I've been reading about the way syscalls are called in windows.
The general theme in all the articles I read is:
64bit- called inside ntdll
32bit- from ntdll jumping to KiFastSystemcall
but when I opened IDA with ntdlls from both 64 and 32 bit to verify these articles this is what I saw:
NtCreateFile proc near mov eax, 55h ; syscall num mov edx, offset j_Wow64Transition call edx ; weird stub is called instead of KiFastSystemcall. ; I couldn't find anything about it.perhaps a wrapper around KiFastSystemcall? retn 2Ch NtCreateFile endp
NtCreateFile proc near mov r10, rcx ; NtCreateFile mov eax, 55h test byte ptr ds:7FFE0308h, 1 ; some test to decide wether to use int 0x2E or syscall? ; I don't know why int 0x2E be used. I thought it causes overhead? jnz short loc_18009CB15 syscall retn loc_18009CB15: int 2Eh retn NtCreateFile endp
if anyone knows why the system calls are called like this I would love to know.
(32 bit) why is j_Wow64Transition there instead of KiFastSystemcall?
(64 bit) what is being compared and why?