j
k
j a
j l
I think there is no way a syscall modifies user stack on Windows that way. Syscall nowadays is executed with 'syscall' instruction on Windows and doesn't touch anything at all on the stack.
Back to the thread
Back to the list