On Linux the strace.so pintool gives a good overview on how system calls are intercepted in PIN. One could monitor the value of EAX
to see which system call is being invoked(and mprotect and writes could be intercepted in the fashion).
How could we do something similar for Windows? I see that the int 2e
interrupt is used to trap into the kernel and that the system calls numbers are given at here. Is NtWriteFile
the analogue of write
? Also is NtProtectVirtualMemory
the analogue of mprotect
?