6. SYSENTER Instruction, Cont.

• To step over SYSENTER, press F8.

• Continue tracing into by pressing Ctrl+F11.

• The debugger stops on each SYSENTER. Eventually, the first character, H, is displayed on the console. Set another breakpoint on the SYSENTER instruction which services the character ouput.

• As it becomes visible in the stack window, kernel32.WriteFile and kernel32.WriteConsoleA system calls are employed to generate the console output.

   

• With the new breakpoint in place, we can

  1. Run command (F9) to execute until the next SYSENTER breakpoint.

  2. Press F8 to step over each SYSENTER and watch the progress of characters appearing on the console screen:

      

  3. Press F9 to continue (back to the step 1 above.)

• See also the article about SYSENTER-based system call mechanism in Linux 2.6.