[PATCH] ntoskrnl.exe: Add emulation of rdmsr for MSR_LSTAR control register.

[Ken Thomases]

On Mar 20, 2019, at 11:19 PM, Derek Lesho <dereklesho52 at gmail.com> wrote:
> 
> Signed-off-by: Derek Lesho <dereklesho52 at Gmail.com>
> ---
> dlls/ntoskrnl.exe/instr.c | 25 +++++++++++++++++++++++++
> 1 file changed, 25 insertions(+)
> 
> diff --git a/dlls/ntoskrnl.exe/instr.c b/dlls/ntoskrnl.exe/instr.c
> index 67cdd327ee..192ba05ee4 100644
> --- a/dlls/ntoskrnl.exe/instr.c
> +++ b/dlls/ntoskrnl.exe/instr.c
> @@ -586,6 +586,12 @@ static BYTE *INSTR_GetOperandAddr( CONTEXT *context, BYTE *instr,
> }
> 
> 
> +static void fake_syscall_function(void)
> +{
> +    TRACE("() stub\n");
> +}
> +
> +
> /***********************************************************************
>  *           emulate_instruction
>  *
> @@ -757,6 +763,25 @@ static DWORD emulate_instruction( EXCEPTION_RECORD *rec, CONTEXT *context )
>             context->Rip += prefixlen + 3;
>             return ExceptionContinueExecution;
>         }
> +        case 0x32: /* rdmsr */
> +        {
> +            int reg = context->Rcx & 0xffffffff;
> +            TRACE("rdmsr CR 0x%08x\n", reg);
> +            switch (reg)
> +            {
> +            case 0xc0000082:

You should probably use a symbolic constant here, rather than a bare magic number.  Define one, if needed (and it probably will be).

-Ken