@Mov AX, 0xDEAD
for functions like ZwAlpcCancelMessage and others
NTSYSCALLAPI NTSTATUS NTAPI ZwAlpcCancelMessage(_In_ HANDLE PortHandle,
_In_ ULONG Flags,
_In_ PALPC_CONTEXT_ATTR MessageContext
);
void __stdcall _ZwAlpcCancelMessage@12( int p1, int p2, int p3 )
{
__asm.pushfd();
_KiSystemService();
}
in asm
void __stdcall _ZwAlpcCancelMessage@12( int p1, int p2, int p3 )
{
mov eax, 0x14
lea edx, [p1]
pushfd
push 0x8
call _KiSystemService; void __cdecl( void )
ret 0xC
}
how should we implement this?
should we take KiSystemService from trap.asm?