Hacker News Reader

Comment by gizmo686 | Hacker News Reader

If all windows applications used the APIs like they were supposed to, then there would be no need to emulate the Windows syscalls. The point of this emulation is that some applications (games, apparently) were not using these APIs, and instead performing syscalls directly.

In order for this to be feasable on Windows, there needs to be some stability in the syscalls; even if that stability involves angry MS engineers complaining that major applications are doing something that they were explicitly told not to do.

View on HN

You'd be surprised, MS doesn't do this randomly. They'd rather break a game if the game is actively in production or the company is around. They only put in shims for applications if the vendor isn't still in business usually or can't get source code. But in quite a few cases they'll just put in a patch binary in the shims that just removes the anti-cheat all together from the binary when loaded. Game still runs... nobody cares.

Until the game checks its integrity?

Files on disk aren’t affected, the OS applies these patches in RAM only.

It’s gonna be very hard to check integrity of code in RAM. The complications include relocation table (applied when loading; see also ASLR) and global variables (modified as the software runs).

It need not be stable. The OS could provide each application with the system call table it expects to see (with most of them getting the standard one)

Determining what table a program expects likely would be a black art, but I don’t think that would stop Microsoft from trying that for programs deemed important for the platform.

The target windows version is part of the standard set of defines set when compiling the program. It's visible in the manifest and the linked c library.

> If all windows applications used the APIs like they were supposed to, then there would be no need to emulate the Windows syscalls.

The Win32 API's require certain operating system semantics, and not all of that semantics comes nicely from Linux syscalls.

A Win32 API library on Linux benefits from Windows-like syscalls underneath, even if nobody is bypassing that library to get to those syscalls.

Think about it; that is exactly like saying that if programs were just written to the C API described in the POSIX spec, we wouldn't need a Unix-like kernel underneath. While that isn't an outright false statement, it has implications for the nature and quality of the system.

Reply on news.ycombinator.com