8.3.3 Quick System call--xp SP3 on systemcallstub Strange Problem

According to the example in the book, the ReadFile () function calls ntdll! Ntreadfile (), which puts the service number in EAX and then calls shareduserdata! SystemCallStub (), this function executes the sysenter instruction to cut into the kernel.

But the actual operation looks at the disassembly like this:

Instructions are completely chaotic, guess here should be not instructions, look back at ntdll! The calling code at Ntreadfile ():

The discovery is to shareduserdata! The address at the SystemCallStub () is written to the edx register, which is then called by the edx indirection, so presumably the data should be a function pointer:

Disassembly this address:

Found to be named ntdll! The function of Kifastsystemcall () is the internal execution of the sysenter instruction to cut into the kernel.

May be due to the actual operation of the system for XP SP3, and the book used in the system is XP SP1, it is biased.

Finally in the online search, found the "software debugging" author Zhang Banque Teacher's own answer:

Questions solved!

8.3.3 Quick System call--xp SP3 on systemcallstub Strange Problem