NtCreateFile
syscall as this will be enough to prove the concept.syscalls.asm
- make sure the main cpp file has a different name as the project will not compile:Build Customizations
:masm
:syscalls.asm
file to be part of the project and compiled using Microsoft Macro Assembler:syscalls.asm
, let's define a procedure SysNtCreateFile
with a syscall number 55 that is reserved for NtCreateFile
in Windows 10:NtCreateFile
(assuming it's not hooked. If hooked, just do the same for, say NtWriteFile
) using WinDbg found in ntdll.dll
module or within Visual Studio by resolving the function's address and viewing its disassembly there:NtCreateFile
in ntdll
- note the highlighted instructions and we can skip the test
/ jne
instructions at this point as they are irrelevant for this exercise:SysNtCreateFile
procedure defined in assembly, we need to define the C function prototype that will call that assembly procedure. The NtCreateFile
prototype per MSDN is:SysNtCreateFile
function can now be found in the process memory by entering the function's name in Visual Studio disassembly panel:0x55
that is normally called by NtCreateFile
from within ntdll.SysNtCreateFile
, we need to initialize some structures and variables (like the name of the file name to be opened, access requirements, etc.) required by the NtCreateFile
:SysNtCreateFile
:SysNtCreateFile
are being pushed on to the stack - as seen on the right disassembler panel where the break point on SysNtCreateFile
is set:SysNtCreateFile
procedure and issues the syscall for NtCreateFile
. Once the syscall finishes executing, a handle to the opened file c:\temp\test.txt
is returned to the variable fileHandle
:NtCreateFile
API call, and was blocking any access to the file c:\temp\test.txt as part of the hooked routine, we would have bypassed that restriction since we did not call the NtCreateFile
API, but called its syscall directly instead by invoking SysNtCreateFile
- the AV/EDR would not have intercepted our attempt to open the file and we would have opened it successfully.