标签：ar sp bs ad as nbsp res br ca
XP 打完补丁 原始
nt!KiSystemServiceAccessTeb+0x12:
804df7c0 ff0538f6dfff inc dword ptr ds:[0FFDFF638h]
804df7c6 8bf2 mov esi,edx
804df7c8 8b5f0c mov ebx,dword ptr [edi+0Ch]
804df7cb 33c9 xor ecx,ecx
804df7cd 8a0c18 mov cl,byte ptr [eax+ebx]
804df7d0 8b3f mov edi,dword ptr [edi]
804df7d2 8b1c87 mov ebx,dword ptr [edi+eax*4]
804df7d5 2be1 sub esp,ecx
kd>
nt!KiSystemServiceAccessTeb+0x29:
804df7d7 c1e902 shr ecx,2
804df7da 8bfc mov edi,esp
804df7dc f6457202 test byte ptr [ebp+72h],2
804df7e0 7506 jne nt!KiSystemServiceAccessTeb+0x3a (804df7e8)
804df7e2 f6456c01 test byte ptr [ebp+6Ch],1
804df7e6 740c je nt!KiSystemServiceCopyArguments (804df7f4)
804df7e8 3b35540d5680 cmp esi,dword ptr [nt!MmUserProbeAddress (80560d54)]
804df7ee 0f83a8010000 jae nt!KiSystemCallExit2+0x9f (804df99c)
kd>
win7 打完补丁 原始
kd>
nt!KiSystemServiceAccessTeb+0x12:
83e9383e 64ff05b0060000 inc dword ptr fs:[6B0h]
83e93845 8bf2 mov esi,edx
83e93847 33c9 xor ecx,ecx
83e93849 8b570c mov edx,dword ptr [edi+0Ch]
83e9384c 8b3f mov edi,dword ptr [edi]
83e9384e 8a0c10 mov cl,byte ptr [eax+edx]
83e93851 8b1487 mov edx,dword ptr [edi+eax*4]
83e93854 2be1 sub esp,ecx
kd>
nt!KiSystemServiceAccessTeb+0x2a:
83e93856 c1e902 shr ecx,2
83e93859 8bfc mov edi,esp
83e9385b f6457202 test byte ptr [ebp+72h],2
83e9385f 7506 jne nt!KiSystemServiceAccessTeb+0x3b (83e93867)
83e93861 f6456c01 test byte ptr [ebp+6Ch],1
83e93865 740c je nt!KiSystemServiceCopyArguments (83e93873)
83e93867 3b3550f8fb83 cmp esi,dword ptr [nt!MmUserProbeAddress (83fbf850)]
83e9386d 0f832e020000 jae nt!KiSystemCallExit2+0xa5 (83e93aa1)
关于KB2839299 微软补丁前后的kifastcallentry
标签：ar sp bs ad as nbsp res br ca
原文地址：http://www.cnblogs.com/kmshhl/p/4151390.html
