wchar_t NativePath[255] = {0};

wchar_t *wString = {0};

IO_STATUS_BLOCK IOSB = {0};

LARGE_INTEGER li = {0}

NTSTATUS Status = 0;

ULONG dwWritten = 0;

__asm

{

	xor eax,eax

	add eax,0x30

	mov eax,fs:[eax]//PEB!!!

	mov eax,[eax+0x10]//RTL_USER_PROCESS_PARAMETERS!!!!

	add eax,0x38//UNICODE_STRING ImagePathName;!!!!

	mov eax,[eax][UNICODE_STRING.Buffer]//ImagePathName.Buffer!!!!!

	push eax//PUSH the buffer

	pop wString //pop it into a wchar*

}

             //we now have the Win32 Path Name and not the NT Path Name...

	//so we create our own Nt Path Name

             wcscpy((wchar_t*)&NativePath,L"\\??\\";

	wcscat((wchar_t*)&NativePath,wString);

             //string looks like:

             //\??\C:\Windows\System32\Sin32.exe

             // : is the signifier for a file stream attached to a file

	wcscat((wchar_t*)&NativePath,L"EBUG_STREAM";

             //this is what it looks like with a File Stream specified

             //\??\C:\Windows\System32\Sin32.exeEBUG_STREAM

	//Init the Created String

             RtlInitUnicodeString(&Unicode,(PCWSTR)&NativePath);

	InitializeObjectAttributes(&oa,&Unicode,OBJ_OPENIF|OBJ_KERNEL_HANDLE,0,0);

	li.QuadPart = 0x4096;

	li.LowPart = 0x4096;

	li.u.LowPart = 0x4096;

	Status = NtCreateFile(&Reusable,GENERIC_WRITE,&oa,&IOSB,&li,FILE_ATTRIBUTE_NORMAL,FILE_SHARE_WRITE,FILE_OVERWRITE_IF,FILE_WRITE_THROUGH,0,0);

             //try to write to the file stream

	Recycler = WriteFile(Reusable,"This is Sin32EBUG_STREAM\r\n",29,&dwWritten,0);

	//Flush File Stream...

             FlushFileBuffers(Reusable);

	CloseHandle(Reusable);

run wordpad "C:\Windows\System32\Sin32.exeEBUG_STREAM" 

wchar_t NativePath[255] = {0};

wchar_t *wString = {0};

IO_STATUS_BLOCK IOSB = {0};

LARGE_INTEGER li = {0}

NTSTATUS Status = 0;

ULONG dwWritten = 0;

	__asm

	{

		xor eax,eax

		add eax,0x30

		mov eax,fs:[eax]

		mov eax,[eax+0x10]

		add eax,0x38

		mov eax,[eax][UNICODE_STRING.Buffer]

		push eax

		pop wString

	}

	//wcscpy((wchar_t*)&NativePath,L"\\??\\";

	wcscat((wchar_t*)&NativePath,wString);

	wcscat((wchar_t*)&NativePath,L"EBUG_STREAM";

	RtlInitUnicodeString(&Unicode,(PCWSTR)&NativePath);

	InitializeObjectAttributes(&oa,&Unicode,OBJ_OPENIF|OBJ_KERNEL_HANDLE,0,0);

	li.QuadPart = 0x4096;

	li.LowPart = 0x4096;

	li.u.LowPart = 0x4096;

	//Status = NtCreateFile(&Reusable,GENERIC_READ | GENERIC_WRITE,&oa,&IOSB,&li,FILE_ATTRIBUTE_NORMAL,FILE_SHARE_WRITE,FILE_OVERWRITE,FILE_WRITE_THROUGH|FILE_NO_INTERMEDIATE_BUF FERING,0,0);

	Reusable = CreateFileW((LPCWSTR)&NativePath,GENERIC_WRITE,FILE_SHARE_WRITE,NULL,OPEN_ALWAYS,0,NULL );

	Recycler = WriteFile(Reusable,"This is Sin32EBUG_STREAM\r\n",31,&dwWritten,0);

	FlushFileBuffers(Reusable);

	CloseHandle(Reusable);

}

#if defined(__INTEL_COMPILER)

#pragma message("conversion does not require any typecast"

#endif

#define UNICODE

#include <wchar.h>

#define WINVER 0x0501		// Windows 5.1

#define _WIN32_WINNT 0x0501	//

#define WIN32_LEAN_AND_MEAN	//

#define WIN32_NO_STATUS		// Tell Windows headers you'll use ntstatus from NDK 

#include <windows.h>		// Declare Windows Headers like you normally would

#define NTOS_MODE_USER

#include <ntndk.h>			// Declare the NDK Headers http://code.google.com/p/native-nt-toolkit/

#include <strsafe.h>



NtStatusMsg(NTSTATUS dwStatus);



DWORD wmain (DWORD argc, WCHAR *argv[])

{

	UNICODE_STRING us;

	WCHAR path[MAX_PATH];

	PEB *peb=NtCurrentPeb();

	OBJECT_ATTRIBUTES oa;

	IO_STATUS_BLOCK iosb;

	HANDLE hFile;

	WCHAR Stream[1024];



	StringCbPrintf(&path,MAX_PATH,L"\\??\\%sEBUG_STREAM",\

		peb->ProcessParameters->ImagePathName.Buffer);

	

	RtlInitUnicodeString(&us,&path);

	

	_putws(us.Buffer);

	

	InitializeObjectAttributes(&oa,&us,OBJ_CASE_INSENSITIVE|OBJ_OPENIF|OBJ_KERNEL_HANDLE,0,0);

	

	RtlZeroMemory(&Stream,sizeof(Stream));

	StringCchCopy(&Stream,sizeof(Stream),L"Hello World!";



	signed register Status;

	

	Status = NtCreateFile(&hFile,GENERIC_READ|GENERIC_WRITE|SYNCHRONIZE,\

			&oa,&iosb,0,FILE_ATTRIBUTE_NORMAL,FILE_SHARE_READ,\

			FILE_OPEN_IF,FILE_SYNCHRONOUS_IO_NONALERT|FILE_NON_DIRECTORY_FILE,0,0);

	if ( NT_SUCCESS(Status))

	{

		if ( iosb.Information == FILE_CREATED )

		{

			Status = NtWriteFile(hFile,0,0,0,&iosb,&Stream,sizeof(Stream),0,0);

			NtStatusMsg(Status);

		}

		else if ( iosb.Information == FILE_OPENED ) 

		{

			RtlZeroMemory(&Stream,sizeof(Stream));

			Status = NtReadFile(hFile,0,0,0,&iosb,&Stream,sizeof(Stream),0,0);

			if (NT_SUCCESS(Status))

				_putws(&Stream);

			else

				NtStatusMsg(Status);

		}

		NtClose(hFile);

	}

	else

		NtStatusMsg(Status);



	RtlFreeUnicodeString(&us);

	return getwchar();

}



NtStatusMsg(NTSTATUS dwStatus)

{

	DWORD doserr = RtlNtStatusToDosError(dwStatus);

	WORD *pbuff;

	FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER|FORMAT_MESSAGE_FROM_SYSTEM,0,doserr,0,&pbuff,0x400-1,0);

	_putws(pbuff);

	LocalFree(pbuff);

}