系统调用得到函数的参数

           调用一个系统调用 从 r3 进入 r0 需要把 r3 堆栈上面的参数复制到 r0 的堆栈上但是怎么得到这个函数的参数呢  ？ 今天在看了下 SSDT 的结构  原来还有一个参数 ParamTableBase 用来保存系统调用 的参数个数

typedef struct ServiceDescriptorTable {

	PVOID ServiceTableBase;

	PVOID ServiceCounterTable(0);

	unsigned int NumberOfServices;

	PVOID ParamTableBase;

}

where

ServiceTableBase	Base address of the System Service Dispatch Table.
NumberOfServices	Number of services described by ServiceTableBase.
ServiceCounterTable	This field is used only in checked builds of the operating system and contains the counter of how many times each service in SSDT is called. This counter is updated by INT 2Eh handler (KiSystemService).
ParamTableBase	Base address of the table containing the number of parameter bytes for each of the system services.