While using WinDbg: u/uf to disassemble functions in ntoskrnl.exe there are functions that are used in system calls and exception handling that have these weird function call patterns and I can't really make out what is going on. For example, the output of uf nt!KiSystemService has this in the middle of it:

fffff803`66e07acb e80e010000      call    nt!KiSystemService+0x21e (fffff803`66e07bde)
fffff803`66e07ad0 4883c408        add     rsp,8
fffff803`66e07ad4 e80e010000      call    nt!KiSystemService+0x227 (fffff803`66e07be7)
fffff803`66e07ad9 4883c408        add     rsp,8
fffff803`66e07add e8eeffffff      call    nt!KiSystemService+0x110 (fffff803`66e07ad0)
fffff803`66e07ae2 4883c408        add     rsp,8
fffff803`66e07ae6 e8eeffffff      call    nt!KiSystemService+0x119 (fffff803`66e07ad9)
fffff803`66e07aeb 4883c408        add     rsp,8
fffff803`66e07aef e8eeffffff      call    nt!KiSystemService+0x122 (fffff803`66e07ae2)
fffff803`66e07af4 4883c408        add     rsp,8
fffff803`66e07af8 e8eeffffff      call    nt!KiSystemService+0x12b (fffff803`66e07aeb)
fffff803`66e07afd 4883c408        add     rsp,8
fffff803`66e07b01 e8eeffffff      call    nt!KiSystemService+0x134 (fffff803`66e07af4)

Goes on for many many more lines...

I'm pretty sure anyone who has poked around ntoskrnl.exe has seen these types of calls before, but I'm not really sure as to what's happening. Is there any explanation as to what kind of C code can cause this kind of ASM code to be compiled, or is this something else from handwritten ASM that's been linked into the executable?

  • 1
    Hi and welcome to RE.SE. Where did you get the assumption from that this is C code in its original form?
    – 0xC0000022L
    Jul 18, 2021 at 21:12
  • 1
    I don't think it came from a C source, but I thought I may be wrong. That's why I asked or is this something else from handwritten ASM that's been linked into the executable?. Jul 19, 2021 at 18:59


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.