mirror of
https://github.com/thefLink/Hunt-Weird-Syscalls
synced 2026-06-24 08:41:12 +00:00
thefLink
27 lines
844 B
NASM
27 lines
844 B
NASM
.code
|
|
|
|
EXTERN SW3_GetSyscallNumber: PROC
|
|
|
|
EXTERN SW3_GetRandomSyscallAddress: PROC
|
|
|
|
NtSetContextThread PROC
|
|
mov [rsp +8], rcx ; Save registers.
|
|
mov [rsp+16], rdx
|
|
mov [rsp+24], r8
|
|
mov [rsp+32], r9
|
|
sub rsp, 28h
|
|
mov ecx, 0123E5E95h ; Load function hash into ECX.
|
|
call SW3_GetRandomSyscallAddress ; Get a syscall offset from a different api.
|
|
mov r15, rax ; Save the address of the syscall
|
|
mov ecx, 0123E5E95h ; Re-Load function hash into ECX (optional).
|
|
call SW3_GetSyscallNumber ; Resolve function hash into syscall number.
|
|
add rsp, 28h
|
|
mov rcx, [rsp+8] ; Restore registers.
|
|
mov rdx, [rsp+16]
|
|
mov r8, [rsp+24]
|
|
mov r9, [rsp+32]
|
|
mov r10, rcx
|
|
jmp r15 ; Jump to -> Invoke system call.
|
|
NtSetContextThread ENDP
|
|
|
|
end |