mirror of
https://github.com/Hue-Jhan/Syscalls-Thread-Hijacking
synced 2026-06-06 15:44:31 +00:00
Hue
118 lines
2.8 KiB
NASM
118 lines
2.8 KiB
NASM
|
|
.data
|
|
extern h_NtOpenProcessSSN:DWORD
|
|
extern h_NtAllocateVirtualMemorySSN:DWORD
|
|
extern h_NtWriteVirtualMemorySSN:DWORD
|
|
extern h_NtProtectVirtualMemorySSN:DWORD
|
|
extern h_NtCreateThreadExSSN:DWORD
|
|
extern h_NtWaitForSingleObjectSSN:DWORD
|
|
extern h_NtFreeVirtualMemorySSN:DWORD
|
|
extern h_NtCloseSSN:DWORD
|
|
extern h_NtSuspendThreadSSN:DWORD
|
|
extern h_NtResumeThreadSSN:DWORD
|
|
extern h_NtQuerySystemInformationSSN:DWORD
|
|
extern h_NtGetContextThreadSSN:DWORD
|
|
extern h_NtSetContextThreadSSN:DWORD
|
|
extern h_NtOpenThreadSSN:DWORD
|
|
|
|
.code
|
|
NtOpenProcess proc
|
|
mov r10, rcx
|
|
mov eax, h_NtOpenProcessSSN
|
|
syscall
|
|
ret
|
|
NtOpenProcess endp
|
|
|
|
NtOpenThread proc
|
|
mov r10, rcx
|
|
mov eax, h_NtOpenThreadSSN
|
|
syscall
|
|
ret
|
|
NtOpenThread endp
|
|
|
|
NtAllocateVirtualMemory proc
|
|
mov r10, rcx
|
|
mov eax, h_NtAllocateVirtualMemorySSN
|
|
syscall
|
|
ret
|
|
NtAllocateVirtualMemory endp
|
|
|
|
NtWriteVirtualMemory proc
|
|
mov r10, rcx
|
|
mov eax, h_NtWriteVirtualMemorySSN
|
|
syscall
|
|
ret
|
|
NtWriteVirtualMemory endp
|
|
|
|
NtProtectVirtualMemory proc
|
|
mov r10, rcx
|
|
mov eax, h_NtProtectVirtualMemorySSN
|
|
syscall
|
|
ret
|
|
NtProtectVirtualMemory endp
|
|
|
|
NtCreateThreadEx proc
|
|
mov r10, rcx
|
|
mov eax, h_NtCreateThreadExSSN
|
|
syscall
|
|
ret
|
|
NtCreateThreadEx endp
|
|
|
|
|
|
NtWaitForSingleObject proc
|
|
mov r10, rcx
|
|
mov eax, h_NtWaitForSingleObjectSSN
|
|
syscall
|
|
ret
|
|
NtWaitForSingleObject endp
|
|
|
|
NtFreeVirtualMemory proc
|
|
mov r10, rcx
|
|
mov eax, h_NtFreeVirtualMemorySSN
|
|
syscall
|
|
ret
|
|
NtFreeVirtualMemory endp
|
|
|
|
NtClose proc
|
|
mov r10, rcx
|
|
mov eax, h_NtCloseSSN
|
|
syscall
|
|
ret
|
|
NtClose endp
|
|
|
|
NtQuerySystemInformation proc
|
|
mov r10, rcx
|
|
mov eax, h_NtQuerySystemInformationSSN
|
|
syscall
|
|
ret
|
|
NtQuerySystemInformation endp
|
|
|
|
NtSetContextThread proc
|
|
mov r10, rcx
|
|
mov eax, h_NtSetContextThreadSSN
|
|
syscall
|
|
ret
|
|
NtSetContextThread endp
|
|
NtGetContextThread proc
|
|
mov r10, rcx
|
|
mov eax, h_NtGetContextThreadSSN
|
|
syscall
|
|
ret
|
|
NtGetContextThread endp
|
|
|
|
NtSuspendThread proc
|
|
mov r10, rcx
|
|
mov eax, h_NtSuspendThreadSSN
|
|
syscall
|
|
ret
|
|
NtSuspendThread endp
|
|
|
|
NtResumeThread proc
|
|
mov r10, rcx
|
|
mov eax, h_NtResumeThreadSSN
|
|
syscall
|
|
ret
|
|
NtResumeThread endp
|
|
|
|
|
|
end |