Use non-volatile registers in call to SetThreadContext as there is anecdotal evidence (i.e. no direct reference from MS) that volatile registers aren't honoured.
Use non-volatile registers in call to SetThreadContext as there is
anecdotal evidence (i.e. no direct reference from MS) that volatile
registers aren't honoured.

There are comments about APCs or the GDI message pump being called first
before RIP is restored to what you want it.

Digging through the ReactOS source shows that non-volatile registers
interact with kernel trap frames differently.

It appears that for x64, Windows does not save the values of
non-volatile registers when it interrupts; it expects the interrupt to
preserve them. This means it oddly *does* preserve volatile registers.

I am taking this to mean that if I set RAX in SetThreadContext then
there's every chance that it will set RAX correctly. However, some
kernel call could be in the process of executing and when it returns,
it destroys RAX as it restores volatile registers. It then chains to
the new EIP, executes the code and ret's into nowhere.

Celtoys/Remotery,Celtoys/Remotery,Celtoys/Remotery