A forum for reverse engineering, OS internals and malware analysis 

 #11051  by _Lynn
 Mon Jan 16, 2012 5:26 am
when we occur trap flag or other various interrupts we have interrupt table of course. or raiseexception (NtRaiseException) that bring us to KiUserExceptionDispatcher.

but what is course of action for access violation (user mode) prior to user mode dispatcher. where do we land first..?

thank you.
 #11061  by EP_X0FF
 Mon Jan 16, 2012 3:34 pm
_Lynn wrote:where do we land first..?
in intel manuals obviously :)

http://www.intel.com/content/www/us/en/ ... nuals.html
(Intel® 64 and IA-32 Architectures Software Developer's Manual Combined Volumes 3A, 3B, and 3C: System Programming Guide, Parts 1 and 2)