VC里面快速调用Nt系列函数示例方法

以下代码仅在Win7 x64测试，可以快速调用NT函数

当初研究的目的也只是为了一个稳定通用的ring3 inline hook bypass

funaddr + 5的方法除外，如果你还有其他方法或思路，欢迎交流指导！

Microsoft Windows [版本 6.1.7601]
版权所有 (c) 2009 Microsoft Corporation。保留所有权利。

#include <Windows.h>
#include <stdio.h>

LONG __declspec(naked) NtCall(DWORD FunctionIndex,DWORD ClassIndex,...)
{
	__asm
	{
		push ebp
		mov ebp,esp
		mov eax,FunctionIndex
		mov ecx,ClassIndex
		lea edx,[ebp+0x10]
		call fs:[0xC0]
		add esp,0x4
		leave
		retn
	}
}

#define NtTerminateProcess(ProcessHandle,ExitStatus) NtCall(0x29,0x0,ProcessHandle,ExitStatus)
#define NtUserSendInput(nInputs,pInput,cbSize) NtCall(0x1082,0x0,nInputs,pInput,cbSize)
#define NtDeleteFile(ObjectAttributes) NtCall(0x0B2,0x0,ObjectAttributes)
#define NtReadVirtualMemory(ProcessHandle,BaseAddress,Buffer,NumberOfBytesToRead,NumberOfBytesRead) NtCall(0x3C,0x0,ProcessHandle,BaseAddress,Buffer,NumberOfBytesToRead,NumberOfBytesRead)
#define NtWriteVirtualMemory(ProcessHandle,BaseAddress,Buffer,NumberOfBytesToWrite,NumberOfBytesWritten) NtCall(0x37,0x0,ProcessHandle,BaseAddress,Buffer,NumberOfBytesToWrite,NumberOfBytesWritten)
#define NtOpenProcess(ProcessHandle,DesiredAccess,ObjectAttributes,ClientId) NtCall(0x23,0x0,ProcessHandle,DesiredAccess,ObjectAttributes,ClientId)
#define NtClose(Handle) NtCall(0x0C,0x0,Handle)
#define NtWaitForSingleObject(ObjectHandle,Alertable,TimeOut) NtCall(0x1,0x0D,ObjectHandle,Alertable,TimeOut)
#define NtDelayExecution(Alertable,DelayInterval) NtCall(0x31,0x6,Alertable,DelayInterval)
#define NtProtectVirtualMemory(ProcessHandle,BaseAddress,NumberOfBytesToProtect,NewAccessProtection,OldAccessProtection) NtCall(0x4D,0x0,ProcessHandle,BaseAddress,NumberOfBytesToProtect,NewAccessProtection,OldAccessProtection)
#define NtAllocateVirtualMemory(ProcessHandle,BaseAddress,ZeroBits,RegionSize,AllocationType,ProtectionType) NtCall(0x15,0x0,ProcessHandle,BaseAddress,ZeroBits,RegionSize,AllocationType,ProtectionType)
#define NtFreeVirtualMemory(ProcessHandle,BaseAddress,RegionSize,FreeType) NtCall(0x1B,0x0,ProcessHandle,BaseAddress,RegionSize,FreeType)

int main()
{
	printf("Terminating self in one second\n");
	Sleep(100);
	NtTerminateProcess(GetCurrentProcess(),-1);
	printf("You should never see this message\n");
	getchar();
	return 0;
}

NtCall第一个参数请参考：

; __stdcall ZwTerminateProcess(x, x)
public _ZwTerminateProcess@8
_ZwTerminateProcess@8 proc near

arg_0= byte ptr  4

mov     eax, 29h        ; NtTerminateProcess
xor     ecx, ecx
lea     edx, [esp+arg_0]
call    large dword ptr fs:0C0h
add     esp, 4
retn    8
_ZwTerminateProcess@8 endp ; sp-analysis failed