Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.More Info on Driver Writing and Debugging
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Switching to x86 mode by iretq doesnt work
Hello Experts!
I have some problem with switching to x86 mode in my driver.
I use command iretq to jump to another segment. Right after jump I get needed value fo CS and SS registers, but next instruction reverts back my segments to x64 mode (0x10 and 0x18).
What could be a reason?
Here is my code:
push 38h push rdx pushfq push 8h push rcx iretq
Thanks in advance!
With respect, Eugene.
Howdy, Stranger!
| Upcoming OSR Seminars | ||
|---|---|---|
| OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
| Kernel Debugging | 16-20 October 2023 | Live, Online |
| Developing Minifilters | 13-17 November 2023 | Live, Online |
| Internals & Software Drivers | 4-8 Dec 2023 | Live, Online |
| Writing WDF Drivers | 10-14 July 2023 | Live, Online |
Comments
What on earth is the purpose of this? You can't run x86 code in kernel mode on a 64-bit system.
Tim Roberts, [email protected]
Providenza & Boekelheide, Inc.
Hello Tim, thank you for the response. Why do you think so? CPU can be switched into Compatibility mode and so 32 bit code can be executed in this mode.
Last time I looked, segments 0x08 and 0x38 were unused, and there was no GDT entry for a code segment in compat mode in ring 0. Have you written your own entries to the GDT?
Tim Roberts, [email protected]
Providenza & Boekelheide, Inc.
Yes, I configured these descriptors by my custom.
The question is solved, thank you, Tim!
malware? I can't think of another reason to attempt this
Maybe, but not necessarily. I remember 100 years ago in Windows 3.1, our display drivers often shifted the chip into 32-bit mode for better performance.
Tim Roberts, [email protected]
Providenza & Boekelheide, Inc.