|
"Official" FastCall disabling
While looking at "ntoskrnl.exe", I just found another way to disable the SYSCALL/SYSENTER stuff and revert to the old INT 2E.
Go to HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel and create an entry named "FastSystemCallDisable" with a DWORD value of 1.
This isn't an "on-the-fly" solution, you must reboot to make it active, so I guess the posted driver will be more handy if it works for you. Unless you don't mind having your machine permanently configured for INT 2E, that is.
Still this seems to be an officially supported flag, it shouldn't stop working when you apply an SP or hotfix.
To find the code in ntoskrnl, search for the unicode text "FastSystemCallDisable". It's referenced in a table of key names and memory locations. The loc associated with that variable is then referenced in the routine that checks the processor capabilities and sets up the ring3/ring0 transition. It will end up writing the chosen stub to the 0xFFDF0300 offset which seems to be the KM equivalent to 0x7FFE0300 in user mode.
|