Hello World with direct system calls under Windows. Without ntdll.dll, kernel32.dll, ... Any solution?

To make the question more clear I will post a short example for Linux 32 bit.

void _start()
{
   const char text[] = "hello world\n";

   long rv = 0;
   long exit_code = 0;

   // write system call to standard output
   asm volatile ("push %%ebx ; movl %2,%%ebx ; int $0x80 ; pop %%ebx"
      : "=a" (rv) \
      : "0" (4),"ri" ((long)1),"c" ((long)text), "d" ((long)(12))
      : "memory");

   // exit system call -  exit with exit code 0
   rv = 0;
   asm volatile ("push %%ebx ; movl %2,%%ebx ; int $0x80 ; pop %%ebx"
      : "=a" (rv)
      : "0" (1),"ri" (exit_code) : "memory");
}

This code can be compiled for Linux 32 bit x86 like this:

gcc -Wall -Wextra -nostartfiles -nostdlib -O3 -m32 hello32.c -o hello32

Now I want to do the same for Windows (Only for fun and to understand some internals). Currently I use Win2K SP4 (inside a VM) for testing. Therefore the system call number (which can maybe changed between different Windows versions) and some other values are for Win2K SP4. For the compilation I use the mingw compiler.

For Windows I try to write "Hello, write!\n" into a file instead of print Hello world to the console. I have already a version which make direct system calls and write into a file (additionally it use no includes). The source code looks like this:

#define FILENAME L"\\??\\C:\\data\\hello_write\\hello.txt"

// system call ids for Windows 2000 SP4
#define SYS_CALL_ID_NT_CLOSE                0x0018
#define SYS_CALL_ID_NT_CREATE_FILE          0x0020
#define SYS_CALL_ID_NT_WRITE_FILE           0x00ED
#define SYS_CALL_ID_RTL_INIT_UNICODE_STRING 0x7C8B

// many makros and defines are from the reactos source code
#ifndef VOID
#define VOID void // from winnt.h:75
#endif

//#define NTOSAPI __declspec(dllimport) // ntddk.h:62 only it the ntdll.dll is used
#define NTOSAPI static // for the own system call wrapper functions

#define DDKAPI __stdcall // from winddk.h
#define CONST const // from ddk/winddk.h:66 or. windef.h:39
#define NULL 0 // windef.h:46
#define OBJ_CASE_INSENSITIVE 64L // from ntdef.h:11

#define SYNCHRONIZE 0x100000L // from winnt.h:230
#define GENERIC_WRITE   0x40000000 // from winnt.h:241
#define FILE_SHARE_READ         0x00000001 // from winnt.h:265
#define FILE_SHARE_WRITE        0x00000002 // from winnt.h:266
#define FILE_OPEN_IF            0x00000003 // from winnt.h:298
#define FILE_SYNCHRONOUS_IO_ALERT   0x00000010 // from winnt.h:307
#define FILE_SYNCHRONOUS_IO_NONALERT    0x00000020 // from winnt.h:308
#define FILE_NON_DIRECTORY_FILE     0x00000040 // from winnt.h:309
#define STATUS_SUCCESS ((NTSTATUS)0x00000000L) // from ddk/ntstatus.h:35

// from windef.h:15
#define InitializeObjectAttributes(p,n,a,r,s) { \
    (p)->Length = sizeof(OBJECT_ATTRIBUTES); \
    (p)->RootDirectory = (r); \
    (p)->Attributes = (a); \
    (p)->ObjectName = (n); \
    (p)->SecurityDescriptor = (s); \
    (p)->SecurityQualityOfService = NULL; \
}

typedef unsigned long ULONG_PTR, *PULONG_PTR; // basetsd.h:100 - __int64 verion not necessary
typedef unsigned long DWORD; // from windef.h

typedef char CHAR; // from winnt.h:77
typedef long LONG; // from winnt.h:79
typedef unsigned short USHORT,*PUSHORT; // from winnt.h:82
typedef unsigned long ULONG,*PULONG; // from winnt.h:83
typedef void *PVOID,*LPVOID; // from winnt.h:86
typedef unsigned short wchar_t; // from winnt:100
typedef wchar_t WCHAR; // from winnt:105
typedef WCHAR *PWCHAR,*LPWCH,*PWCH,*NWPSTR,*LPWSTR,*PWSTR; // from winnt.h:106
typedef CONST WCHAR *LPCWCH,*PCWCH,*LPCWSTR,*PCWSTR; // from winnt.h:107
typedef CHAR *PCHAR,*LPCH,*PCH,*NPSTR,*LPSTR,*PSTR; // from winnt.h:108
typedef PVOID HANDLE; // from winnt.h:151
typedef HANDLE *PHANDLE,*LPHANDLE; // from winnt.h:154
typedef long long LONGLONG; // from winnt.h:167 __int64 durch long long ersetzt
typedef DWORD ACCESS_MASK, *PACCESS_MASK; // from winnt.h:1751

typedef LONG NTSTATUS, *PNTSTATUS; // from ntdef.h:28
typedef union _LARGE_INTEGER { // from winnt.h:2404
  struct {
    DWORD LowPart;
    LONG  HighPart;
  };
  LONGLONG QuadPart;
} LARGE_INTEGER, *PLARGE_INTEGER;

typedef struct _UNICODE_STRING {
    USHORT Length;
    USHORT MaximumLength;
    PWSTR  Buffer;
} UNICODE_STRING, *PUNICODE_STRING; // from ntdef.h:33

typedef struct _OBJECT_ATTRIBUTES { // from ntdef.h:51
    ULONG Length;
    HANDLE RootDirectory;
    PUNICODE_STRING ObjectName;
    ULONG Attributes;
    PVOID SecurityDescriptor;
    PVOID SecurityQualityOfService;
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;

typedef struct _IO_STATUS_BLOCK { // from ddk/winddk.h:785
    union {
        NTSTATUS  Status;
        PVOID  Pointer;
    };
    ULONG_PTR  Information;
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
// remove _ANONYMOUS_UNION and DUMMYUNIONNAME --> nameless union
// *PIO_STATUS_BLOCK is added instead of
// DECLARE_INTERNAL_OBJECT(IO_STATUS_BLOCK) see ddk/winddk.h:102

typedef VOID DDKAPI // from ddk/winddk.h:780
(*PIO_APC_ROUTINE)(
    /*IN*/ PVOID ApcContext,
    /*IN*/ PIO_STATUS_BLOCK IoStatusBlock,
    /*IN*/ ULONG Reserved);

long ntSysCall(long nr, long param)
{
    long rv;
    __asm__ volatile ("push %%ebx ; movl %2,%%ebx ; int $0x2e ; pop %%ebx"
        : "=a" (rv)
        : "0" (nr),"ri" (param) : "memory");
    return rv;
}

__declspec(dllimport)
VOID
DDKAPI
RtlInitUnicodeString(
    /*IN OUT*/ PUNICODE_STRING  DestinationString,
    /*IN*/ PCWSTR  SourceString);

NTOSAPI
VOID
DDKAPI
MyRtlInitUnicodeString(
    /*IN OUT*/ PUNICODE_STRING  DestinationString,
    /*IN*/ PCWSTR  SourceString)
{
    DestinationString->Length = 0;
    PCWCH i;
    for (i = SourceString; *i; i++) {
        DestinationString->Length++;
    }
    DestinationString->Length *= sizeof(WCHAR);
    DestinationString->MaximumLength = DestinationString->Length + sizeof(WCHAR);
    DestinationString->Buffer = (PWSTR)SourceString; // from PCWSTR to PWSTR
}

NTOSAPI
NTSTATUS
DDKAPI
MyCreateFile(
    /*OUT*/ PHANDLE  FileHandle,
    /*IN*/ ACCESS_MASK  DesiredAccess,
    /*IN*/ POBJECT_ATTRIBUTES  ObjectAttributes,
    /*OUT*/ PIO_STATUS_BLOCK  IoStatusBlock,
    /*IN*/ PLARGE_INTEGER  AllocationSize  /*OPTIONAL*/,
    /*IN*/ ULONG  FileAttributes,
    /*IN*/ ULONG  ShareAccess,
    /*IN*/ ULONG  CreateDisposition,
    /*IN*/ ULONG  CreateOptions,
    /*IN*/ PVOID  EaBuffer  /*OPTIONAL*/,
    /*IN*/ ULONG  EaLength)
{
    return ntSysCall(SYS_CALL_ID_NT_CREATE_FILE,
            (long)&FileHandle);
}

NTOSAPI
NTSTATUS
DDKAPI
MyWriteFile(
    /*IN*/ HANDLE  FileHandle,
    /*IN*/ HANDLE  Event  /*OPTIONAL*/,
    /*IN*/ PIO_APC_ROUTINE  ApcRoutine  /*OPTIONAL*/,
    /*IN*/ PVOID  ApcContext  /*OPTIONAL*/,
    /*OUT*/ PIO_STATUS_BLOCK  IoStatusBlock,
    /*IN*/ PVOID  Buffer,
    /*IN*/ ULONG  Length,
    /*IN*/ PLARGE_INTEGER  ByteOffset  /*OPTIONAL*/,
    /*IN*/ PULONG  Key  /*OPTIONAL*/)
{
    return ntSysCall(SYS_CALL_ID_NT_WRITE_FILE,
            (long)&FileHandle);
}

NTOSAPI
NTSTATUS
DDKAPI
MyClose(
    /*IN*/ HANDLE  Handle)
{
    return ntSysCall(SYS_CALL_ID_NT_CLOSE,
            (long)&Handle);
}

int main()
{
    UNICODE_STRING fileNameUnicodeStringMy;
    WCHAR filenameMy[] = FILENAME;
    MyRtlInitUnicodeString(&fileNameUnicodeStringMy, filenameMy);

    OBJECT_ATTRIBUTES objectAttributes;
    InitializeObjectAttributes(&objectAttributes, &fileNameUnicodeStringMy,
            OBJ_CASE_INSENSITIVE, NULL, NULL);
    HANDLE hFile;
    IO_STATUS_BLOCK IoStatus;
    // It should use FILE_SYNCHRONOUS_IO_NONALERT or FILE_SYNCHRONOUS_IO_ALERT
    // otherwise it failed
    NTSTATUS rv = MyCreateFile(&hFile,
            SYNCHRONIZE | GENERIC_WRITE,
            &objectAttributes,
            &IoStatus,
            NULL,
            0,
            FILE_SHARE_READ | FILE_SHARE_WRITE,
            FILE_OPEN_IF,
            //FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,
            FILE_SYNCHRONOUS_IO_ALERT | FILE_NON_DIRECTORY_FILE,
            NULL,
            0);
    if (rv != STATUS_SUCCESS) {
        return 1;
    }

    LPSTR text = "Hello, write!\n";
    rv = MyWriteFile(hFile, NULL, NULL, NULL,
            &IoStatus, text, 14, NULL, NULL);
    if (rv != STATUS_SUCCESS) {
        return 2;
    }
    rv = MyClose(hFile);
    if (rv != STATUS_SUCCESS) {
        return 3;
    }
    return 0;
}

The code can be compiled with mingw under Win2k console like this:

C:\data\hello_write>gcc -Wall hello.c -o hello.exe

This code works for me. It creates a hello.txt with the content "Hello, write!". But this version is linked against msvcrt.dll and kernel32.dll (kernel32.dll uses ntdll.dll ...).

For the next step I try to create a binary without any dependencies (no dlls, only a real static binary --> no ntdll.dll, no kernel32.dll, no msvcrt.dll)

To create a real static binary I replace the int main() with void __main(void) (and change all return x; to return; inside the main function). After that I compile with:

gcc -Wall -nostdlib -nostartfiles -nodefaultlibs hello.c

The compilation works. But the program does nothing (Doesn't work) (Can be started but no output file (and maybe no execution)). Now my question ;-)

What is wrong? What must be make to get a working "hello write" with direct system calls and without any libraries (no ntdll.dll, no kernel32.dll, ...). Maybe someone knows some good references. The solution must not be for Win2k. A solution for >= Win 2K or for the ms vc compiler would be also fin ;-) (And sorry for my bad english)