SYSENTER hook

www.bindview.com/Support/RAZOR/ Utilities/Windows/strace_readme.cfm

[Mkz]

While looking at "ntoskrnl.exe", I just found another way to disable the SYSCALL/SYSENTER stuff and revert to the old INT 2E.

Go to HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel and create an entry named "FastSystemCallDisable" with a DWORD value of 1.

This isn't an "on-the-fly" solution, you must reboot to make it active, so I guess the posted driver will be more handy if it works for you. Unless you don't mind having your machine permanently configured for INT 2E, that is.
Still this seems to be an officially supported flag, it shouldn't stop working when you apply an SP or hotfix.

To find the code in ntoskrnl, search for the unicode text "FastSystemCallDisable". It's referenced in a table of key names and memory locations. The loc associated with that variable is then referenced in the routine that checks the processor capabilities and sets up the ring3/ring0 transition. It will end up writing the chosen stub to the 0xFFDF0300 offset which seems to be the KM equivalent to 0x7FFE0300 in user mode.

Hi, instead of looking for ways to hook int 2E or sysenter/exit, you should consider hooking the function ptr table after this system service stub. Check the kernel api spy example published by Shreiber in his "Undocumented windows 2000" book.

The idea is to find out the KiServiceTable (exported by w2k and xp) and one of its member points to this function ptr table. You probably need a good kernel device driver to accomplish this task though.

Have fun