1

I want to write assembly program using

windows syscall Interrupt number

, so in order to use system call in assembly level using int of sys call, In windows are there kernel calls like posix library unitsd.h in assembly level. where can i find windows system call list for opening file, mkdir,etc.(interrupt number), like the one in like _NR_write 4 in linux or unix.

  • What you're looking for would be the DOS API, but according to this, it isn't supported by modern windows, so you have to call the OS-provided standard libary function instead. – Erik Eidt Jul 21 '16 at 17:34
  • 1
    How does POSIX fit into this? – Blrfl Jul 21 '16 at 22:34
5

Yes.

The Windows NT kernel API (which is traditionally accessed by using the functions defined in ntdll.dll) can be accessed directly by use of the int 2e instruction. However this is not a supported way of using the system, and details of the implementation (including function codes) are likely to change between Windows versions.

The basic approach is:

  • place parameters to the function on the stack
  • put function code in EAX
  • execute int 2e
  • result is in EAX

There is a table of function codes here: http://j00ru.vexillium.org/ntapi/

  • Do you have a reference for amd64 ? – Benoît Jul 23 '16 at 17:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.