静态分析KiSystemService

  KiSystemService 是INT 2EH 后调用的

2000所有的native api 都使用INT 2EH， xp下 GDC函数 进入内核调用INT 2EH

其他native api 调用KiFastCall

.text:00465651 _KiSystemService proc near              ; CODE XREF: ZwAcceptConnectPort(x,x,x,x,x,x)+Cp

.text:00465651                                         ; ZwAccessCheck(x,x,x,x,x,x,x,x)+Cp ...

.text:00465651

.text:00465651 arg_0           = dword ptr  4

.text:00465651

.text:00465651                 push    0

.text:00465653                 push    ebp

.text:00465654                 push    ebx

.text:00465655                 push    esi

.text:00465656                 push    edi

.text:00465657                 push    fs

.text:00465659                 mov     ebx, 30h

.text:0046565E                 db      66h

.text:0046565E                 mov     fs, bx          ; 段选择子为 30H

.text:00465661                 push    dword ptr ds:0FFDFF000h ; fs:[0]

.text:00465667                 mov     dword ptr ds:0FFDFF000h, 0FFFFFFFFh

                                                                                                         ; ExceptionList = FFFFFFFFH

.text:00465671                 mov     esi, ds:0FFDFF124h

                                                                                                                         ; _KPCR.PrcbData.CurrentThread

.text:00465677                 push    dword ptr [esi+140h]

.text:0046567D                 sub     esp, 48h

.text:00465680                 mov     ebx, [esp+68h+arg_0] ; arg_0 = 8

.text:00465684                 and     ebx, 1