11 ms·
Windows X86-64 System Call Table
- pedrocx486 7y agoSorry if this is an dumb question I could easily find on Google (been a webdev for most of my career), buy I'm curious why some syscalls exist on Vista SP1 for example, but don't exist on the versions before and after it. Edit: I meant SP0, not SP1, sorry. It was this SysCall: NtListTransactions
- mehrdadn 7y agoCould you give an example? I don't see anything that's on Vista SP1 but not on SP2.
- pedrocx486 7y agoSorry, in my case I saw this on SP0 not SP1: NtListTransactions
- PeCaN 7y agothat's probably part of TxF (aka transactional ntfs) which got deprecated basically as soon as it was released (though i think it's still used internally for e.g. system restore) so it's likely that got moved around somehow or the TxF API got reimplemented in userspace
- mehrdadn 7y agoI don't believe their deprecation claims on that. It's too deeply ingrained into the OS for them to ever remove it, and too useful and difficult to replace. Really, it just doesn't have enough users, is all. And there's more to transactions than just the file system (TxF) so I'm not even sure it's related to this either. Also you can't implement TxF in userspace. It has to detect conflicts with other applications and roll back in the case of an unsuccessful commit (power loss etc.) before the file system is used again. Any userspace implementation would leave stuff in a corrupted state until it's re-run.
- PeCaN 7y ago> I don't believe their deprecation claims on that. I don't either, although the API is kind of overkill for most use cases so I'm not too surprised they discourage people from using it. > And there's more to transactions than just the file system (TxF) so I'm not even sure it's related to this either. True, I just assumed it was related to the txfs_list_transactions ioctl. > Also you can't implement TxF in userspace. It has to detect conflicts with other applications and […] I think the Kernel Transaction Manager already takes care of that. I think??? TxF could be implemented as a userspace library on top of KTM, but I'm not particularly familiar with either facility. Though if it was possible perhaps they would've done it that way in the first place, since TxF uses KTM regardless. I wonder what did happen to it between SP0 and SP1.
- mehrdadn 7y agoI don't know what it does (seems it was never documented? possibly so it could be removed), but for example, I do see NtEnumerateTransactionObject, which may have overlapped with its functionality? Or maybe NtQuerySystemInformation or another function does similarly.
- rolph 7y agoi would suspect a brand new idea [thus not appearing earlier] lost traction or relevence and didnt make the cut to migrate into the next revision
- skissane 7y agoIt isn't a dumb question. I believe the reason is the following: Leading up to any Windows release, Microsoft has a whole bunch of teams working on different features. Some of those features make it into the release, other features don't make it and get cut. What sometimes happens, is that a feature makes it in, but then problems are discovered in testing, and it gets pulled out again at the last minute. When a feature is removed late in the game like that, it is desired to take the lowest risk removal mechanism as possible–one way of doing that is to actually leave the feature in the code, but leave it undocumented, and hope nobody discovers it and uses it (an approach avoided nowadays due to the risk of exploitable security bugs in the buggy API, but in the past it was more common). Another way is to leave its APIs in-place, and either stub out their implementations (to always return an error), or even hide the actual implementation behind a #define that is turned off in the shipping copy. That way, you avoid making any changes to DLL export tables, the system call table, etc., which you worry (even just out of an abundance of caution) might have some downstream negative effect, but also don't have to worry about anyone discovering the broken feature and trying to use it. Then, in the next release, you have a choice – sometimes they will fix the issues with the feature and put it back in, other times priorities have changed and the remnants of the feature (such as API stubs) get removed altogether. That is why sometimes Windows DLLs export undocumented APIs that don't do anything. (I've never worked for Microsoft, so this is not based on any internal info, just an inference from observing how Microsoft and other vendors do things.)
- ninkendo 7y agoHow do they deal with the syscall numbers being different from release to release, while still maintaining binary compatibility? From what I can tell, (in Linux at least) the syscall numbers are the thing that needs to stay constant for the kernel to not break user space.
- mehrdadn 7y ago> How do they deal with the syscall numbers being different from release to release, while still maintaining binary compatibility By not calling syscalls based on their numbers on Windows. That might sound crazy, but actually to me coming from Windows, calling them by ordinals is what sounds crazy. :-) You're supposed to call exported functions in shared libraries (ntdll.dll etc.) that call the syscalls for you.
- rocqua 7y agoTo be fair, that is how most of linux tends to work. With glib wrappers around syscalls. It's just that the numbers are considered part of the stable interface. Hence people can write their own wrappers. It's part of linux saying 'we don't break userspace' and the syscall numbers being how userspace talks to kernelspace.
- mehrdadn 7y agoGiven glibc isn't part of the OS, and that hence you can statically link to it, it can't be part of the stable interface. glibc isn't a thing as far as the OS is concerned. It seems to me this also means Linux is more limited in what it can do in breaking syscalls too. On Windows, if you load any shared library (including ntdll) and an exported function isn't there, the loader can produce an error for you telling you that a function you need isn't there. On Linux... you're calling the syscall directly, so there's nothing that can stand between you and the syscalls to perform a check or anything. Overall it seems to me like coding against direct syscall numbers is a disadvantage on almost every front.
- 7y ago
- mehrdadn 7y agoNote that this page doesn't show the full set of syscalls, just a subset of them (seems to be the ones ntdll calls). The Win32k stuff, for one, don't seem to be there (edit: they're on this page instead: https://j00ru.vexillium.org/syscalls/win32k/64/ https://j00ru.vexillium.org/syscalls/win32k/64/), let alone more obscure ones that I expect exist but that I don't know about (like WSL stuff).
- monocasa 7y agoThe WSL stuff doesn't have system calls AFAIK. All the work is either kernel mode indirection to the kernel driver, and IPC (ALPC I think on WSL1?).
- mehrdadn 7y agoWell for starters WSL implements Linux system calls, so it definitely has its own system calls! But even beyond that, I was thinking of one thing they added for performance reasons (see 3rd bullet): https://github.com/Microsoft/WSL/issues/873#issuecomment-425272829 https://github.com/Microsoft/WSL/issues/873#issuecomment-425... However I'm not entirely sure if it's a concrete "syscall" or if it's implemented as a new option through an existing one. (It's not clear to me how they could reasonably fit this into anything that already exists, but it might.) Though I would be mildly surprised if they didn't implement at least one syscall specifically for WSL...
- monocasa 7y ago> Well for starters WSL implements Linux system calls, so it definitely has its own system calls! Sure, but not in the NT system call table. > But even beyond that, I was thinking of one thing they added for performance reasons (see 3rd bullet): https://github.com/Microsoft/WSL/issues/873#issuecomment-425.. https://github.com/Microsoft/WSL/issues/873#issuecomment-425.... > However I'm not entirely sure if it's a concrete "syscall" or if it's implemented as a new option through an existing one. (It's not clear to me how they could reasonably fit this into anything that already exists, but it might.) Though I would be mildly surprised if they didn't implement at least one syscall specifically for WSL... It's neither, it's an API inside kernel space. They didn't expose it through the NT syscall table, but instead how the linux transtalion layer calls directly into NT kernel functions.
- quotemstr 7y agoIt's important to note that unlike Linux, NT system call numbers are not stable. That's a very good thing --- it effectively forces all system calls to go through ntdll, which can coordinate closely with userspace in interesting ways. It's as if NT's "vdso" covered all interaction with the kernel. For example, NT has no native 32-bit ABI like Linux does. Instead, userspace translates 32-bit to 64-bit system calls, handling the switch from long and back to long mode transparently. This elegant approach is possible because applications never make system calls directly.
- rocqua 7y agoHow does that work with regards to privilege separation. It sounds like bypassing nt.dll might be an exploit vector that is easily forgotten.
- gruez 7y agoPermission checks are still done in the kernel. >It sounds like bypassing nt.dll might be an exploit vector that is easily forgotten. MSFT might be bad, but not that bad.
- mehrdadn 7y agoJust a note, it's not nt.dll, it's ntdll.dll.
- crehn 7y agoHeh, interesting. Any specific reason for the stuttering? Or just arbitrary inconsistent historical decision?
- october_sky 7y agoCould someone provide examples of what to type in the field, with perhaps the relevance? (I'm not a Windows user, but this looks cool enough to test)
- sbierwagen 7y agoHuh. Why is this so slow? According to Chrome, it took 704 milliseconds from clicking the "show" button on "Windows XP" to displaying the results. No network calls at all. A whole 525ms of script evaluation. Modern computer, thousand row table, wouldn't expect it to take that long.
- lucb1e 7y agoWorks fine for me on an average laptop with latest stable Firefox.
- bediger4000 7y agoWindows NT has been around since what, 1993 or 94? Why is this even news? Doesn't Microsoft document this stuff? How does anybody use a system that doesn't have this documented? PS http://stratigery.com/nt.sekrits.html http://stratigery.com/nt.sekrits.html
- shanemhansen 7y agoBecause developers aren't supposed to to use them. The documented interface is ntdll or whatever.
- derpherpsson 7y agoI also ask myself this question. How can anyone use an OS where the creators deliberately hide some of the documentation? I would love to read up on windows internals, but there are no real resources out there. A few books that at first glance appears to cover it, but then just deals with the application layer and up to point-and-click. This is why I don't use windows anymore. I don't ever again want a job where I have to debug why old program P stopped working after an update. I prefer to be able to learn stuff.
- kyberias 7y agoOh come on! https://www.amazon.co.uk/Windows-Internals-Part-architecture-management/dp/0735684189 https://www.amazon.co.uk/Windows-Internals-Part-architecture... Certainly all systems have undocumented stuff that are left undocumented because the users are not supposed to use it. If they would, they couldn't change it.
- bediger4000 7y agoSystem calls seems like the very definition of what should be documented for users. Particularly if you want someone to write compilers for your operating system.
- yyyk 7y agoThe stable program-kernel interface is not the kernel syscalls, but library API. That's exactly the same as every other non-Linux OS out there including other Unixes and other Free OSs.
- moyix 7y agoOne odd bit of trivia: the Windows system call mechanism supports up to four different tables. The first two are what you'll usually see - the first is the basic kernel services, and the second is for Win32k, the graphical subsystem. The final two slots are up for grabs and historically could be used by drivers to implement custom system calls. The system call number determines what table is used. Calls in the 0x0-0xFFF range are handled by the first table, 0x1000-0x1FFF by the second, and so on. As far as I know, the ability to add another system call table was only ever used by the IIS web server kernel-mode component (spud.sys).
- crusader1099 7y agoI don't doubt your interesting bit of trivia, but I couldn't find anything online about. Do you have a source for this? I would certainly love to read more about it.
- JPLeRouzic 7y agoPerhaps here [0] ? Starting IIS 4.0, Microsoft has added a kernel mode support driver (SPUD.SYS). This driver also calls KeAddSystemServiceTable function to add its own system services. This fills an entry in third array element of KeServiceDescriptorTableShadow. Hence, its services will start from 0x3000. [0] https://community.osr.com/discussion/20626/system-service-dispatcher https://community.osr.com/discussion/20626/system-service-di...
- moyix 7y agoThere's a bit more information in the indispensable Windows Internals book (quoting from the 4th edition, which is a little old now): > As you’ll see in Chapter 6, each thread has a pointer to its system service table. Windows has two built-in system service tables, but up to four are supported. The system service dispatcher determines which table contains the requested service by interpreting a 2-bit field in the 32-bit system service number as a table index. The low 12 bits of the system service number serve as the index into the table specified by the table index. [...] > A primary default array table, KeServiceDescriptorTable, defines the core executive system services implemented in Ntosrknl.exe. The other table array, KeServiceDescriptorTableShadow, includes the Windows USER and GDI services implemented in the kernel-mode part of the Windows subsystem, Win32k.sys. The first time a Windows thread calls a Windows USER or GDI service, the address of the thread’s system service table is changed to point to a table that includes the Windows USER and GDI services. The KeAddSystemServiceTable function allows Win32k.sys and other device drivers to add system service tables. If you install Internet Information Services (IIS) on Windows 2000, its support driver (Spud.sys) upon loading defines an additional service table, leaving only one left for definition by third parties. With the exception of the Win32k.sys service table, a service table added with KeAddSystemServiceTable is copied into both the KeServiceDescriptorTable array and the KeServiceDescriptorTableShadow array. Windows supports the addition of only two system service tables beyond the core and Win32 tables.
- jolmg 7y agoInteresting that on a linux machine man syscalls \ | grep -Po '\w+(?=\(2\))' \ | sort \ | uniq \ | wc -l gives the same number of 481 as the number of rows in that table. Though, the grep includes man-pages that don't correspond with a syscall, like intro(2). It's just a curious coincidence.
- kuroguro 7y agoHas anyone ever done a mapping of which regular API functions map to which syscalls?