Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [system-call]

A way for an operating system to serve requests from user-space without breaking the user-space and kernel-space memory protection.

5
votes
1answer
112 views

How does API call work on Android (NDK)?

In windows platform, an application usually references its IAT(Import Access Table) to get the address of the APIs it wants, then call it. Then some mechanisms are done as demonstrated here nicely. ...
3
votes
0answers
35 views

int 2eh instead of syscall/sysenter [duplicate]

I have been looking into ntdll.dll on windows 10 x64 bit, and i noticed a check inside the ntdll like this: So after testing some bit, it tries to execute the system call via int 2eh. I have tried to ...
0
votes
2answers
115 views

How to know the arguments of a Linux syscall?

To my knowledge, this is a decent resource to know the parameters of a Linux syscall. However, this only lists 32 bit syscalls, not the 64 bit ones. Moreover, the reference doesn't say which register ...
3
votes
2answers
270 views

What are the difference syscall and int 0x2E instructions?

From this question: How does the Windows Native API communicate with the kernel? Here is an example of ZwClose(HANDLE Handle); system call in NTDLL.DLL in Windows 10 X86_64: NtClose proc ...
1
vote
0answers
41 views

Threads blocking in kernel when I attach, can't control them

I'm attaching to a simple program and the new thread breaks at DbgBreakPoint as expected. I'm using x64dbg (32-bit). The problem is, when I go to the Threads window it shows all the threads' EIPs as ...
1
vote
2answers
291 views

hooking sleep & beep syscalls

I have a binary which is playing a Morse code using calls to Beep & Sleep. This file is Windows PE32 exe which I open via Wine on my Ubuntu (16.04). How can I extract the arguments which passed ...
1
vote
1answer
125 views

What's the difference between an interrupt line and the interrupt number

What's the difference between an interrupt line and an interrupt number (like 0x80) ? Also how are IRQs related to syscalls?
3
votes
2answers
1k views

ARM64 syscalls table

I wonder if there some syscall table for Linux ARM64 architecture? I found syscall table for Linux ARM32 and many other architectures, but the problem still exists. Does anyone know where can I find ...
1
vote
1answer
3k views

Difference between INT 0X80 and SYSCALL

The SYSCALL instruction is said to be the 64-bit version of INT 0X80, however it's still possible to use the latter in 64-bit code (although strace decodes it wrong because of the 64-bit ABI I guess) ...
1
vote
0answers
248 views

How to hook Windows syscall ntcreatefile an get path to saved file from notepad? Python 3 [closed]

I need to automate some text editing and encryption. I've been doing some research and it seems uhooker can detect when a file is saved or when a program is closed, but I didn't see any examples to ...
5
votes
2answers
2k views

Struggling between syscall or sysenter ( Windows )

As i understand, from windows xp, there is a sysenter instruction introduced, instead of 'int 2e' interrupt. But on win 10 there is syscall instruction used in ntdll. So is the sysenter used only for ...
1
vote
1answer
3k views

How calls work in x86

I am studying some X86 code and I often see calls: call sym.imp.printf call sym.imp.scanf call sym.imp.strcmp call sym.imp.__stack_chk_fail Those examples are the most common calls. But how do they ...
5
votes
2answers
587 views

What is this hidden stack used by syscalls on Windows?

I've noticed there is a memory region in user mode on Windows 7 x64 WOW64 that changes during syscalls. It is located quite low in the address space and has the characteristics of a stack, i.e. it ...
1
vote
1answer
105 views

Removing randomness from program execution

So I have a program which is highly obfuscated and generates a unique output every time. For ease of reversing I want to make it so that the output is the same for every run (following the logic that ...
1
vote
3answers
211 views

System programming and reverse engineering

Do I need to learn system programming (e.g. WinAPI and Linux API) to be really good in reverse engineering? Or should I treat it as a reference so that whenever I encounter a system call, I go learn ...
5
votes
2answers
1k views

Trace system calls, including stack (and java stack if possible), on android?

I have an android app that reads/writes a data file which seems to be encrypted, and i want to make a tool to read/write that file, so i need to reverse the encryption. The app in question consists ...
0
votes
1answer
272 views

How locate (NtUserUnregisterUserApiHook) function in win32k.sys with IDA

Im trying to understand the execution flow from user32.UnregisterUserApiHook to the belonged System call : NtUserUnregisterUserApiHook if i am right. Currently i cant use Windbg (kernel debugger) to ...
1
vote
0answers
609 views

Find out windows API calls using IDA?

I'm in the process of patching a crackme so that I get recognized as registered without the need of a serial key. Finding the function that checks for the validity of the key and patching it so that ...
0
votes
0answers
282 views

Intercepting syscall in a shared object (dynamically linked)

Ditto. Any technique that allows to intercept sys calls issued from a shared object file? At runtime, the shared object is dlopen'ed by main(). One candidate is to use static binary rewriting (e.g. ...
0
votes
1answer
238 views

Instrumenting syscall by static binary rewriting

(The problem is updated... as the investigation goes deep) My goal is to intercept all syscalls originated from a shared object file. The requirement is not to modify the kernel code (e.g. can not ...
1
vote
1answer
353 views

pintool to intercept writes and VirtualProtect

On Linux the strace.so pintool gives a good overview on how system calls are intercepted in PIN. One could monitor the value of EAX to see which system call is being invoked(and mprotect and writes ...