13 votes

Struggling between syscall or sysenter ( Windows )

The Intel and AMD instruction sets are similar but not identical. There are many examples of that: FMA3/FMA4, AMD-V and VT-x (and their extensions), etc. The fast system call interface is yet ...
user avatar
  • 632
12 votes
Accepted

ARM64 syscalls table

arm64 syscall numbers are defined at: https://github.com/torvalds/linux/blob/v4.17/include/uapi/asm-generic/unistd.h This is a bit confusing since it is quite different from x86 and x86_64 and arm 32-...
user avatar
9 votes

ARM64 syscalls table

Update: See this answer for up-to-date information on where ARM64 syscall definitions are found. Note that the information below may just be for backwards-compatibility. See arch/arm64/include/asm/...
user avatar
  • 191
9 votes
Accepted

Difference between INT 0X80 and SYSCALL

The short answer is that syscall has less overhead than int 0x80. For more details on why this is the case, see the accepted answer to Intel x86 vs x64 system call, where a nearly identical question ...
user avatar
  • 6,819
7 votes
Accepted

How calls work in x86

System calls vs. function calls I mean, I know they are system calls, also printf along with scanf, strcmp are C functions. Many C library functions are wrappers around system calls. printf and ...
user avatar
  • 6,819
7 votes
Accepted

What is this hidden stack used by syscalls on Windows?

This doesn't happen during the system call. It happens in user-mode. WOW64 processes have two user-mode stacks - a 32-bit stack, which is the one you normally use, and a 64-bit stack. The WOW64 ntdll ...
user avatar
  • 632
7 votes
Accepted

What are the difference syscall and int 0x2E instructions?

7FFE0308h is a pointer inside the KUSER_SHARED_DATA struct. The pre-set address for access from kernel mode is defined symbolically in WDM.H as KI_USER_SHARED_DATA. It helps when debugging to ...
user avatar
  • 664
6 votes
Accepted

How does API call work on Android (NDK)?

To answer your question, let us first set a solid ground in terms of entities and definitions. ELF stands for "Executable and Linkable format". That is, it defines the structure and shape of two ...
user avatar
  • 76
5 votes
Accepted

Windows - syscalls being called in a strange way?

Following cites, answering your first question come from Windows Internals Sixth Edition Part 1, page 225: Wow64 (Win32 emulation on 64-bit Windows) refers to the software that permits the ...
user avatar
  • 3,179
4 votes

How to know the arguments of a Linux syscall?

This StackOverflow answer is a great resource. In summary, for 32 bits: Syscall number is eax. ebx, ecx, edx, esi, edi, ebp are used for arguments. You invoke the syscall with int 0x80. All registers ...
user avatar
4 votes

What are the difference syscall and int 0x2E instructions?

int 2Eh is used on 32bit OS to enter the kernel mode. On 64-bit, the same is obtained by using syscall. The check done on memory address 0x7ffe0300 is one of the ways to detect the bitness.
user avatar
2 votes

System programming and reverse engineering

Generally a reverse engineer translates assembly code to a higher level language, for that reason it is quite a necessity to be familiar with that language (or at least a similar language), usually ...
user avatar
  • 11.3k
2 votes
Accepted

Removing randomness from program execution

Generally speaking, yes, there are a lot of ways to generate entropy without system calls (this can be weak entropy, but anyway). Here is a small (but obviously not even close to pretend to be full) ...
user avatar
  • 7,700
2 votes

Instrumenting syscall by static binary rewriting

PIN_AddSyscallEntryFunction and PIN_AddSyscallExitFunction should do the trick. Link to the Documentation. Snippet using theses APIs : (credits to Jurriaan Bremer) #include <stdio.h> #include "...
user avatar
  • 578
2 votes
Accepted

pintool to intercept writes and VirtualProtect

Pintools on Windows can also aid you in instrumenting system calls. Also, if its discovered that the cpu supports sysenter/syscall, those are used in place of int 2e. However, this has no bearing on ...
user avatar
  • 251
2 votes

hooking sleep & beep syscalls

not sure what you mean dot will always sound like dot wont it ? so logically it will always have the same frequency and same duration ? like wise dash will always sound like dash ? if it varied ...
user avatar
  • 14.8k
1 vote

Windows - syscalls being called in a strange way?

I would add information to the first answer. The switch of the mode from Wow64 to 64bit, aka "Heaven's Gate", is in wow64cpu.dll. offset j_Wow64Transition is a part of wow64cpu.dll. These slides ...
user avatar
  • 11
1 vote

How to know the arguments of a Linux syscall?

I wouldn't call it authentic, but this surely is a source I've been using for quite some time now. Double click on the line of the syscall to see what the parameters are (and their types). You may ...
user avatar
1 vote
Accepted

hooking sleep & beep syscalls

If you're using Wine, you just need to enable the trace. Do the following: $ WINEDEBUG="trace+msvcrt" wine your_binary.exe Taking a look to the Wine's source code I verified that both Sleep and Beep ...
user avatar
  • 4,305
1 vote
Accepted

What's the difference between an interrupt line and the interrupt number

LMGTFY: An interrupt is a signal from a device, such as the keyboard, to the CPU, telling it to immediately stop whatever it is currently doing and do something else. For example, the keyboard ...
user avatar
  • 6,819
1 vote

System programming and reverse engineering

Generally system programming is not required, but recommended... It is also important to understand the application flow, the CPU architecture (stack, heap, exceptions), file format (PE, ELF). I ...
user avatar
1 vote

Trace system calls, including stack (and java stack if possible), on android?

you can get system call stack with strace too. you just need to compile strace with libunwind. After that you just need to use -k to get system call stack for each system call.
user avatar
  • 11
1 vote

Trace system calls, including stack (and java stack if possible), on android?

JavaJournal, which was built on top of the pyspresso framework, was designed specifically for tracing method calls in Java.
user avatar
1 vote
Accepted

How locate (NtUserUnregisterUserApiHook) function in win32k.sys with IDA

C:\>md win32k C:\>cd win32k C:\win32k>copy c:\WINDOWS\system32\win32k.sys . 1 file(s) copied. C:\win32k>"c:\Program Files\IDA Free\idag.exe" -B -A win32k.sys wait till *.idb and *....
user avatar
  • 14.8k
1 vote

Find out windows API calls using IDA?

Place a read breakpoint on the memory you patched to find out what instructions are accessing it, that should lead you to some sort of checksum function or comparison to the file on disk. Then you ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible