Jul 24 2021, 02:06 PM, updated 2y ago
Here's a useful website just for that, https://www.kernel.org/doc/man-pages/
As I dig into "/usr/include/x86_64-linux-gnu/asm" directory, I found lists of syscall numbers in unistd_32.h and unistd_64.h.
Here's the first 13 lines of the unistd_64.h header file:
CODE
#ifndef _ASM_X86_UNISTD_64_H
#define _ASM_X86_UNISTD_64_H 1
#define __NR_read 0
#define __NR_write 1
#define __NR_open 2
#define __NR_close 3
#define __NR_stat 4
#define __NR_fstat 5
#define __NR_lstat 6
#define __NR_poll 7
#define __NR_lseek 8
#define __NR_mmap 9
#define __NR_mprotect 10
sys_read = 0, sys_write = 1, sys_exit = 60 (not listed above).
For example, here's a piece of Assembly code to call sys_read and sys_write function. It actually reads a line from console and then writes the line back to console.
As follows:
CODE
format ELF64 executable 3
segment readable executable
entry $
mov edx,256
lea rsi,[buf]
mov edi,1
xor eax,eax; sys_read
syscall
mov edx,256
lea rsi,[buf]
mov edi,1; STDOUT
mov eax,1; sys_write
syscall
xor edi,edi; exit code 0
mov eax,60; sys_exit
syscall
segment readable writeable
buf rb 256
(This ELF64 binary file is 230 bytes only, way smaller than similar Windows PE binary file)
This is still very basic, in demonstrating the 64-bit syscall in ELF64 binary file format.
As shown somewhere in the Linux manual (link given in the first paragraph), parameters preceding a 64-bit syscall is as follows:
CODE
; r9 ; 6th param
; r8 ; 5th param
; r10 ; 4th param
; rdx ; 3rd param
; rsi ; 2nd param
; rdi ; 1st param
; eax ; syscall_number
; syscall
But in 32-bit Linux system programming, we use "int 0x80" instead of "syscall". Corrections are welcomed as I am beginner to Linux kernel.
And one funny hex value from the Linux manual no doubt is: (Look! What's the magic number :=)
CODE
(snipped)
mov rdi,0xfee1dead; MAGIC1
mov eax,169; sys_reboot
syscall
It resembles the English phrase "feel dead", yes, for sys_reboot (as if computers were to "feel dead" before powered down or system restart ;=).
This post has been edited by FlierMate: Jul 28 2021, 02:37 AM
Quote
0.0170sec
0.71
6 queries
GZIP Disabled