3 ms·

> Windows applications are increasingly executing system calls directly rather than going through the API I didn't know this. What applications are doing this

> Windows applications are increasingly executing system calls directly rather than going through the API I didn't know this. What applications are doing this and why?

wtallis 6y ago
Anti-cheating libraries used in games seem to be the primary culprits, and they're doing it this way because their purpose is to break things while resisting the user's attempts to make things work nicely.
- leeter 6y ago
  Unfortunately WINE can't just take the windows shim mechanism that largely just nukes these from orbit on binary load and removes the check all together. Maybe at some point MS will be more open about that.
- mehrdadn 6y ago
  A bit off-topic, but do you happen to know if there is a way on Windows to intercept syscall instructions? (aside from dynamic analysis/recompilation/etc.?) If there isn't, I assume that's why cheat engines do this?
  - wtallis 6y ago
    I think it's inherent to the SYSCALL instruction that control gets transferred directly to the kernel and ring 0, with no possibility of intercepting in userspace. So on Windows or Linux, you need kernel help to redirect/intercept syscalls.
    - mehrdadn 6y ago
      I asked this as a Windows question rather than an x86 question. I was wondering if there's any Windows API that could help with this. (This includes kernel APIs.)
      - monocasa 6y ago
        The PicoProcess model used by the first WSL worked by intercepting syscalls (among other mechanisms). It wasn't generally available for consumption by developers other than Microsoft, though. The gnarlier antivirus will do a similar thing by just patching the IDT and syscall MSRs, but that's a bit frowned upon.
ThrowawayR2 6y ago
Based on the second post, seems to be anti-cheating code for games. Ironically, this work might backfire in the long run if unscrupulous players are able to use cheats developed specifically to run under Linux.
- asddubs 6y ago
  windows may run games better, but linux lets you cheat better
Andoryuuta 6y ago
To add to the mentions of anti-cheat software, there are also multiple binary packers/protectors, such as VMProtect[1], which use system calls directly to protect and/or obfuscate themselves. [1]: https://lifeinhex.com/use-of-syscall-and-sysenter-in-vmprotect-3-1/ https://lifeinhex.com/use-of-syscall-and-sysenter-in-vmprote...

> Windows applications are increasingly executing system calls directly rather than going through the API I didn't know this. What applications are doing this and why?

wtallis 6y ago

Anti-cheating libraries used in games seem to be the primary culprits, and they're doing it this way because their purpose is to break things while resisting the user's attempts to make things work nicely.

leeter 6y ago
Unfortunately WINE can't just take the windows shim mechanism that largely just nukes these from orbit on binary load and removes the check all together. Maybe at some point MS will be more open about that.
mehrdadn 6y ago
A bit off-topic, but do you happen to know if there is a way on Windows to intercept syscall instructions? (aside from dynamic analysis/recompilation/etc.?) If there isn't, I assume that's why cheat engines do this?
- wtallis 6y ago
  I think it's inherent to the SYSCALL instruction that control gets transferred directly to the kernel and ring 0, with no possibility of intercepting in userspace. So on Windows or Linux, you need kernel help to redirect/intercept syscalls.
  - mehrdadn 6y ago
    I asked this as a Windows question rather than an x86 question. I was wondering if there's any Windows API that could help with this. (This includes kernel APIs.)
    - monocasa 6y ago
      The PicoProcess model used by the first WSL worked by intercepting syscalls (among other mechanisms). It wasn't generally available for consumption by developers other than Microsoft, though. The gnarlier antivirus will do a similar thing by just patching the IDT and syscall MSRs, but that's a bit frowned upon.

ThrowawayR2 6y ago

Based on the second post, seems to be anti-cheating code for games. Ironically, this work might backfire in the long run if unscrupulous players are able to use cheats developed specifically to run under Linux.

asddubs 6y ago
windows may run games better, but linux lets you cheat better

Andoryuuta 6y ago

To add to the mentions of anti-cheat software, there are also multiple binary packers/protectors, such as VMProtect[1], which use system calls directly to protect and/or obfuscate themselves. [1]: https://lifeinhex.com/use-of-syscall-and-sysenter-in-vmprotect-3-1/ https://lifeinhex.com/use-of-syscall-and-sysenter-in-vmprote...