██████████████████████████████████████████████████████████████████████████████████████████ █─▄▄▄▄█─▄▄─█▄─▄███▄─▄▄─███▄─▄▄▀█▄─▄▄─█▄─▄▄─█▄─▄▄─█▄─▀█▄─▄█▄─▄▄▀█▄─▄▄─█▄─▀█▄─▄█─▄▄▄─█▄─█─▄█ █▄▄▄▄─█─██─██─██▀██─▄█▀████─██─██─▄█▀██─▄▄▄██─▄█▀██─█▄▀─███─██─██─▄█▀██─█▄▀─██─███▀██▄─▄██ ▀▄▄▄▄▄▀▄▄▄▄▀▄▄▄▄▄▀▄▄▄▄▄▀▀▀▄▄▄▄▀▀▄▄▄▄▄▀▄▄▄▀▀▀▄▄▄▄▄▀▄▄▄▀▀▄▄▀▄▄▄▄▀▀▄▄▄▄▄▀▄▄▄▀▀▄▄▀▄▄▄▄▄▀▀▄▄▄▀▀ ../ ## Contents [CNTS] [0.0] Tooling [0.1] Setup dependencies / resources [0.2] Strip win32 & CRT [0.3] Do that thang [0.4] Dependencies output ## [0.0] Tooling Dependencies.exe lucasg - https://github.com/lucasg/Dependencies/releases/download/v1.11.1/Dependencies_x64_Release.zip Process hacker NT Headers - https://github.com/processhacker/phnt.git ## [0.1] Setup dependencies / resources Add ntdll.lib dependency Project Properties Page -> Configuration Properties -> Linker -> All Options -> Additional Dependencies -> (Add ntdll.lib) Include PHNT Headers into header unit dependencies Project Properties Page -> Configuration Properties -> C/C++ -> All Options -> Additonal Include Directories -> $(ProjectDir)phnt;%(AdditionalHeaderUnitDependencies) Define includes #include "phnt_windows.h" #include "phnt.h" # now can call NTAPI functions void main(void){ DbgPrint("Ayylmao\n"); } ## [0.2] Strip win32 & CRT Project Properties Page -> Configuration Properties -> Linker -> Ignore All Default Libraries -> Yes (/NODEFAULTLIB) Project Properties Page -> Configuration Properties -> Linker -> Show Progress -> Display all progress messages (/VERBOSE) Project Properties Page -> Configuration Properties -> Linker -> Entry Point -> "WhateverYouWant" Project Properties Page -> Configuration Properties -> Linker -> Generate Debug Info -> Generate Debug Information optimized for sharing and publishing (/DEBUG:FULL) Project Properties Page -> Configuration Properties -> C/C++ -> Basic Runtime Checks -> Default ((to avoid linking in __RTC_*. ) Project Properties Page -> Configuration Properties -> C/C++ -> Security Check = Disable Security Check (/GS-) ## [0.3] Do that thang Rebuild started... 1>------ Rebuild All started: Project: win32_crt_less, Configuration: Debug x64 ------ 1>win32_crt_less.c 1>Processed /NODEFAULTLIB (suppressing all default libs) 1>Starting pass 1 1>Searching libraries 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\kernel32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\user32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\gdi32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\winspool.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\comdlg32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\advapi32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\shell32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\ole32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\oleaut32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\uuid.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\odbc32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\odbccp32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\ntdll.lib: 1> Found __imp_DbgPrint 1> Referenced in win32_crt_less.obj 1> Loaded ntdll.lib(ntdll.dll) 1> Found __IMPORT_DESCRIPTOR_ntdll 1> Referenced in ntdll.lib(ntdll.dll) 1> Loaded ntdll.lib(ntdll.dll) 1> Found __NULL_IMPORT_DESCRIPTOR 1> Referenced in ntdll.lib(ntdll.dll) 1> Loaded ntdll.lib(ntdll.dll) 1> Found ntdll_NULL_THUNK_DATA 1> Referenced in ntdll.lib(ntdll.dll) 1> Loaded ntdll.lib(ntdll.dll) 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\kernel32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\user32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\gdi32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\winspool.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\comdlg32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\advapi32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\shell32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\ole32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\oleaut32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\uuid.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\odbc32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\odbccp32.lib: 1>Finished searching libraries 1>Searching libraries 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\kernel32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\user32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\gdi32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\winspool.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\comdlg32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\advapi32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\shell32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\ole32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\oleaut32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\uuid.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\odbc32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\odbccp32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\ntdll.lib: 1>Finished searching libraries 1>Searching libraries 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\kernel32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\user32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\gdi32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\winspool.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\comdlg32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\advapi32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\shell32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\ole32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\oleaut32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\uuid.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\odbc32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\odbccp32.lib: 1> Searching C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\ntdll.lib: 1>Finished searching libraries 1>Finished pass 1 1>Invoking rc.exe: 1> /v 1> /x 1> /fo 1> "C:\Users\p4\AppData\Local\Temp\lnk{86A8A118-0C90-45D9-AE8B-A7A4999D727D}.tmp" 1> "C:\Users\p4\AppData\Local\Temp\lnk{004AE08D-4C1A-4A2F-BBE7-901C9CA6578E}.tmp" 1>Microsoft (R) Windows (R) Resource Compiler Version 10.0.10011.16384 1> 1>Copyright (C) Microsoft Corporation. All rights reserved. 1> 1> 1>Using codepage 1252 as default 1>Creating C:\Users\p4\AppData\Local\Temp\lnk{86A8A118-0C90-45D9-AE8B-A7A4999D727D}.tmp 1> 1> 1>C:\Users\p4\AppData\Local\Temp\lnk{004AE08D-4C1A-4A2F-BBE7-901C9CA6578E}.tmp. 1>Writing 24:1, lang:0x409, size 381 1>Invoking cvtres.exe: 1> /machine:amd64 1> /verbose 1> /out:"C:\Users\p4\AppData\Local\Temp\lnk{00AC8A1B-30C1-461D-81EC-8FC63D855BB7}.tmp" 1> /readonly 1> "C:\Users\p4\AppData\Local\Temp\lnk{86A8A118-0C90-45D9-AE8B-A7A4999D727D}.tmp" 1>Microsoft (R) Windows Resource To Object Converter Version 14.29.30145.0 1>Copyright (C) Microsoft Corporation. All rights reserved. 1> 1>adding resource. type:MANIFEST, name:1, language:0x0409, flags:0x30, size:381 1>Unused libraries: 1> C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\kernel32.lib 1> C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\user32.lib 1> C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\gdi32.lib 1> C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\winspool.lib 1> C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\comdlg32.lib 1> C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\advapi32.lib 1> C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\shell32.lib 1> C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\ole32.lib 1> C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\oleaut32.lib 1> C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\uuid.lib 1> C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\odbc32.lib 1> C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\odbccp32.lib 1>Starting pass 2 1> * linker generated manifest res * 1> win32_crt_less.obj 1> ntdll.lib(ntdll.dll) 1> ntdll.lib(ntdll.dll) 1> ntdll.lib(ntdll.dll) 1> ntdll.lib(ntdll.dll) 1>Finished pass 2 1>win32_crt_less.vcxproj -> C:\Users\p4\source\repos\win32_crt_less\x64\Debug\win32_crt_less.exe ========== Rebuild All: 1 succeeded, 0 failed, 0 skipped ========== ## [0.4] Dependencies output Dependencies File View Options Help win32_crt_less C:\Users\p4\source\repos\win32_crt_less\x64\Debug\win32_crt_less.exe C:\Windows\system32\ntdll.dll PI Ordinal Hint Function Module Delayed IC N/A 34 (0x00000022) DbgPrint C:\Windows\system32\ntdll.dll False VirtualAddress Module Machine Type File Size Image Base Virtual Size Entry point Subsystem Subsystem Ver. Checksum C:\Windows\system32\ntdll.dll AMD64 Dll; Executable 0x001ef5b8 0x180000000 0x001f8000 0x00000000 0x00000003 10.0 0x001f3b49 (correct)