Fun with asm

18 Jun

Today just some fun stuff with ASM, probably not the most recommended way to do things but for sure the most geeky way 😛

Get the Current Session Id:

function GetCurrentSessionId: DWORD;
asm
  mov     eax,fs:[$00000018];   // Get TEB
  mov     eax,[eax+$30];        // PPEB
  mov     eax,[eax+$1d4];       // PEB.SessionId
end;

function GetCurrentSessionId: DWORD;

asm

mov eax,fs:[$00000018]; // Get TEB

mov eax,[eax+$30]; // PPEB

mov eax,[eax+$1d4]; // PEB.SessionId

end;

Get the Current Console Session Id:

function GetConsoleSessionId: DWORD;
asm
  mov eax, [$7ffe02d8];
end;

function GetConsoleSessionId: DWORD;

asm

mov eax, [$7ffe02d8];

end;

And… if we can read it we can also write it?

procedure SetCurrentSessionId(const SessionId: DWORD);
asm
  mov     edx,fs:[$00000018];
  mov     edx,[edx+$30];
  mov     [edx+$1d4], SessionId;
end;

procedure SetCurrentSessionId(const SessionId: DWORD);

asm

mov edx,fs:[$00000018];

mov edx,[edx+$30];

mov [edx+$1d4], SessionId;

end;

and

procedure SetConsoleSessionId(const SessionId: DWORD);
var
  p: PDWORD;
  OldProtect: DWORD;
begin
  p := PDWORD($7ffe02d8);
  Win32Check(VirtualProtect(p, SizeOf(p), PAGE_READWRITE, @OldProtect));
  p^ := SessionId;
  Win32Check(VirtualProtect(p, SizeOf(p), OldProtect, @OldProtect));
end;

procedure SetConsoleSessionId(const SessionId: DWORD);

var

p: PDWORD;

OldProtect: DWORD;

begin

p := PDWORD($7ffe02d8);

Win32Check(VirtualProtect(p, SizeOf(p), PAGE_READWRITE, @OldProtect));

p^ := SessionId;

Win32Check(VirtualProtect(p, SizeOf(p), OldProtect, @OldProtect));

end;

You can safely try it since it of course affects the current process only, so don’t worry.

And perhaps more usefull

procedure SetIsDebuggerPresent(const Value: Boolean);
asm
  mov edx,fs:[$00000018];     // TEB
  mov edx, [edx+$30];         // PPEB
  mov byte ptr[edx+2], Value; // +0x002 BeingDebugged    : UChar
end;

procedure SetIsDebuggerPresent(const Value: Boolean);

asm

mov edx,fs:[$00000018]; // TEB

mov edx, [edx+$30]; // PPEB

mov byte ptr[edx+2], Value; // +0x002 BeingDebugged : UChar

end;

Please consider donating something (even a small amount is ok) to support this site and my work:

Filed under: Delphi, Programming

2 Responses for "Fun with asm"

Petar July 5th, 2010 at 23:28 1
Exellent article Remko!
Little question: imagine you have ThreadA and ThreadB. Is it possible to get ThreadB’s TEB from within ThreadA?
Thanks!
daNIL July 6th, 2010 at 10:30 2
It’s possible by using NtQueryInformationThread function with ThreadBasicInformation class.

Entries (RSS)
Comments (RSS)

Remko Weijnen's Blog (Remko's Blog)

Fun with asm

Related

2 Responses for "Fun with asm"

Leave a reply

Profile

Top Posts

Recent Comments

Featured Downloads

Blogroll

Categories

Archives