Welcome Guest ( Log In | Register )

Bump Topic Add Reply RSS Feed

Outline · [ Standard ] · Linear+

 Using IDA Free, Part 3, Investigate Windows syscall

views
     
MatQuasar
post Sep 15 2023, 08:04 PM

Casual
***
Validating
329 posts

Joined: Jun 2023
Since there is no syscall in 32-bit mode....

user posted image

....I make direct call to ntdll.dll instead, x86 code as below:

CODE
format PE console
entry start

include "win32a.inc"

section ".code" code executable readable

start:

  push 7
  push 0xFFFFFFFF
  call [NtTerminateProcess]

section ".idata" import readable

  library ntdll, "ntdll.dll"

  import ntdll, NtTerminateProcess, "NtTerminateProcess"      

MatQuasar
post Sep 15 2023, 11:34 PM

Casual
***
Validating
329 posts

Joined: Jun 2023
Readers might ask, what is "ntdll.dll"? It is a library part of "kernel32.dll" dependency:

user posted image

Many Win32 API are provided through "kernel32.dll" (along with "user32.dll" and others), but underlying it there is "ntdll.dll" which is even deeper.

So , kernel32.dll ExitProcess API will call ntdll.dll NtTerminateProcess.....
« Next Oldest · Codemasters · Next Newest »
 

Add ReplyOptions
 

Change to:
| Lo-Fi Version
 0.0162sec    0.50    6 queries    GZIP Disabled
Time is now: 25th November 2025 - 04:46 AM
All Rights Reserved © 2002- 2025 Vijandren Ramadass (~unite against racism~)
Removal Request
Powered by Invision Power Board © 2025  IPS, Inc.