; syscall_stubs.asm - user-mode INT 0x40 stubs exported by syscall.dll (MASM64) ; ; Calling convention (kernel side): ; RAX = syscall number ; RCX = arg 0 ; RDX = arg 1 ; R8 = arg 2 ; R9 = arg 3 ; R10 = arg 4 (our extension - loaded from the stack by SYSCALL_STUB6) ; R11 = arg 5 (our extension - loaded from the stack by SYSCALL_STUB6) ; ; User-mode callers follow standard MS x64: args 1-4 in RCX/RDX/R8/R9, ; args 5+ on the stack above the home area ([rsp+28h], [rsp+30h], ...). ; ; SYSCALL_STUB2/3 - 4 or fewer args: pure register passing, no stack read. ; SYSCALL_STUB5 - exactly 5 args: loads [rsp+28h] -> R10 only. ; SYSCALL_STUB6 - 5 or 6 args: loads [rsp+28h] -> R10 and [rsp+30h] -> R11. INCLUDE syscall_nr.inc SYS_USER_APC_FRAME_Magic EQU 0 SYS_USER_APC_FRAME_ReturnToken EQU 8 SYS_USER_APC_FRAME_Routine EQU 16 SYS_USER_APC_FRAME_NormalContext EQU 24 SYS_USER_APC_FRAME_SystemArgument1 EQU 32 SYS_USER_APC_FRAME_SystemArgument2 EQU 40 .CODE ; --------------------------------------------------------------------------- SYSCALL_STUB2 MACRO name, nr PUBLIC Sys&name Sys&name PROC EXPORT mov rax, nr int 40h ret Sys&name ENDP ENDM ; --------------------------------------------------------------------------- SYSCALL_STUB3 MACRO name, nr PUBLIC Sys&name Sys&name PROC EXPORT mov rax, nr int 40h ret Sys&name ENDP ENDM ; --------------------------------------------------------------------------- SYSCALL_STUB5 MACRO name, nr PUBLIC Sys&name Sys&name PROC EXPORT mov r10, [rsp+28h] ; 5th argument mov rax, nr int 40h ret Sys&name ENDP ENDM ; --------------------------------------------------------------------------- SYSCALL_STUB6 MACRO name, nr PUBLIC Sys&name Sys&name PROC EXPORT mov r10, [rsp+28h] ; 5th argument mov r11, [rsp+30h] ; 6th argument mov rax, nr int 40h ret Sys&name ENDP ENDM ; --------------------------------------------------------------------------- ; Process & thread lifecycle ; --------------------------------------------------------------------------- SYSCALL_STUB2 ExitProcess, SYS_EXIT_PROCESS SYSCALL_STUB2 ExitThread, SYS_EXIT_THREAD SYSCALL_STUB2 CreateProcess, SYS_CREATE_PROCESS SYSCALL_STUB3 WaitSingle, SYS_WAIT_SINGLE SYSCALL_STUB2 WaitMany, SYS_WAIT_MANY SYSCALL_STUB2 OpenInputQueue, SYS_OPEN_INPUT_QUEUE SYSCALL_STUB2 GetProcessExitCode, SYS_GET_PROCESS_EXIT_CODE SYSCALL_STUB2 OpenProcess, SYS_OPEN_PROCESS SYSCALL_STUB2 KillProcess, SYS_KILL_PROCESS SYSCALL_STUB2 GetProcessList, SYS_GET_PROCESS_LIST SYSCALL_STUB2 GetProcessPid, SYS_GET_PROCESS_PID SYSCALL_STUB2 GetThreadList, SYS_GET_THREAD_LIST SYSCALL_STUB2 LoadModule, SYS_LOAD_MODULE SYSCALL_STUB2 UnloadModule, SYS_UNLOAD_MODULE SYSCALL_STUB2 GetModuleInfo, SYS_GET_MODULE_INFO SYSCALL_STUB2 GetModuleExport, SYS_GET_MODULE_EXPORT SYSCALL_STUB2 GetModuleList, SYS_GET_MODULE_LIST SYSCALL_STUB2 CreateThread, SYS_CREATE_THREAD SYSCALL_STUB2 ResumeThread, SYS_RESUME_THREAD SYSCALL_STUB2 GetCurrentTid, SYS_GET_CURRENT_TID SYSCALL_STUB2 GetCurrentPid, SYS_GET_CURRENT_PID SYSCALL_STUB2 SetThreadPriority, SYS_SET_THREAD_PRIORITY SYSCALL_STUB2 Yield, SYS_YIELD SYSCALL_STUB2 Sleep, SYS_SLEEP SYSCALL_STUB2 SetUserApcDispatcher, SYS_SET_USER_APC_DISPATCHER SYSCALL_STUB2 ApcReturn, SYS_APC_RETURN SYSCALL_STUB2 SetExceptionDispatcher, SYS_SET_EXCEPTION_DISPATCHER SYSCALL_STUB2 GetExceptionDispatcher, SYS_GET_EXCEPTION_DISPATCHER SYSCALL_STUB2 ContinueException, SYS_CONTINUE_EXCEPTION SYSCALL_STUB2 RaiseException, SYS_RAISE_EXCEPTION ; --------------------------------------------------------------------------- ; User APC dispatcher ; --------------------------------------------------------------------------- PUBLIC SysUserApcDispatcher SysUserApcDispatcher PROC EXPORT ; Kernel enters here with RSP pointing at SYS_USER_APC_FRAME. There is no ; return address because this is an IRET redirection. Preserve RBX because ; the original user context resumes after SysApcReturn. push rbx lea rbx, [rsp + 8] ; original injected RSP = frame pointer sub rsp, 32 ; shadow space; RSP is already call-aligned mov rcx, [rbx + SYS_USER_APC_FRAME_NormalContext] mov rdx, [rbx + SYS_USER_APC_FRAME_SystemArgument1] mov r8, [rbx + SYS_USER_APC_FRAME_SystemArgument2] mov rax, [rbx + SYS_USER_APC_FRAME_Routine] call rax add rsp, 32 mov rcx, rbx ; SysApcReturn(frame) mov rbx, [rsp] ; restore original user RBX add rsp, 8 mov rax, SYS_APC_RETURN int 40h SysUserApcDispatcher_Failed: jmp SysUserApcDispatcher_Failed SysUserApcDispatcher ENDP ; --------------------------------------------------------------------------- ; Virtual memory and handles ; --------------------------------------------------------------------------- SYSCALL_STUB2 AllocVm, SYS_ALLOC_VM SYSCALL_STUB2 FreeVm, SYS_FREE_VM SYSCALL_STUB2 ProtectVm, SYS_PROTECT_VM SYSCALL_STUB2 QueryVm, SYS_QUERY_VM SYSCALL_STUB2 CloseHandle, SYS_CLOSE_HANDLE SYSCALL_STUB2 DuplicateHandle, SYS_DUPLICATE_HANDLE ; --------------------------------------------------------------------------- ; Synchronization objects ; --------------------------------------------------------------------------- SYSCALL_STUB2 CreateMutex, SYS_CREATE_MUTEX SYSCALL_STUB2 TryAcquireMutex, SYS_TRY_ACQUIRE_MUTEX SYSCALL_STUB2 ReleaseMutex, SYS_RELEASE_MUTEX SYSCALL_STUB2 CreateSem, SYS_CREATE_SEM SYSCALL_STUB2 TryWaitSem, SYS_TRY_WAIT_SEM SYSCALL_STUB2 SignalSem, SYS_SIGNAL_SEM SYSCALL_STUB2 CreateEvent, SYS_CREATE_EVENT SYSCALL_STUB2 SignalEvent, SYS_SIGNAL_EVENT SYSCALL_STUB2 ClearEvent, SYS_CLEAR_EVENT ; --------------------------------------------------------------------------- ; Queues and named queues ; --------------------------------------------------------------------------- SYSCALL_STUB2 CreateQueue, SYS_CREATE_QUEUE SYSCALL_STUB2 SendQueue, SYS_SEND_QUEUE SYSCALL_STUB2 RecvQueue, SYS_RECV_QUEUE SYSCALL_STUB2 PublishQueue, SYS_PUBLISH_QUEUE SYSCALL_STUB2 UnpublishQueue, SYS_UNPUBLISH_QUEUE SYSCALL_STUB2 OpenNamedQueue, SYS_OPEN_NAMED_QUEUE SYSCALL_STUB2 OpenNamedQueueOwnerProcess, SYS_OPEN_NAMED_QUEUE_OWNER_PROCESS ; --------------------------------------------------------------------------- ; Files, directories, and current directory ; --------------------------------------------------------------------------- SYSCALL_STUB2 OpenFile, SYS_OPEN_FILE SYSCALL_STUB2 ReadFile, SYS_READ_FILE SYSCALL_STUB2 WriteFile, SYS_WRITE_FILE SYSCALL_STUB2 ReadFileAsync, SYS_READ_FILE_ASYNC SYSCALL_STUB2 WriteFileAsync, SYS_WRITE_FILE_ASYNC SYSCALL_STUB2 CancelIo, SYS_CANCEL_IO SYSCALL_STUB2 SeekFile, SYS_SEEK_FILE SYSCALL_STUB2 GetFilePos, SYS_GET_FILE_POS SYSCALL_STUB2 GetFileSize, SYS_GET_FILE_SIZE SYSCALL_STUB2 GetFileStat, SYS_GET_FILE_STAT SYSCALL_STUB2 StatFile, SYS_STAT_FILE SYSCALL_STUB2 TruncateFile, SYS_TRUNCATE_FILE SYSCALL_STUB2 FlushFile, SYS_FLUSH_FILE SYSCALL_STUB2 DeleteFile, SYS_DELETE_FILE SYSCALL_STUB2 RenameFile, SYS_RENAME_FILE SYSCALL_STUB2 LockFile, SYS_LOCK_FILE SYSCALL_STUB2 UnlockFile, SYS_UNLOCK_FILE SYSCALL_STUB2 OpenDir, SYS_OPEN_DIR SYSCALL_STUB2 ReadDir, SYS_READ_DIR SYSCALL_STUB2 CreateDir, SYS_CREATE_DIR SYSCALL_STUB2 RemoveDir, SYS_REMOVE_DIR SYSCALL_STUB2 SetCwd, SYS_SET_CWD SYSCALL_STUB2 RealPath, SYS_REAL_PATH ; --------------------------------------------------------------------------- ; Console and graphics ; --------------------------------------------------------------------------- SYSCALL_STUB2 WriteConsole, SYS_WRITE_CONSOLE SYSCALL_STUB2 GetConsoleInfo, SYS_GET_CONSOLE_INFO SYSCALL_STUB2 SetConsoleCursor, SYS_SET_CONSOLE_CURSOR SYSCALL_STUB6 FillConsoleCharacter, SYS_FILL_CONSOLE_CHARACTER SYSCALL_STUB6 FillConsoleAttribute, SYS_FILL_CONSOLE_ATTRIBUTE SYSCALL_STUB6 PutScreenChar, SYS_PUT_SCREEN_CHAR SYSCALL_STUB2 CreateSurface, SYS_CREATE_SURFACE SYSCALL_STUB2 MapSurface, SYS_MAP_SURFACE SYSCALL_STUB2 QuerySurface, SYS_QUERY_SURFACE SYSCALL_STUB2 PresentSurface, SYS_PRESENT_SURFACE SYSCALL_STUB2 ClearScreen, SYS_CLEAR_SCREEN SYSCALL_STUB2 GetScreenSize, SYS_GET_SCREEN_SIZE SYSCALL_STUB2 QueryDisplayInfo, SYS_QUERY_DISPLAY_INFO SYSCALL_STUB2 OpenDisplayClock, SYS_OPEN_DISPLAY_CLOCK ; --------------------------------------------------------------------------- ; Native render audio ; --------------------------------------------------------------------------- SYSCALL_STUB2 AudioEnumerateEndpoints, SYS_AUDIO_ENUMERATE_ENDPOINTS SYSCALL_STUB2 AudioOpenStream, SYS_AUDIO_OPEN_STREAM SYSCALL_STUB2 AudioWrite, SYS_AUDIO_WRITE SYSCALL_STUB2 AudioArmWait, SYS_AUDIO_ARM_WAIT SYSCALL_STUB2 AudioQueryStream, SYS_AUDIO_QUERY_STREAM SYSCALL_STUB2 AudioStart, SYS_AUDIO_START SYSCALL_STUB2 AudioPause, SYS_AUDIO_PAUSE SYSCALL_STUB2 AudioResume, SYS_AUDIO_RESUME SYSCALL_STUB2 AudioDrain, SYS_AUDIO_DRAIN SYSCALL_STUB2 AudioStop, SYS_AUDIO_STOP SYSCALL_STUB2 AudioReset, SYS_AUDIO_RESET SYSCALL_STUB2 AudioSetVolume, SYS_AUDIO_SET_VOLUME SYSCALL_STUB2 AudioSetMasterVolume, SYS_AUDIO_SET_MASTER_VOLUME ; --------------------------------------------------------------------------- ; Input ; --------------------------------------------------------------------------- SYSCALL_STUB2 PollKeyboard, SYS_POLL_KEYBOARD SYSCALL_STUB2 IsKeyDown, SYS_IS_KEY_DOWN SYSCALL_STUB2 ReadKeyboardChar, SYS_READ_KEYBOARD_CHAR SYSCALL_STUB2 ReadKey, SYS_READ_KEY SYSCALL_STUB2 GetKeyModifiers, SYS_GET_KEY_MODIFIERS SYSCALL_STUB2 QueryGlobalInputState, SYS_QUERY_GLOBAL_INPUT_STATE SYSCALL_STUB2 ReadInputEvent, SYS_READ_INPUT_EVENT SYSCALL_STUB2 PeekInputEvent, SYS_PEEK_INPUT_EVENT SYSCALL_STUB2 PeekMouse, SYS_PEEK_MOUSE SYSCALL_STUB2 ReadMouse, SYS_READ_MOUSE SYSCALL_STUB2 GetMousePos, SYS_GET_MOUSE_POS ; --------------------------------------------------------------------------- ; Time and debug ; --------------------------------------------------------------------------- SYSCALL_STUB2 CreateTimer, SYS_CREATE_TIMER SYSCALL_STUB2 SetTimer, SYS_SET_TIMER SYSCALL_STUB2 CancelTimer, SYS_CANCEL_TIMER SYSCALL_STUB2 GetTick, SYS_GET_TICK SYSCALL_STUB2 GetTickFrequency, SYS_GET_TICK_FREQUENCY SYSCALL_STUB2 PrintDebug, SYS_PRINT_DEBUG SYSCALL_STUB2 QueryTrapFrame, SYS_QUERY_TRAP_FRAME ; --------------------------------------------------------------------------- ; Native sockets ; --------------------------------------------------------------------------- SYSCALL_STUB2 CreateSocket, SYS_CREATE_SOCKET SYSCALL_STUB2 SocketIoAsync, SYS_SOCKET_IO_ASYNC SYSCALL_STUB2 BindSocket, SYS_BIND_SOCKET SYSCALL_STUB2 ListenSocket, SYS_LISTEN_SOCKET SYSCALL_STUB2 AcceptSocket, SYS_ACCEPT_SOCKET SYSCALL_STUB2 ConnectSocket, SYS_CONNECT_SOCKET SYSCALL_STUB6 SendSocket, SYS_SEND_SOCKET SYSCALL_STUB6 RecvSocket, SYS_RECV_SOCKET SYSCALL_STUB2 ShutdownSocket, SYS_SHUTDOWN_SOCKET SYSCALL_STUB2 SendToSocket, SYS_SEND_TO_SOCKET SYSCALL_STUB2 RecvFromSocket, SYS_RECV_FROM_SOCKET SYSCALL_STUB2 ResolveHost, SYS_RESOLVE_HOST SYSCALL_STUB2 SetSocketOption, SYS_SET_SOCKET_OPTION SYSCALL_STUB2 GetSocketOption, SYS_GET_SOCKET_OPTION SYSCALL_STUB2 Poll, SYS_POLL SYSCALL_STUB2 GetMemoryStatus, SYS_GET_MEMORY_STATUS SYSCALL_STUB2 QueryKernelStats, SYS_QUERY_KERNEL_STATS SYSCALL_STUB2 GetSystemTime, SYS_GET_SYSTEM_TIME SYSCALL_STUB5 CreateFileMapping, SYS_CREATE_FILE_MAPPING SYSCALL_STUB6 MapFile, SYS_MAP_FILE END