Return Styles: Pseud0ch, Terminal, Valhalla, NES, Geocities, Blue Moon. Entire thread

int80h vs syscall

Name: Anonymous 2010-05-15 12:28

Why does int 80h only work with certain code on x86_64 Linux?
for example:

section .bss
  arg    resq

section .text
  global _start

_start:
  ; code here to fill arg with argv[1]
  mov rax,1
  mov rdi,2
  mov rsi,[arg]
  mov rdx,[arglen]
  syscall


is fine, but

section .bss
  arg    resq

section .text
  global _start

_start:
  ; code here to fill arg with argv[1]
  mov rax,4
  mov rbx,2
  mov rcx,[arg]
  mov rdx,[arglen]
  int 80h

doesn't work with pointers copied from bss, if that's even relevant
rax is filled with 0xfffffffffffffff2, aka -14.

Name: Anonymous 2010-05-15 13:08

Because those are OS internals subject to change.
In Windows NT, we used to use int 2Eh, but it was later changed to sysenter. Of course, to retain backwards compatibility, each way to do a syscall was exported as a symbol (undocumented) from NTDLL:

7C90EB8B KiFastSystemCall                        8BD4            MOV EDX,ESP
7C90EB8D                                         0F34            SYSENTER
7C90EB8F                                         90              NOP
7C90EB90                                         90              NOP
7C90EB91                                         90              NOP
7C90EB92                                         90              NOP
7C90EB93                                         90              NOP
7C90EB94 KiFastSystemCallRet                     C3              RETN
7C90EB95                                         8DA424 00000000 LEA ESP,DWORD PTR SS:[ESP]
7C90EB9C                                         8D6424 00       LEA ESP,DWORD PTR SS:[ESP]
7C90EBA0                                         90              NOP
7C90EBA1                                         90              NOP
7C90EBA2                                         90              NOP
7C90EBA3                                         90              NOP
7C90EBA4                                         90              NOP
7C90EBA5 KiIntSystemCall                         8D5424 08       LEA EDX,DWORD PTR SS:[ESP+8]
7C90EBA9                                         CD 2E           INT 2E
7C90EBAB                                         C3              RETN


Each actual syscall being performed like:

mov eax, ssdt_vector_index ; syscall number
call [&ntdll.KiFastSystemCall]
retn XX

The old interrupt dispatcher is still supported on NT.

The reason sysenter is recommended instead of int ** is for efficiency reasons. You usually perform a lot of these calls during an application's lifetime and the ring3->ring0->ring3 switches are costly too. sysenter is more lightweight.

While I'm not as familiar with linux's syscall mechanism, maybe they decided not to retain backwards compatibility, or at least backwards compatibility isn't enabled in your linux kernel build?

Newer Posts
Don't change these.
Name: Email:
Entire Thread Thread List