I am trying to compile a program that hooks KiFastSystemCall from NTDLL.dll. I am using inline assembly from a forum I found (I am by no means an assembly professional and I have 0 experience writing in it). The program compiles but crashes while executing the assembly code.
The function:
void set_up_hook() {
void (*func)() = &new_func;
BOOL(__stdcall *oldProtection)(LPVOID, SIZE_T, DWORD, PDWORD) = &VirtualProtect;
std::cout << "started block number 1\n";
__asm {
mov esi, 07FFE0300h
lodsd
call changeProtection
changeProtection :
push eax
push oldProtection
push 40h
push 6
push eax
call VirtualProtect
pop eax
retn
}
std::cout << "finished block 1\n";
__asm {
mov edx, 03EBh
mov[eax], edx
lea eax, [eax + 5]
mov dl, 68h
mov[eax], dl
}
std::cout << "finished block 2\n";
__asm {
inc eax
mov edx, func
mov[eax], edx
}
std::cout << "finished block 3\n";
__asm {
lea eax, [eax + 4]
mov dl, 0C3h
mov[eax], dl
}
std::cout << "done!";
}
I have divided the code into blocks to see where it crashed and it crashes at the very first block. It didn't work before as well so I don't think the division into blocks is the problem.
Thanks in advanced :D
[EDIT] I found this code with comments that I deleted because for some reason visual studio gave me errors that I couldn't solve on my own.
Here is the original code with comments:
.386
.model flat,stdcall
option casemap:none
include kernel32.inc
includelib kernel32.lib
.data
oldProtection dd ?
fileToDelete db "C:\Temp\deleteMe.txt", 0 ; Create this file or change the path and check if it was deleted.
; Array listing all the hooks we install.
; Each hook is placed according to its function's syscall number.
arrayOfEvil DWORD 149h DUP (0), offset newNtSetInformationFile , 40h DUP (0)
.code
start:
mov esi, 07FFE0300h
lodsd ; EAX = KiFastSystemCall
call changeProtection ; Not changing the protection back is bad for your health
mov edx, 03EBh ; 0xEB06 JMP SHORT 0xE bytes
mov [eax], edx
lea eax, [eax + 5h] ; EAX = [KiFastSystemCallRet + 1]
mov dl, 68h ; 0x68 = PUSH
mov [eax], dl
inc eax
mov edx, offset evilCode ; EDX = Pointer to our trap
mov [eax], edx ; [KiFastSystemCallRet] = PUSH offset evilCode
lea eax, [eax + 4]
mov dl, 0C3h ; 0xC3 = RETN
mov [eax], dl
push offset fileToDelete
call DeleteFile ; Will call NtSetInformationFile
retn
changeProtection:
push eax ; Save KiFastSYstemCall addr
push offset oldProtection
push 40h ; PAGE_EXECUTE_READWRITE
push 0Ah
push eax
call VirtualProtect ; VirutalProtect((void *)KiFastSystemCall, 10, PAGE_EXECUTE_READWRITE, &oldProtection
pop eax
retn
evilCode:
mov ecx, offset arrayOfEvil
lea ecx, [ecx + eax * 4]
mov ebx, [ecx]
cmp ebx, 0
jz origKiFastSystemCall
jmp ebx
newNtSetInformationFile:
pushad
mov edi, [esp + 38h]
cmp edi, 0Dh ; 0xD = FileDispositionInformation
jnz callRealKiFastSystemCall
xor edi, edi
mov ebx, [esp + 30h] ; EBX = (VOID *)dispositionInfo
mov [ebx], dl ; dispositionInfo.DeleteFile = 0 (FALSE)
callRealKiFastSystemCall:
popad
jmp origKiFastSystemCall
origKiFastSystemCall:
mov edx, esp
dw 340fh ; SYSENTER
retn
end start
This code is pure assembly and I wanted to integrate it into my c++ code. Also Instead of calling the evilcode routine I tried to change it so it would call my new_func. As for the other functions I use, VirtualProtect() is a winapi function and new_func() is just a demo function I created to see if the hook works, all it does is ''' std::cout << "hook worked\n"; '''
Hope this is enough info to solve the problem