wmliang

[BITS 32]

; This shellcode is meant to be executed in the kernel just after the token has
; been stolen. It walks up the stack looking for the first frame which returns
; to userland and returns into the one just before it. This is presumably
; nt!KiSystemServicePostCall which will clean up the operation before returning
; to userland.

; This shell code clobbers ecx, ebx and sets eax to 0 for the return value.