Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [system-call]

A way for an operating system to serve requests from user-space without breaking the user-space and kernel-space memory protection.

3
votes
0answers
35 views

int 2eh instead of syscall/sysenter [duplicate]

I have been looking into ntdll.dll on windows 10 x64 bit, and i noticed a check inside the ntdll like this: So after testing some bit, it tries to execute the system call via int 2eh. I have tried to ...
0
votes
2answers
67 views

How to know the arguments of a Linux syscall?

To my knowledge, this is a decent resource to know the parameters of a Linux syscall. However, this only lists 32 bit syscalls, not the 64 bit ones. Moreover, the reference doesn't say which register ...
3
votes
2answers
147 views

What are the difference syscall and int 0x2E instructions?

From this question: How does the Windows Native API communicate with the kernel? Here is an example of ZwClose(HANDLE Handle); system call in NTDLL.DLL in Windows 10 X86_64: NtClose proc ...
1
vote
0answers
39 views

Threads blocking in kernel when I attach, can't control them

I'm attaching to a simple program and the new thread breaks at DbgBreakPoint as expected. I'm using x64dbg (32-bit). The problem is, when I go to the Threads window it shows all the threads' EIPs as ...
1
vote
2answers
235 views

hooking sleep & beep syscalls

I have a binary which is playing a Morse code using calls to Beep & Sleep. This file is Windows PE32 exe which I open via Wine on my Ubuntu (16.04). How can I extract the arguments which passed ...
1
vote
1answer
104 views

What's the difference between an interrupt line and the interrupt number

What's the difference between an interrupt line and an interrupt number (like 0x80) ? Also how are IRQs related to syscalls?
3
votes
2answers
751 views

ARM64 syscalls table

I wonder if there some syscall table for Linux ARM64 architecture? I found syscall table for Linux ARM32 and many other architectures, but the problem still exists. Does anyone know where can I find ...
1
vote
1answer
3k views

Difference between INT 0X80 and SYSCALL

The SYSCALL instruction is said to be the 64-bit version of INT 0X80, however it's still possible to use the latter in 64-bit code (although strace decodes it wrong because of the 64-bit ABI I guess) ...
1
vote
0answers
226 views

How to hook Windows syscall ntcreatefile an get path to saved file from notepad? Python 3 [closed]

I need to automate some text editing and encryption. I've been doing some research and it seems uhooker can detect when a file is saved or when a program is closed, but I didn't see any examples to ...
4
votes
2answers
1k views

Struggling between syscall or sysenter ( Windows )

As i understand, from windows xp, there is a sysenter instruction introduced, instead of 'int 2e' interrupt. But on win 10 there is syscall instruction used in ntdll. So is the sysenter used only for ...
0
votes
1answer
3k views

How calls work in x86

I am studying some X86 code and I often see calls: call sym.imp.printf call sym.imp.scanf call sym.imp.strcmp call sym.imp.__stack_chk_fail Those examples are the most common calls. But how do they ...
5
votes
2answers
558 views

What is this hidden stack used by syscalls on Windows?

I've noticed there is a memory region in user mode on Windows 7 x64 WOW64 that changes during syscalls. It is located quite low in the address space and has the characteristics of a stack, i.e. it ...
1
vote
1answer
101 views

Removing randomness from program execution

So I have a program which is highly obfuscated and generates a unique output every time. For ease of reversing I want to make it so that the output is the same for every run (following the logic that ...
1
vote
3answers
207 views

System programming and reverse engineering

Do I need to learn system programming (e.g. WinAPI and Linux API) to be really good in reverse engineering? Or should I treat it as a reference so that whenever I encounter a system call, I go learn ...
5
votes
2answers
1k views

Trace system calls, including stack (and java stack if possible), on android?

I have an android app that reads/writes a data file which seems to be encrypted, and i want to make a tool to read/write that file, so i need to reverse the encryption. The app in question consists ...
0
votes
1answer
262 views

How locate (NtUserUnregisterUserApiHook) function in win32k.sys with IDA

Im trying to understand the execution flow from user32.UnregisterUserApiHook to the belonged System call : NtUserUnregisterUserApiHook if i am right. Currently i cant use Windbg (kernel debugger) to ...
1
vote
0answers
576 views

Find out windows API calls using IDA?

I'm in the process of patching a crackme so that I get recognized as registered without the need of a serial key. Finding the function that checks for the validity of the key and patching it so that ...
0
votes
0answers
269 views

Intercepting syscall in a shared object (dynamically linked)

Ditto. Any technique that allows to intercept sys calls issued from a shared object file? At runtime, the shared object is dlopen'ed by main(). One candidate is to use static binary rewriting (e.g. ...
0
votes
1answer
230 views

Instrumenting syscall by static binary rewriting

(The problem is updated... as the investigation goes deep) My goal is to intercept all syscalls originated from a shared object file. The requirement is not to modify the kernel code (e.g. can not ...
1
vote
1answer
346 views

pintool to intercept writes and VirtualProtect

On Linux the strace.so pintool gives a good overview on how system calls are intercepted in PIN. One could monitor the value of EAX to see which system call is being invoked(and mprotect and writes ...