That&#x27;s a very interesting question.  I did a little searching and found the following but haven&#x27;t had time to understand it completely:<p><a href="http:&#x2F;&#x2F;expdev-kiuhnm.rhcloud.com&#x2F;2015&#x2F;05&#x2F;29&#x2F;emet-5-2-2&#x2F;" rel="nofollow">http:&#x2F;&#x2F;expdev-kiuhnm.rhcloud.com&#x2F;2015&#x2F;05&#x2F;29&#x2F;emet-5-2-2&#x2F;</a><p>Edited to add - this also mentions sysenter in the context of ASLR&#x2F;DEP bypass exploits:<p><a href="https:&#x2F;&#x2F;www.exploit-db.com&#x2F;docs&#x2F;17914.pdf" rel="nofollow">https:&#x2F;&#x2F;www.exploit-db.com&#x2F;docs&#x2F;17914.pdf</a><p>Edited once again - it&#x27;s old, but it goes into writing shell code for 32-bit Windows that uses system calls:<p><a href="http:&#x2F;&#x2F;www.piotrbania.com&#x2F;all&#x2F;articles&#x2F;windows_syscall_shellcode.pdf" rel="nofollow">http:&#x2F;&#x2F;www.piotrbania.com&#x2F;all&#x2F;articles&#x2F;windows_syscall_shell...</a><p>I guess system call numbers change between Windows versions, so shellcode that uses system calls wouldn&#x27;t be portable.  The author of that last paper also says that this would drastically increase the size of the shellcode.