pub fn get_syscall_address(address: *mut c_void) -> Option<usize>Expand description
Locate the syscall; ret (0F 05 C3) sequence within a stub. The trailing
C3 distinguishes the direct-return syscall path from the
SSDT-side-check branch, which is what we want for stack-discipline
reasons (after the syscall, ntdll’s ret pops back to our caller).