Hardware
│
▼
Interrupt
│
▼
CPU
│
▼
Kernel
For example, an I O operation is completed
Hardware can notify the CPU with an Interrupt that the operation is completed
Then the Kernel can manage this event
The difference between these three concepts:
System Call
A program request to get a service from the operating system
Exception
An event that occurs as a result of executing a command or condition related to the CPU
Interrupt
Declaration of an event that usually comes from hardware
Trap
Is also an architectural and operating system term that is used to transfer control to a Handler. Depending on the source you read, the exact definition of this term may vary slightly, so it's better not to just memorize one definition. The important thing is to understand what causes the CPU to change the execution path and enter the corresponding Handler
Why is this important for Reverse Engineering
Here the topic becomes more interesting for us
When you are reversing a binary
You may see instructions like
syscall
or behaviors related to Exception and Page Fault
If you have only memorized the assembly you will see
syscall
But if you understand the OS you will understand what happened behind this instruction
User Code
↓
System Call
↓
CPU / Kernel Entry
↓
Kernel Handler
↓
Operation
↓
Return
That is, there is a big difference between just seeing an instruction and understanding what happens behind that instruction in the operating system
These are the basic concepts of many things that we will deal with later in OS and Reverse Engineering
@reverseengine
Post #1790
51
ReverseEngineering Trap و ورود از User Mode به Kernel Mode تا اینجا فهمیدیم برنامه ها توی User Mode اجرا میشن و وقتی بخوان از سیستم عامل یه کار حساس بخوان از System Call استفاده میکنن ولی یه سوال مهم داریم CPU دقیقا چطوری از اجرای عادی برنامه توی User Mode میره داخل Kernel…