制造伪Nt函数

PVOID WINAPI 
BuildNtFunc( 
    IN ULONG ServiceId, 
    IN ULONG ParamNum 
    )
/*
* This routine offers the caller for a function as a ntdll api to call the nt service routine
* ServiceId : the index of  the nt service routine;
* ParamNum  : the number of the nt service routine's parameters.
*/
{
    PUCHAR Inst2CallNt = malloc( 32 );
    if ( Inst2CallNt )
    {
        RtlFillMemory( Inst2CallNt, 32, 0x90 );
#ifdef _X86_
        ((PULONG)Inst2CallNt)[0] = 0x0000e8b8;
        ((PULONG)Inst2CallNt)[1] = 0x0003e800;
        ((PULONG)Inst2CallNt)[2] = 0x18c20000;
        ((PULONG)Inst2CallNt)[3] = 0x0fd48b00;
        ((PULONG)Inst2CallNt)[4] = 0x9090c334;
        
        *(PULONG)&Inst2CallNt[1] = ServiceId;
        Inst2CallNt[11] = (UCHAR)(ParamNum*4);
        
        if( ParamNum == 0 )
        {
            Inst2CallNt[10] = 0xc3;
        }
#else     
        ((PULONG)Inst2CallNt)[0] = 0xb8d18b4c;
        ((PULONG)Inst2CallNt)[1] = ServiceId;
        ((PULONG)Inst2CallNt)[2] = 0x90c3050f;      
#endif
    }

    return Inst2CallNt;
}