The Windows 10 TH2 INT 2E mystery
Since Windows 10 TH2, NTDLL's syscall routines have changed: syscalls can now be performed with the
SYSCALL instruction, and with the
INT 2E old one. We say "old" because, until this change, this method had not been supported on x64 architectures since Windows 8. So why such a change? Let's try to find out.