4 ms·
Perhaps here [0] ? Starting IIS 4.0, Microsoft has added a kernel mode support driver (SPUD.SYS). This driver also calls KeAddSystemServiceTable function to ad
by JPLeRouzic 7y ago
Perhaps here [0] ?
Starting IIS 4.0, Microsoft has added a kernel mode
support driver (SPUD.SYS). This driver also calls
KeAddSystemServiceTable function to add its own system
services. This fills an entry in third array element
of KeServiceDescriptorTableShadow. Hence, its services
will start from 0x3000.
[0] https://community.osr.com/discussion/20626/system-service-dispatcher https://community.osr.com/discussion/20626/system-service-di...