[Delphi/Native API] ZwTerminateProcess without declaration from UserMode

atom0s · #1 07-24-2018, 07:49

The sys call offset for this on Windows 10 has changed between each major patch. So this may not work for all Windows 10 versions.

Agmcz · #2 07-24-2018, 21:11

Quote:

Originally Posted by atom0s

The sys call offset for this on Windows 10 has changed between each major patch. So this may not work for all Windows 10 versions.

I have not tested on all versions of Windows 10
But it works on version 10.0.15063.

See here

Code:

System Call Symbol     System Call Number
                       Windows 10 32bit
                       Version 10240.0=1507  10586=1511 14393=1607 15063=1703 16299=1709  17134=1803 
NtTerminateProcess             0x0024        0x0024     0x0024     0x0024     0x0024      0x0024

or

Code:

https://j00ru.vexillium.org/syscalls/nt/32/

Logically will work.
You can test

Thread Tools
Show Printable Version Email this Page
Display Modes
Switch to Linear Mode Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Usermode APC Injection	WorldCrackersUnited	Source Code	4	06-05-2017 15:42
.Net native compiling	atzplzw	General Discussion	8	01-10-2011 15:47
ZwTerminateProcess	Teerayoot	General Discussion	6	09-05-2004 03:20

The Following User Says Thank You to atom0s For This Useful Post:
vic4key (07-24-2018)