PUSHA/POPA and Syscalls
Posted: Sat Feb 25, 2006 4:31 pm
I am trying to save the return value of a syscall in register eax.
So, I can't do popa. However, if I do it the manual way [pop ..., pop ...], I get a GPF on pop edi. Is there any other way?
Code:
So, I can't do popa. However, if I do it the manual way [pop ..., pop ...], I get a GPF on pop edi. Is there any other way?
Code:
Code: Select all
[global _KeAsmSyscallIRQ]
_KeAsmSyscallIRQ:
cli
pusha
push gs
push fs
push ds
push es
push ebx ; Paramater 2
push ecx ; Paramater 1
push edx ; Function Code
call _KeSyscallIRQ
;eax already has return value
pop edx
pop ecx
pop ebx
popa
pop es
pop ds
pop fs
pop gs
iret