[R00tKit]

hi
how can use sysenter to call kernel-mode function in user mode ? ( like native api in NTDLL.DLL ) for example

Code: Select all

mov eax, 0x47    
sysenter

or pass other SSDT index to eax !! how pass argument??

[r2nwcnydc]

Yes you can. Parameters are passed using edx.

Take a look at ntdll in IDA and you can see how it does done:

Here is NtCreateFile:

Code: Select all

.text:7DE90044                 mov     eax, 52h        ; NtCreateFile
.text:7DE90049                 xor     ecx, ecx
.text:7DE9004B                 lea     edx, [esp+arg_0]
.text:7DE9004F                 call    large dword ptr fs:0C0h
.text:7DE90056                 add     esp, 4
.text:7DE90059                 retn    2Ch

[Cr4sh]

Here is an example with calling NtProtectVirtualMemory from the kernel driver (can be used in a user mode also):

Code: Select all

__declspec(naked) NTSTATUS NTAPI _MyProtectVirtualMemory(
    HANDLE ProcessHandle,
    PVOID *BaseAddress,
    PSIZE_T NumberOfBytesToProtect,
    ULONG NewAccessProtection,
    PULONG OldAccessProtection)
{
    __asm
    {
        cmp     SDT_NtProtectVirtualMemory, 0
        jz      _failed
        mov     eax, SDT_NtProtectVirtualMemory
        lea     edx, [esp+4]
        int     0x2E ; legacy
        retn    0x14

_failed:
        mov     eax, 0xc00000001
        retn    0x14
    }
}