1

How do you know which registers you need to use for the system calls? Is this for every machine different? So why is it eax, ebx, etc.? How can I find out for my machine? Will it be different for every processor, I mean will there be a difference for i586 and i386?

_start:             ; entry point for commands

         ; use the write syscall to print 'Hello world!' to stdout
         mov eax, 4          ; move syscall 4(write) to the eax register
         mov ebx, 1          ; move field descriptor for stdout to ebx
         mov ecx, msg        ; move the memory address of our string to ecx
         mov edx, 13         ; move the length of the string to edx
         int 0x80       ; execute the syscall

    section .data
         msg: db “Hello world!”, 0x0a  ; the string, followed by a new line character

closed as too broad by Gilles, Scott, jimmij, Archemar, dr01 Dec 1 '15 at 8:01

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Why do you want to know this? This is something that depends on architecture and OS. – schily Nov 30 '15 at 18:26
  • I need to write shellcode in assembler (college exercise), so I need to know which registers I should use. – Joey Nov 30 '15 at 18:31
  • So your college made a fault. The shell is a scripting interpreter, there is no assembler interface to the shell. Also note that the syscall interface is a moving target. There is intentionally no documented interface. – schily Nov 30 '15 at 19:09
  • 2
    I think you misunderstood the term "shellcode". I mean this en.wikipedia.org/wiki/Shellcode – Joey Nov 30 '15 at 19:10
  • 1
2

Each architecture defines an "ABI" (application binary interface) which basically says "first argument goes here, second goes here, third goes here... return value comes back here". You read the spec for the ABI, and then you use the order and size of the arguments of a function to determine which register they go in.

See https://stackoverflow.com/questions/2535989/what-are-the-calling-conventions-for-unix-linux-system-calls-on-x86-64

You will need to generate different assembly for each platform you want to target. But, you can be reasonably sure that all "Linux x86_64" platforms are binary compatible, and so on for x86, ARM, PowerPC, etc. But then there's BSD as well :-)

Here's some cheat sheets for x86 and x86_64 (pulled off a quick google search)

But also beware that the syscall numbers themselves vary between platforms, so 'open' on x86_64 is 3 but on x86 it is 5.

  • Great answer! Is i586 an architecture by its own with its own ABI or does it use the x86 ABI? I wonder if the syscall numbers for x86 and i586 are the same. – Joey Dec 1 '15 at 10:12
  • 1
    To my knowledge, all 32-bit x86 hardware uses the same ABI (although those specifications evolved as more registers became available). But the oldest hardware I've personally run Linux on was a Pentium 2. (and since I could run the same binaries on it that I used on better hardware, I can conclude the ABI was identical) – dataless Dec 3 '15 at 3:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.