The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

  • Twitter Updates

  • My Flickr Stream

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,861 other subscribers

Going Native – Malicious Native Applications

Posted by jpluimers on 2025/02/25

On the reading list wondering which tool chains can deliver NtAPI based development: [Wayback/Archive] Going Native – Malicious Native Applications

Via [Wayback/Archive] Thread by @MrPc69257431 on Thread Reader App with first tweet at

https://x.com/MrPc69257431/status/1864855379651498292

Note that being able to call NtAPI from your code base does not mean NtAPI based development: Pure NtAPI means you need a linker that can target a different output. See the quote from the above article (emphasis mine):

So, to get started with an empty native executable, all we have to do is include the “phnt.h” file, and set up the NtProcessStartup function. Then it’s important to tell the linker that we want to link against ntdll, and that we’ll be making a native application by passing in the “Native” text to the Subsystem linker option

It means that for instance Delphi is kind of out of the question for this, see these links on why:

Related: [Wayback/Archive] OSR Online: Nt vs. Zw – Clearing Confusion On The Native API (By: The NT Insider, Vol 10, Issue 4, July-August 2003 | Published: 15-Aug-03| Modified: 27-Aug-03)

Queries:

--jeroen


https://x.com/MrPc69257431/status/1864855379651498292

Leave a comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.