SYSENTER hook

[bilbo]

hi, niom,

should i setup a new handlerproc through WRMSR and SYSENTER_CS, SYSENTER_ESP, ..?

Yes! on a theorethical point of view you are right. In the same way one replaces INT 3 handler with a preamble (e.g. for tracing purposes) and then jumps to the old handler, the same guy on Windows XP must replace MSR register 176 (EIP) - which points currently at KiFastCallEntry - with some preamble and then jump to KiFastCallEntry.
You only need to write a kernel driver very similar to that which replace the INT 2E handler. Look for example at the code by sinister (http://www.xfocus.net/articles/200303/499.html).
Obviously you can always hook single system services.

But if you look more deeply at Windows XP architecture, you will find that:

(a) the fuc.ed SYSENTER is in userland (even if in read-only memory, and you cannot use WriteProtect on it to make it writeable because the address (0x7FFE0300) is outside the VadRoot of all the processes)

(b) on AMD processor there is no SYSENTER but INT 2E

So, we can replace SYSENTER with INT 2E and use the same tools we have for Windows 2K, don't we?

In fact after many reboots I finally manage to change on the fly the two ways to enter system services, from SYSENTER to INT 2E and vice versa, and all this without any driver involved!

It is as simple as replacing

7FFE0300: (physical 41300)      8BD4 mov edx, esp
                                0F34 sysenter
                                C3   ret

with

7FFE0300:      8D542408    lea edx, [esp+8]
               CD2E        int 2eh
               C3          ret

with some little trick to avoid system crash

does anybody have a codesnipped for this?

Maybe a tutorial... but bilbo has a lot of things to write and maybe nobody is interested... who knows...

Best regards, bilbo