hfiref0x/syscalltables

Windows NT x64 Syscall tables

syscalltables's Issues

NtQuerySystemTime is missing in enum

NtQuerySystemTime is not listed as syscall because it implemented in user mode as query (RtlQuerySystemTime) of USER_SHARED_DATA -> SystemTime.

NtQuerySystemTime however implemented as service in ntoskrnl, where it is doing the same - reading SystemTime data field from kernel adddress of KUSER_SHARED_DATA. And finally nt!ZwQuerySystemTime implemented as call to nt!NtQuerySystemTime.

Back to ntdll, the missing ID is present because ntdll stubs syscall id indexed by stub number in array. So you have for example (10586) NtAccessCheckByTypeAndAuditAlarm syscall id = 89, NtQuerySystemTime and next to it NtWaitForMultipleObjects with syscall id = 91.

[BREAKING] New NT syscall introduced with minor Win10 update

Update KB5025221 for Win10 19045 (maybe 19041/19042+) inserts NtCopyFileChunk at index 0xA3 and each higher syscall is changed too as a result.