Exit process without api

[FastLife]

Is there a way to shutdown/exit a process/application without using a api and without hardcoding?

[simple]

dont know if I understand u good, but instead of using apis maybe you can use retn instead, and it will "exit" the calling thread

 

depending on the app, maybe force a crash and depending on some things itll show the unhandled exception error, freeze completely, etc. this wouldnt be a clean exit

[deepzero]

a retn from the EP will return back into kernel32 and call ExitThread, which will also terminate the process.

[cypher]

hold down power button of your PC for ~5 seconds or pull the power plug.

 

ok for real: by "without hardcoding" you mean sth like calculating or decrypting the used API function calls so they arent findable /breakpointable just until they are executed?  Thats indeed possible and I'v seen that various times

[FastLife]

thank you people from tuts4you!

 

i use a ret and it seems to work nicely

 

 

to cypher: no imports is used at all.

[DMichael]

maybe:

move eax,00000000

call eax

 

or maybe some loop to freeze i think it depends on imagination

[niling]

mov esp,0xCCCCCCCC

ret

[Peter Ferrie]

Just execute int3 without any exception handler present. Windows will forcibly terminate your application (but possibly trigger a popup and Watson report as a result).

[LCF-AT]

Press the reset button on your PC.

XOR EDX,EDX

SYSENTER

4 Bytes only and bye bye.

 

greetz

[Conquest]

Is there a way to shutdown/exit a process/application without using a api and without hardcoding?

The clean way of performing this will be emulating proper syscall for exitprocess function . but it is a tiresome process to exactly make it universal considering the syscall value for each os is different .

 

http://en.wikipedia.org/wiki/Exit_%28system_call%29

Edited June 21, 2014 by Conquest

[LCF-AT]

So I think FastLife only want to know something about Windows systems & Exit and not on Linux etc right?

 

On the other hand if you don't like those postet possibilities by us etc then just use the ExitProcess API of the target itself which you want to exit if you need it.

Here the exit API is stored in Notepad.exe XP for exsample

-------------------------------------------------------------

$-608A   01001318 <>77C09E7E  msvcrt.exit
Lets say you want to patch your exit call at OEP (exsample)

-------------------------------------------------------------

$ ==>    0100739D <>  E8 00000000     CALL 010073A2          

$+5      010073A2     58              POP EAX                                    

$+6      010073A3     6A 00           PUSH 0x0 ; ExitCode

$+8      010073A5     FF90 769FFFFF   CALL DWORD PTR DS:[EAX+0xFFFF9F76]  ; msvcrt.exit
After the short call + pop into eax (or any other R32 register - not esp of course)

you have the address where the pop is into eax = 010073A2 in this case.Now check

where the exit API is stored in your file = address 01001318 and now just sub it...

010073A2 - 01001318 = 608A bytes = lenght from one address to the other and now just 

create a call "call dword [eax-608A]" (as above) and that it.Now your target can run 

with any base XY and the call will always point to exit "IF" you keep this patch at this 

address (pop address) so if you change it then just re-calc the new lenght.

Or just make a little patch who read the PEB and find ExitProcess API via export table which you can use them.Just try a little and use what you like.

 

greetz

[h4sh3m]

XOR ESP,ESP
RET
 

[FastLife]

thank you all tuts4you members, very usefulll to me

 

i want to exit without looping though exports and without crashing the program

[Cleiton]

How do that in pascal?

[EvOlUtIoN]

@Cleiton Directly in pascal it is not possible.

 

@FastLife Without crashing the application and without calling an API, you have to return over the OEP. So you can save the stack at OEP in any way you want, then just restore it and make RETN when you want to close the program. It won't give any exception, and also closes all open handles.

[xSRTsect]

@evolution: pascal has got inline asm, so why do you say it is not possible?

[FastLife]

once again thank you all guys for the information