Exetools  

Go Back   Exetools > General > Source Code

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 03-27-2020, 14:29
Sir.V65j Sir.V65j is offline
Friend
 
Join Date: Oct 2010
Posts: 66
Rept. Given: 35
Rept. Rcvd 32 Times in 15 Posts
Thanks Given: 70
Thanks Rcvd at 54 Times in 21 Posts
Sir.V65j Reputation: 32
Thanks Bro
Can you help me for do this in Delphi?
Reply With Quote
  #2  
Old 03-27-2020, 17:15
h4sh3m h4sh3m is offline
Friend
 
Join Date: Aug 2016
Location: RCE
Posts: 61
Rept. Given: 1
Rept. Rcvd 4 Times in 2 Posts
Thanks Given: 54
Thanks Rcvd at 81 Times in 35 Posts
h4sh3m Reputation: 4
Sample for NtClose in delphi(x86 api), before testing check function index in your system and replace it in array(in my system index value is $0C).

Code:
program Project1;

{$APPTYPE CONSOLE}

uses
  Windows;

var
  Nt_xyz{NtClose} : function(a1 : THandle) : DWORD; Stdcall;
  Nt_xyz_Bytes : array[0..23] of Byte = ($B8, $0C, $00, $00, $00, $33, $C9, $8D, $54, $24, $04, $64, $FF, $15, $C0, $00, $00, $00, $83, $C4, $04, $C2, $04, $00);
  w : DWORD;
  hndl : THandle;

begin
  if not(VirtualProtect(@Nt_xyz_Bytes[0], High(Nt_xyz_Bytes), PAGE_EXECUTE, w)) then
    exit;

  FlushInstructionCache(GetCurrentProcess(), @Nt_xyz_Bytes[0], High(Nt_xyz_Bytes));

  @Nt_xyz := @Nt_xyz_Bytes[0];

  hndl := OpenProcess(PROCESS_VM_READ{PROCESS_ALL_ACCESS}, False, GetCurrentProcessId);
  if hndl <> 0 then
    Nt_xyz(hndl);
    //CloseHandle(hndl);
end.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is On


Similar Threads
Thread Thread Starter Forum Replies Last Post
Systrack - Linux kernel syscall implementation tracker blue_devil Community Tools 0 03-21-2024 15:06
C# (Classic .exe, Windows 10, Windows Phone etc.) Protection delidolunet General Discussion 7 10-11-2016 01:10
(Q) .NET App Source Code Protection (Silverlight, Windows Phone, Windows 8) delidolunet General Discussion 7 08-02-2013 10:33
Windows 2000 and Windows nt 4 sources, question shady General Discussion 2 04-15-2004 04:17


All times are GMT +8. The time now is 20:14.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )