0

So i was trying to hook the ZwQuerySystemInformation or NtZwQuerySystemInformation using IAT, but i found out that these are not inside the IAT inside the memory nor in the PE file

but maybe i am not importing them properly in my code? because in my sample code which I'm trying to hook I'm basically doing this to get its address :

ZwQuerySystemInformation = (NTSTATUS(__stdcall*)(int, PVOID, ULONG_PTR, PULONG_PTR))GetProcAddress(GetModuleHandle(L"ntdll.dll"), "NtQuerySystemInformation");

ZwQuerySystemInformation(SystemProcessInformation, NULL, NULL, &size);

So my question :

  1. am i using the function wrong in my code and thats why its not IAT? do programs like task manager find the address of it and use it different?

  2. is it possible to do IAT hooking with Nt and Zw functions? if not, why? I mean why its not getting included in IAT? doesn't the loader need to fix the addresses of functions just like any other library that we use?

  3. Why can we use functions like Sleep() without doing stuff like above code and don't need to find its address, but when i try to use ZwQuerySystemInformation or the Nt one, i basically get a segment fault because it tries to access it from address 0 but compiler still recognizes it? if ntdll gets imported into all processes then why can't we get its address automatically?

  • They're usually not called directly, but instead via a Wrapper such as CreateSnapshot(). In that case, your only option is to use inline hooking of the exported address. – peter ferrie Sep 6 at 21:53
  • @peterferrie why are they wrapped around that API and where can i read more about it? also then how does this API get the address of Zw/Nt function? – OneAndOnly Sep 7 at 10:00
  • 1
  • 1
    Maybe you could also include information like what OS version, whether you are trying from 32-bit or 64-bit and so on ... besides, you clearly attempt to dynamically retrieve the function pointer, what has that got to do with the IAT hooking? I must be missing something obvious here. Last but not least ntdll.dll is a special beast indeed, much like kernel32.dll/kernelbase.dll (its Win32 subsystem counterpart, in a sense). – 0xC0000022L Sep 7 at 20:23
  • 1
    Consider this article -- specifically, the first paragraph, which should clue you in on what to Google for next (but do read the whole short article, which explains what you're running into and why): docs.microsoft.com/en-us/windows-hardware/drivers/kernel/… – dsasmblr Sep 8 at 14:00
0

"am i using the function wrong in my code and thats why its not IAT? do programs like task manager find the address of it and use it different?"

It is in IAT, but in normal cases executables will never directly import anything from ntdll. Rather all the imports will be from higher level WinAPI modules such as kernel32 (i.e kernel32.VirtualQuery calls ntdll.NtQueryVirtualMemory).

"is it possible to do IAT hooking with Nt and Zw functions? if not, why? I mean why its not getting included in IAT? doesn't the loader need to fix the addresses of functions just like any other library that we use?"

Yes, it's possible, but IAT hooking by its very nature will only redirect execution from the specific module you modify. You can do it through kernel32/kernelbase but it still won't catch anything outside of that.

"Why can we use functions like Sleep() without doing stuff like above code and don't need to find its address, but when i try to use ZwQuerySystemInformation or the Nt one, i basically get a segment fault because it tries to access it from address 0 but compiler still recognizes it? if ntdll gets imported into all processes then why can't we get its address automatically?"

You can import from ntdll manually, you probably did it incorrectly if it resolved to nullptr.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.