Questions tagged [syscall]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
28 views

Searching for signal calls in a Mach-O multiarch binary

I'm searching for signals call in a Mach-O mutliarch using radare2. This is what I start with: file sample /tmp/sample (for architecture x86_64): Mach-O 64-bit executable x86_64 /tmp/sample (for ...
Plup's user avatar
  • 101
1 vote
1 answer
108 views

Retrieving args from open syscall

The arguments being passed to the open syscall at runtime in a program I'm debugging seem to be as follows: open("SOMESTRING", 0xa01, 0x1b6); These were retrieved using lldb on OSX 12.1 ...
JohnnyBoy's user avatar
0 votes
1 answer
717 views

Is it possible to intercept syscalls with a custom code from inside the program?

I have a binary calling syscall with a code not present on the Linux kernel. Is it possible that the binary catches the syscall by itself and handles it on-the-fly? Furthermore, what happens if I call ...
jmgd's user avatar
  • 3
1 vote
0 answers
87 views

Why do some antiviruses hook x64 Ntdll in WOW64 process?

Why do some antiviruses hook x64 Ntdll in WOW64 process? However, the same antiviruses do not hook Ntdll in the native x64 processes.
DBenson's user avatar
  • 131
1 vote
1 answer
702 views

how could i follow a system call from a dll -> kernel driver syscall

basically i would like to follow (system calls / internal calls) that basically lands in the kernel i would like for example to debug a specific dll ex : ntdll.dll and follow it to (NtXXX) function ...
zeroaceee's user avatar
1 vote
1 answer
1k views

Find all syscall in statically Arm Binary

What is the easy and fast way to find all syscall in statically Arm binary ? Is there any Ida plugin that do that?
wfj96649BcaooCom's user avatar
-1 votes
1 answer
193 views

How to find each interrupt's line in the Interrupt Descriptor Table

I'm trying to find the line number of the 0f05 syscall interrupt with no success. I searched everywhere and couldn't find any way of doing that, it seems like this information is hard coded in the ...
Daniel Cohen's user avatar
0 votes
1 answer
475 views

Understand what Ioctl do

I looking in ida on arm linux binary . I can see there that there is ioctl call ioctl(fd,req,num). fd is fd to /dev/module. ,req is some 4bytes and num is some number. How can I understand what ...
Keystone's user avatar
  • 523
2 votes
2 answers
1k views

mprotect syscall not working

I want to modify the protection of the .text segment to RWX using a shellcode. In the shellcode, I can issue the syscall for mprotect however it's not working. Per the sys_mprotect definition, it ...
Neon Flash's user avatar