I have encountered the problem shown in the screenshot below. As I am not very familiar with assembly code, I hope to receive guidance and help from everyone on how to solve the error in the screenshot.
I have tried the answers in this article, but the problem in the screenshot appears again, and I don’t know how to solve it.
The code is as follows:
; https://gist.github.com/esoterix/df38008568c50d4f83123e3a90b62ebb
include ksamd64.inc
extern InstrumentationCallback:proc
EXTERNDEF __imp_RtlCaptureContext:QWORD
.code
InstrHook proc
mov gs:[2e0h], rsp ; Win10 TEB InstrumentationCallbackPreviousSp
mov gs:[2d8h], r10 ; Win10 TEB InstrumentationCallbackPreviousPc
mov r10, rcx ; Save original RCX
sub rsp, 4d0h ; Alloc stack space for CONTEXT structure
and rsp, -10h ; RSP must be 16 byte aligned before calls
mov rcx, rsp
call __imp_RtlCaptureContext ; Save the current register state. RtlCaptureContext does not require shadow space
sub rsp, 20h ; Shadow space
call InstrumentationCallback ; Call main instrumentation routine
InstrHook endp
end