- use the edx register to store the function pointer to the syscall trampoline.
This is how google Chrome checks if an exported function is a system call or not.
See https://chromium.googlesource.com/chromium/src.git/+/master/sandbox/win/src/service_resolver_32.cc and https://bugs.winehq.org/show_bug.cgi?id=21232 for details

svn path=/trunk/; revision=66161
This commit is contained in:
Jérôme Gardou 2015-02-04 16:58:41 +00:00
parent 667174effd
commit f8de863698

View file

@ -6,8 +6,8 @@ MACRO(STUBCODE_U, Name, SyscallId, ArgCount)
StackBytes = 4 * ArgCount
FPO 0, 0, 0, 0, 0, FRAME_FPO
mov eax, SyscallId
mov ecx, KUSER_SHARED_SYSCALL
call dword ptr [ecx]
mov edx, KUSER_SHARED_SYSCALL
call dword ptr [edx]
ret StackBytes
ENDM
MACRO(STUBCODE_K, Name, SyscallId, ArgCount)