3 ms·

Windows never used syscalls officially - the Windows API evolved from essentially having the operating system be inside few shared libraries that your program l

by p_l 4y ago

Windows never used syscalls officially - the Windows API evolved from essentially having the operating system be inside few shared libraries that your program linked with. Even once the idea of syscall started showing up with protected mode and NT, the applications wouldn't directly invoke them, but through interfaces in the libraries. Thus there was never really a proper need to have stable syscall interface, because at least officially no application was supposed to use them - they were private implementation details of various DLLs.

ryao 4y ago
These days, you have DRM solutions doing syscalls directly. I think Jurassic World evolution is an example of software using DRM that does that. The wine developers had to implement the ability to emulate windows syscalls because of it. I wonder how Microsoft will react to third parties beginning to do syscalls.
- userbinator 4y ago
  "beginning to"? This has been around since the early NT days, basically as long as DRM (and thus anti-DRM) has existed. Microsoft's reaction? Nothing but occasionally changing the syscall numbers.
- yjftsjthsd-h 4y ago
  I'm shocked that that works - I was given to understand that MS outright shuffles syscalls per build to make them completely unreliable from userspace.
  - p_l 4y ago
    A lot of DRM (especially game DRM) solutions don't care about reliability or stability. If they figure a way that makes it harder to reverse or run or whatever, they will do it. Even if they are essentially rootkits bad enough someone really should try to see if CFAA would stick.
userbinator 4y ago
In particular, Windows 9x has a completely different syscall interface (if you could even call it that) than the NT line; the majority of kernel32 functions seem to go through a far call to a fixed address: https://news.ycombinator.com/item?id=13264007 https://news.ycombinator.com/item?id=13264007 The above-linked handful of pages may be the only detailed documentation of the 9x syscall interface that is still reachable by search engines today.

by p_l 4y ago

ryao 4y ago

These days, you have DRM solutions doing syscalls directly. I think Jurassic World evolution is an example of software using DRM that does that. The wine developers had to implement the ability to emulate windows syscalls because of it. I wonder how Microsoft will react to third parties beginning to do syscalls.

userbinator 4y ago
"beginning to"? This has been around since the early NT days, basically as long as DRM (and thus anti-DRM) has existed. Microsoft's reaction? Nothing but occasionally changing the syscall numbers.
yjftsjthsd-h 4y ago
I'm shocked that that works - I was given to understand that MS outright shuffles syscalls per build to make them completely unreliable from userspace.
- p_l 4y ago
  A lot of DRM (especially game DRM) solutions don't care about reliability or stability. If they figure a way that makes it harder to reverse or run or whatever, they will do it. Even if they are essentially rootkits bad enough someone really should try to see if CFAA would stick.

userbinator 4y ago

In particular, Windows 9x has a completely different syscall interface (if you could even call it that) than the NT line; the majority of kernel32 functions seem to go through a far call to a fixed address: https://news.ycombinator.com/item?id=13264007 https://news.ycombinator.com/item?id=13264007 The above-linked handful of pages may be the only detailed documentation of the 9x syscall interface that is still reachable by search engines today.