Questions tagged [syscall]
The syscall tag has no usage guidance.
10
questions
0
votes
0
answers
24
views
Why does dup2(2) function has no effect here?
I am trying to solve The Protostar Net One task.
When I open the net1 binary with strace -f ./net1 I get this result. In which the program clones itself, kills the parent, and dups all standard file ...
- 1,145
0
votes
0
answers
32
views
Searching for signal calls in a Mach-O multiarch binary
I'm searching for signals call in a Mach-O mutliarch using radare2. This is what I start with:
file sample
/tmp/sample (for architecture x86_64): Mach-O 64-bit executable x86_64
/tmp/sample (for ...
- 101
1
vote
1
answer
112
views
Retrieving args from open syscall
The arguments being passed to the open syscall at runtime in a program I'm debugging seem to be as follows:
open("SOMESTRING", 0xa01, 0x1b6);
These were retrieved using lldb on OSX 12.1 ...
- 16.5k
0
votes
1
answer
799
views
Is it possible to intercept syscalls with a custom code from inside the program?
I have a binary calling syscall with a code not present on the Linux kernel.
Is it possible that the binary catches the syscall by itself and handles it on-the-fly?
Furthermore, what happens if I call ...
- 7,246
1
vote
0
answers
87
views
Why do some antiviruses hook x64 Ntdll in WOW64 process?
Why do some antiviruses hook x64 Ntdll in WOW64 process? However, the same antiviruses do not hook Ntdll in the native x64 processes.
- 131
1
vote
1
answer
1k
views
Find all syscall in statically Arm Binary
What is the easy and fast way to find all syscall in statically Arm binary ?
Is there any Ida plugin that do that?
CommunityBot
- 1
1
vote
1
answer
778
views
how could i follow a system call from a dll -> kernel driver syscall
basically i would like to follow (system calls / internal calls) that basically lands in the kernel i would like for example to debug a specific dll ex : ntdll.dll and follow it to (NtXXX) function ...
CommunityBot
- 1
2
votes
2
answers
1k
views
mprotect syscall not working
I want to modify the protection of the .text segment to RWX using a shellcode. In the shellcode, I can issue the syscall for mprotect however it's not working.
Per the sys_mprotect definition, it ...
CommunityBot
- 1
-1
votes
1
answer
201
views
How to find each interrupt's line in the Interrupt Descriptor Table
I'm trying to find the line number of the 0f05 syscall interrupt with no success.
I searched everywhere and couldn't find any way of doing that, it seems like this information is hard coded in the ...
- 36.9k
0
votes
1
answer
486
views
Understand what Ioctl do
I looking in ida on arm linux binary . I can see there that there is ioctl call
ioctl(fd,req,num).
fd is fd to /dev/module. ,req is some 4bytes and num is some number.
How can I understand what ...
- 36.9k