Questions tagged [syscall]
The syscall tag has no usage guidance.
9 questions
0
votes
0
answers
25
views
Why does dup2(2) function has no effect here?
I am trying to solve The Protostar Net One task.
When I open the net1 binary with strace -f ./net1 I get this result. In which the program clones itself, kills the parent, and dups all standard file ...
- 1
1
vote
1
answer
113
views
Retrieving args from open syscall
The arguments being passed to the open syscall at runtime in a program I'm debugging seem to be as follows:
open("SOMESTRING", 0xa01, 0x1b6);
These were retrieved using lldb on OSX 12.1 ...
- 43
0
votes
1
answer
822
views
Is it possible to intercept syscalls with a custom code from inside the program?
I have a binary calling syscall with a code not present on the Linux kernel.
Is it possible that the binary catches the syscall by itself and handles it on-the-fly?
Furthermore, what happens if I call ...
- 3
1
vote
0
answers
88
views
Why do some antiviruses hook x64 Ntdll in WOW64 process?
Why do some antiviruses hook x64 Ntdll in WOW64 process? However, the same antiviruses do not hook Ntdll in the native x64 processes.
- 131
1
vote
1
answer
788
views
how could i follow a system call from a dll -> kernel driver syscall
basically i would like to follow (system calls / internal calls) that basically lands in the kernel i would like for example to debug a specific dll ex : ntdll.dll and follow it to (NtXXX) function ...
- 11
1
vote
1
answer
1k
views
Find all syscall in statically Arm Binary
What is the easy and fast way to find all syscall in statically Arm binary ?
Is there any Ida plugin that do that?
-1
votes
1
answer
204
views
How to find each interrupt's line in the Interrupt Descriptor Table
I'm trying to find the line number of the 0f05 syscall interrupt with no success.
I searched everywhere and couldn't find any way of doing that, it seems like this information is hard coded in the ...
- 101
0
votes
1
answer
490
views
Understand what Ioctl do
I looking in ida on arm linux binary . I can see there that there is ioctl call
ioctl(fd,req,num).
fd is fd to /dev/module. ,req is some 4bytes and num is some number.
How can I understand what ...
- 533
2
votes
2
answers
1k
views
mprotect syscall not working
I want to modify the protection of the .text segment to RWX using a shellcode. In the shellcode, I can issue the syscall for mprotect however it's not working.
Per the sys_mprotect definition, it ...
- 775