Cover by Bill Blunden

Safari, the world’s most comprehensive technology and business learning platform.

Find the exact information you need to solve a problem on the fly, or go deeper to master the technologies and skills you need to succeed

Start Free Trial

No credit card required

O'Reilly logo

Chapter 11  Modifying Call Tables

 

A call table is just an array where each element of the array stores the address of a routine. Call tables exist both in user space and kernel space and assume different forms depending on the call table’s basic role in the grand scheme of things (see Table 11.1).

Table 11.1 Call Tables

Location Table Types of Addresses Stored
User space IAT Windows DLL routines imported by module
Kernel space IDT Interrupt handling routines (mostly hardware related)
Kernel space CPU MSRs Machine-specific registers (e.g., IA32_SYSENTER_EIP)
Kernel space GDT Entire segments of memory
Kernel space SSDT Stores addresses of executive system call routines
Kernel space IRP dispatch table Routines used by a driver to ...

Find the exact information you need to solve a problem on the fly, or go deeper to master the technologies and skills you need to succeed

Start Free Trial

No credit card required