3 ms·
> Windows also allows you to issue syscalls directly Technically most systems do, OpenBSD is the only one I know of actively trying to prevent that. The line
by masklinn 2y ago
> Windows also allows you to issue syscalls directly
Technically most systems do, OpenBSD is the only one I know of actively trying to prevent that.
The line is rather whether there is support and maintenance for doing that aka how likely is it that your program will break on updates.
For Windows, it’s virtually guaranteed because IIRC the syscall numbers are just the index of the syscall name in a big sorted table, so if any syscall gets added or removed the table gets offset and you get the wrong syscall.
- deng 2y agoWe fully agree: it's technically possible, but it's not practical and really only done by malware to skip the userland hooks set up by antivirus software.