mirror of
https://github.com/Hue-Jhan/Syscalls-Thread-Hijacking
synced 2026-06-06 15:44:31 +00:00
Hue
132 lines
3.7 KiB
NASM
132 lines
3.7 KiB
NASM
|
|
.data
|
|
extern h_NtOpenProcessSSN:DWORD
|
|
extern h_NtOpenProcessSyscall:QWORD
|
|
extern h_NtAllocateVirtualMemorySSN:DWORD
|
|
extern h_NtAllocateVirtualMemorySyscall:QWORD
|
|
extern h_NtWriteVirtualMemorySSN:DWORD
|
|
extern h_NtWriteVirtualMemorySyscall:QWORD
|
|
extern h_NtProtectVirtualMemorySSN:DWORD
|
|
extern h_NtProtectVirtualMemorySyscall:QWORD
|
|
extern h_NtCreateThreadExSSN:DWORD
|
|
extern h_NtCreateThreadExSyscall:QWORD
|
|
extern h_NtWaitForSingleObjectSSN:DWORD
|
|
extern h_NtWaitForSingleObjectSyscall:QWORD
|
|
extern h_NtFreeVirtualMemorySSN:DWORD
|
|
extern h_NtFreeVirtualMemorySyscall:QWORD
|
|
extern h_NtCloseSSN:DWORD
|
|
extern h_NtCloseSyscall:QWORD
|
|
extern h_NtSuspendThreadSSN:DWORD
|
|
extern h_NtSuspendThreadSyscall:QWORD
|
|
extern h_NtResumeThreadSSN:DWORD
|
|
extern h_NtResumeThreadSyscall:QWORD
|
|
extern h_NtQuerySystemInformationSSN:DWORD
|
|
extern h_NtQuerySystemInformationSyscall:QWORD
|
|
extern h_NtGetContextThreadSSN:DWORD
|
|
extern h_NtGetContextThreadSyscall:QWORD
|
|
extern h_NtSetContextThreadSSN:DWORD
|
|
extern h_NtSetContextThreadSyscall:QWORD
|
|
extern h_NtOpenThreadSSN:DWORD
|
|
extern h_NtOpenThreadSyscall:QWORD
|
|
|
|
.code
|
|
NtOpenProcess proc
|
|
mov r10, rcx
|
|
mov eax, h_NtOpenProcessSSN
|
|
jmp qword ptr h_NtOpenProcessSyscall
|
|
ret
|
|
NtOpenProcess endp
|
|
|
|
NtOpenThread proc
|
|
mov r10, rcx
|
|
mov eax, h_NtOpenThreadSSN
|
|
jmp qword ptr h_NtOpenThreadSyscall
|
|
ret
|
|
NtOpenThread endp
|
|
|
|
NtAllocateVirtualMemory proc
|
|
mov r10, rcx
|
|
mov eax, h_NtAllocateVirtualMemorySSN
|
|
jmp qword ptr h_NtAllocateVirtualMemorySyscall
|
|
ret
|
|
NtAllocateVirtualMemory endp
|
|
|
|
NtWriteVirtualMemory proc
|
|
mov r10, rcx
|
|
mov eax, h_NtWriteVirtualMemorySSN
|
|
jmp qword ptr h_NtWriteVirtualMemorySyscall
|
|
ret
|
|
NtWriteVirtualMemory endp
|
|
|
|
NtProtectVirtualMemory proc
|
|
mov r10, rcx
|
|
mov eax, h_NtProtectVirtualMemorySSN
|
|
jmp qword ptr h_NtProtectVirtualMemorySyscall
|
|
ret
|
|
NtProtectVirtualMemory endp
|
|
|
|
NtCreateThreadEx proc
|
|
mov r10, rcx
|
|
mov eax, h_NtCreateThreadExSSN
|
|
jmp qword ptr h_NtCreateThreadExSyscall
|
|
ret
|
|
NtCreateThreadEx endp
|
|
|
|
|
|
NtWaitForSingleObject proc
|
|
mov r10, rcx
|
|
mov eax, h_NtWaitForSingleObjectSSN
|
|
jmp qword ptr h_NtWaitForSingleObjectSyscall
|
|
ret
|
|
NtWaitForSingleObject endp
|
|
|
|
NtFreeVirtualMemory proc
|
|
mov r10, rcx
|
|
mov eax, h_NtFreeVirtualMemorySSN
|
|
jmp qword ptr h_NtFreeVirtualMemorySyscall
|
|
ret
|
|
NtFreeVirtualMemory endp
|
|
|
|
NtClose proc
|
|
mov r10, rcx
|
|
mov eax, h_NtCloseSSN
|
|
jmp qword ptr h_NtCloseSyscall
|
|
ret
|
|
NtClose endp
|
|
|
|
NtQuerySystemInformation proc
|
|
mov r10, rcx
|
|
mov eax, h_NtQuerySystemInformationSSN
|
|
jmp qword ptr h_NtQuerySystemInformationSyscall
|
|
ret
|
|
NtQuerySystemInformation endp
|
|
|
|
NtSetContextThread proc
|
|
mov r10, rcx
|
|
mov eax, h_NtSetContextThreadSSN
|
|
jmp qword ptr h_NtSetContextThreadSyscall
|
|
ret
|
|
NtSetContextThread endp
|
|
NtGetContextThread proc
|
|
mov r10, rcx
|
|
mov eax, h_NtGetContextThreadSSN
|
|
jmp qword ptr h_NtGetContextThreadSyscall
|
|
ret
|
|
NtGetContextThread endp
|
|
|
|
NtSuspendThread proc
|
|
mov r10, rcx
|
|
mov eax, h_NtSuspendThreadSSN
|
|
jmp qword ptr h_NtSuspendThreadSyscall
|
|
ret
|
|
NtSuspendThread endp
|
|
|
|
NtResumeThread proc
|
|
mov r10, rcx
|
|
mov eax, h_NtResumeThreadSSN
|
|
jmp qword ptr h_NtResumeThreadSyscall
|
|
ret
|
|
NtResumeThread endp
|
|
|
|
|
|
end |