char pretr[6] = {0x78, 0x56, 0x34, 0x12, 0x28, 0x00};
void _declspec(naked) test()
{
_asm
{
int 3
iretd
//jmp fword ptr ds:[pretr]
}
}
int main(int argc, char* argv[])
{
char sele[6] = {0};
*(DWORD*)sele = 0x12345678;
*(WORD*)&sele[4] = 0x0048;
DWORD cr3 = 0;
printf("cr3:");
scanf("%x",&cr3);
//12ff0c
DWORD myTSS[26] ={
0x00000000, //0 previous task link
0x0012fe00, //4 esp0
0x00000010, //8
0x00000000, //12
0x00000000, //16
0x00000000, //20
0x00000000, //24
cr3, //28 cr3
0x00401020, //32 eip
0x00000000, //36 eflags
0x00000000, //40 eax
0x00000000, //44 ecx
0x00000000, //48 edx
0x00000000, //52 ebx
0x0012fe00, //56 esp
0x00000000, //60 ebp
0x00000000, //64 esi
0x00000000, //68 edi
0x00000023, //72 es
0x00000008, //76 cs
0x00000010, //80 ss
0x00000023, //84 ds
0x00000030, //88 fs
0x00000000, //92 gs
0x00000000, //96 LDT
0x20ac0000, //100 I/O map
};
_asm
{
call fword ptr ds:[sele]
//jmp fword ptr ds:[sele]
}
return 0;
}