Log in

View Full Version : indirect __stdcall function

BanMe
June 29th, 2009, 01:11
Code:


             POP ECX ;pop return address

             POP EDX ;pop function pointer

             PUSH ECX ;place function return back on stack

             CALL EDX ;call function

             XOR ECX,ECX ;zero ecx

             ADD ECX,18 ;add 18

             MOV EBX,DWORD PTR FS:[ECX] ;NtCurrentTeb to ebx

             ;return the value of call of call to a generally

             ;read/writable area Teb.NtTib.ArbritraryUserPointer

             MOV DWORD PTR DS:[EBX+14],EAX

             PUSH 0

             PUSH -2

             CALL ntdll.ZwSuspendThread


ok so this is not all that special.. but maybe combined with the C++definition you will see something of my scheme

Code:


__declspec(naked) InvokeFunc(__in void*FunctionPtr, __in_opt ULONG NumberOfParameter,__in_opt ...);


Ill try to explain where I'm going with this as best as I can...
Indirect in or out of image call mechanism placed in all loaded images. hooks without recognizable hooks routines anyone?

p.s. something of interest to me in this area was cod's post and other's regarding the subject "Where to find space in a dll" located at http://www.woodmann.com/forum/showthread.php?t=12748 if there is any further information on this subject, I would greatly appreciate it

regards BanMe
BanMe
July 8th, 2009, 15:04
ok well I guess this didnt really interest anybody but me...lol as usual...so maybe I can better explain the circumstances in which this functionality could be used..a DYNAMIC THREAD POOL is one..I've noticed that if I dont set the PUSER_THREAD_START_ROUTINE in a call to RtlCreateUserThread then resetting it by changing the Context's EIP is impossible..absolutly doesnt work. So I got to thinking how can I redirect Threads that are suspended.One way is to Call RtlCreateUserThread and pass in this routine as the PUSER_THREAD_START_ROUTINE and then just manipulate the context a little.. which seems to me to be a decent solution for now.. your thoughts or suggestions? any way to implement a indirect __fastcall as this would also be helpfull.. but ill prolly get to it b4u

regards BanMe