User-mode System Call Hooking

[waliedassar]

Here you can find my two posts about implementing system calls hooks from user-mode in Wow64 processes and native x86 processes:

http://waleedassar.b...ls-hooking.html

http://waleedassar.b...stem-calls.html

[BoB]

Interesting method to make compatible between sp2 and sp3, but couldn't you just use a short jump to the Mov ESP, [ESP] filler instructions following KiFastSystemCallRet and put long jump there?? Jmp+11 seems to be safe in both service packs

[waliedassar]

BoB, your method also works fine. I have also added it as a note to the blog post. Thanks for letting me know.

Edited July 28, 2012 by waliedassar