On Linux the strace.so pintool gives a good overview on how system calls are intercepted in PIN. One could monitor the value of
EAX to see which system call is being invoked(and mprotect and writes could be intercepted in the fashion).
How could we do something similar for Windows? I see that the
int 2e interrupt is used to trap into the kernel and that the system calls numbers are given at here. Is
NtWriteFile the analogue of
write? Also is
NtProtectVirtualMemory the analogue of