Syscall

From aldeid
Jump to navigation Jump to search

Description

System calls

  • syscall is default way of entering kernel mode on x86-64. This instruction is not available in 32 bit modes of operation on Intel processors.
  • sysenter is an instruction most frequently used to invoke system calls in 32 bit modes of operation. It is similar to syscall, a bit more difficult to use though, but that is kernel's concern.
  • int 0x80 is a legacy way to invoke a system call and should be avoided.

32-bit example

.text:08048080 mov     eax, 4          ; 0x4 = sys_write
.text:08048085 mov     ebx, 1          ; fd
.text:0804808A mov     ecx, offset aWelcomeToRootM ; "Welcome to Root-Me Challenges\r\nPass: "
.text:0804808F mov     edx, 26h        ; len
.text:08048094 int     80h             ; LINUX - sys_write
.text:08048096 mov     eax, 3          ; 0x3 = sys_read
.text:0804809B xor     ebx, ebx        ; fd
.text:0804809D mov     ecx, offset unk_8049188 ; addr
.text:080480A2 mov     edx, 33h        ; len
.text:080480A7 int     80h             ; LINUX - sys_read

32-bit

EAX syscall
00 (0x0) sys_setup [sys_ni_syscall]
01 (0x1) sys_exit
02 (0x2) sys_fork
03 (0x3) sys_read
04 (0x4) sys_write
05 (0x5) sys_open
06 (0x6) sys_close
07 (0x7) sys_waitpid
08 (0x8) sys_creat
09 (0x9) sys_link
10 (0xa) sys_unlink
11 (0xb) sys_execve
12 (0xc) sys_chdir
13 (0xd) sys_time
14 (0xe) sys_mknod
15 (0xf) sys_chmod
16 (0x10) sys_lchown
17 (0x11) sys_break [sys_ni_syscall]
18 (0x12) sys_oldstat [sys_stat]
19 (0x13) sys_lseek
20 (0x14) sys_getpid
21 (0x15) sys_mount
22 (0x16) sys_umount [sys_oldumount]
23 (0x17) sys_setuid
24 (0x18) sys_getuid
25 (0x19) sys_stime
26 (0x1a) sys_ptrace
27 (0x1b) sys_alarm
28 (0x1c) sys_oldfstat [sys_fstat]
29 (0x1d) sys_pause
30 (0x1e) sys_utime
31 (0x1f) sys_stty [sys_ni_syscall]
32 (0x20) sys_gtty [sys_ni_syscall]
33 (0x21) sys_access
34 (0x22) sys_nice
35 (0x23) sys_ftime [sys_ni_syscall]
36 (0x24) sys_sync
37 (0x25) sys_kill
38 (0x26) sys_rename
39 (0x27) sys_mkdir
40 (0x28) sys_rmdir
41 (0x29) sys_dup
42 (0x2a) sys_pipe
43 (0x2b) sys_times
44 (0x2c) sys_prof [sys_ni_syscall]
45 (0x2d) sys_brk
46 (0x2e) sys_setgid
47 (0x2f) sys_getgid
48 (0x30) sys_signal
49 (0x31) sys_geteuid
50 (0x32) sys_getegid
51 (0x33) sys_acct
52 (0x34) sys_umount2 [sys_umount] (2.2+)
53 (0x35) sys_lock [sys_ni_syscall]
54 (0x36) sys_ioctl
55 (0x37) sys_fcntl
56 (0x38) sys_mpx [sys_ni_syscall]
57 (0x39) sys_setpgid
58 (0x3a) sys_ulimit [sys_ni_syscall]
59 (0x3b) sys_oldolduname
60 (0x3c) sys_umask
61 (0x3d) sys_chroot
62 (0x3e) sys_ustat
63 (0x3f) sys_dup2
64 (0x40) sys_getppid
65 (0x41) sys_getpgrp
66 (0x42) sys_setsid
67 (0x43) sys_sigaction
68 (0x44) sys_sgetmask
69 (0x45) sys_ssetmask
70 (0x46) sys_setreuid
71 (0x47) sys_setregid
72 (0x48) sys_sigsuspend
73 (0x49) sys_sigpending
74 (0x4a) sys_sethostname
75 (0x4b) sys_setrlimit
76 (0x4c) sys_getrlimit
77 (0x4d) sys_getrusage
78 (0x4e) sys_gettimeofday
79 (0x4f) sys_settimeofday
80 (0x50) sys_getgroups
81 (0x51) sys_setgroups
82 (0x52) sys_select [old_select]
83 (0x53) sys_symlink
84 (0x54) sys_oldlstat [sys_lstat]
85 (0x55) sys_readlink
86 (0x56) sys_uselib
87 (0x57) sys_swapon
88 (0x58) sys_reboot
89 (0x59) sys_readdir [old_readdir]
90 (0x5a) sys_mmap [old_mmap]
91 (0x5b) sys_munmap
92 (0x5c) sys_truncate
93 (0x5d) sys_ftruncate
94 (0x5e) sys_fchmod
95 (0x5f) sys_fchown
96 (0x60) sys_getpriority
97 (0x61) sys_setpriority
98 (0x62) sys_profil [sys_ni_syscall]
99 (0x63) sys_statfs
100 (0x64) sys_fstatfs
101 (0x65) sys_ioperm
102 (0x66) sys_socketcall
103 (0x67) sys_syslog
104 (0x68) sys_setitimer
105 (0x69) sys_getitimer
106 (0x6a) sys_stat [sys_newstat]
107 (0x6b) sys_lstat [sys_newlstat]
108 (0x6c) sys_fstat [sys_newfstat]
109 (0x6d) sys_olduname [sys_uname]
110 (0x6e) sys_iopl
111 (0x6f) sys_vhangup
112 (0x70) sys_idle
113 (0x71) sys_vm86old
114 (0x72) sys_wait4
115 (0x73) sys_swapoff
116 (0x74) sys_sysinfo
117 (0x75) sys_ipc
118 (0x76) sys_fsync
119 (0x77) sys_sigreturn
120 (0x78) sys_clone
121 (0x79) sys_setdomainname
122 (0x7a) sys_uname [sys_newuname]
123 (0x7b) sys_modify_ldt
124 (0x7c) sys_adjtimex
125 (0x7d) sys_mprotect
126 (0x7e) sys_sigprocmask
127 (0x7f) sys_create_module
128 (0x80) sys_init_module
129 (0x81) sys_delete_module
130 (0x82) sys_get_kernel_syms
131 (0x83) sys_quotactl
132 (0x84) sys_getpgid
133 (0x85) sys_fchdir
134 (0x86) sys_bdflush
135 (0x87) sys_sysfs
136 (0x88) sys_personality
137 (0x89) sys_afs_syscall [sys_ni_syscall]
138 (0x8a) sys_setfsuid
139 (0x8b) sys_setfsgid
140 (0x8c) sys__llseek [sys_lseek]
141 (0x8d) sys_getdents
142 (0x8e) sys__newselect [sys_select]
143 (0x8f) sys_flock
144 (0x90) sys_msync
145 (0x91) sys_readv
146 (0x92) sys_writev
147 (0x93) sys_getsid
148 (0x94) sys_fdatasync
149 (0x95) sys__sysctl [sys_sysctl]
150 (0x96) sys_mlock
151 (0x97) sys_munlock
152 (0x98) sys_mlockall
153 (0x99) sys_munlockall
154 (0x9a) sys_sched_setparam
155 (0x9b) sys_sched_getparam
156 (0x9c) sys_sched_setscheduler
157 (0x9d) sys_sched_getscheduler
158 (0x9e) sys_sched_yield
159 (0x9f) sys_sched_get_priority_max
160 (0xa0) sys_sched_get_priority_min
161 (0xa1) sys_sched_rr_get_interval
162 (0xa2) sys_nanosleep
163 (0xa3) sys_mremap
164 (0xa4) sys_setresuid (2.2+)
165 (0xa5) sys_getresuid (2.2+)
166 (0xa6) sys_vm86
167 (0xa7) sys_query_module (2.2+)
168 (0xa8) sys_poll (2.2+)
169 (0xa9) sys_nfsservctl (2.2+)
170 (0xaa) sys_setresgid (2.2+)
171 (0xab) sys_getresgid (2.2+)
172 (0xac) sys_prctl (2.2+)
173 (0xad) sys_rt_sigreturn (2.2+)
174 (0xae) sys_rt_sigaction (2.2+)
175 (0xaf) sys_rt_sigprocmask (2.2+)
176 (0xb0) sys_rt_sigpending (2.2+)
177 (0xb1) sys_rt_sigtimedwait (2.2+)
178 (0xb2) sys_rt_sigqueueinfo (2.2+)
179 (0xb3) sys_rt_sigsuspend (2.2+)
180 (0xb4) sys_pread (2.2+)
181 (0xb5) sys_pwrite (2.2+)
182 (0xb6) sys_chown (2.2+)
183 (0xb7) sys_getcwd (2.2+)
184 (0xb8) sys_capget (2.2+)
185 (0xb9) sys_capset (2.2+)
186 (0xba) sys_sigaltstack (2.2+)
187 (0xbb) sys_sendfile (2.2+)
188 (0xbc) sys_getpmsg [sys_ni_syscall]
189 (0xbd) sys_putpmsg [sys_ni_syscall]
190 (0xbe) sys_vfork (2.2+)

64-bit

RAX Name Syscall
0 (0x0) read sys_read
1 (0x1) write sys_write
2 (0x2) open sys_open
3 (0x3) close sys_close
4 (0x4) stat sys_newstat
5 (0x5) fstat sys_newfstat
6 (0x6) lstat sys_newlstat
7 (0x7) poll sys_poll
8 (0x8) lseek sys_lseek
9 (0x9) mmap sys_mmap
10 (0xa) mprotect sys_mprotect
11 (0xb) munmap sys_munmap
12 (0xc) brk sys_brk
13 (0xd) rt_sigaction sys_rt_sigaction
14 (0xe) rt_sigprocmask sys_rt_sigprocmask
15 (0xf) rt_sigreturn stub_rt_sigreturn
16 (0x10) ioctl sys_ioctl
17 (0x11) pread64 sys_pread64
18 (0x12) pwrite64 sys_pwrite64
19 (0x13) readv sys_readv
20 (0x14) writev sys_writev
21 (0x15) access sys_access
22 (0x16) pipe sys_pipe
23 (0x17) select sys_select
24 (0x18) sched_yield sys_sched_yield
25 (0x19) mremap sys_mremap
26 (0x1a) msync sys_msync
27 (0x1b) mincore sys_mincore
28 (0x1c) madvise sys_madvise
29 (0x1d) shmget sys_shmget
30 (0x1e) shmat sys_shmat
31 (0x1f) shmctl sys_shmctl
32 (0x20) dup sys_dup
33 (0x21) dup2 sys_dup2
34 (0x22) pause sys_pause
35 (0x23) nanosleep sys_nanosleep
36 (0x24) getitimer sys_getitimer
37 (0x25) alarm sys_alarm
38 (0x26) setitimer sys_setitimer
39 (0x27) getpid sys_getpid
40 (0x28) sendfile sys_sendfile64
41 (0x29) socket sys_socket
42 (0x2a) connect sys_connect
43 (0x2b) accept sys_accept
44 (0x2c) sendto sys_sendto
45 (0x2d) recvfrom sys_recvfrom
46 (0x2e) sendmsg sys_sendmsg
47 (0x2f) recvmsg sys_recvmsg
48 (0x30) shutdown sys_shutdown
49 (0x31) bind sys_bind
50 (0x32) listen sys_listen
51 (0x33) getsockname sys_getsockname
52 (0x34) getpeername sys_getpeername
53 (0x35) socketpair sys_socketpair
54 (0x36) setsockopt sys_setsockopt
55 (0x37) getsockopt sys_getsockopt
56 (0x38) clone stub_clone
57 (0x39) fork stub_fork
58 (0x3a) vfork stub_vfork
59 (0x3b) execve stub_execve
60 (0x3c) exit sys_exit
61 (0x3d) wait4 sys_wait4
62 (0x3e) kill sys_kill
63 (0x3f) uname sys_newuname
64 (0x40) semget sys_semget
65 (0x41) semop sys_semop
66 (0x42) semctl sys_semctl
67 (0x43) shmdt sys_shmdt
68 (0x44) msgget sys_msgget
69 (0x45) msgsnd sys_msgsnd
70 (0x46) msgrcv sys_msgrcv
71 (0x47) msgctl sys_msgctl
72 (0x48) fcntl sys_fcntl
73 (0x49) flock sys_flock
74 (0x4a) fsync sys_fsync
75 (0x4b) fdatasync sys_fdatasync
76 (0x4c) truncate sys_truncate
77 (0x4d) ftruncate sys_ftruncate
78 (0x4e) getdents sys_getdents
79 (0x4f) getcwd sys_getcwd
80 (0x50) chdir sys_chdir
81 (0x51) fchdir sys_fchdir
82 (0x52) rename sys_rename
83 (0x53) mkdir sys_mkdir
84 (0x54) rmdir sys_rmdir
85 (0x55) creat sys_creat
86 (0x56) link sys_link
87 (0x57) unlink sys_unlink
88 (0x58) symlink sys_symlink
89 (0x59) readlink sys_readlink
90 (0x5a) chmod sys_chmod
91 (0x5b) fchmod sys_fchmod
92 (0x5c) chown sys_chown
93 (0x5d) fchown sys_fchown
94 (0x5e) lchown sys_lchown
95 (0x5f) umask sys_umask
96 (0x60) gettimeofday sys_gettimeofday
97 (0x61) getrlimit sys_getrlimit
98 (0x62) getrusage sys_getrusage
99 (0x63) sysinfo sys_sysinfo
100 (0x64) times sys_times
101 (0x65) ptrace sys_ptrace
102 (0x66) getuid sys_getuid
103 (0x67) syslog sys_syslog
104 (0x68) getgid sys_getgid
105 (0x69) setuid sys_setuid
106 (0x6a) setgid sys_setgid
107 (0x6b) geteuid sys_geteuid
108 (0x6c) getegid sys_getegid
109 (0x6d) setpgid sys_setpgid
110 (0x6e) getppid sys_getppid
111 (0x6f) getpgrp sys_getpgrp
112 (0x70) setsid sys_setsid
113 (0x71) setreuid sys_setreuid
114 (0x72) setregid sys_setregid
115 (0x73) getgroups sys_getgroups
116 (0x74) setgroups sys_setgroups
117 (0x75) setresuid sys_setresuid
118 (0x76) getresuid sys_getresuid
119 (0x77) setresgid sys_setresgid
120 (0x78) getresgid sys_getresgid
121 (0x79) getpgid sys_getpgid
122 (0x7a) setfsuid sys_setfsuid
123 (0x7b) setfsgid sys_setfsgid
124 (0x7c) getsid sys_getsid
125 (0x7d) capget sys_capget
126 (0x7e) capset sys_capset
127 (0x7f) rt_sigpending sys_rt_sigpending
128 (0x80) rt_sigtimedwait sys_rt_sigtimedwait
129 (0x81) rt_sigqueueinfo sys_rt_sigqueueinfo
130 (0x82) rt_sigsuspend sys_rt_sigsuspend
131 (0x83) sigaltstack sys_sigaltstack
132 (0x84) utime sys_utime
133 (0x85) mknod sys_mknod
134 (0x86) uselib
135 (0x87) personality sys_personality
136 (0x88) ustat sys_ustat
137 (0x89) statfs sys_statfs
138 (0x8a) fstatfs sys_fstatfs
139 (0x8b) sysfs sys_sysfs
140 (0x8c) getpriority sys_getpriority
141 (0x8d) setpriority sys_setpriority
142 (0x8e) sched_setparam sys_sched_setparam
143 (0x8f) sched_getparam sys_sched_getparam
144 (0x90) sched_setscheduler sys_sched_setscheduler
145 (0x91) sched_getscheduler sys_sched_getscheduler
146 (0x92) sched_get_priority_max sys_sched_get_priority_max
147 (0x93) sched_get_priority_min sys_sched_get_priority_min
148 (0x94) sched_rr_get_interval sys_sched_rr_get_interval
149 (0x95) mlock sys_mlock
150 (0x96) munlock sys_munlock
151 (0x97) mlockall sys_mlockall
152 (0x98) munlockall sys_munlockall
153 (0x99) vhangup sys_vhangup
154 (0x9a) modify_ldt sys_modify_ldt
155 (0x9b) pivot_root sys_pivot_root
156 (0x9c) _sysctl sys_sysctl
157 (0x9d) prctl sys_prctl
158 (0x9e) arch_prctl sys_arch_prctl
159 (0x9f) adjtimex sys_adjtimex
160 (0xa0) setrlimit sys_setrlimit
161 (0xa1) chroot sys_chroot
162 (0xa2) sync sys_sync
163 (0xa3) acct sys_acct
164 (0xa4) settimeofday sys_settimeofday
165 (0xa5) mount sys_mount
166 (0xa6) umount2 sys_umount
167 (0xa7) swapon sys_swapon
168 (0xa8) swapoff sys_swapoff
169 (0xa9) reboot sys_reboot
170 (0xaa) sethostname sys_sethostname
171 (0xab) setdomainname sys_setdomainname
172 (0xac) iopl stub_iopl
173 (0xad) ioperm sys_ioperm
174 (0xae) create_module
175 (0xaf) init_module sys_init_module
176 (0xb0) delete_module sys_delete_module
177 (0xb1) get_kernel_syms
178 (0xb2) query_module
179 (0xb3) quotactl sys_quotactl
180 (0xb4) nfsservctl
181 (0xb5) getpmsg
182 (0xb6) putpmsg
183 (0xb7) afs_syscall
184 (0xb8) tuxcall
185 (0xb9) security
186 (0xba) gettid sys_gettid
187 (0xbb) readahead sys_readahead
188 (0xbc) setxattr sys_setxattr
189 (0xbd) lsetxattr sys_lsetxattr
190 (0xbe) fsetxattr sys_fsetxattr
191 (0xbf) getxattr sys_getxattr
192 (0xc0) lgetxattr sys_lgetxattr
193 (0xc1) fgetxattr sys_fgetxattr
194 (0xc2) listxattr sys_listxattr
195 (0xc3) llistxattr sys_llistxattr
196 (0xc4) flistxattr sys_flistxattr
197 (0xc5) removexattr sys_removexattr
198 (0xc6) lremovexattr sys_lremovexattr
199 (0xc7) fremovexattr sys_fremovexattr
200 (0xc8) tkill sys_tkill
201 (0xc9) time sys_time
202 (0xca) futex sys_futex
203 (0xcb) sched_setaffinity sys_sched_setaffinity
204 (0xcc) sched_getaffinity sys_sched_getaffinity
205 (0xcd) set_thread_area
206 (0xce) io_setup sys_io_setup
207 (0xcf) io_destroy sys_io_destroy
208 (0xd0) io_getevents sys_io_getevents
209 (0xd1) io_submit sys_io_submit
210 (0xd2) io_cancel sys_io_cancel
211 (0xd3) get_thread_area
212 (0xd4) lookup_dcookie sys_lookup_dcookie
213 (0xd5) epoll_create sys_epoll_create
214 (0xd6) epoll_ctl_old
215 (0xd7) epoll_wait_old
216 (0xd8) remap_file_pages sys_remap_file_pages
217 (0xd9) getdents64 sys_getdents64
218 (0xda) set_tid_address sys_set_tid_address
219 (0xdb) restart_syscall sys_restart_syscall
220 (0xdc) semtimedop sys_semtimedop
221 (0xdd) fadvise64 sys_fadvise64
222 (0xde) timer_create sys_timer_create
223 (0xdf) timer_settime sys_timer_settime
224 (0xe0) timer_gettime sys_timer_gettime
225 (0xe1) timer_getoverrun sys_timer_getoverrun
226 (0xe2) timer_delete sys_timer_delete
227 (0xe3) clock_settime sys_clock_settime
228 (0xe4) clock_gettime sys_clock_gettime
229 (0xe5) clock_getres sys_clock_getres
230 (0xe6) clock_nanosleep sys_clock_nanosleep
231 (0xe7) exit_group sys_exit_group
232 (0xe8) epoll_wait sys_epoll_wait
233 (0xe9) epoll_ctl sys_epoll_ctl
234 (0xea) tgkill sys_tgkill
235 (0xeb) utimes sys_utimes
236 (0xec) vserver
237 (0xed) mbind sys_mbind
238 (0xee) set_mempolicy sys_set_mempolicy
239 (0xef) get_mempolicy sys_get_mempolicy
240 (0xf0) mq_open sys_mq_open
241 (0xf1) mq_unlink sys_mq_unlink
242 (0xf2) mq_timedsend sys_mq_timedsend
243 (0xf3) mq_timedreceive sys_mq_timedreceive
244 (0xf4) mq_notify sys_mq_notify
245 (0xf5) mq_getsetattr sys_mq_getsetattr
246 (0xf6) kexec_load sys_kexec_load
247 (0xf7) waitid sys_waitid
248 (0xf8) add_key sys_add_key
249 (0xf9) request_key sys_request_key
250 (0xfa) keyctl sys_keyctl
251 (0xfb) ioprio_set sys_ioprio_set
252 (0xfc) ioprio_get sys_ioprio_get
253 (0xfd) inotify_init sys_inotify_init
254 (0xfe) inotify_add_watch sys_inotify_add_watch
255 (0xff) inotify_rm_watch sys_inotify_rm_watch
256 (0x100) migrate_pages sys_migrate_pages
257 (0x101) openat sys_openat
258 (0x102) mkdirat sys_mkdirat
259 (0x103) mknodat sys_mknodat
260 (0x104) fchownat sys_fchownat
261 (0x105) futimesat sys_futimesat
262 (0x106) newfstatat sys_newfstatat
263 (0x107) unlinkat sys_unlinkat
264 (0x108) renameat sys_renameat
265 (0x109) linkat sys_linkat
266 (0x10a) symlinkat sys_symlinkat
267 (0x10b) readlinkat sys_readlinkat
268 (0x10c) fchmodat sys_fchmodat
269 (0x10d) faccessat sys_faccessat
270 (0x10e) pselect6 sys_pselect6
271 (0x10f) ppoll sys_ppoll
272 (0x110) unshare sys_unshare
273 (0x111) set_robust_list sys_set_robust_list
274 (0x112) get_robust_list sys_get_robust_list
275 (0x113) splice sys_splice
276 (0x114) tee sys_tee
277 (0x115) sync_file_range sys_sync_file_range
278 (0x116) vmsplice sys_vmsplice
279 (0x117) move_pages sys_move_pages
280 (0x118) utimensat sys_utimensat
281 (0x119) epoll_pwait sys_epoll_pwait
282 (0x11a) signalfd sys_signalfd
283 (0x11b) timerfd_create sys_timerfd_create
284 (0x11c) eventfd sys_eventfd
285 (0x11d) fallocate sys_fallocate
286 (0x11e) timerfd_settime sys_timerfd_settime
287 (0x11f) timerfd_gettime sys_timerfd_gettime
288 (0x120) accept4 sys_accept4
289 (0x121) signalfd4 sys_signalfd4
290 (0x122) eventfd2 sys_eventfd2
291 (0x123) epoll_create1 sys_epoll_create1
292 (0x124) dup3 sys_dup3
293 (0x125) pipe2 sys_pipe2
294 (0x126) inotify_init1 sys_inotify_init1
295 (0x127) preadv sys_preadv
296 (0x128) pwritev sys_pwritev
297 (0x129) rt_tgsigqueueinfo sys_rt_tgsigqueueinfo
298 (0x12a) perf_event_open sys_perf_event_open
299 (0x12b) recvmmsg sys_recvmmsg
300 (0x12c) fanotify_init sys_fanotify_init
301 (0x12d) fanotify_mark sys_fanotify_mark
302 (0x12e) prlimit64 sys_prlimit64
303 (0x12f) name_to_handle_at sys_name_to_handle_at
304 (0x130) open_by_handle_at sys_open_by_handle_at
305 (0x131) clock_adjtime sys_clock_adjtime
306 (0x132) syncfs sys_syncfs
307 (0x133) sendmmsg sys_sendmmsg
308 (0x134) setns sys_setns
309 (0x135) getcpu sys_getcpu
310 (0x136) process_vm_readv sys_process_vm_readv
311 (0x137) process_vm_writev sys_process_vm_writev
312 (0x138) kcmp sys_kcmp
313 (0x139) finit_module sys_finit_module