Questions tagged [syscall]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
34 views

Set standard input/output to a process using NtCreateProcessEx

In the official Windows API function CreateProcessA is possible set or change the standar input and output of the process vía LPSTARTUPINFO structure. How can do this using the undocumented function ...
0
votes
1answer
84 views

Is it possible to intercept syscalls with a custom code from inside the program?

I have a binary calling syscall with a code not present on the Linux kernel. Is it possible that the binary catches the syscall by itself and handles it on-the-fly? Furthermore, what happens if I call ...
1
vote
0answers
49 views

Why do some antiviruses hook x64 Ntdll in WOW64 process?

Why do some antiviruses hook x64 Ntdll in WOW64 process? However, the same antiviruses do not hook Ntdll in the native x64 processes.
1
vote
1answer
118 views

how could i follow a system call from a dll -> kernel driver syscall

basically i would like to follow (system calls / internal calls) that basically lands in the kernel i would like for example to debug a specific dll ex : ntdll.dll and follow it to (NtXXX) function ...
1
vote
1answer
244 views

Find all syscall in statically Arm Binary

What is the easy and fast way to find all syscall in statically Arm binary ? Is there any Ida plugin that do that?
-1
votes
1answer
117 views

How to find each interrupt's line in the Interrupt Descriptor Table

I'm trying to find the line number of the 0f05 syscall interrupt with no success. I searched everywhere and couldn't find any way of doing that, it seems like this information is hard coded in the ...
0
votes
1answer
260 views

Understand what Ioctl do

I looking in ida on arm linux binary . I can see there that there is ioctl call ioctl(fd,req,num). fd is fd to /dev/module. ,req is some 4bytes and num is some number. How can I understand what ...
2
votes
2answers
587 views

mprotect syscall not working

I want to modify the protection of the .text segment to RWX using a shellcode. In the shellcode, I can issue the syscall for mprotect however it's not working. Per the sys_mprotect definition, it ...