note : get address of KiFastCallEntry

在开源工程中看到取 KiFastCallEntry 地址, 但是 rdmsr  的参数 0x176, 是个魔法数.

查了资料， 弄清楚了魔法数的含义.

#ifndef IA32_SYSENTER_EIP#define IA32_SYSENTER_CS 0x174 ///< The 16-bit selector of a Ring 0 code segment#define IA32_SYSENTER_EIP 0x176 ///< The 32-bit offset into a Ring 0 code segment#define IA32_SYSENTER_ESP0x175 ///< The 32-bit stack pointer for a Ring 0 stack#endif  // #ifndef IA32_SYSENTER_EIP

PUCHAR pKiFastCallEntry = NULL;

_asm{pushad;mov ecx, IA32_SYSENTER_EIP;rdmsr;  ///< 读 MSR 寄存器mov pKiFastCallEntry, eax;popad;}/// 判断是否已经被Hookif (0xe9 == *pKiFastCallEntry){DbgPrint("Terminate System Thread\n");return;}