flat assembler
Message board for the users of flat assembler.

Index > Windows > KiSystemService and KiSystemFastCall

Author
Thread Post new topic Reply to topic
shism2



Joined: 14 Sep 2005
Posts: 248
shism2
Where are these 2 apis located....??

I researched and found out they were located in ntsokrnl but when I used IDA and dissambeled it... I was not able to locate the apis...
Post 18 Dec 2005, 16:14
View user's profile Send private message Reply with quote
crc



Joined: 21 Jun 2003
Posts: 637
Location: Penndel, PA [USA]
crc
The first is part of the Native API (see http://www.sysinternals.com/Information/NativeApi.html)

Quote:
The Native API exception handler in kernel mode is named KiSystemService, and it is invoked whenever a Native API is executed in user mode. Its task is to determine if the API's index number is valid, and if so, pass control to the appropriate system service in kernel mode to service the request. It does this by simply using the index number passed from user mode to index into an array called KiSystemServiceTable. Each entry in this array includes a pointer to the appropriate function and the number of parameters the function expects. KiSystemService takes the parameters passed on the user mode stack (pointed to in the edx register on x86) and pushes them on the kernel stack before calling the function specified in the array for the index.


I found some references to KiFastCall, but not to KiSystemFastCall. Google for "windows native api functions" or something similar and perhaps you can dig up more details on these undocumented APIs Smile
Post 18 Dec 2005, 19:48
View user's profile Send private message Visit poster's website Reply with quote
chris



Joined: 05 Jan 2006
Posts: 62
Location: China->US->China->?
chris
they are not exported, from the prefix you can tell.
Post 05 Jan 2006, 12:10
View user's profile Send private message Reply with quote
shism2



Joined: 14 Sep 2005
Posts: 248
shism2
??? Where are these apis at then?
Post 05 Jan 2006, 21:24
View user's profile Send private message Reply with quote
crc



Joined: 21 Jun 2003
Posts: 637
Location: Penndel, PA [USA]
crc
I think the actual code for the functions may be implemented in ntoskernel.exe; possibly you might want to check and see if anyone developing ReactOS (http://reactos.com) is certain since they're making a lot of headway on a their Windows-compatible OS.
Post 06 Jan 2006, 01:17
View user's profile Send private message Visit poster's website Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on GitHub, YouTube, Twitter.

Website powered by rwasa.