|
|
|
|
|
|
by JPLeRouzic
2483 days ago
|
|
|
Perhaps here [0] ? Starting IIS 4.0, Microsoft has added a kernel mode
support driver (SPUD.SYS). This driver also calls
KeAddSystemServiceTable function to add its own system
services. This fills an entry in third array element
of KeServiceDescriptorTableShadow. Hence, its services
will start from 0x3000. [0] https://community.osr.com/discussion/20626/system-service-di... |
|
|