Question: The User-Kernel Boundary 1. Why must the kernel carefully check system call parameters? 2. What test does the kernel perform when receiving the address of
The User-Kernel Boundary
1. Why must the kernel carefully check system call parameters?
2. What test does the kernel perform when receiving the address of a buffer (e.g., to write the contents of a file to) as a system call parameter?
3. Consider the following disassembly of a function in the ntdll.dll system library of a 64-bit Windows 8.1. What purpose does this function serve? What is the meaning of the number marked in bold? 
mov ; Nt CreateProcess .text :0000000180092120 .text: 0000000180092123 .text: 0000000180092128 .text: 000000018009212A r10, rc eax, OAAh mov 4C 8B Di B8 AA 00 00 00 OF 05 C3 syscall retn
Step by Step Solution
There are 3 Steps involved in it
Get step-by-step solutions from verified subject matter experts
