; syscall_stubs.asm - user-mode INT 0x40 stubs exported by syscall.dll (MASM64) ; ; Calling convention (kernel side): ; RAX = syscall number ; RCX = arg 0 ; RDX = arg 1 ; R8 = arg 2 ; R9 = arg 3 ; R10 = arg 4 (our extension - loaded from the stack by SYSCALL_STUB6) ; R11 = arg 5 (our extension - loaded from the stack by SYSCALL_STUB6) ; ; User-mode callers follow standard MS x64: args 1-4 in RCX/RDX/R8/R9, ; args 5+ on the stack above the home area ([rsp+28h], [rsp+30h], ...). ; ; SYSCALL_STUB2/3 - 4 or fewer args: pure register passing, no stack read. ; SYSCALL_STUB5 - exactly 5 args: loads [rsp+28h] -> R10 only. ; SYSCALL_STUB6 - 5 or 6 args: loads [rsp+28h] -> R10 and [rsp+30h] -> R11. ; ; Handle lifecycle: ; SysCloseHandle is the single close stub for every object type. ; There is no SysCloseFile - files are closed through the unified path, ; exactly like mutexes, semaphores, events, and queues. INCLUDE syscall_nr.inc SYS_USER_APC_FRAME_Magic EQU 0 SYS_USER_APC_FRAME_OriginalRip EQU 8 SYS_USER_APC_FRAME_OriginalRsp EQU 16 SYS_USER_APC_FRAME_OriginalRflags EQU 24 SYS_USER_APC_FRAME_OriginalRax EQU 32 SYS_USER_APC_FRAME_Routine EQU 40 SYS_USER_APC_FRAME_NormalContext EQU 48 SYS_USER_APC_FRAME_SystemArgument1 EQU 56 SYS_USER_APC_FRAME_SystemArgument2 EQU 64 .CODE ; --------------------------------------------------------------------------- SYSCALL_STUB2 MACRO name, nr PUBLIC Sys&name Sys&name PROC EXPORT mov rax, nr int 40h ret Sys&name ENDP ENDM ; --------------------------------------------------------------------------- SYSCALL_STUB3 MACRO name, nr PUBLIC Sys&name Sys&name PROC EXPORT mov rax, nr int 40h ret Sys&name ENDP ENDM ; --------------------------------------------------------------------------- SYSCALL_STUB5 MACRO name, nr PUBLIC Sys&name Sys&name PROC EXPORT mov r10, [rsp+28h] ; 5th argument mov rax, nr int 40h ret Sys&name ENDP ENDM ; --------------------------------------------------------------------------- SYSCALL_STUB6 MACRO name, nr PUBLIC Sys&name Sys&name PROC EXPORT mov r10, [rsp+28h] ; 5th argument mov r11, [rsp+30h] ; 6th argument mov rax, nr int 40h ret Sys&name ENDP ENDM ; --------------------------------------------------------------------------- ; Process & thread lifecycle ; --------------------------------------------------------------------------- SYSCALL_STUB2 ExitProcess, SYS_EXIT_PROCESS SYSCALL_STUB2 ExitThread, SYS_EXIT_THREAD SYSCALL_STUB2 CreateProcess, SYS_CREATE_PROCESS SYSCALL_STUB3 WaitSingle, SYS_WAIT_SINGLE SYSCALL_STUB2 WaitMany, SYS_WAIT_MANY SYSCALL_STUB2 OpenInputQueue, SYS_OPEN_INPUT_QUEUE SYSCALL_STUB2 GetProcessExitCode, SYS_GET_PROCESS_EXIT_CODE SYSCALL_STUB2 KillProcess, SYS_KILL_PROCESS SYSCALL_STUB2 GetProcessList, SYS_GET_PROCESS_LIST SYSCALL_STUB2 GetProcessPid, SYS_GET_PROCESS_PID SYSCALL_STUB2 GetThreadList, SYS_GET_THREAD_LIST SYSCALL_STUB2 CreateThread, SYS_CREATE_THREAD SYSCALL_STUB2 GetCurrentTid, SYS_GET_CURRENT_TID SYSCALL_STUB2 GetCurrentPid, SYS_GET_CURRENT_PID SYSCALL_STUB2 SetThreadPriority, SYS_SET_THREAD_PRIORITY SYSCALL_STUB2 Yield, SYS_YIELD SYSCALL_STUB2 Sleep, SYS_SLEEP SYSCALL_STUB2 SetUserApcDispatcher, SYS_SET_USER_APC_DISPATCHER SYSCALL_STUB2 ApcReturn, SYS_APC_RETURN ; --------------------------------------------------------------------------- ; User APC dispatcher ; --------------------------------------------------------------------------- PUBLIC SysUserApcDispatcher SysUserApcDispatcher PROC EXPORT ; Kernel enters here with RSP pointing at SYS_USER_APC_FRAME. There is no ; return address because this is an IRET redirection. Preserve RBX because ; the original user context resumes after SysApcReturn. push rbx lea rbx, [rsp + 8] ; original injected RSP = frame pointer sub rsp, 32 ; shadow space; RSP is already call-aligned mov rcx, [rbx + SYS_USER_APC_FRAME_NormalContext] mov rdx, [rbx + SYS_USER_APC_FRAME_SystemArgument1] mov r8, [rbx + SYS_USER_APC_FRAME_SystemArgument2] mov rax, [rbx + SYS_USER_APC_FRAME_Routine] call rax add rsp, 32 mov rcx, rbx ; SysApcReturn(frame) mov rbx, [rsp] ; restore original user RBX add rsp, 8 mov rax, SYS_APC_RETURN int 40h SysUserApcDispatcher_Failed: jmp SysUserApcDispatcher_Failed SysUserApcDispatcher ENDP ; --------------------------------------------------------------------------- ; Virtual memory and handles ; --------------------------------------------------------------------------- SYSCALL_STUB6 AllocVm, SYS_ALLOC_VM SYSCALL_STUB2 FreeVm, SYS_FREE_VM SYSCALL_STUB2 ProtectVm, SYS_PROTECT_VM SYSCALL_STUB2 QueryVm, SYS_QUERY_VM SYSCALL_STUB2 CloseHandle, SYS_CLOSE_HANDLE ; --------------------------------------------------------------------------- ; Synchronization objects ; --------------------------------------------------------------------------- SYSCALL_STUB2 CreateMutex, SYS_CREATE_MUTEX SYSCALL_STUB2 TryAcquireMutex, SYS_TRY_ACQUIRE_MUTEX SYSCALL_STUB2 ReleaseMutex, SYS_RELEASE_MUTEX SYSCALL_STUB2 CreateSem, SYS_CREATE_SEM SYSCALL_STUB2 TryWaitSem, SYS_TRY_WAIT_SEM SYSCALL_STUB2 SignalSem, SYS_SIGNAL_SEM SYSCALL_STUB2 CreateEvent, SYS_CREATE_EVENT SYSCALL_STUB2 SignalEvent, SYS_SIGNAL_EVENT SYSCALL_STUB2 ClearEvent, SYS_CLEAR_EVENT ; --------------------------------------------------------------------------- ; Queues and named queues ; --------------------------------------------------------------------------- SYSCALL_STUB2 CreateQueue, SYS_CREATE_QUEUE SYSCALL_STUB2 SendQueue, SYS_SEND_QUEUE SYSCALL_STUB2 RecvQueue, SYS_RECV_QUEUE SYSCALL_STUB2 PublishQueue, SYS_PUBLISH_QUEUE SYSCALL_STUB2 OpenNamedQueue, SYS_OPEN_NAMED_QUEUE SYSCALL_STUB2 DuplicateQueue, SYS_DUPLICATE_QUEUE SYSCALL_STUB2 GetNamedQueueOwnerPid, SYS_GET_NAMED_QUEUE_OWNER_PID ; --------------------------------------------------------------------------- ; Files, directories, and current directory ; --------------------------------------------------------------------------- SYSCALL_STUB2 OpenFile, SYS_OPEN_FILE SYSCALL_STUB2 CreateFile, SYS_CREATE_FILE SYSCALL_STUB2 ReadFile, SYS_READ_FILE SYSCALL_STUB2 WriteFile, SYS_WRITE_FILE SYSCALL_STUB2 ReadFileAsync, SYS_READ_FILE_ASYNC SYSCALL_STUB2 WriteFileAsync, SYS_WRITE_FILE_ASYNC SYSCALL_STUB2 CancelIo, SYS_CANCEL_IO SYSCALL_STUB2 SeekFile, SYS_SEEK_FILE SYSCALL_STUB2 GetFilePos, SYS_GET_FILE_POS SYSCALL_STUB2 GetFileSize, SYS_GET_FILE_SIZE SYSCALL_STUB2 TruncateFile, SYS_TRUNCATE_FILE SYSCALL_STUB2 FlushFile, SYS_FLUSH_FILE SYSCALL_STUB2 DeleteFile, SYS_DELETE_FILE SYSCALL_STUB2 RenameFile, SYS_RENAME_FILE SYSCALL_STUB2 OpenDir, SYS_OPEN_DIR SYSCALL_STUB2 ReadDir, SYS_READ_DIR SYSCALL_STUB2 CreateDir, SYS_CREATE_DIR SYSCALL_STUB2 RemoveDir, SYS_REMOVE_DIR SYSCALL_STUB2 SetCwd, SYS_SET_CWD SYSCALL_STUB2 GetCwd, SYS_GET_CWD ; --------------------------------------------------------------------------- ; Console and graphics ; --------------------------------------------------------------------------- SYSCALL_STUB2 WriteConsole, SYS_WRITE_CONSOLE SYSCALL_STUB2 GetConsoleInfo, SYS_GET_CONSOLE_INFO SYSCALL_STUB2 SetConsoleCursor, SYS_SET_CONSOLE_CURSOR SYSCALL_STUB6 FillConsoleCharacter, SYS_FILL_CONSOLE_CHARACTER SYSCALL_STUB6 FillConsoleAttribute, SYS_FILL_CONSOLE_ATTRIBUTE SYSCALL_STUB6 PutScreenChar, SYS_PUT_SCREEN_CHAR SYSCALL_STUB5 CreateSurface, SYS_CREATE_SURFACE SYSCALL_STUB2 MapSurface, SYS_MAP_SURFACE SYSCALL_STUB2 QuerySurface, SYS_QUERY_SURFACE SYSCALL_STUB2 PresentSurface, SYS_PRESENT_SURFACE SYSCALL_STUB2 ClearScreen, SYS_CLEAR_SCREEN SYSCALL_STUB2 GetScreenSize, SYS_GET_SCREEN_SIZE SYSCALL_STUB2 QueryDisplayInfo, SYS_QUERY_DISPLAY_INFO ; --------------------------------------------------------------------------- ; Input ; --------------------------------------------------------------------------- SYSCALL_STUB2 PollKeyboard, SYS_POLL_KEYBOARD SYSCALL_STUB2 IsKeyDown, SYS_IS_KEY_DOWN SYSCALL_STUB2 ReadKeyboardChar, SYS_READ_KEYBOARD_CHAR SYSCALL_STUB2 ReadKey, SYS_READ_KEY SYSCALL_STUB2 GetKeyModifiers, SYS_GET_KEY_MODIFIERS SYSCALL_STUB2 ReadInputEvent, SYS_READ_INPUT_EVENT SYSCALL_STUB2 PeekInputEvent, SYS_PEEK_INPUT_EVENT SYSCALL_STUB2 PollMouse, SYS_POLL_MOUSE SYSCALL_STUB2 ReadMouse, SYS_READ_MOUSE SYSCALL_STUB2 GetMousePos, SYS_GET_MOUSE_POS ; --------------------------------------------------------------------------- ; Time and debug ; --------------------------------------------------------------------------- SYSCALL_STUB2 GetTick, SYS_GET_TICK SYSCALL_STUB2 PrintDebug, SYS_PRINT_DEBUG SYSCALL_STUB2 QueryTrapFrame, SYS_QUERY_TRAP_FRAME ; --------------------------------------------------------------------------- ; Native sockets ; --------------------------------------------------------------------------- SYSCALL_STUB2 CreateSocket, SYS_CREATE_SOCKET SYSCALL_STUB2 BindSocket, SYS_BIND_SOCKET SYSCALL_STUB2 ListenSocket, SYS_LISTEN_SOCKET SYSCALL_STUB2 AcceptSocket, SYS_ACCEPT_SOCKET SYSCALL_STUB2 ConnectSocket, SYS_CONNECT_SOCKET SYSCALL_STUB6 SendSocket, SYS_SEND_SOCKET SYSCALL_STUB6 RecvSocket, SYS_RECV_SOCKET SYSCALL_STUB2 ShutdownSocket, SYS_SHUTDOWN_SOCKET SYSCALL_STUB2 SendToSocket, SYS_SEND_TO_SOCKET SYSCALL_STUB2 RecvFromSocket, SYS_RECV_FROM_SOCKET SYSCALL_STUB2 ResolveHost, SYS_RESOLVE_HOST SYSCALL_STUB2 SetSocketOption, SYS_SET_SOCKET_OPTION SYSCALL_STUB2 GetSocketOption, SYS_GET_SOCKET_OPTION SYSCALL_STUB2 Poll, SYS_POLL SYSCALL_STUB2 GetMemoryStatus, SYS_GET_MEMORY_STATUS SYSCALL_STUB2 QueryKernelStats, SYS_QUERY_KERNEL_STATS SYSCALL_STUB2 GetSystemTime, SYS_GET_SYSTEM_TIME SYSCALL_STUB5 CreateFileMapping, SYS_CREATE_FILE_MAPPING SYSCALL_STUB6 MapFile, SYS_MAP_FILE END