시스템 서비스 서술자 테이블

시스템 서비스 서술자 테이블(System Service Descriptor Table, SSDT)은 마이크로소프트 윈도우의 내부 디스패치 테이블이다.
SSDT 호출을 후킹하는 것은 주로 윈도우 루트킷이나 백신에서 사용된다.
2010년, SSDT 호출 후킹에 의존하는 많은 컴퓨터 보안 제품들이 제품의 보안 체크를 공격하기 위한 경합 조건들을 이용한 익스플로잇 공격에 취약하다는 것이 밝혀졌다.

SSDT 구조

typedef struct _KSERVICE_DESCRIPTOR_TABLE{
    PULONG ServiceTableBase;
    PULONG ServiceCounterTableBase;
    ULONG NumberOfServices;
    PUCHAR ParamTableBase;}KSERVICE_DESCRIPTOR_TABLE,*PKSERVICE_DESCRIPTOR_TABLE;
SSDT의 포인터는 KeServiceDescriptorTable이며, ntoskrnl.exe에서 노출된다.
lkd> dds KiServiceTable l 19182ab8d9c  82cb4c28 nt!NtAcceptConnectPort82ab8da0  82afb40d nt!NtAccessCheck82ab8da4  82c44b68 nt!NtAccessCheckAndAuditAlarm82ab8da8  82a5f88a nt!NtAccessCheckByType82ab8dac  82cb64ff nt!NtAccessCheckByTypeAndAuditAlarm82ab8db0  82b383fa nt!NtAccessCheckByTypeResultList82ab8db4  82d26b05 nt!NtAccessCheckByTypeResultListAndAuditAlarm82ab8db8  82d26b4e nt!NtAccessCheckByTypeResultListAndAuditAlarmByHandle82ab8dbc  82c393bd nt!NtAddAtom82ab8dc0  82d40368 nt!NtAddBootEntry82ab8dc4  82d415c1 nt!NtAddDriverEntry82ab8dc8  82c2fb95 nt!NtAdjustGroupsToken82ab8dcc  82cc0b35 nt!NtAdjustPrivilegesToken82ab8dd0  82d19963 nt!NtAlertResumeThread82ab8dd4  82c6ca56 nt!NtAlertThread82ab8dd8  82c3c6cc nt!NtAllocateLocallyUniqueId82ab8ddc  82bd2928 nt!NtAllocateReserveObject82ab8de0  82d0b898 nt!NtAllocateUserPhysicalPages82ab8de4  82c2314e nt!NtAllocateUuids82ab8de8  82c65a62 nt!NtAllocateVirtualMemory82ab8dec  82cb1df1 nt!NtAlpcAcceptConnectPort82ab8df0  82c13238 nt!NtAlpcCancelMessage82ab8df4  82cb11fe nt!NtAlpcConnectPort82ab8df8  82c30c0c nt!NtAlpcCreatePort82ab8dfc  82cc25bc nt!NtAlpcCreatePortSection82ab8e00  82c3328f nt!NtAlpcCreateResourceReserve82ab8e04  82cc239c nt!NtAlpcCreateSectionView82ab8e08  82cbaafc nt!NtAlpcCreateSecurityContext82ab8e0c  82c450f0 nt!NtAlpcDeletePortSection82ab8e10  82d06657 nt!NtAlpcDeleteResourceReserve82ab8e14  82cb7ec9 nt!NtAlpcDeleteSectionView82ab8e18  82cc27ee nt!NtAlpcDeleteSecurityContext82ab8e1c  82c9b1fc nt!NtAlpcDisconnectPort82ab8e20  82cb5f2e nt!NtAlpcImpersonateClientOfPort82ab8e24  82c47d15 nt!NtAlpcOpenSenderProcess82ab8e28  82c3bcf3 nt!NtAlpcOpenSenderThread82ab8e2c  82c2db70 nt!NtAlpcQueryInformation82ab8e30  82c9ba83 nt!NtAlpcQueryInformationMessage82ab8e34  82d0677f nt!NtAlpcRevokeSecurityContext82ab8e38  82c8df0a nt!NtAlpcSendWaitReceivePort82ab8e3c  82c3b702 nt!NtAlpcSetInformation82ab8e40  82c4d21b nt!NtApphelpCacheControl82ab8e44  82c090e3 nt!NtAreMappedFilesTheSame82ab8e48  82c3aed1 nt!NtAssignProcessToJobObject82ab8e4c  82ab98bc nt!NtCallbackReturn82ab8e50  82c045c3 nt!NtCancelIoFile82ab8e54  82c38ce7 nt!NtCancelIoFileEx82ab8e58  82cf2fb0 nt!NtCancelSynchronousIoFile82ab8e5c  82a65d56 nt!NtCancelTimer82ab8e60  82c67b5f nt!NtClearEvent82ab8e64  82c8037a nt!NtClose82ab8e68  82cb642e nt!NtCloseObjectAuditAlarm82ab8e6c  82d2e412 nt!NtCommitComplete82ab8e70  82d2e132 nt!NtCommitEnlistment82ab8e74  82c0f9b9 nt!NtCommitTransaction82ab8e78  82cd8013 nt!NtCompactKeys82ab8e7c  82c36c9d nt!NtCompareTokens82ab8e80  82c3bce9 nt!NtCompleteConnectPort82ab8e84  82cd827f nt!NtCompressKey82ab8e88  82cb3d09 nt!NtConnectPort82ab8e8c  82a7bd0c nt!NtContinue82ab8e90  82ce8c79 nt!NtCreateDebugObject82ab8e94  82c3e505 nt!NtCreateDirectoryObject82ab8e98  82be0a55 nt!NtCreateEnlistment82ab8e9c  82c7c671 nt!NtCreateEvent82ab8ea0  82d46068 nt!NtCreateEventPair82ab8ea4  82c8b1e4 nt!NtCreateFile82ab8ea8  82c96667 nt!NtCreateIoCompletion82ab8eac  82c2d977 nt!NtCreateJobObject82ab8eb0  82d1b6de nt!NtCreateJobSet82ab8eb4  82c3ce2a nt!NtCreateKey82ab8eb8  82c4bd1e nt!NtCreateKeyedEvent82ab8ebc  82c0da36 nt!NtCreateKeyTransacted82ab8ec0  82c4132f nt!NtCreateMailslotFile82ab8ec4  82c4c196 nt!NtCreateMutant82ab8ec8  82cbc4f9 nt!NtCreateNamedPipeFile82ab8ecc  82bc8406 nt!NtCreatePagingFile82ab8ed0  82c2d75f nt!NtCreatePort82ab8ed4  82c0f57f nt!NtCreatePrivateNamespace82ab8ed8  82d17df9 nt!NtCreateProcess82ab8edc  82d17e44 nt!NtCreateProcessEx82ab8ee0  82d46afb nt!NtCreateProfile82ab8ee4  82d46ac1 nt!NtCreateProfileEx82ab8ee8  82be335f nt!NtCreateResourceManager82ab8eec  82c5ef2b nt!NtCreateSection82ab8ef0  82c4198d nt!NtCreateSemaphore82ab8ef4  82c3d7f5 nt!NtCreateSymbolicLinkObject82ab8ef8  82d17c02 nt!NtCreateThread82ab8efc  82cac124 nt!NtCreateThreadEx82ab8f00  82c3a304 nt!NtCreateTimer82ab8f04  82c40ac8 nt!NtCreateToken82ab8f08  82c0be62 nt!NtCreateTransaction82ab8f0c  82be316b nt!NtCreateTransactionManager82ab8f10  82caa056 nt!NtCreateUserProcess82ab8f14  82be0134 nt!NtCreateWaitablePort82ab8f18  82c4bf39 nt!NtCreateWorkerFactory82ab8f1c  82ce9b36 nt!NtDebugActiveProcess82ab8f20  82cea1f3 nt!NtDebugContinue82ab8f24  82c6496f nt!NtDelayExecution82ab8f28  82c2807b nt!NtDeleteAtom82ab8f2c  82d4039b nt!NtDeleteBootEntry82ab8f30  82d415f3 nt!NtDeleteDriverEntry82ab8f34  82bd46ad nt!NtDeleteFile82ab8f38  82c27911 nt!NtDeleteKey82ab8f3c  82cc69df nt!NtDeleteObjectAuditAlarm82ab8f40  82ccf6f6 nt!NtDeletePrivateNamespace82ab8f44  82c19328 nt!NtDeleteValueKey82ab8f48  82caf3ca nt!NtDeviceIoControlFile82ab8f4c  82d034da nt!NtDisableLastKnownGood82ab8f50  82d3e5ef nt!NtDisplayString82ab8f54  82b4f259 nt!NtDrawText82ab8f58  82c6d4f0 nt!NtDuplicateObject82ab8f5c  82ca7974 nt!NtDuplicateToken82ab8f60  82d035bb nt!NtEnableLastKnownGood82ab8f64  82d4059d nt!NtEnumerateBootEntries82ab8f68  82d417f3 nt!NtEnumerateDriverEntries82ab8f6c  82ca2a59 nt!NtEnumerateKey82ab8f70  82d4017b nt!NtEnumerateSystemEnvironmentValuesEx82ab8f74  82d2ef4c nt!NtEnumerateTransactionObject82ab8f78  82ca4ebf nt!NtEnumerateValueKey82ab8f7c  82d09a0f nt!NtExtendSection82ab8f80  82c20d81 nt!NtFilterToken82ab8f84  82c2c8ff nt!NtFindAtom82ab8f88  82c44117 nt!NtFlushBuffersFile82ab8f8c  82bd090f nt!NtFlushInstallUILanguage82ab8f90  82c3b4c2 nt!NtFlushInstructionCache82ab8f94  82c1a9cd nt!NtFlushKey82ab8f98  82a601b1 nt!NtFlushProcessWriteBuffers82ab8f9c  82c16130 nt!NtFlushVirtualMemory82ab8fa0  82d0c9b7 nt!NtFlushWriteBuffer82ab8fa4  82d0c039 nt!NtFreeUserPhysicalPages82ab8fa8  82af44db nt!NtFreeVirtualMemory82ab8fac  82b0e6fc nt!NtFreezeRegistry82ab8fb0  82d2f39a nt!NtFreezeTransactions82ab8fb4  82c916a2 nt!NtFsControlFile82ab8fb8  82cd0dc1 nt!NtGetContextThread82ab8fbc  82cd0d56 nt!NtGetCurrentProcessorNumber82ab8fc0  82d14e37 nt!NtGetDevicePowerState82ab8fc4  82c4cdaf nt!NtGetMUIRegistryInfo82ab8fc8  82d19b54 nt!NtGetNextProcess82ab8fcc  82cc8c0a nt!NtGetNextThread82ab8fd0  82c155c6 nt!NtGetNlsSectionPtr82ab8fd4  82d2f4f4 nt!NtGetNotificationResourceManager82ab8fd8  82bfae67 nt!NtGetPlugPlayEvent82ab8fdc  82b255c7 nt!NtGetWriteWatch82ab8fe0  82c317ca nt!NtImpersonateAnonymousToken82ab8fe4  82d057a1 nt!NtImpersonateClientOfPort82ab8fe8  82cb55fc nt!NtImpersonateThread82ab8fec  82c97f0d nt!NtInitializeNlsFiles82ab8ff0  82bd41ca nt!NtInitializeRegistry82ab8ff4  82ccb5c3 nt!NtInitiatePowerAction82ab8ff8  82ccccdd nt!NtIsProcessInJob82ab8ffc  82d14e1e nt!NtIsSystemResumeAutomatic82ab9000  82bcede9 nt!NtIsUILanguageComitted82ab9004  82bcbc75 nt!NtListenPort82ab9008  82c01b78 nt!NtLoadDriver82ab900c  82bcd426 nt!NtLoadKey82ab9010  82bbaa1c nt!NtLoadKey282ab9014  82bdde72 nt!NtLoadKeyEx82ab9018  82c3f32b nt!NtLockFile82ab901c  82bb4026 nt!NtLockProductActivationKeys82ab9020  82baf6d5 nt!NtLockRegistryKey82ab9024  82a5f191 nt!NtLockVirtualMemory82ab9028  82c021b1 nt!NtMakePermanentObject82ab902c  82c47851 nt!NtMakeTemporaryObject82ab9030  82c4c35b nt!NtMapCMFModule82ab9034  82d0ab57 nt!NtMapUserPhysicalPages82ab9038  82d0b12d nt!NtMapUserPhysicalPagesScatter82ab903c  82c82394 nt!NtMapViewOfSection82ab9040  82d4056c nt!NtModifyBootEntry82ab9044  82d417c4 nt!NtModifyDriverEntry82ab9048  82c31db6 nt!NtNotifyChangeDirectoryFile82ab904c  82c35e17 nt!NtNotifyChangeKey82ab9050  82c34f39 nt!NtNotifyChangeMultipleKeys82ab9054  82bfbd6b nt!NtNotifyChangeSession82ab9058  82c7e584 nt!NtOpenDirectoryObject82ab905c  82d2d995 nt!NtOpenEnlistment82ab9060  82c4bb92 nt!NtOpenEvent82ab9064  82d46169 nt!NtOpenEventPair82ab9068  82c6db10 nt!NtOpenFile82ab906c  82cf2ca5 nt!NtOpenIoCompletion82ab9070  82d1b057 nt!NtOpenJobObject82ab9074  82c87642 nt!NtOpenKey82ab9078  82c4badd nt!NtOpenKeyEx82ab907c  82d4649f nt!NtOpenKeyedEvent82ab9080  82c0b169 nt!NtOpenKeyTransacted82ab9084  82c0b0f9 nt!NtOpenKeyTransactedEx82ab9088  82c9d0e2 nt!NtOpenMutant82ab908c  82c144b2 nt!NtOpenObjectAuditAlarm82ab9090  82c15f07 nt!NtOpenPrivateNamespace82ab9094  82c4d9dc nt!NtOpenProcess82ab9098  82c9ffff nt!NtOpenProcessToken82ab909c  82c8db37 nt!NtOpenProcessTokenEx82ab90a0  82bb90c7 nt!NtOpenResourceManager82ab90a4  82ca5674 nt!NtOpenSection82ab90a8  82c210c6 nt!NtOpenSemaphore82ab90ac  82cc2977 nt!NtOpenSession82ab90b0  82c89b6f nt!NtOpenSymbolicLinkObject82ab90b4  82c99d87 nt!NtOpenThread82ab90b8  82cb42e4 nt!NtOpenThreadToken82ab90bc  82c8dc4e nt!NtOpenThreadTokenEx82ab90c0  82d45e0f nt!NtOpenTimer82ab90c4  82d2e6f1 nt!NtOpenTransaction82ab90c8  82d2f989 nt!NtOpenTransactionManager82ab90cc  82c1f506 nt!NtPlugPlayControl82ab90d0  82c7c970 nt!NtPowerInformation82ab90d4  82d2e2a2 nt!NtPrepareComplete82ab90d8  82d2dfc2 nt!NtPrepareEnlistment82ab90dc  82d2e35a nt!NtPrePrepareComplete82ab90e0  82d2e07a nt!NtPrePrepareEnlistment82ab90e4  82c3293f nt!NtPrivilegeCheck82ab90e8  82c01f60 nt!NtPrivilegedServiceAuditAlarm82ab90ec  82c1ca51 nt!NtPrivilegeObjectAuditAlarm82ab90f0  82d300e4 nt!NtPropagationComplete82ab90f4  82d301aa nt!NtPropagationFailed82ab90f8  82c7e403 nt!NtProtectVirtualMemory82ab90fc  82ccf5a7 nt!NtPulseEvent82ab9100  82c939a1 nt!NtQueryAttributesFile82ab9104  82d40a3e nt!NtQueryBootEntryOrder82ab9108  82d40e83 nt!NtQueryBootOptions82ab910c  82afed34 nt!NtQueryDebugFilterState82ab9110  82cb2b8c nt!NtQueryDefaultLocale82ab9114  82bdef5c nt!NtQueryDefaultUILanguage82ab9118  82c6fd11 nt!NtQueryDirectoryFile82ab911c  82c949f0 nt!NtQueryDirectoryObject82ab9120  82d41381 nt!NtQueryDriverEntryOrder82ab9124  82bcdb4a nt!NtQueryEaFile82ab9128  82c3681e nt!NtQueryEvent82ab912c  82cbc5d5 nt!NtQueryFullAttributesFile82ab9130  82c2824c nt!NtQueryInformationAtom82ab9134  82d2dba2 nt!NtQueryInformationEnlistment82ab9138  82c916d5 nt!NtQueryInformationFile82ab913c  82cc80ff nt!NtQueryInformationJobObject82ab9140  82d057d4 nt!NtQueryInformationPort82ab9144  82c72644 nt!NtQueryInformationProcess82ab9148  82d2f5fe nt!NtQueryInformationResourceManager82ab914c  82c98d6d nt!NtQueryInformationThread82ab9150  82c8e06e nt!NtQueryInformationToken82ab9154  82d2e8e4 nt!NtQueryInformationTransaction82ab9158  82bb8bcf nt!NtQueryInformationTransactionManager82ab915c  82b4fe81 nt!NtQueryInformationWorkerFactory82ab9160  82c1ac3f nt!NtQueryInstallUILanguage82ab9164  82d46e6b nt!NtQueryIntervalProfile82ab9168  82cf2d68 nt!NtQueryIoCompletion82ab916c  82c87cae nt!NtQueryKey82ab9170  82c3de8d nt!NtQueryLicenseValue82ab9174  82c1ccc0 nt!NtQueryMultipleValueKey82ab9178  82d4657c nt!NtQueryMutant82ab917c  82c3ced6 nt!NtQueryObject82ab9180  82cd7b05 nt!NtQueryOpenSubKeys82ab9184  82cc5df8 nt!NtQueryOpenSubKeysEx82ab9188  82c4c277 nt!NtQueryPerformanceCounter82ab918c  82d182c4 nt!NtQueryPortInformationProcess82ab9190  82cf4349 nt!NtQueryQuotaInformationFile82ab9194  82cb29e6 nt!NtQuerySection82ab9198  82c322d0 nt!NtQuerySecurityAttributesToken82ab919c  82c35e4c nt!NtQuerySecurityObject82ab91a0  82d3f3fc nt!NtQuerySemaphore82ab91a4  82c89c15 nt!NtQuerySymbolicLinkObject82ab91a8  82d3f5d3 nt!NtQuerySystemEnvironmentValue82ab91ac  82d3fbc7 nt!NtQuerySystemEnvironmentValueEx82ab91b0  82c6bcd4 nt!NtQuerySystemInformation82ab91b4  82ca4ddd nt!NtQuerySystemInformationEx82ab91b8  82cb2af7 nt!NtQuerySystemTime82ab91bc  82d45ece nt!NtQueryTimer82ab91c0  82c28729 nt!NtQueryTimerResolution82ab91c4  82c86405 nt!NtQueryValueKey82ab91c8  82c976a7 nt!NtQueryVirtualMemory82ab91cc  82c922c8 nt!NtQueryVolumeInformationFile82ab91d0  82c37caa nt!NtQueueApcThread82ab91d4  82c33e67 nt!NtQueueApcThreadEx82ab91d8  82a7bd54 nt!NtRaiseException82ab91dc  82c130a3 nt!NtRaiseHardError82ab91e0  82c9dc8c nt!NtReadFile82ab91e4  82bd36a7 nt!NtReadFileScatter82ab91e8  82d2e580 nt!NtReadOnlyEnlistment82ab91ec  82d058b9 nt!NtReadRequestData82ab91f0  82c9b82c nt!NtReadVirtualMemory82ab91f4  82d2db46 nt!NtRecoverEnlistment82ab91f8  82be388c nt!NtRecoverResourceManager82ab91fc  82be5128 nt!NtRecoverTransactionManager82ab9200  82d2ff38 nt!NtRegisterProtocolAddressInformation82ab9204  82d1909c nt!NtRegisterThreadTerminatePort82ab9208  82c6c0ed nt!NtReleaseKeyedEvent82ab920c  82c64873 nt!NtReleaseMutant82ab9210  82c4eb6a nt!NtReleaseSemaphore82ab9214  82abec28 nt!NtReleaseWorkerFactoryWorker82ab9218  82c41a8e nt!NtRemoveIoCompletion82ab921c  82c3ca8e nt!NtRemoveIoCompletionEx82ab9220  82ce9c81 nt!NtRemoveProcessDebug82ab9224  82cd7d4b nt!NtRenameKey82ab9228  82d2fbd4 nt!NtRenameTransactionManager82ab922c  82cd7898 nt!NtReplaceKey82ab9230  82b173d3 nt!NtReplacePartitionUnit82ab9234  82c2ca3d nt!NtReplyPort82ab9238  82c745e2 nt!NtReplyWaitReceivePort82ab923c  82c74165 nt!NtReplyWaitReceivePortEx82ab9240  82d05a85 nt!NtReplyWaitReplyPort82ab9244  82cbc435 nt!NtRequestPort82ab9248  82c798d9 nt!NtRequestWaitReplyPort82ab924c  82c17ec3 nt!NtResetEvent82ab9250  82b25c18 nt!NtResetWriteWatch82ab9254  82ccd904 nt!NtRestoreKey82ab9258  82d198fd nt!NtResumeProcess82ab925c  82cac34b nt!NtResumeThread82ab9260  82d2e636 nt!NtRollbackComplete82ab9264  82d2e1ea nt!NtRollbackEnlistment82ab9268  82be1c7c nt!NtRollbackTransaction82ab926c  82d2fd36 nt!NtRollforwardTransactionManager82ab9270  82ccf176 nt!NtSaveKey82ab9274  82cce91c nt!NtSaveKeyEx82ab9278  82cd6bbb nt!NtSaveMergedKeys82ab927c  82c99dbc nt!NtSecureConnectPort82ab9280  82bc6f07 nt!NtSerializeBoot82ab9284  82d40c7f nt!NtSetBootEntryOrder82ab9288  82d4116b nt!NtSetBootOptions82ab928c  82d18cff nt!NtSetContextThread82ab9290  82bac9bd nt!NtSetDebugFilterState82ab9294  82bca895 nt!NtSetDefaultHardErrorPort82ab9298  82bdece1 nt!NtSetDefaultLocale82ab929c  82bdf250 nt!NtSetDefaultUILanguage82ab92a0  82d41bf5 nt!NtSetDriverEntryOrder82ab92a4  82cf3dda nt!NtSetEaFile82ab92a8  82c656de nt!NtSetEvent82ab92ac  82d3f0b7 nt!NtSetEventBoostPriority82ab92b0  82d46435 nt!NtSetHighEventPair82ab92b4  82d46367 nt!NtSetHighWaitLowEventPair82ab92b8  82cea3b9 nt!NtSetInformationDebugObject82ab92bc  82d2ddea nt!NtSetInformationEnlistment82ab92c0  82c9275c nt!NtSetInformationFile82ab92c4  82c37cce nt!NtSetInformationJobObject82ab92c8  82cd73ad nt!NtSetInformationKey82ab92cc  82c44314 nt!NtSetInformationObject82ab92d0  82c74603 nt!NtSetInformationProcess82ab92d4  82d2f80c nt!NtSetInformationResourceManager82ab92d8  82ca5aaf nt!NtSetInformationThread82ab92dc  82c3f780 nt!NtSetInformationToken82ab92e0  82d2f146 nt!NtSetInformationTransaction82ab92e4  82d2fdfb nt!NtSetInformationTransactionManager82ab92e8  82ae8362 nt!NtSetInformationWorkerFactory82ab92ec  82d46e48 nt!NtSetIntervalProfile82ab92f0  82c1fb82 nt!NtSetIoCompletion82ab92f4  82cf2e8e nt!NtSetIoCompletionEx82ab92f8  82d1ad17 nt!NtSetLdtEntries82ab92fc  82d463d2 nt!NtSetLowEventPair82ab9300  82d462fc nt!NtSetLowWaitHighEventPair82ab9304  82cf495f nt!NtSetQuotaInformationFile82ab9308  82c3d626 nt!NtSetSecurityObject82ab930c  82d3f8cd nt!NtSetSystemEnvironmentValue82ab9310  82d3fedf nt!NtSetSystemEnvironmentValueEx82ab9314  82c8a0ee nt!NtSetSystemInformation82ab9318  82d5cd7a nt!NtSetSystemPowerState82ab931c  82ccbe70 nt!NtSetSystemTime82ab9320  82cd2b4d nt!NtSetThreadExecutionState82ab9324  82abed52 nt!NtSetTimer82ab9328  82ad14b9 nt!NtSetTimerEx82ab932c  82c2cb3e nt!NtSetTimerResolution82ab9330  82bce2d7 nt!NtSetUuidSeed82ab9334  82c46427 nt!NtSetValueKey82ab9338  82cf4979 nt!NtSetVolumeInformationFile82ab933c  82d3e5ad nt!NtShutdownSystem82ab9340  82c4e9b7 nt!NtShutdownWorkerFactory82ab9344  82b08701 nt!NtSignalAndWaitForSingleObject82ab9348  82d2e4ca nt!NtSinglePhaseReject82ab934c  82d46b84 nt!NtStartProfile82ab9350  82d46d7b nt!NtStopProfile82ab9354  82d1989f nt!NtSuspendProcess82ab9358  82cd0e2d nt!NtSuspendThread82ab935c  82cc1464 nt!NtSystemDebugControl82ab9360  82c2e36f nt!NtTerminateJobObject82ab9364  82c969bf nt!NtTerminateProcess82ab9368  82cb4334 nt!NtTerminateThread82ab936c  82cabafa nt!NtTestAlert82ab9370  82b0e75f nt!NtThawRegistry82ab9374  82d2f478 nt!NtThawTransactions82ab9378  82c8b9bb nt!NtTraceControl82ab937c  82b016a0 nt!NtTraceEvent82ab9380  82d41df9 nt!NtTranslateFilePath82ab9384  82d0574b nt!NtUmsThreadYield82ab9388  82cf51cf nt!NtUnloadDriver82ab938c  82cc4503 nt!NtUnloadKey82ab9390  82cc451d nt!NtUnloadKey282ab9394  82cd6d53 nt!NtUnloadKeyEx82ab9398  82c41eaf nt!NtUnlockFile82ab939c  82a57b17 nt!NtUnlockVirtualMemory82ab93a0  82ca063a nt!NtUnmapViewOfSection82ab93a4  82d33769 nt!NtVdmControl82ab93a8  82ce9ed7 nt!NtWaitForDebugEvent82ab93ac  82c6be16 nt!NtWaitForKeyedEvent82ab93b0  82c64435 nt!NtWaitForMultipleObjects82ab93b4  82d0f904 nt!NtWaitForMultipleObjects3282ab93b8  82c63ae7 nt!NtWaitForSingleObject82ab93bc  82abe7b1 nt!NtWaitForWorkViaWorkerFactory82ab93c0  82d46293 nt!NtWaitHighEventPair82ab93c4  82d4622a nt!NtWaitLowEventPair82ab93c8  82af74b4 nt!NtWorkerFactoryWorkerReady82ab93cc  82caaf2b nt!NtWriteFile82ab93d0  82bdb2f7 nt!NtWriteFileGather82ab93d4  82d05926 nt!NtWriteRequestData82ab93d8  82c9b71c nt!NtWriteVirtualMemory82ab93dc  82a665c5 nt!NtYieldExecution