Questions tagged [syscall]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
0answers
43 views

Why do some antiviruses hook x64 Ntdll in WOW64 process?

Why do some antiviruses hook x64 Ntdll in WOW64 process? However, the same antiviruses do not hook Ntdll in the native x64 processes.
1
vote
1answer
141 views

Find all syscall in statically Arm Binary

What is the easy and fast way to find all syscall in statically Arm binary ? Is there any Ida plugin that do that?
1
vote
1answer
98 views

how could i follow a system call from a dll -> kernel driver syscall

basically i would like to follow (system calls / internal calls) that basically lands in the kernel i would like for example to debug a specific dll ex : ntdll.dll and follow it to (NtXXX) function ...
2
votes
2answers
509 views

mprotect syscall not working

I want to modify the protection of the .text segment to RWX using a shellcode. In the shellcode, I can issue the syscall for mprotect however it's not working. Per the sys_mprotect definition, it ...
0
votes
0answers
41 views

Address of calling syscall

With strace I can see all syscall that process call. Is there any way to know witch address of process call to this syscall?
-1
votes
1answer
97 views

How to find each interrupt's line in the Interrupt Descriptor Table

I'm trying to find the line number of the 0f05 syscall interrupt with no success. I searched everywhere and couldn't find any way of doing that, it seems like this information is hard coded in the ...
0
votes
1answer
210 views

Understand what Ioctl do

I looking in ida on arm linux binary . I can see there that there is ioctl call ioctl(fd,req,num). fd is fd to /dev/module. ,req is some 4bytes and num is some number. How can I understand what ...