Questions tagged [syscall]
The syscall tag has no usage guidance.
9
questions
0
votes
0
answers
24
views
Searching for signal calls in a Mach-O multiarch binary
I'm searching for signals call in a Mach-O mutliarch using radare2. This is what I start with:
file sample
/tmp/sample (for architecture x86_64): Mach-O 64-bit executable x86_64
/tmp/sample (for ...
- 101
1
vote
1
answer
92
views
Retrieving args from open syscall
The arguments being passed to the open syscall at runtime in a program I'm debugging seem to be as follows:
open("SOMESTRING", 0xa01, 0x1b6);
These were retrieved using lldb on OSX 12.1 ...
- 43
0
votes
1
answer
629
views
Is it possible to intercept syscalls with a custom code from inside the program?
I have a binary calling syscall with a code not present on the Linux kernel.
Is it possible that the binary catches the syscall by itself and handles it on-the-fly?
Furthermore, what happens if I call ...
- 3
1
vote
0
answers
85
views
Why do some antiviruses hook x64 Ntdll in WOW64 process?
Why do some antiviruses hook x64 Ntdll in WOW64 process? However, the same antiviruses do not hook Ntdll in the native x64 processes.
- 131
1
vote
1
answer
640
views
how could i follow a system call from a dll -> kernel driver syscall
basically i would like to follow (system calls / internal calls) that basically lands in the kernel i would like for example to debug a specific dll ex : ntdll.dll and follow it to (NtXXX) function ...
- 11
1
vote
1
answer
1k
views
Find all syscall in statically Arm Binary
What is the easy and fast way to find all syscall in statically Arm binary ?
Is there any Ida plugin that do that?
-1
votes
1
answer
188
views
How to find each interrupt's line in the Interrupt Descriptor Table
I'm trying to find the line number of the 0f05 syscall interrupt with no success.
I searched everywhere and couldn't find any way of doing that, it seems like this information is hard coded in the ...
0
votes
1
answer
457
views
Understand what Ioctl do
I looking in ida on arm linux binary . I can see there that there is ioctl call
ioctl(fd,req,num).
fd is fd to /dev/module. ,req is some 4bytes and num is some number.
How can I understand what ...
- 523
2
votes
2
answers
955
views
mprotect syscall not working
I want to modify the protection of the .text segment to RWX using a shellcode. In the shellcode, I can issue the syscall for mprotect however it's not working.
Per the sys_mprotect definition, it ...
- 765