-1

I'm trying to find the line number of the 0f05 syscall interrupt with no success.

I searched everywhere and couldn't find any way of doing that, it seems like this information is hard coded in the CPU (which make sense).

My goal is to follow the debugger to the kernel code but currently I don't know which function I need to put a break point on.

When I do "step into" on the syscall line it simply move to the next instruction like it is mov or something

Thanks

  • what do you mean by "line number"? – Igor Skochinsky Oct 9 at 9:08
  • I assume the OP is trying to debug a user space process with WinDbg and wonders why stepping in "syscall" instruction does not lead him to the syscall handler code (in kernel mode), but instead it moves to the next instruction after syscall. Am I right? – Anton Angelov Oct 9 at 11:51
  • You guys are wrong. I'm debugging a VM with KD and can debug the kernel without any problem if I put the breakpoint on a kernel function, for example. For some reason you can't step into kernel code from the syscall instruction. – Daniel Cohen Oct 9 at 13:33
  • No need to get confrontational, Anton was just making a guess from the information you provided. You can edit the question to clarify your issue (and maybe fix the title since it's not actually about interrupts) – Igor Skochinsky Oct 10 at 9:17
1

The AMD64 syscall instruction is not an interrupt (neither software nor hardware). The destination of it is stored not in IDT but in a Machine-specific register (MSR) called IA32_LSTAR.

  • Thanks, this is correct. I later found a page who explained just that. I would add that you can get the relevant information with the following command: rdmsr 0xC0000082 – Daniel Cohen Oct 10 at 15:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.