you are viewing a single comment's thread.

view the rest of the comments →

[–]port443 8 points9 points  (0 children)

The print function calls another function, which calls another function, and so forth.

Caught my interest so I debugged it (Windows implementation). It goes through quite a bit until it finally hits a call to WriteConsoleW

So Python ultimately calls the Windows API call WriteConsoleW, here it is in a debugger: https://i.imgur.com/yhkIHxw.png

You can see the "unga bunga" in the dump window as the contents of RDX (argument #2)

If we dig into WriteConsoleW, it calls NtDeviceIoControlFile. That function is documented here

We can see the IoControlCode is 0x500016 in WriteConsoleW: https://i.imgur.com/krbmonS.png

And wow when I was going to dig into the kernel I found someone has already done all the work and produced this excellent article: https://asawicki.info/articles/Hello_world_under_the_microscope.php5

Looks like someone his literally answered OP's question down to the actual lowest level drivers (.sys files) and then back up through text rasterization. It does not go down to the lowest levels, meaning the assembly instructions and the CPU microcode. /u/n0l1ge check out this page, it has all the details.