Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
How do you find out what number each sys call is? Like on SP3 ZwCreateFile is
ZwCreateFile:
mov eax, 0x25
mov edx, 0x7ffe0300
call [edx]
retn 0x2c
How do you find out that ZwCreateFile is 0x25?
Windows System Call Table (NT/2000/XP/2003/Vista) says that
NtCreateFile(the same function asZwCreateFile, see MSDN and many others) isWindows NT Windows 2000 Windows XP W2K3 Vista SP3 SP4 SP5 SP6 SP0 SP1 SP2 SP3 SP4 SP0 SP1 SP2 SP0 SP1 SP0 0x17 0x17 0x17 0x17 0x20 0x20 0x20 0x20 0x20 0x25 0x25 0x25 0x27 0x27 0x3bYou can easily discover these for yourself by dumping the syscall table
nt!KiServiceTableusing kd or WinDbg.Information from the Sysinternals forums.