I am trying to compile a program that hooks KiFastSystemCall from NTDLL.dll. I am using inline assembly from a forum I found (I am by no means an assembly professional and I have 0 experience writing in it). The program compiles but crashes while executing the assembly code.
The function:
void set_up_hook() {
    void (*func)() = &new_func;
    BOOL(__stdcall *oldProtection)(LPVOID, SIZE_T, DWORD, PDWORD) = &VirtualProtect;
    std::cout << "started block number 1\n";
    __asm {
        mov esi, 07FFE0300h
        lodsd
        call changeProtection
    changeProtection :
        push eax
            push oldProtection
            push 40h
            push 6
            push eax
            call VirtualProtect
            pop eax
            retn
    }
    std::cout << "finished block 1\n";
    __asm {
        mov edx, 03EBh
        mov[eax], edx
        lea eax, [eax + 5]
        mov dl, 68h
        mov[eax], dl
    }
    std::cout << "finished block 2\n";
    __asm {
        inc eax
        mov edx, func
        mov[eax], edx
    }
    std::cout << "finished block 3\n";
    __asm {
        lea eax, [eax + 4]
        mov dl, 0C3h
        mov[eax], dl
    }
    std::cout << "done!";
}
I have divided the code into blocks to see where it crashed and it crashes at the very first block. It didn't work before as well so I don't think the division into blocks is the problem.
Thanks in advanced :D
[EDIT] I found this code with comments that I deleted because for some reason visual studio gave me errors that I couldn't solve on my own.
Here is the original code with comments:
.386
.model flat,stdcall
option casemap:none
include kernel32.inc
includelib kernel32.lib
.data
oldProtection dd ? 
fileToDelete db "C:\Temp\deleteMe.txt", 0 ; Create this file or change the path and check if it was deleted.
; Array listing all the hooks we install.
; Each hook is placed according to its function's syscall number.
arrayOfEvil DWORD 149h DUP (0), offset newNtSetInformationFile , 40h DUP (0)
.code
start:
    mov esi, 07FFE0300h
    lodsd                       ; EAX = KiFastSystemCall
    call changeProtection       ; Not changing the protection back is bad for your health
    mov edx, 03EBh              ; 0xEB06 JMP SHORT 0xE bytes
    mov [eax], edx
    
    lea eax, [eax + 5h]         ; EAX = [KiFastSystemCallRet + 1]
    mov dl, 68h                 ; 0x68 = PUSH
    mov [eax], dl
    
    inc eax
    
    mov edx, offset evilCode    ; EDX = Pointer to our trap
    mov [eax], edx              ; [KiFastSystemCallRet] = PUSH offset evilCode
    
    lea eax, [eax + 4]  
    mov dl, 0C3h                ; 0xC3 = RETN
    mov [eax], dl
    
    push offset fileToDelete
    call DeleteFile             ; Will call NtSetInformationFile
    
    retn
    
    
    changeProtection:
        push eax                    ; Save KiFastSYstemCall addr
        push offset oldProtection
        push 40h                    ; PAGE_EXECUTE_READWRITE
        push 0Ah                    
        push eax
        call VirtualProtect         ; VirutalProtect((void *)KiFastSystemCall, 10, PAGE_EXECUTE_READWRITE, &oldProtection
        pop eax
        retn
    
    evilCode:
        mov ecx, offset arrayOfEvil
        lea ecx, [ecx + eax * 4]
        mov ebx, [ecx]
        cmp ebx, 0
        jz origKiFastSystemCall
        jmp ebx
        
    newNtSetInformationFile:
        pushad
        mov edi, [esp + 38h]
        cmp edi, 0Dh                ; 0xD = FileDispositionInformation
        jnz callRealKiFastSystemCall
        xor edi, edi
        mov ebx, [esp + 30h]        ; EBX = (VOID *)dispositionInfo
        mov [ebx], dl               ; dispositionInfo.DeleteFile = 0 (FALSE)
    callRealKiFastSystemCall:
        popad   
        jmp origKiFastSystemCall
        
    origKiFastSystemCall:
        mov edx, esp
        dw 340fh                    ; SYSENTER
        retn
end start
This code is pure assembly and I wanted to integrate it into my c++ code. Also Instead of calling the evilcode routine I tried to change it so it would call my new_func. As for the other functions I use, VirtualProtect() is a winapi function and new_func() is just a demo function I created to see if the hook works, all it does is ''' std::cout << "hook worked\n"; '''
Hope this is enough info to solve the problem
