ttyssh

New Member
Hi,
I have a few questions.
So if i understand correctly:
Example:
OpenProcess is a function Win32 API (wrapper?) that calls ntdll.dll (NATIVE API) which in turn calls the corresponding function in the kernel right? what function does it call in the kernel?
the prefix Nt (Example: NtOpenProcess) and Zw (Example: ZwOpenProcess) are aliases?
NtOpenProcess / ZwOpenProcess is just usermode?
what function need to use in the kernel?

PS: sry for bad english >.>
 

maka

Level 1
Hi
OpenProcess is a function Win32 API (wrapper?) that calls ntdll.dll (NATIVE API) which in turn calls the corresponding function in the kernel right?
As far as I know, you're right. If you open kernel32.dll on W10 with IDA (which has a free version, IDA Free) you'll see this:
openprocess-kernel32.png


OpenProcess from kernel32.dll will call OpenProcess from KernelBase.dll (on W10):
openprocess-KernelBase.png

OpenProcess (kernel32.dll) => OpenProcess (KernelBase.dll) => NtOpenProcess (ntdll.dll)


the prefix Nt (Example: NtOpenProcess) and Zw (Example: ZwOpenProcess) are aliases?
Yes, NtOpenProcess and ZwOpenProcess in usermode are the same:
nt-zw-Openprocess.png



what function does it call in the kernel?
if I'm not mistaken, when you call NtOpenProcess/ZwOpenprocess from usermode it will call the real NtOpenProcess from ntoskrnl.exe and if you call ZwOpenProcess from kernel mode it will call ZwOpenProcess (ntoskrnl.exe).

what function need to use in the kernel?
In kernel mode use ZwOpenProcess

sry for bad english
Welcome to the club :)

It's a pity that users like Wave and Opcode are no longer in the forum because they have a great knowledge about reversing and Windows Internals. I hope that one day they will return.
PS: I may be wrong in some of my affirmations. If someone find false information in my post, please let me know.
 

Attachments

Last edited:

Andy Ful

Level 62
Verified
Trusted
Content Creator
Hi

As far as I know, you're right. If you open kernel32.dll on W10 with IDA (which has a free version, IDA Free) you'll see this:
View attachment 194398

OpenProcess from kernel32.dll will call OpenProcess from KernelBase.dll (on W10):
View attachment 194400
OpenProcess (kernel32.dll) => OpenProcess (KernelBase.dll) => NtOpenProcess (ntdll.dll)



Yes, NtOpenProcess and ZwOpenProcess in usermode are the same:View attachment 194401



if I'm not mistaken, when you call NtOpenProcess/ZwOpenprocess from usermode it will call the real NtOpenProcess from ntoskrnl.exe and if you call ZwOpenProcess from kernel mode it will call ZwOpenProcess (ntoskrnl.exe).


In kernel mode use ZwOpenProcess


Welcome to the club :)

It's a pity that users like Wave and Opcode are no longer in the forum because they have a great knowledge about reversing and Windows Internals. I hope that one day they will return.
PS: I may be wrong in some of my affirmations. If someone find false information in my post, please let me know.
kram7750, Wave, and Opcode (Deleted member 65228), there are the names of the same smart & knowledgeable guy. There are some very interesting tutorials posted by him over some years. I also hope to see him again here on Malwaretips. You both seem to have the similar interest in programming, so it would be interesting to see your discussions.
 

maka

Level 1
kram7750, Wave, and Opcode (Deleted member 65228), there are the names of the same smart & knowledgeable guy. There are some very interesting tutorials posted by him over some years.
Honestly, I suspected that they were the same user due to some similarities in their posts. Now I have no doubt.
I respect this user a lot and I consider that his tutorials are a very valuable resource.

You both seem to have the similar interest in programming, so it would be interesting to see your discussions.
Thanks for your words :)
Yes sure we have similar interest in programming/reversing/Windows internals but, being humble, this guy is on another level.

Regards! (y)
 

ttyssh

New Member
ohh thanks for the help.

Im trying to learn how to program drivers in kernel mode,
Can i use all the functions of ntdll.dll in the driver (kernel mode)? or only functions of ntoskrnl?

EDIT:
Why NtOpenProcess don't have arguments? There are many function without arguments..
OpenProcess.png
 
Last edited:
Top