int 2eh 方式调用Native api

小技巧。但是用的人好像不多。例子: Windows 2000 下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
NtQuerySystemInformationNo = 0x97;

_declspec(naked)
NTSTATUS __stdcall PrivateNtQuerySystemInformation
(IN SYSTEM_INFORMATION_CLASS,
IN OUT PVOID,
IN ULONG,
OUT PULONG OPTIONAL)
{

_asm {
mov eax, NtQuerySystemInformationNo
lea edx, [esp+4]
int 2Eh
ret 10h
}

}