windows内核分析

push 0

push ebp

push ebx

push esi

push edi

push KGDT_R3_TEB + RPL_MASK

mov ebx,PCR[KPCR_SELF]

mov esi,[ebx + KPCR_CURRENT_THREAD]

push [ebx + KPC_EXCEPTION_LIST]

mov dword ptr [ebx + KPCR_EXCEPTION_LIST],-1

mov ebp,[esi + KTHREAD_INITIAL_STACK]

push UserMode

sub esp,0x48

sub ebp,0x29C

mov byte ptr[esi + KTHREAD_PREVIOUS_MODE],UserMode

cmp ebp,esp

jnz BadStack

add dword ptr [ebp + KTRAP_FRAME_DR7],0

test byte ptr[esi + KTHREAD_DEBUG_ACTIVE],0xFF

mov [esi + KTHREAD_TRAP_FRAME],ebp

jnz Dr_&Label

Dr_&Label:

SET_TF_DEBUG_HEADER

sti