0

To my knowledge, this is a decent resource to know the parameters of a Linux syscall. However, this only lists 32 bit syscalls, not the 64 bit ones. Moreover, the reference doesn't say which register is being used by what parameter.

So far I understand, the man-pages for the libc wrappers or referring to the Linux kernel headers can be a solution. But, I am looking for a more friendly resource that can be consulted quickly.

  • What is an authentic resource to know the parameter to register mappings?
  • Is there a resource for 64 bit syscalls as well?
3

This StackOverflow answer is a great resource.

In summary, for 32 bits: Syscall number is eax. ebx, ecx, edx, esi, edi, ebp are used for arguments. You invoke the syscall with int 0x80. All registers are preserved after the syscall.

For 64 bit, that answer cites this specification, which might be a good "authentic resource" as you asked for.

This is a good syscall table for 64 bit.

This is a good syscall table for 32-bit.

| improve this answer | |
1

I wouldn't call it authentic, but this surely is a source I've been using for quite some time now.

Double click on the line of the syscall to see what the parameters are (and their types).

You may see things like struct sockaddr __user, for these you need to dig a bit into the source files.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.