Re: Need help in understanding x86 syscall

Steven Rostedt
2005-08-11T17:26:44Z

On Thu, 2005-08-11 at 13:10 -0400, linux-os (Dick Johnson) wrote:
> On Thu, 11 Aug 2005, Coywolf Qi Hunt wrote:

> >>
> >
> > Also glibc support.
> >
> > --
> > Coywolf Qi Hunt
> > http://ahbl.org/~coywolf/
>
> Probably doesn't use int 0x80 at all.

$ objdump -Dhalpr /lib/libc.so.6 | egrep 'int *\$0x80' | wc
448 2240 20160

And a little snapshot:

000288d0 <__libc_sigsuspend>:
288d0: 55 push %ebp
288d1: 89 e5 mov %esp,%ebp
288d3: 57 push %edi
288d4: 56 push %esi
288d5: 53 push %ebx
288d6: e8 00 00 00 00 call 288db <__libc_sigsuspend+0xb>
288db: 5b pop %ebx
288dc: 81 c3 19 c7 0e 00 add $0xec719,%ebx
288e2: 8b 83 b4 32 00 00 mov 0x32b4(%ebx),%eax
288e8: 85 c0 test %eax,%eax
288ea: 75 23 jne 2890f <__libc_sigsuspend+0x3f>
288ec: b9 08 00 00 00 mov $0x8,%ecx
288f1: 8b 55 08 mov 0x8(%ebp),%edx
288f4: 87 d3 xchg %edx,%ebx
288f6: b8 b3 00 00 00 mov $0xb3,%eax
288fb: cd 80 int $0x80
288fd: 87 d3 xchg %edx,%ebx
288ff: 89 c6 mov %eax,%esi
28901: 3d 00 f0 ff ff cmp $0xfffff000,%eax
28906: 77 33 ja 2893b <__libc_sigsuspend+0x6b>
28908: 89 f0 mov %esi,%eax
2890a: 5b pop %ebx
2890b: 5e pop %esi
2890c: 5f pop %edi
2890d: 5d pop %ebp
2890e: c3 ret

288fb seems to use "int 0x80" and so do all the other system calls that
I inspected.

$ ls -l /lib/libc.so.6
lrwxrwxrwx 1 root root 13 2005-08-09 22:28 /lib/libc.so.6 -> libc-2.3.5.so

-- Steve