http://www.codeguru.com/Cpp/W-P/system/devicedriverdevelopment/article.php/c8223__1/

System Call Optimization with the SYSENTER Instruction

有些看不懂，/////////////////////////////////////////////////
If you have paid close attention so far, you might have noticed that there is no "SYSEXIT_EIP_MSR" or "SYSEXIT_ESP_MSR" register. So, how does the SYSEXIT instruction know where to return to in the user-mode code that initially called SYSENTER? When you think about it, such information could not be fixed in an MSR because each system call can potentially originate from completely different locations in user-mode. Therefore, it is the responsibility of the caller (the code that calls SYSENTER) to place the address the CPU is to return to after the system call has returned in the EDX register. The caller must also place the current stack pointer (the value of ESP) in the ECX register. The SYSEXIT instruction will then restore the original value in the EIP and ESP by copying the content from EDX and ECX respectively. This will cause the execution to continue at the instruction after the original SYSENTER instruction.

////////////////////////////////////////////////////////////

-----------------------------------------------------------------
01年，知道有软件破解这回事，无奈人太笨，
到现在还没学会：-（

楼主，为甚么你要跟进 system call 里 ?   

最初由 riijj 发布
楼主，为甚么你要跟进 system call 里 ?

想看看从那里出来.

/////////////////////////////////////////////

在sysenter指令处的看ECX+B8的值,通常是产生异常的地方,
异常处理完后,返回的地方也在这里

/////////////////////////////////////////////

-----------------------------------------------------------------
01年，知道有软件破解这回事，无奈人太笨，
到现在还没学会：-（