Exetools  

Go Back   Exetools > General > Source Code

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #1  
Old 07-22-2018, 19:45
Agmcz Agmcz is offline
Friend
 
Join Date: Mar 2018
Posts: 16
Rept. Given: 0
Rept. Rcvd 4 Times in 3 Posts
Thanks Given: 15
Thanks Rcvd at 61 Times in 13 Posts
Agmcz Reputation: 4
[Delphi/Native API] ZwTerminateProcess without declaration from UserMode

PHP Code:
function ZwTerminateProcess(hProcessDWORDuCodeDWORD): NTSTATUSstdcallassembler;
{
  
Coded By Agmcz
  Support 
for all operating systems [XP788.11032bit]
  
Tested on Windows XP/7/8.1/10.
}
asm
{$IFDEF WIN32}
  
MOV EAXFS:[$C0]
  
CMP EAX, $0
  JNZ 
@Exit
  
MOV EAXFS:[$30]
  
MOV EAX, [EAX+$A4]
  
SUB EAX, $5
  JE 
@WinXP
  DEC EAX
  JE 
@Win8_81
  SUB EAX
, $4
  JNE 
@Sys
  MOV EAX
, $0024
  JMP 
@Sys
  
@Win8_81:
  
MOV EAXEBX
  MOV EAX
, [EAX+$A8]
  
DEC EAX
  JE 
@Win7
  DEC EAX
  SUB EAX
, $2
  JAE 
@Sys
  MOV EAX
, $0023
  JMP 
@Sys
  
@Win7:
  
MOV EAX, $0172
  JMP 
@Sys
  
@WinXP:
  
MOV EAX, $0101
  
@Sys:
  
LEA EDX,[EBP+$8]
  
INT $2E
  
@Exit:
{
$ENDIF}
end
Reply With Quote
The Following 6 Users Say Thank You to Agmcz For This Useful Post:
canopus (08-11-2018), h4sh3m (07-24-2018), Insid3Code (07-28-2018), Nacho_dj (07-23-2018), niculaita (07-24-2018), Pushad (07-23-2018)
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is On


Similar Threads
Thread Thread Starter Forum Replies Last Post
Usermode APC Injection WorldCrackersUnited Source Code 4 06-05-2017 15:42
.Net native compiling atzplzw General Discussion 8 01-10-2011 15:47
ZwTerminateProcess Teerayoot General Discussion 6 09-05-2004 03:20


All times are GMT +8. The time now is 18:57.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2024 )