Hacker News Reader

Comment by kyberias | Hacker News Reader

> Windows applications are increasingly executing system calls directly rather than going through the API

I didn't know this. What applications are doing this and why?

Anti-cheating libraries used in games seem to be the primary culprits, and they're doing it this way because their purpose is to break things while resisting the user's attempts to make things work nicely.

Unfortunately WINE can't just take the windows shim mechanism that largely just nukes these from orbit on binary load and removes the check all together. Maybe at some point MS will be more open about that.

A bit off-topic, but do you happen to know if there is a way on Windows to intercept syscall instructions? (aside from dynamic analysis/recompilation/etc.?) If there isn't, I assume that's why cheat engines do this?

I think it's inherent to the SYSCALL instruction that control gets transferred directly to the kernel and ring 0, with no possibility of intercepting in userspace. So on Windows or Linux, you need kernel help to redirect/intercept syscalls.

I asked this as a Windows question rather than an x86 question. I was wondering if there's any Windows API that could help with this. (This includes kernel APIs.)

The PicoProcess model used by the first WSL worked by intercepting syscalls (among other mechanisms). It wasn't generally available for consumption by developers other than Microsoft, though.

The gnarlier antivirus will do a similar thing by just patching the IDT and syscall MSRs, but that's a bit frowned upon.

To add to the mentions of anti-cheat software, there are also multiple binary packers/protectors, such as VMProtect[1], which use system calls directly to protect and/or obfuscate themselves.

[1]: https://lifeinhex.com/use-of-syscall-and-sysenter-in-vmprote...

Based on the second post, seems to be anti-cheating code for games.

Ironically, this work might backfire in the long run if unscrupulous players are able to use cheats developed specifically to run under Linux.

windows may run games better, but linux lets you cheat better

Reply on news.ycombinator.com