File ID is filesystem but not OS specific, and it's supported in NTFS only.
Also, the one I grabbed was using the Unicode U+202e trick to fool the user, it's looks like a pdf document while it's an executable screensaver (fooled me 1st time :D ):
http://www.kernelmode.info/forum/viewto ... f=16&t=471
AFAIK, PCR is stored in MSR.MSR_GS_BASE and TEB is stored in MSR.MSR_GS_SWAP and during context switch GS and FS are reloaded to specific values if changed.
I think Vrtule meant by "deep copy" is that IO manager will only copy the passed structure but not the buffer it points to, try including the APINAME/MODULENAME buffers inside API_HOOK_SSDT instead of pointing to them.
MmGetPhysicalMemoryRanges was first documented by Mark Russinovich here :
http://blogs.technet.com/b/sysinternals ... 52896.aspx
Also note that it doesn't count page number 0 in that array so you must add it to your pages list :)
Well, the main problem is that walking through physical memory page 0 to NumberOfPhysicalPages will count some memory portions reserved to other hardware devices, this will usually corrupt and crash the system. You will notice that if you test the code in x64 system with RAM > 4GB. The most stable m...