mirror of
https://github.com/thefLink/Hunt-Weird-Syscalls
synced 2026-06-24 08:41:12 +00:00
thefLink
23 lines
551 B
NASM
23 lines
551 B
NASM
.code
|
|
|
|
EXTERN SW3_GetSyscallNumber: PROC
|
|
|
|
NtSetContextThread PROC
|
|
mov [rsp +8], rcx ; Save registers.
|
|
mov [rsp+16], rdx
|
|
mov [rsp+24], r8
|
|
mov [rsp+32], r9
|
|
sub rsp, 28h
|
|
mov ecx, 0FA5F256Dh ; Load function hash into ECX.
|
|
call SW3_GetSyscallNumber ; Resolve function hash into syscall number.
|
|
add rsp, 28h
|
|
mov rcx, [rsp+8] ; Restore registers.
|
|
mov rdx, [rsp+16]
|
|
mov r8, [rsp+24]
|
|
mov r9, [rsp+32]
|
|
mov r10, rcx
|
|
syscall ; Invoke system call.
|
|
ret
|
|
NtSetContextThread ENDP
|
|
|
|
end |