-
Notifications
You must be signed in to change notification settings - Fork 32
/
interrupts.asm
124 lines (97 loc) · 1.63 KB
/
interrupts.asm
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
.code
;
; Erik3000
; https://www.unknowncheats.me/forum/anti-cheat-bypass/658736-universal-ac-bypass.html
;
extern nmi_handler_original:proc
extern nmi_handler:proc
extern pagefault_handler_original:proc
extern pagefault_handler:proc
save_general_regs macro
push rax
push rbx
push rcx
push rdx
push rsi
push rdi
push rbp
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
endm
restore_general_regs macro
pop r15
pop r14
pop r13
pop r12
pop r11
pop r10
pop r9
pop r8
pop rbp
pop rdi
pop rsi
pop rdx
pop rcx
pop rbx
pop rax
endm
asm_nmi_handler proc
save_general_regs
;
; enable interrupts
;
mov rax, QWORD PTR [rsp + 88h] ; load rflags
or rax, 200h ; set interrupt enable flag
mov QWORD PTR [rsp + 88h], rax ; save rflags
;
; call nmi handler
;
sub rsp, 40h
call nmi_handler
add rsp, 40h
restore_general_regs
jmp qword ptr [nmi_handler_original]
asm_nmi_handler endp
asm_pagefault_handler proc
save_general_regs
;
; enable interrupts
;
mov rax, QWORD PTR [rsp + 90h] ; load rflags
or rax, 200h ; set interrupt enable flag
mov QWORD PTR [rsp + 90h], rax ; save rflags
;
; error code as first parameter
;
mov rcx, [rsp + 88h] ; error code
;
; call pagefault handler
;
sub rsp, 40h
call pagefault_handler
add rsp, 40h
;
; return 0 -> jmp to original handler
;
test rax, rax
je E0
;
; continue execution
;
restore_general_regs
add rsp, 8 ; skip error code
iretq
E0:
;
; windows page fault handler
;
restore_general_regs
jmp qword ptr [pagefault_handler_original]
asm_pagefault_handler endp
end