1

Hi i want to hook the KiFastCallEntry function from my Windows Driver , but i dont know how to get the addrres of this function , can someone pls tell me how?

Target OS is Windows 7 32 bit

Improve this question

1 Answer 1

Reset to default
1

__readmsr(IA32_SYSENTER_EIP )

Improve this answer
5
  • __readmsr undefined ? What header do i Need to use? Note, i need to get the address from kernel mode...
    – test123423
    Sep 28, 2015 at 17:25
  • You need to #include <intrin.h>.
    – Jason Geffner
    Sep 28, 2015 at 17:27
  • IA32_SYSENTER_EIP undefined ...... ?
    – test123423
    Sep 28, 2015 at 17:31
  • 1
    In my original post, I linked to the documentation for __readmsr(), which shows what header you need to include, and I linked to documentation on IA32_SYSENTER_EIP, which shows its numeric value.
    – Jason Geffner
    Sep 28, 2015 at 17:32
  • ok thx very much you helped me alot
    – test123423
    Sep 28, 2015 at 17:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.