"System calls in Linux are done through int 0x80. (actually there's a kernel patch allowing system calls to be done via the syscall (sysenter) instruction on ne

"System calls in Linux are done through int 0x80. (actually there's a kernel patch allowing system calls to be done via the syscall (sysenter) instruction on newer CPUs, but this thing is still experimental)." This is no longer the case. While int 0x80 still works, this is not how well behaved binaries should syscall on Linux. The proper way is to call a magic address on a magic page in own process space, which contains the proper code to do the system call. It will execute int 0x80 on CPUs that don't support sysenter/sysexit and sysenter on those that do. The page (vdso) is inserted in all processes' address space by the kernel. Although its address is probably fixed, the proper way to find it is to examine the ELF auxilliary vector, which in turn is passed by the kernel via the initial process stack.