Windows I/o без Kernel32.dll и Advapi32.dll

[JTG]

Ну тогда вы просто гений, если за пару дней разобрались с механизмом LPC

[coinkrsk]

Да нет конечно, без внешних вливаний интеллекта не обошлось.

На MASM`е это выглядит так:

		

.386
.model flat,stdcall

includelib ntdll.lib 
CsrClientCallServer PROTO :DWORD,:DWORD,:DWORD,:DWORD


CLIENT_ID struct 
       UniqueProcess dd ?
       UniqueThread dd ?
CLIENT_ID ends


PORT_MESSAGE struct 
       Lengthh dd ?
       ZeroInit dd ?
       ClientId CLIENT_ID <>
       Unknown dq ?
       MessageId dd ?
       CallbackId dd ?
PORT_MESSAGE ends

CSRSS_WRITE_CONSOLE_REQUEST struct 
       Header PORT_MESSAGE <>
       Unknown dq ?
       ConsoleHandle dd ?
       StdHandle dd ?
       Buffer db 80 dup (?)  ; 0x50 bytes max (40 WCHARs)
       BufferAddress dd ?
       BufferLength dd ?
       Unknown2 dd ?
       UnknownFlag db ?
       IsUnicode db ?
       Unknown4 db 42 dup (?)
       Unknown5 dd ?
       Unknown6 db 116 dup (?)
CSRSS_WRITE_CONSOLE_REQUEST ends




.data

     Request CSRSS_WRITE_CONSOLE_REQUEST <>
     RequestSize = $-Request
     wstrMessage db 'Hello World'
     wstrMessageSize = $-wstrMessage
     
   

.code

start:




     xor eax,eax
     mov edi, offset Request
     mov ecx, RequestSize
     rep stosb          

     
     assume fs:nothing
     xor eax,eax
     mov     eax, fs:[eax+30h]
     mov     eax, [eax+10h]           ; RTL_USER_PROCESS_PARAMETERS
     mov     edx, [eax+10h]           ; ProcessParameters.ConsoleHandle
     

     mov Request.ConsoleHandle, edx
     mov edx, [eax+1ch]			; ProcessParameters.StdOutputHandle
     mov Request.StdHandle, edx
     mov Request.UnknownFlag, 1
     mov Request.IsUnicode, 0
     mov Request.Unknown5, -1

     lea esi, wstrMessage
     lea edi,Request.Buffer
     mov Request.BufferAddress,edi
     mov Request.BufferLength,wstrMessageSize
     mov ecx,wstrMessageSize
     rep movsb

     invoke CsrClientCallServer,OFFSET Request,0,0002021eh,0000006ch  


retn

end start