.globl _KiSystemService
_KiFastCallEntry:
-
+
/* Set FS to PCR */
movl $PCR_SELECTOR, %ecx
movw %cx, %fs
-
+
/* Set the current stack to Kernel Stack */
movl %fs:KPCR_TSS, %ecx
- movl KTSS_ESP0(%ecx), %ecx
+ movl %ss:KTSS_ESP0(%ecx), %ecx
movl %ecx, %esp
/* Set up a fake INT Stack. */
/* Save pointer to Trap Frame */
movl %esp, %ebx
- /* Raise IRQL to HIGH_LEVEL */
+ /* Raise IRQL to APC_LEVEL */
movl $1, %ecx
call @KfRaiseIrql@4
return TRUE;
}
-BOOL
-DisableFastSystemCall(VOID)
-{
- DWORD Value = 1;
- HKEY hReg;
-
- /* Open or Create the Kernel Settings Key */
- if(RegCreateKeyEx(HKEY_LOCAL_MACHINE,
- L"SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Kernel",
- 0,
- NULL,
- REG_OPTION_NON_VOLATILE,
- KEY_SET_VALUE,
- NULL,
- &hReg,
- NULL) != ERROR_SUCCESS) {
- DbgPrint("Failed to Disable Sysenter\n");
- return FALSE;
- }
-
- /* Disable Fast System Call */
- if(RegSetValueEx(hReg,
- L"FastSystemCallDisable",
- 0,
- REG_DWORD,
- (BYTE*)&Value,
- sizeof(DWORD)) != ERROR_SUCCESS) {
- RegCloseKey(hReg);
- DbgPrint("Failed to Disable Sysenter\n");
- return FALSE;
- }
-
- /* Return Success */
- RegCloseKey(hReg);
- return TRUE;
-}
-
BOOL
EnableDriver(WCHAR *Key, BOOL Enable)
{
/* restore the exception handler */
SetUnhandledExceptionFilter(OldHandler);
- /* Disable Fast System Call no matter what */
- DisableFastSystemCall();
-
lc = DestinationPath;
lc += GetSystemDirectory(DestinationPath, MAX_PATH) - 1;
if(lc >= DestinationPath && *lc != L'\\')