1

So i just compared NTterminateProcess between 32 and 64 bit version of a program, and the mov instruction which moves the syscall into eax is almost the same, both 5 byte, (both the B8 mov) but the only difference is that the last 2 byte in the 32 bit version is some random number which is not even used as the syscall number, for example opcode is its B8 - 2C000700, but the 64 bit is B8 - 2C000000, and that last part is not even used in the syscall number, the number in both of them is 2C, so whats the deal with that last 2-3 byte?

EDIT : yes it is in fact Wow64 process

EDIT 2 : heres the picture, as you can see some of them have something in the last 2 byte which is not part of syscall number, and for some reason only the ones that have their Zw shown have them, why!? also the rest of them are Zw functions as well, for example the black one is ZwQuerySystemInformation, but i dont get why its name is not showing! ( does it have anything to do with the last bytes of mov not having a number?)

(Picture taken in x32dbg)

enter image description here

EDIT3:

77C61FF0 | B8 36000000              | mov eax,36                                                                                     | 36:'6'
77C61FF5 | BA 508CC777              | mov edx,ntdll.77C78C50                                                                         |
77C61FFA | FFD2                     | call edx                                                                                       |
77C61FFC | C2 1000                  | ret 10                                                                                         |
77C61FFF | 90                       | nop                                                                                            |
77C62000 | B8 37000000              | mov eax,37                                                                                     | 37:'7'
77C62005 | BA 508CC777              | mov edx,ntdll.77C78C50                                                                         |
77C6200A | FFD2                     | call edx                                                                                       |
77C6200C | C2 0C00                  | ret C                                                                                          |
77C6200F | 90                       | nop                                                                                            |
77C62010 | B8 38000000              | mov eax,38                                                                                     | 38:'8'
77C62015 | BA 508CC777              | mov edx,ntdll.77C78C50                                                                         |
77C6201A | FFD2                     | call edx                                                                                       |
77C6201C | C2 1400                  | ret 14                                                                                         |
77C6201F | 90                       | nop                                                                                            |
77C62020 | B8 39001B00              | mov eax,1B0039                                                                                 |
77C62025 | BA 508CC777              | mov edx,ntdll.77C78C50                                                                         |
77C6202A | FFD2                     | call edx                                                                                       |
77C6202C | C2 2800                  | ret 28                                                                                         |
77C6202F | 90                       | nop                                                                                            |
77C62030 | B8 3A000000              | mov eax,3A                                                                                     | 3A:':'
77C62035 | BA 508CC777              | mov edx,ntdll.77C78C50                                                                         |
77C6203A | FFD2                     | call edx                                                                                       |
77C6203C | C2 1400                  | ret 14                                                                                         |
77C6203F | 90                       | nop                                                                                            |
77C62040 | B8 3B000000              | mov eax,3B                                                                                     | 3B:';'
77C62045 | BA 508CC777              | mov edx,ntdll.77C78C50                                                                         |
77C6204A | FFD2                     | call edx                                                                                       |
77C6204C | C2 0C00                  | ret C                                                                                          |
77C6204F | 90                       | nop                                                                                            |
77C62050 | B8 3C000000              | mov eax,3C                                                                                     | 3C:'<'
77C62055 | BA 508CC777              | mov edx,ntdll.77C78C50                                                                         |
77C6205A | FFD2                     | call edx                                                                                       |
77C6205C | C2 1C00                  | ret 1C                                                                                         |
77C6205F | 90                       | nop                                                                                            |
77C62060 | B8 3D000000              | mov eax,3D                                                                                     | 3D:'='
77C62065 | BA 508CC777              | mov edx,ntdll.77C78C50                                                                         |
77C6206A | FFD2                     | call edx                                                                                       |
77C6206C | C2 0800                  | ret 8                                                                                          |
77C6206F | 90                       | nop                                                                                            |
77C62070 | B8 3E000300              | mov eax,3003E                                                                                  |
77C62075 | BA 508CC777              | mov edx,ntdll.77C78C50                                                                         |
77C6207A | FFD2                     | call edx                                                                                       |
77C6207C | C2 0400                  | ret 4                                                                                          |
  • drag the disassembly column right side and you will See NtQuerySystemInformation 77EB0800 <ntdll.NtQuerySystemInformation> | B8 36000000 | mov eax,36 | 36:'6' – blabb Sep 5 at 18:28
  • @blabb yes but why isn't it showing the name on the right column for exactly those who have 0 in the right bytes instead of a number? what's the relation? and whats the deal with stuff like 36:6, 37:7 and such on right column, is that a bible verse or something?! :D – OneAndOnly Sep 5 at 18:36
  • it must be some bug may be when dealing with Ascii Range or printable range if you go past 0x7f both with and without have the comments go to 8b and 50008c and see xx00yy isn't a single printable character but 0xzz is so 36 is hex for printable numeral 6 finding patterns is a basic trait that should be developed bible wont teach you that – blabb Sep 5 at 18:56
1

It seems you're looking at a Wow64 syscall stubs in 32-bit ntdll.dll. WOW64 can use a special value in the high part of the syscall number for so-called Turbo thunks. From WoW64 internals by "wbenny":

typedef struct _WOW64_SYSTEM_SERVICE
{
    ULONG SystemCallNumber  : 12;
    ULONG ServiceTableIndex :  4;
    ULONG TurboThunkNumber  :  5; // Can hold values 0 - 31
    ULONG AlwaysZero        : 11;
} WOW64_SYSTEM_SERVICE, *PWOW64_SYSTEM_SERVICE;

It seems this is done to speed up extraction of syscall arguments from the x86 stack area. The thunk number used in NtTerminateProcess wrapper (7) corresponds to Thunk2ArgSpNSp which has the following code:

.text:000000006B101C40                 movsxd  r10, dword ptr [r11]
.text:000000006B101C43                 mov     edx, [r11+4]
.text:000000006B101C47                 jmp     short Thunk0Arg

So the first dword from the x86 stack (to which r11 points) is sign-extended into r10 while the second is copied into rdx (equivalent to zero-extending into rdx).

  • Interesting! i uploaded a picture in EDIT, so whats the deal with some of them having some end byte and some only having 0? and why the ones with 0 don't get a name in x64dbg? – OneAndOnly Sep 5 at 17:49
  • @OneAndOnly if TurboThunkNumber is 0, the default case calls Wow64SystemServiceEx in wow64.dll which performs full translation of input and output parameters for the corresponding x64 API instead of invoking the syscall instruction directly as done for turbo thunks. – Igor Skochinsky Sep 6 at 11:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.