The value is sent to system call function, don't match with the valid system call codex86: ZF not always updated by AND?Opcode and ModRM for 'call dword ptr [mem32]' question?Problem on dword ptr[…] with visual studio 2010Floating point exceptions in x86 NASM assembly using div instructionAssembly MASM Dealing with Negative IntegersI am trying to program finite state machine in assembly language but i am stuck(VC++) Runtime Check for Uninitialized Variables: How is the test Implemented?What is the correct use of multiple input and output operands in extended GCC asm?Assembly memory math and loopingVirtual Address assigned to an imported function
Can a fight scene, component-wise, be too complex and complicated?
How does 'AND' distribute over 'OR' (Set Theory)?
As a 16 year old, how can I keep my money safe from my mother?
Are differences between uniformly distributed numbers uniformly distributed?
Loading military units into ships optimally, using backtracking
What are the conventions for transcribing Semitic languages into Greek?
Am I overreacting to my team leader's unethical requests?
Why does Intel's Haswell chip allow FP multiplication to be twice as fast as addition?
Is TA-ing worth the opportunity cost?
Infeasibility in mathematical optimization models
Does this Foo machine halt?
Who are these characters/superheroes in the posters from Chris's room in Family Guy?
How is this kind of structure made?
How can I shift my job responsibilities back to programming?
The equation of motion for a scalar field in curved spacetime in terms of the covariant derivative
Sign changes after taking the square root inequality. Why?
Is there a way to unplug the Raspberry pi safely without shutting down
try/finally with bash shell
Ex-contractor published company source code and secrets online
multiplying two array in python3.7
Y2K... in 2019?
What costs less energy? Roll or Yaw?
How to avoid the "need" to learn more before conducting research?
Withdrew when Jimmy met up with Heath
The value is sent to system call function, don't match with the valid system call code
x86: ZF not always updated by AND?Opcode and ModRM for 'call dword ptr [mem32]' question?Problem on dword ptr[…] with visual studio 2010Floating point exceptions in x86 NASM assembly using div instructionAssembly MASM Dealing with Negative IntegersI am trying to program finite state machine in assembly language but i am stuck(VC++) Runtime Check for Uninitialized Variables: How is the test Implemented?What is the correct use of multiple input and output operands in extended GCC asm?Assembly memory math and loopingVirtual Address assigned to an imported function
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;
When I was investigating in an executable file,I reached to the piece of code below:
MOV EAX,11B9
MOV EDX,7FFE0300
CALL DWORD PTR DS:[EDX]
RETN 10
This is used to demand a system call. Until here, there is no problem.
I searched within the whole system call code of Windows OS, but none of them is equal to 11B9 in the instruction in the first row "MOV EAX,11B9".
Could everybody guide me, what it means here exactly?
windows assembly x86 system-calls
edited Mar 27 at 8:34
Peter Cordes
153k21 gold badges243 silver badges390 bronze badges
asked Mar 27 at 8:27
FarshidFarshid
114 bronze badges
add a comment |
When I was investigating in an executable file,I reached to the piece of code below:
MOV EAX,11B9
MOV EDX,7FFE0300
CALL DWORD PTR DS:[EDX]
RETN 10
This is used to demand a system call. Until here, there is no problem.
I searched within the whole system call code of Windows OS, but none of them is equal to 11B9 in the instruction in the first row "MOV EAX,11B9".
Could everybody guide me, what it means here exactly?
windows assembly x86 system-calls
edited Mar 27 at 8:34
Peter Cordes
153k21 gold badges243 silver badges390 bronze badges
asked Mar 27 at 8:27
FarshidFarshid
114 bronze badges
ret 10is really weird; that's not a multiple of 4. Is this function called with some 16-bit push instructions or something? Oh, I guess all your numbers are hex but you left out a0xprefix orhsuffix.
– Peter Cordes
Mar 27 at 8:32
I copied the whole code from Olly debugger.yes, the numbers are in hex,but my concern here is not for the instruction ret 10! I got confused by the 11B9 system call value.
– Farshid
Mar 28 at 8:38
add a comment |
When I was investigating in an executable file,I reached to the piece of code below:
MOV EAX,11B9
MOV EDX,7FFE0300
CALL DWORD PTR DS:[EDX]
RETN 10
This is used to demand a system call. Until here, there is no problem.
I searched within the whole system call code of Windows OS, but none of them is equal to 11B9 in the instruction in the first row "MOV EAX,11B9".
Could everybody guide me, what it means here exactly?
windows assembly x86 system-calls
edited Mar 27 at 8:34
Peter Cordes
153k21 gold badges243 silver badges390 bronze badges
asked Mar 27 at 8:27
FarshidFarshid
114 bronze badges
When I was investigating in an executable file,I reached to the piece of code below:
MOV EAX,11B9
MOV EDX,7FFE0300
CALL DWORD PTR DS:[EDX]
RETN 10
This is used to demand a system call. Until here, there is no problem.
I searched within the whole system call code of Windows OS, but none of them is equal to 11B9 in the instruction in the first row "MOV EAX,11B9".
Could everybody guide me, what it means here exactly?
windows assembly x86 system-calls
windows assembly x86 system-calls
edited Mar 27 at 8:34
Peter Cordes
153k21 gold badges243 silver badges390 bronze badges
asked Mar 27 at 8:27
FarshidFarshid
114 bronze badges
edited Mar 27 at 8:34
Peter Cordes
153k21 gold badges243 silver badges390 bronze badges
asked Mar 27 at 8:27
FarshidFarshid
114 bronze badges
edited Mar 27 at 8:34
Peter Cordes
153k21 gold badges243 silver badges390 bronze badges
edited Mar 27 at 8:34
Peter Cordes
153k21 gold badges243 silver badges390 bronze badges
edited Mar 27 at 8:34
Peter Cordes
153k21 gold badges243 silver badges390 bronze badges
153k21 gold badges243 silver badges390 bronze badges
asked Mar 27 at 8:27
FarshidFarshid
114 bronze badges
asked Mar 27 at 8:27
FarshidFarshid
114 bronze badges
asked Mar 27 at 8:27
FarshidFarshid
114 bronze badges
114 bronze badges
ret 10is really weird; that's not a multiple of 4. Is this function called with some 16-bit push instructions or something? Oh, I guess all your numbers are hex but you left out a0xprefix orhsuffix.
– Peter Cordes
Mar 27 at 8:32
I copied the whole code from Olly debugger.yes, the numbers are in hex,but my concern here is not for the instruction ret 10! I got confused by the 11B9 system call value.
– Farshid
Mar 28 at 8:38
add a comment |
ret 10is really weird; that's not a multiple of 4. Is this function called with some 16-bit push instructions or something? Oh, I guess all your numbers are hex but you left out a0xprefix orhsuffix.
– Peter Cordes
Mar 27 at 8:32
I copied the whole code from Olly debugger.yes, the numbers are in hex,but my concern here is not for the instruction ret 10! I got confused by the 11B9 system call value.
– Farshid
Mar 28 at 8:38
ret 10 is really weird; that's not a multiple of 4. Is this function called with some 16-bit push instructions or something? Oh, I guess all your numbers are hex but you left out a 0x prefix or h suffix.– Peter Cordes
Mar 27 at 8:32
ret 10 is really weird; that's not a multiple of 4. Is this function called with some 16-bit push instructions or something? Oh, I guess all your numbers are hex but you left out a 0x prefix or h suffix.– Peter Cordes
Mar 27 at 8:32
I copied the whole code from Olly debugger.yes, the numbers are in hex,but my concern here is not for the instruction ret 10! I got confused by the 11B9 system call value.
– Farshid
Mar 28 at 8:38
I copied the whole code from Olly debugger.yes, the numbers are in hex,but my concern here is not for the instruction ret 10! I got confused by the 11B9 system call value.
– Farshid
Mar 28 at 8:38
add a comment |
1 Answer
1
active
oldest
votes
Syscalls numbered 0x1XXX are calls to win32k.sys.
Here is a great table created and updated by j00ru showing the win32k syscall IDs for different versions of Windows:
answered Mar 28 at 14:34
qwmqwm
9257 silver badges9 bronze badges
add a comment |
Your Answer
StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55372686%2fthe-value-is-sent-to-system-call-function-dont-match-with-the-valid-system-cal%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Syscalls numbered 0x1XXX are calls to win32k.sys.
Here is a great table created and updated by j00ru showing the win32k syscall IDs for different versions of Windows:
answered Mar 28 at 14:34
qwmqwm
9257 silver badges9 bronze badges
add a comment |
Syscalls numbered 0x1XXX are calls to win32k.sys.
Here is a great table created and updated by j00ru showing the win32k syscall IDs for different versions of Windows:
answered Mar 28 at 14:34
qwmqwm
9257 silver badges9 bronze badges
add a comment |
Syscalls numbered 0x1XXX are calls to win32k.sys.
Here is a great table created and updated by j00ru showing the win32k syscall IDs for different versions of Windows:
answered Mar 28 at 14:34
qwmqwm
9257 silver badges9 bronze badges
Syscalls numbered 0x1XXX are calls to win32k.sys.
Here is a great table created and updated by j00ru showing the win32k syscall IDs for different versions of Windows:
answered Mar 28 at 14:34
qwmqwm
9257 silver badges9 bronze badges
answered Mar 28 at 14:34
qwmqwm
9257 silver badges9 bronze badges
answered Mar 28 at 14:34
qwmqwm
9257 silver badges9 bronze badges
answered Mar 28 at 14:34
qwmqwm
9257 silver badges9 bronze badges
9257 silver badges9 bronze badges
add a comment |
add a comment |
Got a question that you can’t ask on public Stack Overflow? Learn more about sharing private information with Stack Overflow for Teams.
Got a question that you can’t ask on public Stack Overflow? Learn more about sharing private information with Stack Overflow for Teams.
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55372686%2fthe-value-is-sent-to-system-call-function-dont-match-with-the-valid-system-cal%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
ret 10is really weird; that's not a multiple of 4. Is this function called with some 16-bit push instructions or something? Oh, I guess all your numbers are hex but you left out a0xprefix orhsuffix.– Peter Cordes
Mar 27 at 8:32
I copied the whole code from Olly debugger.yes, the numbers are in hex,but my concern here is not for the instruction ret 10! I got confused by the 11B9 system call value.
– Farshid
Mar 28 at 8:38