Mismatch Between win32syscalls.h and Windows System Call Numbers
The APIs and call numbers in win32syscalls.h don't seem to match those in the Windows system. NtGdiAlphaBlend is listed as 4 in win32syscalls.h, but in reality, it's 0x1075 in win32u.dll on Windows 11. So are these values user-defined?
Am 05.06.2025 um 06:18 schrieb zhengxianwei <baikaishiuc(a)gmail.com>:
The APIs and call numbers in win32syscalls.h don't seem to match those in the Windows system.
NtGdiAlphaBlend is listed as 4 in win32syscalls.h, but in reality, it's 0x1075 in win32u.dll on Windows 11.
So are these values user-defined?
Afaiu we don't need them to match up, and they differ between Windows versions too. On paper, applications aren't supposed to call syscalls directly at all. Those that do usually parse the syscall thunks in the DLLs to extract the syscall numbers. If you have an application that does depend on a particular syscall having a particular number, and the application works on a reasonable number of Windows versions, then that would be a reason for us to follow a particular Windows version.
thank you On Thu, Jun 5, 2025 at 3:11 PM Stefan Dösinger <stefandoesinger(a)gmail.com> wrote:
Am 05.06.2025 um 06:18 schrieb zhengxianwei <baikaishiuc(a)gmail.com>:
The APIs and call numbers in win32syscalls.h don't seem to match those in the Windows system.
NtGdiAlphaBlend is listed as 4 in win32syscalls.h, but in reality, it's 0x1075 in win32u.dll on Windows 11.
So are these values user-defined?
Afaiu we don't need them to match up, and they differ between Windows versions too. On paper, applications aren't supposed to call syscalls directly at all. Those that do usually parse the syscall thunks in the DLLs to extract the syscall numbers.
If you have an application that does depend on a particular syscall having a particular number, and the application works on a reasonable number of Windows versions, then that would be a reason for us to follow a particular Windows version.
On Thu, Jun 5, 2025 at 1:11 AM Stefan Dösinger <stefandoesinger(a)gmail.com> wrote:
Am 05.06.2025 um 06:18 schrieb zhengxianwei <baikaishiuc(a)gmail.com>:
The APIs and call numbers in win32syscalls.h don't seem to match those in the Windows system.
NtGdiAlphaBlend is listed as 4 in win32syscalls.h, but in reality, it's 0x1075 in win32u.dll on Windows 11.
So are these values user-defined?
Afaiu we don't need them to match up, and they differ between Windows versions too. On paper, applications aren't supposed to call syscalls directly at all. Those that do usually parse the syscall thunks in the DLLs to extract the syscall numbers.
If you have an application that does depend on a particular syscall having a particular number, and the application works on a reasonable number of Windows versions, then that would be a reason for us to follow a particular Windows version.
DVDFab depends on the syscalls matching the Windows 10 numbering when running on Windows 10. I think that's a good reason why Wine's syscall numbers should be changed to match those of the default Windows version in winecfg. See https://bugs.winehq.org/show_bug.cgi?id=58043#c4 -Alex
DVDFab depends on the syscalls matching the Windows 10 numbering when running on Windows 10. I think that's a good reason why Wine's syscall numbers should be changed to match those of the default Windows version in winecfg. See https://bugs.winehq.org/show_bug.cgi?id=58043#c4
-Alex Probably worth noting that the syscall numbers can't just be arbitrary assigned to what Windows has on the current version. There are few known cases when game detect those numbers not based on hardcoding per Windows version and not based on parsing syscall thunk, but based on the fact syscalls are sequentually ordered (starting from 0) on Windows when sorted by Nt function address in ntdll. There is now a test for that in commit ad6c662c468812549a636fcc0f66ec3f824c2675. So the solution probably has to have the syscall functions set matching Windows for the default Wine version in some way.
Paul Gofman <pgofman(a)codeweavers.com> writes:
DVDFab depends on the syscalls matching the Windows 10 numbering when running on Windows 10. I think that's a good reason why Wine's syscall numbers should be changed to match those of the default Windows version in winecfg. See https://bugs.winehq.org/show_bug.cgi?id=58043#c4
-Alex Probably worth noting that the syscall numbers can't just be arbitrary assigned to what Windows has on the current version. There are few known cases when game detect those numbers not based on hardcoding per Windows version and not based on parsing syscall thunk, but based on the fact syscalls are sequentually ordered (starting from 0) on Windows when sorted by Nt function address in ntdll. There is now a test for that in commit ad6c662c468812549a636fcc0f66ec3f824c2675. So the solution probably has to have the syscall functions set matching Windows for the default Wine version in some way.
I have some patches for this that will go in with today's commit round. -- Alexandre Julliard julliard(a)winehq.org
On Thu, Jun 5, 2025 at 8:49 AM zhengxianwei <baikaishiuc(a)gmail.com> wrote:
NtGdiAlphaBlend is listed as 4 in win32syscalls.h, but in reality, it's 0x1075 in win32u.dll on Windows 11.
The syscall number differs across major Windows versions and Windows 10/11 revisions too. For example, * syscall number across Windows 10/11 revisions -https://hfiref0x.github.io/X86_64/NT10_w32ksyscalls.html#:~:text=NtGdiAlphaB... * syscall number across major Windows versions - https://j00ru.vexillium.org/syscalls/win32k/64/#:~:text=NtGdiAlphaBlend
Thanks, it looks like this syscall number was automatically generated by some tool. I think I have a general idea now. On Thu, Jun 5, 2025 at 3:59 PM Biswapriyo Nath <nathbappai(a)gmail.com> wrote:
On Thu, Jun 5, 2025 at 8:49 AM zhengxianwei <baikaishiuc(a)gmail.com> wrote:
NtGdiAlphaBlend is listed as 4 in win32syscalls.h, but in reality, it's 0x1075 in win32u.dll on Windows 11.
The syscall number differs across major Windows versions and Windows 10/11 revisions too. For example, * syscall number across Windows 10/11 revisions - https://hfiref0x.github.io/X86_64/NT10_w32ksyscalls.html#:~:text=NtGdiAlphaB... * syscall number across major Windows versions - https://j00ru.vexillium.org/syscalls/win32k/64/#:~:text=NtGdiAlphaBlend
participants (6)
-
Alex Henrie -
Alexandre Julliard -
Biswapriyo Nath -
Paul Gofman -
Stefan Dösinger -
zhengxianwei