31–37 of 37 posts
I guess not many actually need to call linux kernel system calls directly bypassing proper measures, but how many fondly remembers int 21h?
The thing I don't like using language like "proper" is that it creates a frame of "good or bad", when in reality everything in tech is a trade-off, rather than "good or bad".
Earlier quoted context omitted.
That is true for Linux but might not be true for other operating systems though.
It is absolutely not true on many (most?) operating systems; Linux is actually an outlier, and we mostly forget that it's the odd one out because it's so popular. Off the top of my head, I believe both NT and Solaris define libc as the stable interface that userspace uses; I don't recall exactly what the BSDs do, but I suspect that they at least strongly encourage using libc and not trying to talk to the kernel yours…
> Calling system calls by crafting your own assembly is generally a bad idea as the ABI may break underneath you. syscall should have a stable ABI at the very least, because this would otherwise break all statically linked code.
> Calling system calls by crafting your own assembly is generally a bad idea as the ABI may break underneath you. syscall should have a stable ABI at the very least, because this would otherwise break all statically linked code.
Did it ever change the last 15 years for linux or windows systems? There are additional commands and perhaps some rules changed about which register need parameters and which need to be saved. But I cannot remember fundamental changes here.
As mentioned below, on Windows syscalls are highly unstable. They change with every single update to the OS. You have to call functions in ntdll and they in turn will call the kernel. Think of it like a kind of libc but one that must be dynamically linked. You can't statically link it because it's tied to the exact version of Windows you're using.
Of course Window's actual stable interface is the Win32 API, which will call ntdll which in turn makes the syscall.
Earlier quoted context omitted.
Did it ever change the last 15 years for linux or windows systems? There are additional commands and perhaps some rules changed about which register need parameters and which need to be saved. But I cannot remember fundamental changes here.
Note that a "syscall" means calling into the kernel directly. Only Linux has stable syscalls. As mentioned below, on Windows syscalls are highly unstable. They change with every single update to the OS. You have to call functions in ntdll and they in turn will call the kernel. Think of it like a kind of libc but one that must be dynamically linked. You can't statically link it because it's tied to the exact version o…
Earlier quoted context omitted.
Note that a "syscall" means calling into the kernel directly. Only Linux has stable syscalls. As mentioned below, on Windows syscalls are highly unstable. They change with every single update to the OS. You have to call functions in ntdll and they in turn will call the kernel. Think of it like a kind of libc but one that must be dynamically linked. You can't statically link it because it's tied to the exact version o…
They don't have them documented, but I didn't think they changed that much. But apparently they did. Just found this neat site: https://j00ru.vexillium.org/syscalls/nt/64/
Earlier quoted context omitted.
> Note that I have left out the instructions to statically link binaries because they are documented as unsupported That's a bit annoying, especially since you're already using raw syscall numbers anyways. Here's how to make it static: .intel_syntax noprefix #include #define UNIX_SYSCALL 0x2000000 .globl start start: mov rax, UNIX_SYSCALL | SYS_write mov rdi, 1 lea rsi, text[rip] lea rdx, length syscall mov rax, UNIX…
You don't have to change the source or compile with `clang` -- switching the LD command to: ld -arch x86_64 -o hello hello.o -macosx_version_min 10.8 -static -e _main is sufficient if you're determined to violate the OS vendor's compatibility requirements.