6

Checking out Linux ARM shellcode I see that the system call is made by using the svc 1 instruction. However, I have also seen examples where they use svc 0 as the instruction that calls the system call.

Evidently, system calls in Linux on ARM can be performed using both svc 0 and svc 1. Why is this the case as opposed to architectures such as x86. Are the kind of interrupts generated by both these instructions the same?

  • 2
    It's the same interrupt. The #imm parameter part (0, 1 etc) is ignored by Linux IIRC. – Vitaly Osipov May 1 '14 at 3:10
3

I suppose you should check this part of the ARM documentation, and this description of svc and its parameters. By cross referencing the two links you'll find an answer to your question.

From the links above you'll be able to understand what the parameter of the svc instruction represents. It is supposed to be ignored by the CPU but the exception handler can use that parameter to determine the service being requested : ARM instruction if the value is between 0 & 16777215, or Thumb instruction if the value is between 0 & 255.

The thumb instruction set is a compact 16bit encoding for ARM instructions. It was mainly designed & implemented for compact code-density. You can check the Wikipedia page about the ARM architecture for more information, but I would recommend you going through the ARM documentation for accurate technical details.

|improve this answer|||||
  • could you add a short answer derived from those links ? – 0xea May 1 '14 at 9:58
  • Here we go :done ! – yaspr May 2 '14 at 11:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy