2 ms·
I should've known better than to be vague here. I'm talking about just syscalls. Windows differs from Linux in that Windows doesn't have backwards compatibilit
by jchw 3y ago
I should've known better than to be vague here.
I'm talking about just syscalls. Windows differs from Linux in that Windows doesn't have backwards compatibility for the kernel ABI but the userspace ABI; all of the syscalls HAVE to be dispatched by NTDLL, because the syscall numbers are not stable between kernel versions anyway. (Not that this entirely stops crapware like anti-cheat from doing so, but nonetheless.)
From my point of view, the closest Wine equivalent of a "syscall" would be calling out to UNIX system libraries, so it does bear some similarities even if it's not quite the same.
I don't personally want to open WOW64 NTDLL in IDA because doing so would probably limit me from contributing to Wine, but my understanding is that WOW64 NTDLL is just thunks to Win64 NTDLL, using an intermediate library (one of the wow64*.dlls presumably?) to perform a Heaven's Gate call into the 64-bit NTDLL.
- AshamedCaptain 3y agoNot even that is true anymore since some Windows games are now hardcoding system call numbers.
- sapphyrus 3y agoWOW64 syscalls are indeed implemented using heaven's gate, the 32-bit ntdll calls into a "wow64cpu.dll" module, which does the long-mode transition and ends up calling into the 64-bit ntdll. Unfortunately manual syscalls are still possible (and widely used) on windows, either by hardcoding syscall IDs for common versions or performing very rudimentary "disassembling" of the ntdll syscall stubs.
- Dwedit 3y agoSyscalls aren't just dispatched by NTDLL, they're also dispatched by "Win32u.dll". In earlier versions of Windows, "User32.dll" also makes system calls as well.
- jchw 3y agoOkay, I genuinely did not know that User32.dll made syscalls directly. Interesting, and kind of bizarre.