logoalt Hacker News

throwaway27448 • today at 4:07 AM • 2 replies • view on HN

How does it handle stuff like syscalls without altering the executed code?


Replies

pcwalton • today at 4:49 AM

Windows apps don't use syscalls directly; they call into kernel32.dll, which is convenient for Wine. (Microsoft enforces this by scrambling the syscall numbers on OS updates [1].)

[1]: https://j00ru.vexillium.org/syscalls/nt/64/

➕ show 1 reply
aunderscored • today at 4:34 AM

It installs handlers. I don't have the exact name but there's support in the kernel to redirect syscalls to a Userland process

➕ show 1 reply