On Mar 20, 2019, at 11:19 PM, Derek Lesho <dereklesho52(a)gmail.com> wrote:
Signed-off-by: Derek Lesho <dereklesho52(a)Gmail.com> --- dlls/ntoskrnl.exe/instr.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+)
diff --git a/dlls/ntoskrnl.exe/instr.c b/dlls/ntoskrnl.exe/instr.c index 67cdd327ee..192ba05ee4 100644 --- a/dlls/ntoskrnl.exe/instr.c +++ b/dlls/ntoskrnl.exe/instr.c @@ -586,6 +586,12 @@ static BYTE *INSTR_GetOperandAddr( CONTEXT *context, BYTE *instr, }
+static void fake_syscall_function(void) +{ + TRACE("() stub\n"); +} + + /*********************************************************************** * emulate_instruction * @@ -757,6 +763,25 @@ static DWORD emulate_instruction( EXCEPTION_RECORD *rec, CONTEXT *context ) context->Rip += prefixlen + 3; return ExceptionContinueExecution; } + case 0x32: /* rdmsr */ + { + int reg = context->Rcx & 0xffffffff; + TRACE("rdmsr CR 0x%08x\n", reg); + switch (reg) + { + case 0xc0000082:
You should probably use a symbolic constant here, rather than a bare magic number. Define one, if needed (and it probably will be). -Ken