On Linux the strace.so pintool gives a good overview on how system calls are intercepted in PIN. One could monitor the value of EAX to see which system call is being invoked(and mprotect and writes could be intercepted in the fashion).

How could we do something similar for Windows? I see that the int 2e interrupt is used to trap into the kernel and that the system calls numbers are given at here. Is NtWriteFile the analogue of write? Also is NtProtectVirtualMemory the analogue of mprotect?

  • 1
    I might have a bad understanding of your question, but pintool is suppose to work also for Windows. Haven't you tried it for Windows ? – perror Feb 3 '15 at 9:47

Pintools on Windows can also aid you in instrumenting system calls. Also, if its discovered that the cpu supports sysenter/syscall, those are used in place of int 2e. However, this has no bearing on whether or not instrumentation can take place.

To answer your second question, yes, NtReadFile, NtWriteFile and NtDeviceIoControlFile are the *nix equivalent of read/write/ioctl.

Your Answer
