From e279fab5004697d2016f5d4314b8eb563b255cca Mon Sep 17 00:00:00 2001 From: _xeroxz Date: Tue, 23 Feb 2021 22:29:21 +0000 Subject: [PATCH] Update README.md --- README.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/README.md b/README.md index fdbfc81..34202e0 100644 --- a/README.md +++ b/README.md @@ -47,6 +47,14 @@ msrexec.exec([&](void* krnl_base, get_system_routine_t get_kroutine) -> void }); ``` +Result: + +``` +> allocated pool -> 0xFFFFAA8B13AD1000 +> cr4 -> 0x0000000000020678 +> hello world! +``` + # Syscall - Fast System Call SYSCALL invokes an OS system-call handler at privilege level 0. It does so by ***loading RIP from the IA32_LSTAR MSR*** (after saving the address of the instruction following SYSCALL into RCX). (The WRMSR instruction ensures that the IA32_LSTAR MSR always contain a canonical address.)