7FFE0308h is a pointer inside the
The pre-set address for access from kernel mode is defined symbolically in WDM.H as KI_USER_SHARED_DATA. It helps when debugging to remember that this is 0xFFDF0000 or 0xFFFFF780`00000000, respectively, in 32-bit and 64-bit Windows. Also defined is a convenient symbol, SharedUserData, which casts this constant address to a KUSER_SHARED_DATA pointer.
The read-only user-mode address for the shared data is 0x7FFE0000, both in 32-bit and 64-bit Windows.
We see from that ref above that SharedUserData+0x308 is
0x0308 ULONG SystemCall
for Windows versions 1511 and higher.
So what does it do?
// On AMD64, this value is initialized to a nonzero value if the system
// operates with an altered view of the system service call mechanism.
from recent ntddk.h
...not very helpful.
So what's the difference between int 2e and syscall in this context?
Might be a clue: 'int 2e' instruction can be trapped by vmx, syscall not
More info here: https://www.amossys.fr/fr/ressources/blog-technique/windows10-th2-int2e-mystery/
In the context of your question the
int 0x2e system calls probably have something to do with Virtualization Based Security. They have been present in Windows 10 since version 1511, after having been removed as a syscall method since Windows 8.