[Vrtule]

Hello,

Code: Select all

PKPCR pKpCR = (PKPCR) _readgsdword(FIELD_OFFSET(KPCR, Self));

You should use something like readgsqword if such a macro exists. Otherwise, you get only the lower 32 bits of the pointer which makes it corrupted.

[EP_X0FF]

http://gate.upm.ro/os/LABs/Windows_OS_I ... nc/amd64.h

[g4mbit]

I'm not sure I get why you gave that link. I do have the complete structure already but thanks anyways ;)

I've read (can't remember exactly where) that in x64, the kdVersionBlock might be zero'd out and that a different technique needed to be used to access it. Do you guys know anything about that? Or how I can get a hold of that structure?

[EP_X0FF]

I'm not sure I get why you gave that link. I do have the complete structure already but thanks anyways ;)

Because it have ready to use KeGetPcr and KeGetCurrentPrcb for x86-x64.

[g4mbit]

Thank you!