@chjara there are some programs that do direct syscalls, it's just generally discouraged by microsoft since they do occasionally change the syscall numbers and interfaces
linux actually implemented a feature in the kernel to intercept raw syscalls from userspace to be handled by a custom handler instead of being attempted to be interpreted as a linux syscall