Re: Using Visual Basic to Write System-Wide Hooks

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Wondering how to hook into Interrupt 0x2E and if that might help?

>From the following page:
http://www.internals.com/articles/apispy/apispy.htm
by Yariv Kaplan.

"If you have ever examined ntdll.dll with QuickView, you might
have noticed that it exports a set of functions that begin
with the Nt prefix. These functions are actually small stubs
of code that pass control to the Windows NT kernel (NTOSKRNL)
using interrupt 2E."

"Many of the functions exported from kernel32.dll are nothing
more than control transfer routines to the stubs located in
ntdll. For example, when a Windows application issues a call
to CreateFile located in kernel32.dll, the call is redirected
to NtCreateFile, which passes it on to NT's kernel for further
processing."

--
Jim Carlock
Please post replies to newsgroup.


.

Relevant Pages

  • Re: location of CEs vector table
    ... I understood that the standard windows CE kernel cann't be adapted easily to ... support a low-end interrupt processor. ... successfully manufactured the ARM processor which support windows CE ...
    (microsoft.public.windowsce.platbuilder)
  • Re: info about IDT
    ... anything in the kernel is trusted so there is not a lot ... model of interrupt handling, you mess with it you are likely to crash. ... Don Burn (MVP, Windows DDK) ...
    (microsoft.public.development.device.drivers)
  • Shellcode & NT System Calls
    ... are actually small stubs of code that pass control to the Windows NT kernel ... are nothing more than control transfer routines to the stubs located in ntdll. ... NT's kernel for further processing. ... Do you Yahoo!? ...
    (Vuln-Dev)
  • Re: Interrupt context...
    ... > gone through most of the posts on interrupt in usenet. ... > kernel stack and ISR is executed. ... More may be saved depending on the architecture. ... Here the kernel have assembler code to save all general ...
    (comp.os.linux.development.system)
  • Re: Assembling Visual Studio generated listing files
    ... card issues an interrupt each time it has a new position for any one ... An ISR is constrained to act in < 10us, and for most modern machines, 12.5us is a very ... Without MASM and in pure C or C++ and without any Windows API/MFC, ... This is a device driver. ...
    (microsoft.public.vc.mfc)