = LI_FN(NtUnmapViewOfSection).nt_cached();
return nt_open_secthion && nt_map_view_of_secthion && nt_close && nt_unmap_view_of_secthion;
}
public:
INLINE auto map_get_syscall(CONST WCHAR* name_module, uint64_t hahs_str) -> INT
{
INT syscall_number = NULL;
SIZE_T viewSize = NULL;
HANDLE secthion_handle = NULL;
PVOID functhion_address = NULL;
PVOID mapped_module = NULL;
UNICODE_STRING secthion_name = { NULL };
OBJECT_ATTRIBUTES obj_attribut = { NULL };
NTSTATUS nt_status = STATUS_UNSUCCESSFUL;
WCHAR buffer[MAX_PATH];
//Disassembly
UINT count_decode = NULL;
_CodeInfo ci = { 0 };
_DInst decode_instr[100] = { 0 };
if (!init_struct())
return NULL;
crt_wrapper:memset(buffer, NULL, MAX_PATH);
#ifdef _WIN64
crt_wrapper::str_cat_w(buffer, L"\\KnownDlls\\");
#else
if (process_platrorm == PROCESS_WOW64)
crt_wrapper::str_cat_w(buffer, L"\\KnownDlls32\\");
else
crt_wrapper::str_cat_w(buffer, L"\\KnownDlls\\");
#endif
crt_wrapper::str_cat_w(buffer, name_module);
secthion_name = crt_wrapper::init_unicode_str(buffer);
InitializeObjectAttributes(&obj_attribut, §hion_name, OBJ_CASE_INSENSITIVE, NULL, NULL);
nt_status = reinterpret_cast<decltype(&NtOpenSection)>(nt_open_secthion)(§hion_handle, SECTION_MAP_READ, &obj_attribut);
if (!NT_SUCCESS(nt_status))
return NULL;
nt_status = reinterpret_cast<decltype(&NtMapViewOfSection)>(nt_map_view_of_secthion)(secthion_handle, NtCurrentProcess, &mapped_module, NULL, NULL, nullptr,
&viewSize, (SECTION_INHERIT)1, NULL, PAGE_READONLY);
if (!NT_SUCCESS(nt_status))
{
if (secthion_handle)
reinterpret_cast<decltype(&NtClose)>(nt_close)(secthion_handle);
return NULL;
}
if (secthion_handle && mapped_module)
{
functhion_address = crt_wrapper::get_proc_address(mapped_module, hahs_str);
#ifdef _WIN64
if (process_platrorm == PROCESS_64)
{
ci.features = NULL;
ci.code = reinterpret_cast<uint8_t*>(functhion_address);
ci.codeLen = 0x20;//Safe min lenght need
ci.dt = Decode64Bits;
if (distorm_decompose(&ci, decode_instr, 100, &count_decode) != DECRES_INPUTERR)
{
for (uint32_t i = NULL; i < count_decode ; i++)
{
if (
decode_instr[i].flags != FLAG_NOT_DECODABLE &&
decode_instr[i].opcode == I_MOV &&
decode_instr[i].ops[0].index == R_R10 &&
decode_instr[i].ops[1].index == R_RCX &&
decode_instr[i + 1].flags != FLAG_NOT_DECODABLE &&
decode_instr[i + 1].opcode == I_MOV &&
decode_instr[i + 1].ops[0].index == R_EAX &&
decode_instr[i + 4].flags != FLAG_NOT_DECODABLE &&
decode_instr[i + 4].opcode == I_SYSCALL
)
{
syscall_number = decode_instr[i + 1].imm.dword;
break;
}
}
}
}
#else
ci.features = NULL;
ci.code = reinterpret_cast<uint8_t*>(functhion_address);
ci.codeLen = MAXIMUM_INSTRUCTION_SIZE;
ci.dt = Decode32Bits;
/*
* WoW64:
* Windows 10
| B8 9F010000 | mov eax,19F
| BA 408B5D77 | mov edx,ntdll.775D8B40
| FFD2 | call edx
| C2 1000
| ret 10
X32 windows 10
B8 9B 00 00 00 | mov eax, 9Bh ; RtlGetNativeSystemInformation
E8 03 00 00 00 | call sub_6A290E8D via call $+8
C2 10 00 | retn 10h
8B D4 | mov edx, esp
0F 34 | sysenter
C3 | retn
*/
if (process_platrorm == PROCESS_WOW64 && functhion_address)
{
if (distorm_decompose(&ci, decode_instr, 100, &count_decode) != DECRES_INPUTERR)
{
for (uint32_t i = NULL; i < count_decode; i++)
{
if (
decode_instr[i].flags != FLAG_NOT_DECODABLE &&
decode_instr[i].opcode == I_MOV &&
decode_instr[i].ops[0].index == R_EAX &&
decode_instr[i].size == 0x5
)
{
//Not dword for get correct number(thank's microsoft)
syscall_number = decode_instr[i].imm.sword;
break;
}
}
}
}
else if (process_platrorm == PROCESS_32 && functhion_address)
{
if (distorm_decompose(&ci, decode_instr, 100, &count_decode) != DECRES_INPUTERR)
{
for (uint32_t i = NULL; i < count_decode; i++)
{
if (
decode_instr[i].flags != FLAG_NOT_DECODABLE &&
decode_instr[i].opcode == I_MOV &&
decode_instr[i].ops[0].index == R_EAX &&
decode_instr[i].size == 0x5
)
{
syscall_number = decode_instr[i].imm.dword;
break;
}
}
}
}
#endif // _WIN64
if (secthion_handle)
reinterpret_cast<decltype(&NtClose)>(nt_close)(secthion_handle);
if (mapped_module && NT_SUCCESS(nt_status))
reinterpret_cast<decltype(&NtUnmapViewOfSection)>(nt_unmap_view_of_secthion)(NtCurrentProcess, mapped_module);
}
return syscall_number;
}
};
auto main() -> INT
{
INT process_platrorm = dump_syscall_util::get_proc_info::get_process_platform();
if (process_platrorm == PROCESS_32)
std::cout << "Process is x32(x32 system)\n";
else if(process_platrorm == PROCESS_64)
std::cout << "Process is x64(x64 system)\n";
else if(process_platrorm == PROCESS_WOW64)
std::cout << "Process is WoW64(x64 system)\n";
else
std::cout << "Unknown process(not supported)\n";
dump_syscall_util::syscall_help_map syscall_set_info_thread;
std::cout << std::dec << "windows build number ->\t" << NtCurrentPeb()->OSBuildNumber << '\n';
std::cout << "syscall number NtQueryInformationProcess ->\t0x" << std::hex << syscall_set_info_thread.map_get_syscall(L"ntdll.dll", FNV("NtQueryInformationProcess") )<< '\n';
std::cout << "syscall number NtSetInformationProcess ->\t0x" << std::hex << syscall_set_info_thread.map_get_syscall(L"ntdll.dll", FNV("NtSetInformationProcess") )<< '\n';
std::cout << "syscall number NtDebugActiveProcess ->\t0x" << std::hex << syscall_set_info_thread.map_get_syscall(L"ntdll.dll", FNV("NtDebugActiveProcess")) << '\n';
std::cout << "syscall number NtRemoveProcessDebug ->\t0x" << std::hex << syscall_set_info_thread.map_get_syscall(L"ntdll.dll", FNV("NtRemoveProcessDebug")) << '\n';
std::cin.get();
return NULL;
}
