Skip to main content

dr_syscall_intercept_natively

Function dr_syscall_intercept_natively 

Source
pub unsafe extern "C" fn dr_syscall_intercept_natively(
    name: *const c_char,
    sysnum: c_int,
    num_args: c_int,
    wow64_index: c_int,
) -> bool_
Expand description

Must be invoked from dr_client_main(). Requests that the named ntoskrnl system call be intercepted even when threads are native (e.g., due to #DR_EMIT_GO_NATIVE). Only a limited number of system calls being intercepted while native are supported. This routine will fail once that limit is reached.

@param[in] name The system call name. The name must match an exported system call wrapper in \p ntdll.dll. @param[in] sysnum The system call number (the value placed in the eax register). @param[in] num_args The number of arguments to the system call. @param[in] wow64_index The value placed in the ecx register when this system call is executed in a WOW64 process. This value should be obtainable by examining the system call wrapper.

\note Windows only.