NtCreateFilesyscall as this will be enough to prove the concept.
syscalls.asm- make sure the main cpp file has a different name as the project will not compile:
syscalls.asmfile to be part of the project and compiled using Microsoft Macro Assembler:
NtCreateFile(assuming it's not hooked. If hooked, just do the same for, say
NtWriteFile) using WinDbg found in
ntdll.dllmodule or within Visual Studio by resolving the function's address and viewing its disassembly there:
ntdll- note the highlighted instructions and we can skip the
jneinstructions at this point as they are irrelevant for this exercise:
SysNtCreateFilefunction can now be found in the process memory by entering the function's name in Visual Studio disassembly panel:
0x55that is normally called by
NtCreateFilefrom within ntdll.
SysNtCreateFile, we need to initialize some structures and variables (like the name of the file name to be opened, access requirements, etc.) required by the
SysNtCreateFileare being pushed on to the stack - as seen on the right disassembler panel where the break point on
SysNtCreateFileprocedure and issues the syscall for
NtCreateFile. Once the syscall finishes executing, a handle to the opened file
c:\temp\test.txtis returned to the variable
NtCreateFileAPI call, and was blocking any access to the file c:\temp\test.txt as part of the hooked routine, we would have bypassed that restriction since we did not call the
NtCreateFileAPI, but called its syscall directly instead by invoking
SysNtCreateFile- the AV/EDR would not have intercepted our attempt to open the file and we would have opened it successfully.