In 32-bit systems, the SSDT address is exported by ntoskrnl.exe under the name of KeServiceDescriptorTable. There are slots for four different SSDT entries, but Windows has used only two of them so far: KeServiceDescriptorTable and KeServiceDescriptorTableShadow.
When a user-mode application uses sysenter, as you saw in Figure 3, the application provides the function number or ID in the eax register. This value in eax is divided in the following way:
Figure 7: The sysenter eax argument value
These values are as follows:
- bits 0-11: This is the System Service Number (SSN), which is the index of this function in the SSDT
- bits 12-13: This is the Service Descriptor Table (SDT), which represents the SSDT number (here, KeServiceDescriptorTable is 0x00, and KeServiceDescriptorTableShadow is 0x01)
- bits 14-31: This value is not used and is filled with zeros
As there are only two tables, the value of SDT is always either 00 or 01. The KeServiceDescriptorTable...
