This program based on NtCall by Peter Kosyh. It isn't advanced version and its purpose - port NtCall functionality for x64 Windows NT 6+.
- x64 Windows 7/8/8.1/10;
- Account with administrative privileges (optional).
NTCALL64 -help[-win32k][-log][-call Id][-pc Value]
- -help - show program parameters help;
- -log - enable logging via COM1 port, service parameters will be logged (slow), default disabled;
- -win32k - launch W32pServiceTable services fuzzing (sometimes referenced as Shadow SSDT);
- -call Id - fuzz syscall by supplied id (id can be from any table ntos/win32k);
- -pc Value - set pass count for each syscall (maximum value is limited to ULONG64 max value), default value 65536.
When used without parameters NtCall64 will start fuzzing services in KiServiceTable (ntos, sometimes referenced as SSDT).
Default timeout of each fuzzing thread is set to 30 sec. If logging enabled then timeout extended to 120 sec.
Note that when used with -call option all blacklists will be ignored and fuzzing thread timeout will be set to INFINITE.
Example:
- ntcall64 -log
- ntcall64 -log -pc 1234
- ntcall64 -log -pc 1234 -call 4096
- ntcall64 -win32k
- ntcall64 -win32k -log
- ntcall64 -win32k -log -pc 1234
- ntcall64 -call 4097
- ntcall64 -call 4097 -log
- ntcall64 -call 4097 -log -pc 1000
- ntcall64 -pc 1000
Note: make sure to configure Windows crash dump settings before trying this tool
(e.g. https://msdn.microsoft.com/en-us/library/windows/hardware/ff542953(v=vs.85).aspx).
It brute-force through system services and call them multiple times with input parameters randomly taken from predefined "bad arguments" list.
By using badcalls.ini configuration file you can blacklist certain services. To do this - add service name (case sensitive) to the corresponding section of the badcalls.ini, e.g. if you want to blacklist services from KiServiceTable then use [ntos] section.
Example of badcalls.ini (default config shipped with program)
[ntos] NtClose NtRaiseHardError NtReleaseKeyedEvent NtPropagationComplete NtShutdownSystem NtSuspendProcess NtSuspendThread NtTerminateProcess NtTerminateThread NtWaitForAlertByThreadId NtWaitForSingleObject NtWaitForKeyedEvent [win32k] NtUserRealWaitMessageEx NtUserShowSystemCursor NtUserSwitchDesktop NtUserLockWorkStation NtUserEnumDisplayMonitors NtUserGetMessage NtUserWaitMessage NtUserDoSoundConnect NtUserRealInternalGetMessage NtUserBroadcastThemeChangeEvent NtUserWaitAvailableMessageEx NtUserMsgWaitForMultipleObjectsEx
This program may crash the operation system, affect it stability, which may result in data lost or program crash itself. You use it at your own risk.
- win32k!NtGdiDdDDISetHwProtectionTeardownRecovery
- win32k!NtUserCreateActivationObject
- win32k!NtUserOpenDesktop
- nt!NtLoadEnclaveData
NTCALL64 comes with full source code written in C with tiny assembler usage. In order to build from source you need Microsoft Visual Studio 2015 and later versions.
- Select Platform ToolSet first for project in solution you want to build (Project->Properties->General):
- v120 for Visual Studio 2013;
- v140 for Visual Studio 2015;
- v141 for Visual Studio 2017.
- For v140 and above set Target Platform Version (Project->Properties->General):
- If v140 then select 8.1 (Note that Windows 8.1 SDK must be installed);
- If v141 then select 10.0.17763.0 (Note that Windows 10.0.17763 SDK must be installed).
(c) 2016 - 2019 NTCALL64 Project
Original NtCall by Peter Kosyh aka Gloomy (c) 2001, http://gl00my.chat.ru/