3 ms·
> NT system calls use the same syscall numbering as recent Windows, to support applications that hardcode syscall numbers. Other than antivirus software and ma
by mschuster91 10mo ago
> NT system calls use the same syscall numbering as recent Windows, to
support applications that hardcode syscall numbers.
Other than antivirus software and maybe MAYBE kernel-level "anticheat" slop - who in their right mind does straight syscalls to the kernel?
- tux3 10mo agoUserland DRMs do all sort of nonsense. Kernel anticheats wouldn't use the syscalls, they're already able to call the kernel routines they want directly.
- StrauXX 10mo agoSome programming language compilers generate asm that does call systemcalls directly. Go for example.
- teraflop 10mo agoGo does hardcode system call numbers on Linux, but it doesn't on Windows. Instead it follows the normal Windows convention of calling the userspace wrappers from kernel32.dll and similar libraries. https://cs.opensource.google/go/go/+/refs/tags/go1.25.6:src/syscall/zsyscall_windows.go https://cs.opensource.google/go/go/+/refs/tags/go1.25.6:src/... Unlike on Linux, the low-level syscall numbers on the NT kernel are highly unstable across releases, so programs that try to call them directly will generally only work on a very specific kernel version.
- nasretdinov 10mo agoI wonder if due to C slowly fading away things like syscall ABI, kernel numbers, etc, will start getting more stable, not just on Windows but on macOS too
- mschuster91 10mo agoThere still needs to be a cause for working directly with the kernel interface instead of going via the userland interfaces (libc on Linux, kernel32/user32 on Windows, macOS frameworks) to justify the required effort, and the use cases are basically only DRM, malware, malware detectors and anti-cheat.
- deleted 10mo ago[deleted]
- kachapopopow 10mo agoanti tamper, drm, library call obfuscation and they all do it wrong, really wrong.
- userbinator 10mo agoDoes it matter? The closer they get to being indistinguishable from Windows, the better.
- mschuster91 10mo agoThe problem is, Windows syscalls change around a lot. Keeping up with that is Sisyphean.
- embedding-shape 10mo agoWine, from the first moment I saw it decades ago, seems to be all about doing the sisyphean tasks no one else wants to be doing. I'm still in awe how they managed to get Wine to where it is today, so if someone can do it, it's the wine devs :)
- wat10000 10mo agoI'd argue that anyone who willingly attempts to program these infernal beasts is not entirely in their right mind to begin with.
- realusername 10mo agoThis change was motivated to improve anticheat support indeed.
- yshui 10mo agoIf you think directly calling Windows syscall is crazy, some applications parse binary code from ntdll.dll to figure out what the syscall numbers actually are, since they change across different Windows versions :)