NTCALL64

Windows NT x64 syscall fuzzer.

This program based on NtCall by Peter Kosyh. It isn't advanced version and its purpose - port NtCall functionality for x64 Windows NT 6+.

System Requirements

x64 Windows 7/8/8.1/10;
Account with administrative privileges (optional).

Usage

NTCALL64 -help[-win32k][-log][-call Id][-pc Value][-wt Value][-s]

-help - show program parameters help;
-log - enable logging via COM1 port, service parameters will be logged (slow), default disabled;
-pname - port name for logging, default COM1 (-log enabled required, mutual exclusive with -ofile);
-ofile - file name for logging, default ntcall64.log (-log enabled required, mutual exclusive with -pname);
-win32k - launch W32pServiceTable services fuzzing (sometimes referenced as Shadow SSDT);
-call Id - fuzz syscall by supplied id (id can be from any table ntos/win32k);
-pc Value - set pass count for each syscall (maximum value is limited to ULONG64 max value), default value 65536;
-wt Value - set wait timeout for calling threads in seconds (except single syscall fuzzing), default value is 30;
-s - Attempt to run program from LocalSystem account.

When used without parameters NtCall64 will start fuzzing services in KiServiceTable (ntos, sometimes referenced as SSDT).

Default timeout of each fuzzing thread is set to 30 sec. If logging enabled then timeout extended to 120 sec.

Note that when used with -call option all blacklists will be ignored and fuzzing thread timeout will be set to INFINITE.

Example:

ntcall64 -log
ntcall64 -log -pc 1234
ntcall64 -log -pc 1234 -call 4096
ntcall64 -log -ofile mylog.txt
ntcall64 -win32k -log -pname COM2
ntcall64 -win32k
ntcall64 -win32k -log
ntcall64 -win32k -log -pc 1234
ntcall64 -call 4097
ntcall64 -call 4097 -log
ntcall64 -call 4097 -log -pc 1000
ntcall64 -pc 1000
ntcall64 -s
ntcall64 -pc 1000 -s

Note: make sure to configure Windows crash dump settings before trying this tool

(e.g. https://msdn.microsoft.com/en-us/library/windows/hardware/ff542953(v=vs.85).aspx).

How it work

It brute-force through system services and call them multiple times with input parameters randomly taken from predefined "bad arguments" list.

Configuration

By using badcalls.ini configuration file you can blacklist certain services. To do this - add service name (case sensitive) to the corresponding section of the badcalls.ini, e.g. if you want to blacklist services from KiServiceTable then use [ntos] section.

Example of badcalls.ini (default config shipped with program)

[ntos]
NtClose
NtRaiseHardError
NtReleaseKeyedEvent
NtPropagationComplete
NtShutdownSystem
NtSuspendProcess
NtSuspendThread
NtTerminateProcess
NtTerminateThread
NtWaitForAlertByThreadId
NtWaitForSingleObject
NtWaitForKeyedEvent

[win32k]
NtUserRealWaitMessageEx
NtUserShowSystemCursor
NtUserSwitchDesktop
NtUserLockWorkStation
NtUserEnumDisplayMonitors
NtUserGetMessage
NtUserWaitMessage
NtUserDoSoundConnect
NtUserRealInternalGetMessage
NtUserBroadcastThemeChangeEvent
NtUserWaitAvailableMessageEx
NtUserMsgWaitForMultipleObjectsEx

Warning

This program may crash the operation system, affect it stability, which may result in data lost or program crash itself. You use it at your own risk.

Bugs found with NtCall64

Build

NTCALL64 comes with full source code written in C with tiny assembler usage. In order to build from source you need Microsoft Visual Studio 2015 and later versions.

Instructions

Select Platform ToolSet first for project in solution you want to build (Project->Properties->General):
- v120 for Visual Studio 2013;
- v140 for Visual Studio 2015;
- v141 for Visual Studio 2017;
- v142 for Visual Studio 2019.
For v140 and above set Target Platform Version (Project->Properties->General):
- If v140 then select 8.1;
- If v141/v142 then select 10.
Minimum required Windows SDK version 8.1

Lilith2/NtCall64