Re: Need help in understanding x86 syscall

linux-os (Dick Johnson)
2005-08-11T17:47:13Z

On Thu, 11 Aug 2005, Steven Rostedt wrote:

> On Thu, 2005-08-11 at 13:10 -0400, linux-os (Dick Johnson) wrote:
>> On Thu, 11 Aug 2005, Coywolf Qi Hunt wrote:
>
>>>>
>>>
>>> Also glibc support.
>>>
>>> --
>>> Coywolf Qi Hunt
>>> http://ahbl.org/~coywolf/
>>
>> Probably doesn't use int 0x80 at all.
>
> $ objdump -Dhalpr /lib/libc.so.6 | egrep 'int *\$0x80' | wc
> 448 2240 20160
>
> And a little snapshot:
>
> 000288d0 <__libc_sigsuspend>:
> 288d0: 55 push %ebp
> 288d1: 89 e5 mov %esp,%ebp
> 288d3: 57 push %edi
> 288d4: 56 push %esi
> 288d5: 53 push %ebx
> 288d6: e8 00 00 00 00 call 288db <__libc_sigsuspend+0xb>
> 288db: 5b pop %ebx
> 288dc: 81 c3 19 c7 0e 00 add $0xec719,%ebx
> 288e2: 8b 83 b4 32 00 00 mov 0x32b4(%ebx),%eax
> 288e8: 85 c0 test %eax,%eax
> 288ea: 75 23 jne 2890f <__libc_sigsuspend+0x3f>
> 288ec: b9 08 00 00 00 mov $0x8,%ecx
> 288f1: 8b 55 08 mov 0x8(%ebp),%edx
> 288f4: 87 d3 xchg %edx,%ebx
> 288f6: b8 b3 00 00 00 mov $0xb3,%eax
> 288fb: cd 80 int $0x80
> 288fd: 87 d3 xchg %edx,%ebx
> 288ff: 89 c6 mov %eax,%esi
> 28901: 3d 00 f0 ff ff cmp $0xfffff000,%eax
> 28906: 77 33 ja 2893b <__libc_sigsuspend+0x6b>
> 28908: 89 f0 mov %esi,%eax
> 2890a: 5b pop %ebx
> 2890b: 5e pop %esi
> 2890c: 5f pop %edi
> 2890d: 5d pop %ebp
> 2890e: c3 ret
>
> 288fb seems to use "int 0x80" and so do all the other system calls that
> I inspected.
>
> $ ls -l /lib/libc.so.6
> lrwxrwxrwx 1 root root 13 2005-08-09 22:28 /lib/libc.so.6 -> libc-2.3.5.so
>
>
> -- Steve
>

I was talking about the one who had the glibc support to use
the newer system-call entry (who's name can confuse).

You are looking at code that uses int 0x80. It's an interrupt,
therefore, in the kernel, once the stack is set up, interrupts
need to be (re)enabled.

Cheers,
Dick Johnson
Penguin : Linux version 2.6.12 on an i686 machine (5537.79 BogoMips).
Warning : 98.36% of all statistics are fiction.
.
I apologize for the following. I tried to kill it with the above dot :

****************************************************************
The information transmitted in this message is confidential and may be privileged. Any review, retransmission, dissemination, or other use of this information by persons or entities other than the intended recipient is prohibited. If you are not the intended recipient, please notify Analogic Corporation immediately - by replying to this message or by sending an email to DeliveryErrors@analogic.com - and destroy all copies of this information, including any attachments, without reading or disclosing them.

Thank you.