But first, a word from our sponsor, O'Reilly & Associates...
 [The World Wide Web Journal]
A publication of the World Wide Web Consortium (W3C)
----------------------------------------------------------------------------

Adding New System Services to the Windows NT Kernel

This page last updated April 11, 1997
Copyright (C) 1997 Prasad Dabak, Sandeep Phadke, and Milind Borate
----------------------------------------------------------------------------

Microsoft Windows NT provides a set of system services (similar to the
System Call Interface under UNIX). Various environment subsystems such as
WIN32 and use these services for implementing their own APIs.

The system services are implemented by a system trap (INT 2Eh on Intel X86
processors); see Helen Custer's Inside Windows NT (page 230) and the
discussion of "Undocumented NT" in Andrew Schulman et al., Undocumented DOS,
2nd edition (pages 225-227).

Under Windows NT, NTDLL.DLL provides the system call interface. The user
level DLLs such as KERNEL32 call this interface. NTDLL.DLL fills the service
id in the EAX register, fills EDX register with a pointer to the stack frame
required for the service and then issues an INT 2Eh. The control passes
through the interrupt descriptor table (IDT) to a handler in NTOSKRNL.EXE.
This handler in called _KiSystemService. The handler uses the system service
dispatch table (SSDT) to locate the handler for a particular service and
calls the service.

There is NO documented way to add new system services to the Windows NT
kernel. Our method of adding new system services to NT kernel fits in the
exising skeleton of the INT 2Eh handler. Therefore we now have the solution
for the problem noted on page 231 of Helen Custer's Inside Windows NT, which
states:

     "The kernel can support new system services simply by expanding
     the table, without requiring changes to the system or to
     applications... ... Although neither this capability nor its user
     interface is present in the first release of Windows NT, it could
     be added at a later time".

We discovered that in the 3.51 and 4.0 releases of NT, it is possible to
extend the SSDT using some tricks.

Using the sample program

1. Download ADDSYS.ZIP

2. Unzip the file ADDSYS.ZIP using the command "pkunzip -d ADDSYS.ZIP"

2. Change to the BIN directory: cd BIN

3. Run the INSTDRV.EXE program to load the driver which will add new system
services to the kernel. (The INSTDRV.EXE is compiled using the NT 3.51 DDK
sample files and is contained in the ADDSYS.ZIP file.)

INSTDRV EXTNDDRV C:\SAMPLE\BIN\EXTNDDRV.SYS

Note: It is important that you specify the COMPLETE path to the EXTNDDRV.SYS
driver file as indicated above. The above example assumes that you have
unzipped the file from C:\SAMPLE directory.

4. When the driver is loaded, it will add a total of 7 services to the NT
kernel. Each of these services return values between 0 and 6. i.e Service 0
returns 0, Service 1 returns 1 and so on...

Each of these services outputs a debug message: "Kernel service ## called
..." (which you will be seen if you are running under a kernel-mode debugger
such as Nu-Mega Soft-ICE for Windows NT.)

5. Run the program called MYAPP.EXE. This executable will call functions
from a DLL called MYNTDLL.DLL. MYNTDLL.DLL is just like NTDLL.DLL. It
provides "INT 2E" wrappers around the new services implemented inside
kernel. The MYAPP.EXE calls each of the newly added 7 services and prints a
return value from these services. This should confirm the correct execution
of MYAPP.EXE calling the newly added system services using MYNTDLL.DLL
wrappers.

Recompiling the source code

1. MYAPP.EXE and MYNTDLL.DLL are compiled using the MSVC ++ Ver. 4.0
EXTNDSYS.SYS is compiled using the NT 3.51 DDK build environment.

2. The file ADDSYS.OBJ is the one which actually adds services to the NT
Kernel. Source code for this file is NOT yet disclosed. You may modify the
EXTNDSYS.C file to change the implementation of a service or to play around
with the mechanism. The source code for ADDSYS.OBJ will be presented in our
forthcoming book Undocumented Windows NT to be published by O'Reilly
Associates.

3. You can not change the number of parameter which each of the service
expects, since this information is hardcoded in ADDSYS.OBJ file by design.
----------------------------------------------------------------------------
Undocumented Bookstore