Windows Assembly – System Calls Like POSIX Using Int Number

assemblyckernelwindows

I want to write assembly program using

windows syscall Interrupt number

, so in order to use system call in assembly level using int of sys call, In windows are there kernel calls like posix library unitsd.h in assembly level. where can i find windows system call list for opening file, mkdir,etc.(interrupt number), like the one in like _NR_write 4 in linux or unix.

Best Answer

Yes.

The Windows NT kernel API (which is traditionally accessed by using the functions defined in ntdll.dll) can be accessed directly by use of the int 2e instruction. However this is not a supported way of using the system, and details of the implementation (including function codes) are likely to change between Windows versions.

The basic approach is:

  • place parameters to the function on the stack
  • put function code in EAX
  • execute int 2e
  • result is in EAX

There is a table of function codes here: http://j00ru.vexillium.org/ntapi/

Related Topic