#pragma once #include #include #include #include "fnv.hpp" #include "strings.hpp" namespace syscall { // stub for calling the syscalls class c_syscall_stub { uint8_t m_stub[11] = { 0x4c, 0x8b, 0xd1, // mov r10, rcx 0xb8, 0x00, 0x00, 0x00, 0x00, // mov eax, 0h 0x0f, 0x05, // syscall 0xc3 // retn }; public: void set_index(uint32_t index) { unsigned long old; if (VirtualProtect(m_stub, sizeof m_stub, PAGE_EXECUTE_READWRITE, &old)) { // okay now this is epic *(uint32_t*)(&m_stub[4]) = index; } } __forceinline bool validate() { return *(uint32_t*)(&m_stub[4]) != 0; } uintptr_t operator()() { return (uintptr_t)m_stub; } }; // syscaller using file_t = std::pair< uint8_t *, size_t >; class c_syscall_mgr { std::map< hash_t, c_syscall_stub > m_syscalls; file_t load_ntdll(); public: bool start(); template T get(hash_t hash) { return (T)(m_syscalls[hash]()); } }; }