📄 ntdll_u.cpp
字号:
/*
* ntdll_u.cpp: for ntdll_u.dll
*
* Copyright (C) 2006 Insigme Co., Ltd
*
* Authors:
* - Decao Mao, Chenzhan Hu, Lixing Chu, Limin Jin, Liwei Zhou, Zhiqiang Jiao
*
* This software has been developed while working on the Linux Unified Kernel
* project (http://linux.insigma.com.cn) in the Insigma Reaserch Institute,
* which is a subdivision of Insigma Co., Ltd (http://www.insigma.com.cn).
*
* The project is sponsored by Insigma Co., Ltd.
*
* The authors can be reached at linux@insigma.com.cn.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version.
*
* Revision History:
* Jan 2006 - Created.
*/
#include "stdafx.h"
BOOL APIENTRY DllMain( HANDLE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
return TRUE;
}
__declspec(dllexport) __declspec(naked) __stdcall
InitialiseWin32()
{
__asm{
push ebp
mov ebp,esp
mov eax,0xE8
lea edx,8[ebp]
int 0x2E
pop ebp
ret 0x0 //ret 0
}
}
__declspec(dllexport) __declspec(naked) __stdcall
UninitialiseWin32()
{
__asm{
push ebp
mov ebp,esp
mov eax,0xE9
lea edx,8[ebp]
int 0x2E
pop ebp
ret 0x0 //ret 0
}
}
/* Event */
__declspec(dllexport) __declspec(naked) __stdcall
NtCreateEvent(int param0, int param1, int param2,int param3,
int param4)
{
__asm{
push ebp
mov ebp,esp
mov eax,0x17
lea edx,8[ebp]
int 0x2E
pop ebp
ret 0x14 //ret 5
}
}
__declspec(dllexport) __declspec(naked) __stdcall
NtOpenEvent(int param0, int param1, int param2)
{
__asm{
push ebp
mov ebp,esp
mov eax,0x56
lea edx,8[ebp]
int 0x2E
pop ebp
ret 0xC //ret 3
}
}
__declspec(dllexport) __declspec(naked) __stdcall
NtSetEvent(int param0, int param1)
{
__asm{
push ebp
mov ebp,esp
mov eax,0xB3
lea edx,8[ebp]
int 0x2E
pop ebp
ret 0x8 //ret 2
}
}
__declspec(dllexport) __declspec(naked) __stdcall
NtResetEvent(int param0, int param1)
{
__asm{
push ebp
mov ebp,esp
mov eax,0xA6
lea edx,8[ebp]
int 0x2E
pop ebp
ret 0x8 //ret 2
}
}
__declspec(dllexport) __declspec(naked) __stdcall
NtPulseEvent(int param0, int param1)
{
__asm{
push ebp
mov ebp,esp
mov eax,0x6E
lea edx,8[ebp]
int 0x2E
pop ebp
ret 0x8 //ret 2
}
}
/* File */
__declspec(dllexport) __declspec(naked) __stdcall
NtCreateFile(int param0, int param1, int param2, int param3,
int param4, int param5, int param6, int param7,
int param8, int param9, int param10)
{
__asm{
push ebp
mov ebp,esp
mov eax,0x19
lea edx,8[ebp]
int 0x2E
pop ebp
ret 0x2C //ret 11
}
}
__declspec(dllexport) __declspec(naked) __stdcall
NtOpenFile(int param0, int param1, int param2, int param3,
int param4, int param5)
{
__asm{
push ebp
mov ebp,esp
mov eax,0x58
lea edx,8[ebp]
int 0x2E
pop ebp
ret 0x18 //ret 6
}
}
__declspec(dllexport) __declspec(naked) __stdcall
NtReadFile(int param0, int param1, int param2, int param3,
int param4, int param5, int param6, int param7,
int param8)
{
__asm{
push ebp
mov ebp,esp
mov eax,0x98
lea edx,8[ebp]
int 0x2E
pop ebp
ret 0x24 //ret 9
}
}
__declspec(dllexport) __declspec(naked) __stdcall
NtWriteFile(int param0, int param1, int param2, int param3,
int param4, int param5, int param6, int param7,
int param8)
{
__asm{
push ebp
mov ebp,esp
mov eax,0xE2
lea edx,8[ebp]
int 0x2E
pop ebp
ret 0x24 //ret 9
}
}
__declspec(dllexport) __declspec(naked) __stdcall
NtFlushBuffersFile(int param0, int param1)
{
__asm{
push ebp
mov ebp,esp
mov eax,0x3B
lea edx,8[ebp]
int 0x2E
pop ebp
ret 0x8 //ret 2
}
}
__declspec(dllexport) __declspec(naked) __stdcall
NtQueryInformationFile(int param0, int param1, int param2, int param3,
int param4)
{
__asm{
push ebp
mov ebp,esp
mov eax,0x7A
lea edx,8[ebp]
int 0x2E
pop ebp
ret 0x14 //ret 5
}
}
__declspec(dllexport) __declspec(naked) __stdcall
NtSetInformationFile(int param0, int param1, int param2, int param3,
int param4)
{
__asm{
push ebp
mov ebp,esp
mov eax,0xB6
lea edx,8[ebp]
int 0x2E
pop ebp
ret 0x14 //ret 5
}
}
/* Mutex */
__declspec(dllexport) __declspec(naked) __stdcall
NtCreateMutant(int param0, int param1, int param2, int param3)
{
__asm{
push ebp
mov ebp,esp
mov eax,0x1E
lea edx,8[ebp]
int 0x2E
pop ebp
ret 0x10 //ret 4
}
}
__declspec(dllexport) __declspec(naked) __stdcall
NtOpenMutant(int param0, int param1, int param2)
{
__asm{
push ebp
mov ebp,esp
mov eax,0x5C
lea edx,8[ebp]
int 0x2E
pop ebp
ret 0xC //ret 3
}
}
__declspec(dllexport) __declspec(naked) __stdcall
NtReleaseMutant(int param0, int param1)
{
__asm{
push ebp
mov ebp,esp
mov eax,0x9D
lea edx,8[ebp]
int 0x2E
pop ebp
ret 0x8 //ret 2
}
}
/* Section */
__declspec(dllexport) __declspec(naked) __stdcall
NtCreateSection(int param0, int param1, int param2, int param3,
int param4, int param5, int param6)
{
__asm{
push ebp
mov ebp,esp
mov eax,0x24
lea edx,8[ebp]
int 0x2E
pop ebp
ret 0x1C //ret 7
}
}
__declspec(dllexport) __declspec(naked) __stdcall
NtMapViewOfSection(int param0, int param1, int param2, int param3,
int param4, int param5, int param6, int param7,
int param8, int param9)
{
__asm{
push ebp
mov ebp,esp
mov eax,0x52
lea edx,8[ebp]
int 0x2E
pop ebp
ret 0x28 //ret 10
}
}
__declspec(dllexport) __declspec(naked) __stdcall
NtUnmapViewOfSection(int param0, int param1)
{
__asm{
push ebp
mov ebp,esp
mov eax,0xDC
lea edx,8[ebp]
int 0x2E
pop ebp
ret 0x8 //ret 2
}
}
/* Semaphore */
__declspec(dllexport) __declspec(naked) __stdcall
NtCreateSemaphore(int param0, int param1, int param2, int param3,
int param4)
{
__asm{
push ebp
mov ebp,esp
mov eax,0x25
lea edx,8[ebp]
int 0x2E
pop ebp
ret 0x14 //ret 5
}
}
__declspec(dllexport) __declspec(naked) __stdcall
NtOpenSemaphore(int param0, int param1, int param2)
{
__asm{
push ebp
mov ebp,esp
mov eax,0x62
lea edx,8[ebp]
int 0x2E
pop ebp
ret 0xC //ret 3
}
}
__declspec(dllexport) __declspec(naked) __stdcall
NtReleaseSemaphore(int param0, int param1, int param2)
{
__asm{
push ebp
mov ebp,esp
mov eax,0x9E
lea edx,8[ebp]
int 0x2E
pop ebp
ret 0xC //ret 3
}
}
/* wait */
__declspec(dllexport) __declspec(naked) __stdcall
NtWaitForMultipleObjects(int param0, int param1, int param2,
int param3, int param4)
{
__asm{
push ebp
mov ebp,esp
mov eax,0xDE
lea edx,8[ebp]
int 0x2E
pop ebp
ret 0x14 //ret 5
}
}
/* handle */
__declspec(dllexport) __declspec(naked) __stdcall
NtClose(int param0)
{
__asm{
push ebp
mov ebp,esp
mov eax,0x11
lea edx,8[ebp]
int 0x2E
pop ebp
ret 0x4 //ret 1
}
}
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -