News for hackers. Stuff that matters.

A comment on Windows X86-64 System Call Table. Parent comment

Re:Windows X86-64 System Call Table by KyleJ61782 on Sunday September 01, 2019 @10:57PM (#20856467)
Using the NTDLL calls breaks stuff because NTDLL doesn't understand anything about the overlaid subsystems. NT was originally designed to support multiple subsystems in addition to Win32, like the Interix (POSIX compliant) subsystem and the OS/2 subsystem I believe. I think (I could be wrong on this) that this was possible by switching the system call table depending upon which process was currently active (doable by switching the system call vector).
[ Parent | on HN ]
Re:Windows X86-64 System Call Table by Avery3R on Monday September 02, 2019 @03:19AM (#20857326)
IIRC the syscall table doesn't get swapped out. Each subsystem translates its calls to NT API calls. For example, user32.dll and kernel32.dll are a part of the win32 subsystem and eventually end up calling NT APIs in ntdll.dll. It's possible for a process to have no subsystem, these are called native NT process and the only dll loaded by default into their address space is ntdll, csrss.exe is an example of this.
[ Parent | on HN ]
Re:Windows X86-64 System Call Table by mehrdadn on Monday September 02, 2019 @04:19AM (#20857549)
The layer underneath that they build subsystems on is always the system call interface (ntdll), not the syscall numbers themselves.
[ Parent | on HN ]