[madaboo]

Hi,

Any ideas how to obtain SYSENTER_EIP_MSR (unexported nt!kiFastCallEntry) in kernel module?
Only way I see is to attach to user process, call any zw api then get call stack and tkae address of kitrap - however I'm not sure if it can work?
Any ideas guys?

Thanks!

[rkhunter]

Code: Select all

mov ecx, 176h
rdmsr

EAX -> address (KiFastCallEntry on clean system). Look Intel Manuals - rdmsr instruction, vol 2B as i remember at
http://www.kernelmode.info/forum/viewto ... f=13&t=994

[madaboo]

rkhuner.. Yeah I know I can do it like this .. but I'm looking for C/C++ solution without asm..
but maybe there is no such solution?

Thanks a lot anyway!

[rkhunter]

http://msdn.microsoft.com/en-us/library ... s.80).aspx