0

So i was reading this article :

http://waleedassar.blogspot.com/2012/07/wow64-user-mode-system-calls-hooking.html

which explains the wow64, the part that we do a far jmp and change the CS register in the same opcode is interesting :

So, we can now conclude that by changing the CS, code segment to 0x33, transition from 32-bit mode to 64-bit mode occurs and this is where system calls are taken care of.

This is the opcode in my win 7 VM : jmp far 33:7458271E

so i have two questions :

  1. What does xx mean xx:Address, does it always mean to change the CS register from whatever it is to xx?

  2. what does this changing CS register achieve? why changing it to 33 transmits from 32 bit to 64?! why 33?

  3. why this CS register change doesnt happen in Win 10 64 bit? its like this in my Win 10 : jmp dword ptr ds:[] |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.