Call64, Issue 64-bit System Calls

//http://waleedassar.blogspot.com
//http://www.twitter.com/waleedassar

//Use this function to issue 64-bit system calls without passing
//through Wow64 emulation layer.

#include "stdafx.h"
#include "windows.h"
#include "stdio.h"
#include "malloc.h"

#define ProcessConsoleHostProcess 0x31

//------------------------------------------------------

void* _aligned_malloc(unsigned long size,unsigned long alignment)
{
    if(size==0) return 0;
    unsigned long total_size=size+alignment+4;
    if(total_size<size) return 0;
    unsigned long pReal=(unsigned long)LocalAlloc(LMEM_ZEROINIT,total_size);
    unsigned long pRunner=pReal+4;
    if(pReal==0) return 0;

    while(pRunner & (alignment-1)) pRunner++;
    *(unsigned long*)(pRunner-4)=pReal;
    return (void*)pRunner;
}

void _aligned_free(void* pMem)
{
    if(!pMem) return;
    unsigned long p=*(((unsigned long*)pMem)-1);
    LocalFree((void*)p);
}


unsigned short Get64CSValue()
{
        unsigned short cs_64=0x33; //default
        unsigned long X86SwitchTo64BitMode=0;
        __asm
        {
                    push eax
                    mov eax,dword ptr fs:[0xC0]
                    mov X86SwitchTo64BitMode,eax
                    pop eax
        }
        if(!X86SwitchTo64BitMode) return 0;
        if(*(unsigned char*)X86SwitchTo64BitMode==0xEA) //Jmp Far
        {
             cs_64=*(unsigned short*)(X86SwitchTo64BitMode+5);
        }
        return cs_64;
}
//------------------------------------------------------


//You can change this value.
#define MAX_NUMBER_ARGUMENTS 0x30


struct LARGE_INTEGER_
{
    unsigned long Low;
    unsigned long High;
};

bool Call64(LARGE_INTEGER_* pReturnValue,unsigned long syscallNum,unsigned long numArg,...);

char shellcode64[]=
"\x48\x8B\x0C\x24\x48\x89\x0F\x48\x83\xC4\x08\x48\x8B\x0C\x24"
"\x90\x90\x48\x8B\x54\x24\x08\x4C\x8B\x44\x24\x10\x4C\x8B\x4C"
"\x24\x18\xE8\x08\x00\x00\x00\x48\x89\x06\x48\x8B\x0F\x51\xCB"
"\x4C\x8B\xD1\xB8\xCE\xCE\xCE\xCE\x0F\x05\xC3";

//I will see AdditionalIndex later.
bool Call64(LARGE_INTEGER_* pReturnValue,unsigned long syscallNum,unsigned long numArg,...)
{
    //---------------Sanity checks-------------------------------------
    if(numArg>MAX_NUMBER_ARGUMENTS) return false;
    //-----------------------------------------------------------------
    va_list arguments;
    va_start(arguments,numArg);
    //-----------Initialize first four arguments------------------------
    unsigned long rem=0;
    unsigned long extra_stack_size=0x20;
    unsigned long* pStack=0;
    if(numArg>4)
    {
        rem=numArg-4;
        extra_stack_size+=(rem*sizeof(LARGE_INTEGER_));
        pStack=(unsigned long*)_alloca(extra_stack_size);
        memset(pStack,0x0,extra_stack_size);

    }
    else
    {
        pStack=(unsigned long*)_alloca(extra_stack_size);
        memset(pStack,0x0,extra_stack_size);
    }

    LARGE_INTEGER_* pR=0;
    LARGE_INTEGER_* pStack_=(LARGE_INTEGER_*)pStack;
    for(unsigned long i=0;i<numArg;i++)
    {
            pR=va_arg(arguments,LARGE_INTEGER_*);
            pStack_->Low=pR->Low;
            pStack_->High=pR->High;
            pStack_++;
    }
    //-----------------------------------------------------------------
    if(!pReturnValue) return false;
    char* p64Code=(char*)LocalAlloc(LMEM_ZEROINIT,0x100);  //This holds code
    memcpy(p64Code,shellcode64,sizeof(shellcode64));
           *(unsigned long*)(&p64Code[0x31])=syscallNum;
           memset(pReturnValue,0,sizeof(LARGE_INTEGER_));

           char* pGate=&p64Code[0x50];
           *(unsigned long*)pGate=(unsigned long)p64Code;
           *(unsigned short*)(pGate+0x4)=Get64CSValue();
           LARGE_INTEGER_ HouseKeeping;
           LARGE_INTEGER_* pHouseKeeping=&HouseKeeping;
           __asm
           {
               mov eax,pGate
               mov esi,pReturnValue
               mov edi,pHouseKeeping
               call fword ptr[eax]
           }
    LocalFree(p64Code);
    return true;
}


//-------------------------------------Examples--------------------------------------
void ZwClose64(HANDLE h)
{
    //------------------------------------------
    LARGE_INTEGER_ ret;
    LARGE_INTEGER_ handle={(unsigned long)h,0};
    Call64(&ret,0xC /*System call ordinal of ZwClose*/,0x1,&handle);
}

void ZwDelayExecution64(BOOL bAlertable,LARGE_INTEGER* Interval)
{
    LARGE_INTEGER_ argAlertable={(unsigned long)bAlertable,0};
    LARGE_INTEGER_ argInterval ={(unsigned long)Interval,  0};
    LARGE_INTEGER_ ret;
    Call64(&ret,0x31 /*System call ordinal of ZwDelayExecution*/,0x2,&argAlertable,&argInterval);

}

int ZwSetInformationProcess64(HANDLE hProcess,unsigned long ProcessInformationClass,
                             void*  ProcessInformation,unsigned long ProcessInformationLength)
{
    LARGE_INTEGER_ loc_hProcess={0};
    if((unsigned long)hProcess==0xFFFFFFFF)
    {
        loc_hProcess.Low=0xFFFFFFFF;
        loc_hProcess.High=0xFFFFFFFF;
    }
    else loc_hProcess.Low=(unsigned long)hProcess;
    LARGE_INTEGER_ loc_ProcessInformationClass      ={(unsigned long)ProcessInformationClass,0};
    LARGE_INTEGER_ loc_ProcessInformation           ={(unsigned long)ProcessInformation,0};
    LARGE_INTEGER_ loc_ProcessInformationLength     ={(unsigned long)ProcessInformationLength,0};

    LARGE_INTEGER_ ret;
    bool B=Call64(&ret,0x19,0x4,&loc_hProcess,&loc_ProcessInformationClass,&loc_ProcessInformation,&loc_ProcessInformationLength);
    if(B) return ret.Low;
}
int ZwQueryInformationThread64(HANDLE hThread,unsigned long ThreadInformationClass,
                               void* ThreadInformation,unsigned long ThreadInformationLength,
                               unsigned long* pResultLength)
{
    LARGE_INTEGER_ loc_hThread={0};
    if((unsigned long)hThread==0xFFFFFFFE)
    {
        loc_hThread.Low=0xFFFFFFFE;
        loc_hThread.High=0xFFFFFFFF;
    }
    else loc_hThread.Low=(unsigned long)hThread;

    LARGE_INTEGER_ loc_ThreadInformationClass      ={(unsigned long)ThreadInformationClass,0};
    LARGE_INTEGER_ loc_ThreadInformation           ={(unsigned long)ThreadInformation,0};
    LARGE_INTEGER_ loc_ThreadInformationLength     ={(unsigned long)ThreadInformationLength,0};
    LARGE_INTEGER_ loc_pResultLength               ={(unsigned long)pResultLength,0};

    LARGE_INTEGER_ ret;
    bool B=Call64(&ret,0x22,0x5,&loc_hThread,&loc_ThreadInformationClass,&loc_ThreadInformation,&loc_ThreadInformationLength,&loc_pResultLength);
    if(B) return ret.Low;
}

void main()
{
    HANDLE h=OpenProcess(PROCESS_ALL_ACCESS,FALSE,GetCurrentProcessId());
    if(!h) return;
    ZwClose64(h);
    //-------------------------------------------------
    /*LARGE_INTEGER_* pNewId=(LARGE_INTEGER_*)_aligned_malloc(sizeof(LARGE_INTEGER_),0x8);
    pNewId->Low=CsrGetProcessId();
    pNewId->High=0;
    int ret=ZwSetInformationProcess64(GetCurrentProcess(),ProcessConsoleHostProcess,(void*)pNewId,0x8);
    printf("return value is %x\r\n",ret);
    _aligned_free(pNewId);
    */
    //-------------------------------------------------
    unsigned long Req_Len=0;
    unsigned long IsTerminated=0;
#define ThreadIsTerminated 0x14
    int ret=ZwQueryInformationThread64(GetCurrentThread(),ThreadIsTerminated,&IsTerminated,0x4,&Req_Len);
    printf("return value is %x Required length  %x\r\n",ret,Req_Len);
    //-------------------------------------------------
    LARGE_INTEGER interv={0,0x80000000};
    ZwDelayExecution64(FALSE,&interv);
}