Hot answers tagged

1 vote
Accepted

Retrieving args from open syscall

should be some thing like this compiles fine in godbolt.org #include <fcntl.h> int main (void) { open( "foo", //1 | 0x200 | 0x800 O_WRONLY | O_TRUNC ...
blabb's user avatar
  • 16.3k
1 vote
Accepted

Is it possible to intercept syscalls with a custom code from inside the program?

I think intercepting system calls can be done in at least 3 ways: registering a handler for the SIGSYS signal using seccomp() to filter system calls selective syscall userspace redirection with prctl(...
julian's user avatar
  • 7,118
1 vote

how could i follow a system call from a dll -> kernel driver syscall

Assuming You Wrote this code This opens a file in the current Directory Reads its contents and counts the content length and Prints to console contents and count This is a crt function it transistions ...
blabb's user avatar
  • 16.3k
1 vote

Find all syscall in statically Arm Binary

In ARM the syscalls are either Supervisor call or Software interrupt. You can just search->text in IDA for: SVC 0x SWI 0x
macro_controller's user avatar
1 vote
Accepted

How to find each interrupt's line in the Interrupt Descriptor Table

The AMD64 syscall instruction is not an interrupt (neither software nor hardware). The destination of it is stored not in IDT but in a Machine-specific register (MSR) called IA32_LSTAR.
Igor Skochinsky's user avatar
  • 36.5k
1 vote

Understand what Ioctl do

You need to find the driver (either a separate binary or built-in into the kernel) which publishes this dev file entry, the code to handle the ioctl request will be in it. Here’s an article with an ...
Igor Skochinsky's user avatar
  • 36.5k
1 vote

mprotect syscall not working

IDA does not update memory map after each step since it can potentially take a long time. You can try to either use “run to”(F4) instead of stepping or force refresh by calling refresh_debugger_memory(...
Igor Skochinsky's user avatar
  • 36.5k
1 vote

mprotect syscall not working

Your parameters for mprotect are not correct. Here's the correct order start: rdi len: rsi prot: rdx The shellcode that works is push 0xA pop rax push 0x7 pop rdx call x x:pop rdi and rdi, ...
sudhackar's user avatar
  • 2,639

Only top scored, non community-wiki answers of a minimum length are eligible