By consulting various scattered tutorials and books, I've been able to learn that the 64-bit Linux "exit" system call is 60, and the status value is moved to edi. Similarly, "write" has call number 1, and the file descriptor must be passed to edi, etc.

However, it seems very hard to find information about the other system calls. For example, this table shows the relevant registers for each call, but in e.g. sys_chmod, a value of type mode_t must be moved to rsi. Where does one find the different integer values that can be passed as arguments? man 2 chmod doesn't appear to have them, and greping through header files in /usr/include hasn't been helpful.

In general, how does one go about finding a consistent reference for low-level details like these? Are they considered useless, since the same functionality can generally be performed with C rather than assembly? I'm reading the AMD64 developer manuals, which are helpful for conceptual understanding, but those won't help me with Linux system calls.

  • 2
    Why exactly do you ask? Are you coding an entire user-land program in assembly? – Basile Starynkevitch Feb 8 '16 at 6:04
  • I'm just generally interested in how C ultimately interacts with the processor, and also in reverse engineering. Isn't it helpful, when looking at an assembler dump, to know why certain values are being moved to particular registers? Or do modern disassemblers take care of this and just tell the user what's going on? – Vale132 Feb 8 '16 at 6:50

The relevant documentation is called the Application Binary Interface (ABI) and the calling conventions. Both are processor and operating system specific.

Read the x86_64 Linux ABI. See also syscalls(2) for the available system calls. Almost every system call has its man page in section 2.

BTW, chmod(2) does list various symbolic constants like S_ISUID, S_IXUSR suitable to build the mode_t second argument to chmod

Of course, glancing inside the source code of some C standard library implementation should help a lot (to understand some gory details). I find the source code of musl-libc very readable.

Also use strace(1) to understand the syscalls done by some program & process.

The syscall numbers are listed in /usr/include/asm/unistd_64.h which has #define __NR_exit 60 etc.

See also vdso(7).

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.