Questions tagged [system-call]

A way for an operating system to serve requests from user-space without breaking the user-space and kernel-space memory protection.

Filter by
Sorted by
Tagged with
0
votes
0answers
41 views

How large are privileges of linux kernel module?

I know that kernel modules are practically part of the kernel since it gets loaded inside it. But I am not sure if it really gets all privileges the system has. Can it read/write code inside the ...
1
vote
0answers
341 views

Tracing calls, rets and instructions with Intel Pin

I am writing a Pin tool with the following functionality: It has to record instructions with arguments. (works well) It has to record memory access operations associated with instructions. (works ...
5
votes
1answer
359 views

How does API call work on Android (NDK)?

In windows platform, an application usually references its IAT(Import Access Table) to get the address of the APIs it wants, then call it. Then some mechanisms are done as demonstrated here nicely. ...
3
votes
0answers
72 views

int 2eh instead of syscall/sysenter [duplicate]

I have been looking into ntdll.dll on windows 10 x64 bit, and i noticed a check inside the ntdll like this: So after testing some bit, it tries to execute the system call via int 2eh. I have tried to ...
0
votes
2answers
1k views

How to know the arguments of a Linux syscall?

To my knowledge, this is a decent resource to know the parameters of a Linux syscall. However, this only lists 32 bit syscalls, not the 64 bit ones. Moreover, the reference doesn't say which register ...
3
votes
2answers
1k views

What are the difference syscall and int 0x2E instructions?

From this question: How does the Windows Native API communicate with the kernel? Here is an example of ZwClose(HANDLE Handle); system call in NTDLL.DLL in Windows 10 X86_64: NtClose proc ...
1
vote
0answers
44 views

Threads blocking in kernel when I attach, can't control them

I'm attaching to a simple program and the new thread breaks at DbgBreakPoint as expected. I'm using x64dbg (32-bit). The problem is, when I go to the Threads window it shows all the threads' EIPs as ...
1
vote
2answers
474 views

hooking sleep & beep syscalls

I have a binary which is playing a Morse code using calls to Beep & Sleep. This file is Windows PE32 exe which I open via Wine on my Ubuntu (16.04). How can I extract the arguments which passed ...
1
vote
1answer
341 views

What's the difference between an interrupt line and the interrupt number

What's the difference between an interrupt line and an interrupt number (like 0x80) ? Also how are IRQs related to syscalls?
7
votes
2answers
4k views

ARM64 syscalls table

I wonder if there some syscall table for Linux ARM64 architecture? I found syscall table for Linux ARM32 and many other architectures, but the problem still exists. Does anyone know where can I find ...
2
votes
1answer
6k views

Difference between INT 0X80 and SYSCALL

The SYSCALL instruction is said to be the 64-bit version of INT 0X80, however it's still possible to use the latter in 64-bit code (although strace decodes it wrong because of the 64-bit ABI I guess) ...
1
vote
0answers
313 views

How to hook Windows syscall ntcreatefile an get path to saved file from notepad? Python 3 [closed]

I need to automate some text editing and encryption. I've been doing some research and it seems uhooker can detect when a file is saved or when a program is closed, but I didn't see any examples to ...
6
votes
2answers
2k views

Struggling between syscall or sysenter ( Windows )

As i understand, from windows xp, there is a sysenter instruction introduced, instead of 'int 2e' interrupt. But on win 10 there is syscall instruction used in ntdll. So is the sysenter used only for ...
1
vote
1answer
5k views

How calls work in x86

I am studying some X86 code and I often see calls: call sym.imp.printf call sym.imp.scanf call sym.imp.strcmp call sym.imp.__stack_chk_fail Those examples are the most common calls. But how do they ...
4
votes
2answers
723 views

What is this hidden stack used by syscalls on Windows?

I've noticed there is a memory region in user mode on Windows 7 x64 WOW64 that changes during syscalls. It is located quite low in the address space and has the characteristics of a stack, i.e. it ...
1
vote
1answer
116 views

Removing randomness from program execution

So I have a program which is highly obfuscated and generates a unique output every time. For ease of reversing I want to make it so that the output is the same for every run (following the logic that ...
1
vote
3answers
231 views

System programming and reverse engineering

Do I need to learn system programming (e.g. WinAPI and Linux API) to be really good in reverse engineering? Or should I treat it as a reference so that whenever I encounter a system call, I go learn ...
5
votes
2answers
1k views

Trace system calls, including stack (and java stack if possible), on android?

I have an android app that reads/writes a data file which seems to be encrypted, and i want to make a tool to read/write that file, so i need to reverse the encryption. The app in question consists ...
0
votes
1answer
346 views

How locate (NtUserUnregisterUserApiHook) function in win32k.sys with IDA

Im trying to understand the execution flow from user32.UnregisterUserApiHook to the belonged System call : NtUserUnregisterUserApiHook if i am right. Currently i cant use Windbg (kernel debugger) to ...
1
vote
0answers
726 views

Find out windows API calls using IDA?

I'm in the process of patching a crackme so that I get recognized as registered without the need of a serial key. Finding the function that checks for the validity of the key and patching it so that ...
0
votes
0answers
339 views

Intercepting syscall in a shared object (dynamically linked)

Ditto. Any technique that allows to intercept sys calls issued from a shared object file? At runtime, the shared object is dlopen'ed by main(). One candidate is to use static binary rewriting (e.g. ...
0
votes
1answer
302 views

Instrumenting syscall by static binary rewriting

(The problem is updated... as the investigation goes deep) My goal is to intercept all syscalls originated from a shared object file. The requirement is not to modify the kernel code (e.g. can not ...
1
vote
1answer
389 views

pintool to intercept writes and VirtualProtect

On Linux the strace.so pintool gives a good overview on how system calls are intercepted in PIN. One could monitor the value of EAX to see which system call is being invoked(and mprotect and writes ...