+- delphi4arab منتديات دلفي للعرب (https://delphi4arab.net/forum)
+-- قسم : منتديات دلفي التقنية (https://delphi4arab.net/forum/forumdisplay.php?fid=6)
+--- قسم : دلفي والتعامل مع النظام و الذاكرة (https://delphi4arab.net/forum/forumdisplay.php?fid=20)
+--- الموضوع : إستدعاء & إستخدام الدالة ZwTerminateProcess من User Mode (/showthread.php?tid=9594)
إستدعاء & إستخدام الدالة ZwTerminateProcess من User Mode - Agmcz - 22-07-2018
السلام عليكم ورحمة الله وبركاته
إستدعاء دوال Native API مباشرة من User Mode بدون تصريح
بالإعتماد على Syscall Number
ومنه إجراء لإستخدام الدالة ZwTerminateProcess مع دعم متعدد لأنظمة التشغيل (XP/ 7/ 8/ 8.1/ 10 Win 32Bit)
تم التجربة على كل من الأنظمة (XP/7/8.1/10)
إقباس الفكرة كان من هنا إستدعاء & إستخدام Native Api من الـ User Mode
PHP كود :
function ZwTerminateProcess(hProcess: DWORD; uCode: DWORD): NTSTATUS; stdcall; assembler;
{
Coded By Agmcz
Support for all operating systems [XP, 7, 8, 8.1, 10; 32bit]
Tested on Windows XP/7/8.1/10.
}
asm
{$IFDEF WIN32}
MOV EAX, FS:[$C0]
CMP EAX, $0
JNZ @Exit
MOV EAX, FS:[$30]
MOV EAX, [EAX+$A4]
SUB EAX, $5
JE @WinXP
DEC EAX
JE @Win8_81
SUB EAX, $4
JNE @Sys
MOV EAX, $0024
JMP @Sys
@Win8_81:
MOV EAX, EBX
MOV EAX, [EAX+$A8]
DEC EAX
JE @Win7
DEC EAX
SUB EAX, $2
JAE @Sys
MOV EAX, $0023
JMP @Sys
@Win7:
MOV EAX, $0172
JMP @Sys
@WinXP:
MOV EAX, $0101
@Sys:
LEA EDX,[EBP+$8]
INT $2E
@Exit:
{$ENDIF}
end;
RE: إستدعاء & إستخدام الدالة ZwTerminateProcess من User Mode - Agmcz - 22-07-2018
بنكهة شل كود (171 بايت)
PHP كود :
const
arrZwTerminateProcess: array[0..171] of byte = (
$55, $8B, $EC, $64, $8B, $05, $C0, $00, $00, $00, $83, $F8, $00, $75, $4A,
$64, $8B, $05, $30, $00, $00, $00, $8B, $80, $A4, $00, $00, $00, $83, $E8,
$05, $74, $2E, $48, $74, $0C, $83, $E8, $04, $75, $2B, $B8, $24, $00, $00,
$00, $EB, $24, $89, $D8, $8B, $80, $A8, $00, $00, $00, $48, $74, $0D, $48,
$83, $E8, $02, $73, $13, $B8, $23, $00, $00, $00, $EB, $0C, $B8, $72, $01,
$00, $00, $EB, $05, $B8, $01, $01, $00, $00, $8D, $55, $08, $CD, $2E, $5D,
$C2, $08, $00, $8D, $40, $00, $98, $25, $40, $00, $11, $02, $2E, $31, $01,
$00, $00, $00, $00, $00, $00, $00, $11, $00, $00, $00, $00, $10, $40, $00,
$11, $47, $65, $6E, $65, $72, $61, $74, $65, $53, $68, $65, $6C, $6C, $43,
$6F, $64, $65, $8B, $C0, $55, $8B, $EC, $33, $C0, $55, $68, $DF, $25, $40,
$00, $64, $FF, $30, $64, $89, $20, $33, $C0, $5A, $59, $59, $64, $89, $10,
$68, $E6, $25, $40, $00, $C3, $00);
var
ZwTerminateProcess: function(hProcess: DWORD; uCode: DWORD): NTSTATUS; stdcall;
begin
ZwTerminateProcess := @arrZwTerminateProcess;
{code}
end.
RE: إستدعاء & إستخدام الدالة ZwTerminateProcess من User Mode - AX302 - 23-07-2018
172 بايت
RE: إستدعاء & إستخدام الدالة ZwTerminateProcess من User Mode - Agmcz - 28-08-2018
شل كود فيه زيادة وتكفي فقط 93 بايت
PHP كود :
const
arrZwTerminateProcess: array[0..92] of byte = (
$55, $8B, $EC, $64, $8B, $05, $C0, $00, $00, $00, $83, $F8, $00, $75, $4A,
$64, $8B, $05, $30, $00, $00, $00, $8B, $80, $A4, $00, $00, $00, $83, $E8,
$05, $74, $2E, $48, $74, $0C, $83, $E8, $04, $75, $2B, $B8, $24, $00, $00,
$00, $EB, $24, $89, $D8, $8B, $80, $A8, $00, $00, $00, $48, $74, $0D, $48,
$83, $E8, $02, $73, $13, $B8, $23, $00, $00, $00, $EB, $0C, $B8, $72, $01,
$00, $00, $EB, $05, $B8, $01, $01, $00, $00, $8D, $55, $08, $CD, $2E, $5D,
$C2, $08, $00);
var
ZwTerminateProcess: function(hProcess: DWORD; uCode: DWORD): NTSTATUS; stdcall;
begin
ZwTerminateProcess := @arrZwTerminateProcess;
{code}
end.