waliedassar

ZwQueryInformationThread(ThreadLastSystemCall)

Dec 14th, 2012
431
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. //http://waleedassar.blogspot.com
  2. //http://www.twitter.com/waleedassar
  3. //You can use this method to retrieve the last system call issued by a specific thread.
  4. #include "stdafx.h"
  5. #include "windows.h"
  6. #include "stdio.h"
  7.  
  8. #define ThreadLastSystemCall            0x15
  9.  
  10. extern "C"
  11. {
  12. int __stdcall ZwSetInformationThread(HANDLE,unsigned long,unsigned long*,unsigned long);
  13. int __stdcall ZwQueryInformationThread(HANDLE,unsigned long,unsigned long*,unsigned long,unsigned long*);
  14. }
  15.  
  16. void Wait()
  17. {
  18.     MessageBox(0,"Waliedassar","waliedassar",0);
  19.     //Sleep(INFINITE);
  20.     return;
  21. }
  22.  
  23.  
  24. struct ThreadLastSysCallInfo
  25. {
  26.     unsigned long FirstArgument;
  27.     unsigned short SysCallNumber;
  28.     unsigned short pad;
  29. };
  30.  
  31. int main(int argc, char* argv[])
  32. {
  33.  
  34.     unsigned long tid=0;
  35.     HANDLE hT=CreateThread(0,0x1000,(LPTHREAD_START_ROUTINE)&Wait,0,0,&tid);
  36.     if(!hT) return 0;
  37.     Sleep(1000);
  38.  
  39.     unsigned long length=0;
  40.     ThreadLastSysCallInfo LASTCALL={0};
  41.     int ret=ZwQueryInformationThread(hT,ThreadLastSystemCall,(unsigned long*)(&LASTCALL),0x8,&length);
  42.     if(ret>=0)
  43.     {
  44.         printf("Okay\r\n");
  45.         printf("First argument is %x\r\n",LASTCALL.FirstArgument); //FirstArgument
  46.         printf("Last System call is %x\r\n",LASTCALL.SysCallNumber); //Syscall ordinal
  47.     }
  48.     else       printf("Error: %x\r\n",ret);
  49.     return 0;
  50. }
RAW Paste Data

Adblocker detected! Please consider disabling it...

We've detected AdBlock Plus or some other adblocking software preventing Pastebin.com from fully loading.

We don't have any obnoxious sound, or popup ads, we actively block these annoying types of ads!

Please add Pastebin.com to your ad blocker whitelist or disable your adblocking software.

×