Zw/Nt functions

[Hartmut Birr]

Hi,

currently our Zw functions for kernel mode are implemented by an 
parameter wrapper and an int 0x2e instruction. The only reason for using 
the Zw functions in kernel mode is to bypass the buffer check. Can we 
implement the Zw functions by saving/changing/restoring the previous 
mode and calling the equal Nt function?

- Hartmut

[Alex Ionescu]

Hartmut Birr wrote:
> Hi,
>
> currently our Zw functions for kernel mode are implemented by an 
> parameter wrapper and an int 0x2e instruction. The only reason for 
> using the Zw functions in kernel mode is to bypass the buffer check. 
> Can we implement the Zw functions by saving/changing/restoring the 
> previous mode and calling the equal Nt function?
> Hartmut

Hi,

Actually they don't do INT 2E anymore since my optimizations.

Best regards,
Alex Ionescu