<?xml version="1.0" encoding="UTF-8"?>
<!-- Generated on Sat, 26 May 2012 14:17:11 -0700 -->
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
  <channel>
    <atom:link href="http://software.intel.com/en-us/articles/intercepting-system-api-calls/feed/" rel="self" type="application/rss+xml" />
    <title>Intel Software Network Comments Feed</title>
    <link>http://software.intel.com/en-us/articles/intercepting-system-api-calls</link>
    <description></description>
    <language>en-us</language>
    <item>
      <title>By asmfan</title>
      <description><![CDATA[ The only safe trampoline methods are: to use double trampoline 2bytes (rel8) + 5bytes (rel32) jumps in place of {mov edi, edi} or using only 5bytes (rel32) trampoline that's not spanning underlying instructions to avoid potential crash - this one is available using length disassembly (or checking instructions pointer of all threads running under IRQL (=dispatch) on all processors).

This example by intel will finally badly chrash if one thread will execute wrong byte - part of trampoline if interception will interrupt the execution process of e.g. {mov edi, edi} instruction with the next byte now 3rd byte of trampoline or 2nd byte of rel32 offset - which is unknown for rescheduled/resumed previously interrupted thread. ]]></description>
      <link>http://software.intel.com/en-us/articles/intercepting-system-api-calls/#comment-51589</link>
      <pubDate>Wed, 10 Nov 2010 07:25:44 -0800</pubDate>
      <guid isPermaLink="true">http://software.intel.com/en-us/articles/intercepting-system-api-calls/#comment-51589</guid>
    </item>
    <item>
      <title>By aqidah</title>
      <description><![CDATA[ perfect codes , cheers man ]]></description>
      <link>http://software.intel.com/en-us/articles/intercepting-system-api-calls/#comment-53631</link>
      <pubDate>Thu, 16 Dec 2010 23:42:05 -0800</pubDate>
      <guid isPermaLink="true">http://software.intel.com/en-us/articles/intercepting-system-api-calls/#comment-53631</guid>
    </item>
  </channel></rss>
