When i was disassembling WinXP's ntdll.dll I encountered a call to some adress where is posted code. I found that allmost all functions have a call there. I'd like to find out what does it. Before a function calls it eax is set to some value like 11h or 118h, that depends on the function.
Thanks for help.
[code]mov edx,esp
sysenter
ret[/code]
Thanks for help.
[code]mov edx,esp
sysenter
ret[/code]