3 ms·

Syscall.sh

68 points by notepad0x90 2y ago

jagrsw 2y ago
This seems useful, especially for CTF players and glibc/musl/.. devs. PS: x64 is a bit ambiguous, as it was not uncommon to use it for Itanium ;)
- c0balt 2y ago
  Besides the point, but are there any deployed Itanium systems left? They seem to have fizzled out somewhere around the 2010s.
  - fullspectrumdev 2y ago
    I come across them every so often! Usually stuff that just hasn’t been replaced yet because “it works fine” like most other legacy kit :)
- electroly 2y ago
  Was it? I'm not saying you're wrong but I don't recall x64 ever referring to Itanium, not even colloquially. "IA-64" was the name that I remember.
Olesya000 2y ago
[dead]
frereit 2y ago
Cool! I built something very similar but for Windows a while back: https://syscalls.win https://syscalls.win
- notepad0x90 2y ago
  nice work. (hopefully) constructive feedback from me, it would be nice if you can list all the syscall items in one page for ctrl+f reasons. and if you can somehow enumerate and include the parameters they take that'd be really nice, but I know in windows land you don't have documentation of the function signatures, I get why you didn't do that already, it is super tedious.
gkbrk 2y ago
Really cool. I always used the Chrome OS one [1] so far. I think yours could use manpage/documentation links from the syscall table too. [1]: https://www.chromium.org/chromium-os/developer-library/reference/linux-constants/syscalls/ https://www.chromium.org/chromium-os/developer-library/refer...
JonChesterfield 2y ago
x64 clobbers rcx and r11, I don't see that mentioned in the calling convention. I'm not confident whether the other architectures have additional clobbers.
- LegionMammal978 2y ago
  Indeed, in bytecode golfing, you can actually make use of SYSCALL's use of RCX for its return address: make a dummy syscall, then use RCX-relative addresses to refer to nearby data, since they're significantly shorter than RIP-relative addresses. (Something I still don't know: On returning from a syscall, is it ever possible for RCX to contain something other than the syscall's return address on Linux, assuming that another process isn't explicitly overwriting it through ptrace or other means? Some people have vaguely hinted so in the case of an interruption by a signal, but I have failed to find any actual example of this.)
boomskats 2y ago
How up to date is this? It seems to be missing a bunch of newer calls, at least for x64.
deleted 2y ago
[deleted]
efilife 2y ago
> Use the links above Not a single link above on mobile

68 points by notepad0x90 2y ago

This seems useful, especially for CTF players and glibc/musl/.. devs. PS: x64 is a bit ambiguous, as it was not uncommon to use it for Itanium ;)

c0balt 2y ago
Besides the point, but are there any deployed Itanium systems left? They seem to have fizzled out somewhere around the 2010s.
- fullspectrumdev 2y ago
  I come across them every so often! Usually stuff that just hasn’t been replaced yet because “it works fine” like most other legacy kit :)
electroly 2y ago
Was it? I'm not saying you're wrong but I don't recall x64 ever referring to Itanium, not even colloquially. "IA-64" was the name that I remember.

Olesya000 2y ago

[dead]

frereit 2y ago

Cool! I built something very similar but for Windows a while back: https://syscalls.win https://syscalls.win

notepad0x90 2y ago
nice work. (hopefully) constructive feedback from me, it would be nice if you can list all the syscall items in one page for ctrl+f reasons. and if you can somehow enumerate and include the parameters they take that'd be really nice, but I know in windows land you don't have documentation of the function signatures, I get why you didn't do that already, it is super tedious.

gkbrk 2y ago

Really cool. I always used the Chrome OS one [1] so far. I think yours could use manpage/documentation links from the syscall table too. [1]: https://www.chromium.org/chromium-os/developer-library/reference/linux-constants/syscalls/ https://www.chromium.org/chromium-os/developer-library/refer...

JonChesterfield 2y ago

x64 clobbers rcx and r11, I don't see that mentioned in the calling convention. I'm not confident whether the other architectures have additional clobbers.

LegionMammal978 2y ago
Indeed, in bytecode golfing, you can actually make use of SYSCALL's use of RCX for its return address: make a dummy syscall, then use RCX-relative addresses to refer to nearby data, since they're significantly shorter than RIP-relative addresses. (Something I still don't know: On returning from a syscall, is it ever possible for RCX to contain something other than the syscall's return address on Linux, assuming that another process isn't explicitly overwriting it through ptrace or other means? Some people have vaguely hinted so in the case of an interruption by a signal, but I have failed to find any actual example of this.)

boomskats 2y ago

How up to date is this? It seems to be missing a bunch of newer calls, at least for x64.

deleted 2y ago

[deleted]

efilife 2y ago

> Use the links above Not a single link above on mobile