Windows Research Kernel Part 2 — Monitoring the function invocation

This is the second part of the WRK series. For your convenience you can find other parts in the table of contents in Part 1 — Compiling and debugging

In this part we are going to monitor the invocation of QuerySystemInformation system function by using the debugger.
First, make sure that you can debug the kernel. Next, open file base\ntos\ex\sysinfo.c. You can see that the function starts in line 1390. We will add a static variable to count the invocations, so go to the line 1721 and add the following:

Next, just before Status = STATUS_SUCCESS; in line 1728 add this:

Recompile the kernel, add new boot option to the boot.ini, restart the OS, attach the debugger and you should see:

This is just a sample of what you can do with the code. Next time, we are going to implement the syscall.