i want to open a .exe file using ZwOpenFile. No i dont want to use OpenFile or other winapi's, just ZwOpenFile.

 

I created a simple project based upon the link down, but when i try to open calc.exe nt-status error = C0000008 == STATUS_INVALID_HANDLE.

my code is almost the same as

http://www.asmcommunity.net/forums/topic/?id=15345

Edited November 11, 201311 yr by Yoshi

Your variable names are really really confusing!

mov oa.ObjectName,offset ntpath 

This doesn't look right. I believe it should be "offset dospath".

 

See also http://eretik.omegahg.com/art/04.html (Google Translate, if you don't read Russian).

thank you for the reply.

 

not only my variable names are confusing, also the RtlDosPathNameToNtPathName_U structure. The link you gave, the link beneath this line, and some other links are defining the structure of this api all different.

http://assarbad.net/stuff/!export/apis_revealed.txt

Edited November 11, 201311 yr by Yoshi

Perhaps you need to call 'InitializeObjectAttributes' to prepare your OBJECT_ATTRIBUTES structure?

http://msdn.microsoft.com/en-us/library/windows/hardware/ff547804(v=vs.85).aspx

the initialization of the OBJECT_ATTRIBUTES strc is done right after the ntpath

Edited November 11, 201311 yr by Yoshi

After these 2 small fixes, it seems to work for me:

xor eax, eax  ; provide null ptr, not dospath here!

mov oa.RootDirectory,eax  

mov oa.ObjectName,offset dospath  ; already mentioned in my post #2

Edited November 11, 201311 yr by kao

You are da hero kao! 

 

So the file can be openend without any problem. However, this was just an demo project. Now i should open the file itself, thus base.exe. but a acces_denied error pops up

Edited November 11, 201311 yr by Yoshi

You're getting parameters wrong.

 

2nd parameter is DesiredAccess (eg. GENERIC_READ), ShareAccess (FILE_SHARE_xxx) goes into the 5th parameter.. Re-check MS documentation: http://msdn.microsoft.com/en-us/library/windows/hardware/ff567011(v=vs.85).aspx

Catch working project. password is the same.

 

Attachment was removed at topic author's request.

Edited November 13, 201311 yr by huntingspace

huntingspace, you are incredible! it seems to work, so        thank you, i knew you could fix it

 

also kao very greatfull for your help

 

you guys are amazing

which pass