Return to Question

I'm trying to reverse the Dbgv.sys (x86 kernel driver) for the DbgView tool. It has this sub_10D4A function that is called almost from the beginning of its DriverEntry. It goes as such:

The relevant piece of disassembly:

.text:00010D64                 mov     eax, ds:KeNumberProcessors
.text:00010D69                 mov     al, [eax]
.text:00010D6B                 cmp     al, 40h ; '@'
.text:00010D6D                 movsx   eax, al
.text:00010D70                 jl      short loc_10D74
.text:00010D72                 mov     eax, [eax] ; <-- line pointed out

What I don't understand is the construct that I showed with a red arrow. If KeNumberProcessors global variable is larger than or equal to 64 CPU cores (or 40h) it will execute mov eax, [eax] instruction, which will try to read a DWORD from an address that is a number of CPUs, say 40h, which makes no sense.

Wouldn't it result in a BSOD? What's the intention there?

I'm trying to reverse the Dbgv.sys (x86 kernel driver) for the DbgView tool. It has this sub_10D4A function that is called almost at the beginning of the driver's DriverEntry function. It goes as such:

The relevant piece of disassembly:

.text:00010D64                 mov     eax, ds:KeNumberProcessors
.text:00010D69                 mov     al, [eax]
.text:00010D6B                 cmp     al, 40h ; '@'
.text:00010D6D                 movsx   eax, al
.text:00010D70                 jl      short loc_10D74
.text:00010D72                 mov     eax, [eax] ; <-- line pointed out

What I don't understand is the construct that is pointed by the red arrow. If KeNumberProcessors global variable is larger than or equal to 64 CPU cores (or 40h) it will execute mov eax, [eax] instruction, which will try to read a DWORD from an address that is a number of CPUs, say 40h, which makes no sense.

Wouldn't it result in a BSOD? What's the intention there?

I'm trying to reverse the Dbgv.sys (x86 kernel driver) for the DbgView tool. It has this sub_10D4A function that is called almost from the beginning of its DriverEntry. It goes as such:

What I don't understand is the construct that I showed with a red arrow. If KeNumberProcessors global variable is larger than or equal to 64 CPU cores (or 40h) it will execute mov eax, [eax] instruction, which will try to read a DWORD from an address that is a number of CPUs, say 40h, which makes no sense.

Wouldn't it result in a BSOD? What's the intention there?

I'm trying to reverse the Dbgv.sys (x86 kernel driver) for the DbgView tool. It has this sub_10D4A function that is called almost from the beginning of its DriverEntry. It goes as such:

The relevant piece of disassembly:

.text:00010D64                 mov     eax, ds:KeNumberProcessors
.text:00010D69                 mov     al, [eax]
.text:00010D6B                 cmp     al, 40h ; '@'
.text:00010D6D                 movsx   eax, al
.text:00010D70                 jl      short loc_10D74
.text:00010D72                 mov     eax, [eax] ; <-- line pointed out

What I don't understand is the construct that I showed with a red arrow. If KeNumberProcessors global variable is larger than or equal to 64 CPU cores (or 40h) it will execute mov eax, [eax] instruction, which will try to read a DWORD from an address that is a number of CPUs, say 40h, which makes no sense.

Wouldn't it result in a BSOD? What's the intention there?

I'm trying to reverse the Dbgv.sys (x86 kernel driver) for the DbgView tool. It has this sub_10D4A function that is called almost from the beginning of its DriverEntry. It goes as such:

What I don't understand is the construct that I showed with a red arrow. If KeNumberProcessors global variable is larger than or equal to 64 CPU cores (or 40h) it will execute mov eax, [eax] instruction, which will try to read a DWORD from an address that is a number of CPUs, say 40h, that makes no sense.

Wouldn't it result in a BSOD? What's the intention there?

I'm trying to reverse the Dbgv.sys (x86 kernel driver) for the DbgView tool. It has this sub_10D4A function that is called almost from the beginning of its DriverEntry. It goes as such:

What I don't understand is the construct that I showed with a red arrow. If KeNumberProcessors global variable is larger than or equal to 64 CPU cores (or 40h) it will execute mov eax, [eax] instruction, which will try to read a DWORD from an address that is a number of CPUs, say 40h, which makes no sense.

Wouldn't it result in a BSOD? What's the intention there?