Posted July 28, 201213 yr Here you can find my two posts about implementing system calls hooks from user-mode in Wow64 processes and native x86 processes:http://waleedassar.b...ls-hooking.htmlhttp://waleedassar.b...stem-calls.html
July 28, 201213 yr Interesting method to make compatible between sp2 and sp3, but couldn't you just use a short jump to the Mov ESP, [ESP] filler instructions following KiFastSystemCallRet and put long jump there?? Jmp+11 seems to be safe in both service packs
July 28, 201213 yr Author BoB, your method also works fine. I have also added it as a note to the blog post. Thanks for letting me know. Edited July 28, 201213 yr by waliedassar
Create an account or sign in to comment