__asm

{

    push CalloutRecaptureRoutine

    ret

}

void ReCreateThread()

{

	NTSTATUS Status = 0;

	HANDLE Thread = INVALID_HANDLE_VALUE;

	CLIENT_ID Cid = {0};

	SIN32_HANDLE_TABLE_ENTRY *HandleEntry = {0};

	Status = RtlCreateUserThread(NtCurrentProcess(),0,true,0,0x4096,0x4096,(PUSER_THREAD_START_ROUTINE)CallOutHan dlerRoutine,0,&Thread,&Cid);

	Native_GetCurrentEntry(HandleEntry);

	Native_AddEntry((void*)NtCurrentTeb()->ProcessEnvironmentBlock->ProcessParameters->ShowWindowFlags,Thread,ObThread,ObTSuspended,HandleEntry);

	Thread = Native_GetHandleTableHandle((void*)NtCurrentTeb()->ProcessEnvironmentBlock->ProcessParameters->ShowWindowFlags,ObThread,ObTRunning);

	NtClose(Thread);

	Native_DeleteEntry((void*)NtCurrentTeb()->ProcessEnvironmentBlock->ProcessParameters->ShowWindowFlags,ObThread,ObTRunning);

	LoadedApi.RtlExitThread(0);

}

__declspec(naked)void CallOutRecaptureRoutine(void *FnPointer,void* ...)

{

	__asm

	{

		POP EBP//old stack address

		CMP EBP,0//minor parameter validations..

		JE Failed

		POP EBX//GetReturnAddress

		CMP EBX,0

		JE Failed

		POP EDX//GetCallSite

		CMP EDX,0

		JE Failed

		POP ECX//GetNumberOfParameters..

		JMP SetupJmpStack

CleanusFakeStack:

		POP EAX//GetHandleToHeap

		CMP EAX,-1

		JE Failed

		PUSH EAX//push heap handle

		PUSH 0//push 0 heapflags

		POP ECX

		PUSH ECX

		//GetProcessHeap

		ADD ECX,0x30

		MOV EAX,FS:[ECX]

        	SUB ECX,0x1E

		MOV EAX,[EAX+ECX]

		PUSH EAX//push handle to heap

		POP EDI//Does Return Value Matter

		CALL RtlFreeHeap//Free the Heap used for stack..

		XOR ECX,ECX

		JMP CallInitReady

SetupJmpStack:

		CMP ECX,0//test if there

		JE CleanupFakeStack

		POP EAX//Get a Parameter

		MOV ESI,ESP

		MOV ESP,EBP

		PUSH EAX//push the parameter onto real stack

		PUSH ESI

		DEC ECX//dec parametr counter

		POP ESP

		JMP SetupJmpStack		

CallInitReady:

		PUSHAD

		PUSH EBX

		JMP EDX //;call the function in EDX

		PUSH EAX

		POPAD

		CMP EDI,0

		JE ReturnNotImportant

		ADD ECX,0x18 //;add 18

		MOV EAX,DWORD PTR FS:[ECX] //;NtCurrentTeb to ebx

		//;return the value of call of call to a generally

		//;read/writable area Teb.NtTib.ArbritraryUserPointer

		MOV DWORD PTR DS:[EBX+14],EAX

ReturnNotImportant:

		PUSH CallOutRecaptureRoutine

		JMP RecaptureThread

Failed:

		ret	

	}

}

//see Indirect call thread on woodmann forums for further info.. 

__declspec(naked)void CallOutRecaptureRoutine(void *FnPointer,void* ...)

{

	__asm

	{	//Parameter_Entry..

		//Threads ESP in [EAX]

		//return address in [EAX+4] 

		//call site [EAX+8]

		//number of params+3[EAX+c]

		PUSH ESP

		XOR ECX,ECX

		MOV EDX,[EAX]

		CMP EDX,0

		JE  Failed

		MOV ESP,EDX

		INC ECX

		MOV	EDX,[EAX+(ECX*4)]

		MOV [ESP+(ECX*4)],EDX

		INC ECX

		MOV EDX,[EAX+(ECX*4)]

        INC ECX

		MOV EDI,[EAX+(ECX*4)]

		CMP EDI,3

		JE CallInitReady

Increment:

		INC ECX

GetParameter:

		MOV EBX,[EAX+(ECX*4)]

		PUSH EBX

		CMP EDI,ECX

		JL Increment

CallInitReady:

		JMP EDX //;call the function in EDX

		POP ESP

		XOR ECX,ECX

		ADD ECX,0x18 //;add 18

		MOV EBX,DWORD PTR FS:[ECX] //;NtCurrentTeb to ebx

		//;return the value of call of call to a generally

		//;read/writable area Teb.NtTib.ArbritraryUserPointer

		MOV DWORD PTR DS:[EBX+14],EAX

		PUSH CallOutRecaptureRoutine

		JMP RecaptureThread

Failed:

		POP ESP

		ret

	}

}

SIN32_HANDLE_TABLE_ENTRY *Init_Debug(void)

{

	wchar_t NativePath[MAX_PATH] = {0};

	UNICODE_STRING Unicode = {0};

	OBJECT_ATTRIBUTES oa = {0};

	IO_STATUS_BLOCK IOSB = {0};

	LARGE_INTEGER li = {0};

	SIN32_HANDLE_TABLE_ENTRY *HandleEntry = {0};

	ULONG HandleIndex = 0;

	HANDLE hFile = INVALID_HANDLE_VALUE;

	PEB *peb = NtCurrentPeb();

	wcscpy((wchar_t*)&NativePath,L"\\??\\";

	wcscat((wchar_t*)&NativePath,peb->ProcessParameters->ImagePathName.Buffer);

	wcscat((wchar_t*)&NativePath,L"EBUG_STREAM";

	RtlInitUnicodeString(&Unicode,(PCWSTR)&NativePath);

	InitializeObjectAttributes(&oa,&Unicode,OBJ_CASE_INSENSITIVE|OBJ_OPENIF|OBJ_KERNEL_HANDLE,0,0);

	if(NT_SUCCESS(NtCreateFile(&hFile,GENERIC_WRITE | SYNCHRONIZE,&oa,&IOSB,&li,FILE_ATTRIBUTE_NORMAL,FILE_SHARE_WRITE,FILE_OPEN_IF,FILE_WRITE_THROUGH|FILE_SYNCHRONOUS_IO_NONALE RT|FILE_NON_DIRECTORY_FILE,0,0)))

	{

		HandleEntry = (SIN32_HANDLE_TABLE_ENTRY*)RtlAllocateHandle((PRTL_HANDLE_TABLE)NtCurrentTeb()->ProcessEnvironmentBlock->ProcessParameters->ShowWindowFlags,&HandleIndex);

		HandleEntry->Handle = hFile;

		HandleEntry->HandleIndex = HandleIndex;

		HandleEntry->HandleType = ObFile;

		HandleEntry->HandleState = Ob_DbgStream;

		return HandleEntry;

	}

	return HandleEntry;

}

__checkReturn bool Write_Debug(UNICODE_STRING *UniDbg,NTSTATUS DbgStatus)

{

	char Msg[MAX_PATH] = {0};

	ANSI_STRING Ansi = {0};

	NTSTATUS Status = 0;

	IO_STATUS_BLOCK IOSB = {0};

	HANDLE hFile = INVALID_HANDLE_VALUE;

	PEB *peb = NtCurrentPeb();

	RTL_HANDLE_TABLE *HandleTable = (RTL_HANDLE_TABLE*)peb->ProcessParameters->ShowWindowFlags;

	if(HandleTable->SizeOfHandleTableEntry != sizeof(SIN32_HANDLE_TABLE_ENTRY))

	{

		return false;

	}

	hFile = Native_GetHandleTableHandle((void*)HandleTable,ObFile,Ob_DbgStream);

	if(hFile != INVALID_HANDLE_VALUE)

	{

		if(NT_SUCCESS(RtlUnicodeStringToAnsiString(&Ansi,UniDbg,true)))

		{

			strcat((char*)&Msg,Ansi.Buffer);

			_ultoa(DbgStatus,(char *)&Msg + Ansi.Length,16);

			strcat((char*)&Msg + Ansi.Length + 1,"\r\n";

			Status = NtWriteFile(hFile,0,0,0,&IOSB,(PVOID)&Msg,strlen(Msg),0,0);

			RtlFreeAnsiString(&Ansi);

			return true;

		}

	}

	return false;

}