alt Hacker News> NT system calls use the same syscall numbering as recent Windows, to support applications that hardcode syscall numbers.
Other than antivirus software and maybe MAYBE kernel-level "anticheat" slop - who in their right mind does straight syscalls to the kernel?
Replies
Userland DRMs do all sort of nonsense. Kernel anticheats wouldn't use the syscalls, they're already able to call the kernel routines they want directly.
Does it matter? The closer they get to being indistinguishable from Windows, the better.
This change was motivated to improve anticheat support indeed.
anti tamper, drm, library call obfuscation and they all do it wrong, really wrong.
I'd argue that anyone who willingly attempts to program these infernal beasts is not entirely in their right mind to begin with.
Some programming language compilers generate asm that does call systemcalls directly. Go for example.