13
votes
Struggling between syscall or sysenter ( Windows )
The Intel and AMD instruction sets are similar but not identical.
There are many examples of that: FMA3/FMA4, AMD-V and VT-x (and their extensions), etc.
The fast system call interface is yet ...
- 632
12
votes
Accepted
ARM64 syscalls table
arm64 syscall numbers are defined at: https://github.com/torvalds/linux/blob/v4.17/include/uapi/asm-generic/unistd.h
This is a bit confusing since it is quite different from x86 and x86_64 and arm 32-...
9
votes
ARM64 syscalls table
Update: See this answer for up-to-date information on where ARM64 syscall definitions are found. Note that the information below may just be for backwards-compatibility.
See arch/arm64/include/asm/...
- 191
9
votes
Accepted
Difference between INT 0X80 and SYSCALL
The short answer is that syscall has less overhead than int 0x80.
For more details on why this is the case, see the accepted answer to Intel x86 vs x64 system call, where a nearly identical question ...
- 6,819
7
votes
Accepted
How calls work in x86
System calls vs. function calls
I mean, I know they are system calls, also printf along with scanf, strcmp are C functions.
Many C library functions are wrappers around system calls. printf and ...
- 6,819
7
votes
Accepted
What is this hidden stack used by syscalls on Windows?
This doesn't happen during the system call. It happens in user-mode.
WOW64 processes have two user-mode stacks - a 32-bit stack, which is the one you normally use, and a 64-bit stack. The WOW64 ntdll ...
- 632
7
votes
Accepted
What are the difference syscall and int 0x2E instructions?
7FFE0308h is a pointer inside the KUSER_SHARED_DATA struct.
The pre-set address for access from kernel mode is defined symbolically in WDM.H as KI_USER_SHARED_DATA. It helps when debugging to ...
- 664
6
votes
Accepted
How does API call work on Android (NDK)?
To answer your question, let us first set a solid ground in terms of entities and definitions.
ELF stands for "Executable and Linkable format".
That is, it defines the structure and shape of two ...
- 76
5
votes
Accepted
Windows - syscalls being called in a strange way?
Following cites, answering your first question come from Windows Internals Sixth Edition Part 1, page 225:
Wow64 (Win32 emulation on 64-bit Windows) refers to the software that permits the ...
- 3,179
4
votes
How to know the arguments of a Linux syscall?
This StackOverflow answer is a great resource.
In summary, for 32 bits: Syscall number is eax. ebx, ecx, edx, esi, edi, ebp are used for arguments. You invoke the syscall with int 0x80. All registers ...
- 96
4
votes
What are the difference syscall and int 0x2E instructions?
int 2Eh is used on 32bit OS to enter the kernel mode. On 64-bit, the same is obtained by using syscall. The check done on memory address 0x7ffe0300 is one of the ways to detect the bitness.
- 4,512
2
votes
System programming and reverse engineering
Generally a reverse engineer translates assembly code to a higher level language, for that reason it is quite a necessity to be familiar with that language (or at least a similar language), usually ...
- 11.3k
2
votes
Accepted
Removing randomness from program execution
Generally speaking, yes, there are a lot of ways to generate entropy without system calls (this can be weak entropy, but anyway).
Here is a small (but obviously not even close to pretend to be full) ...
- 7,700
2
votes
Instrumenting syscall by static binary rewriting
PIN_AddSyscallEntryFunction and PIN_AddSyscallExitFunction should do the trick. Link to the Documentation.
Snippet using theses APIs : (credits to Jurriaan Bremer)
#include <stdio.h>
#include "...
- 578
2
votes
Accepted
pintool to intercept writes and VirtualProtect
Pintools on Windows can also aid you in instrumenting system calls. Also, if its discovered that the cpu supports sysenter/syscall, those are used in place of int 2e. However, this has no bearing on ...
- 251
2
votes
hooking sleep & beep syscalls
not sure what you mean
dot will always sound like dot wont it ?
so logically it will always have the same frequency and same duration ?
like wise dash will always sound like dash ?
if it varied ...
- 14.8k
1
vote
Windows - syscalls being called in a strange way?
I would add information to the first answer.
The switch of the mode from Wow64 to 64bit, aka "Heaven's Gate", is in wow64cpu.dll. offset j_Wow64Transition is a part of wow64cpu.dll.
These slides ...
- 11
1
vote
How to know the arguments of a Linux syscall?
I wouldn't call it authentic, but this surely is a source I've been using for quite some time now.
Double click on the line of the syscall to see what the parameters are (and their types).
You may ...
- 364
1
vote
Accepted
hooking sleep & beep syscalls
If you're using Wine, you just need to enable the trace. Do the following:
$ WINEDEBUG="trace+msvcrt" wine your_binary.exe
Taking a look to the Wine's source code I verified that both Sleep and Beep ...
- 4,305
1
vote
Accepted
What's the difference between an interrupt line and the interrupt number
LMGTFY:
An interrupt is a signal from a device, such as the keyboard, to the CPU, telling it to immediately stop whatever it is currently doing and do something else. For example, the keyboard ...
- 6,819
1
vote
System programming and reverse engineering
Generally system programming is not required, but recommended...
It is also important to understand the application flow, the CPU architecture (stack, heap, exceptions), file format (PE, ELF).
I ...
- 299
1
vote
Trace system calls, including stack (and java stack if possible), on android?
you can get system call stack with strace too. you just need to compile strace with libunwind. After that you just need to use -k to get system call stack for each system call.
- 11
1
vote
Trace system calls, including stack (and java stack if possible), on android?
JavaJournal, which was built on top of the pyspresso framework, was designed specifically for tracing method calls in Java.
- 20.4k
1
vote
Accepted
How locate (NtUserUnregisterUserApiHook) function in win32k.sys with IDA
C:\>md win32k
C:\>cd win32k
C:\win32k>copy c:\WINDOWS\system32\win32k.sys .
1 file(s) copied.
C:\win32k>"c:\Program Files\IDA Free\idag.exe" -B -A win32k.sys
wait till *.idb and *....
- 14.8k
1
vote
Find out windows API calls using IDA?
Place a read breakpoint on the memory you patched to find out what instructions are accessing it, that should lead you to some sort of checksum function or comparison to the file on disk. Then you ...
- 156
Only top scored, non community-wiki answers of a minimum length are eligible