bd01

4 ms·

1. 1.▲
   by bd01 2y ago

   That's because you're using `mov rdi, rax` again. You keep changing `edi, eax` to `rdi, rax`. Why? The default operand size in 64-bit mode is, for most instructions, still 32 bits. So `mov edi, eax` encodes the same in 32- and 64-
2. 2.▲
   by bd01 2y ago

   Yes, because: push 1 ; 6A 01 (2 bytes) pop rdi ; 5F (1 byte) is longer than a simple: mov edi, eax ; 89 C7 (2 bytes)
3. 3.▲
   by bd01 2y ago

   That second snippet is pretty funny: push 1 pop rax pop rdi You can't push a value once and pop it twice, that's not how a stack works! You're popping something else off the stack. So why does this even work? Linux
4. 4.▲
   by bd01 2y ago

   Initial register state is documented to be undefined except for rbp, rsp and rdx [1]. Can you say for certain that no other Linux version ever used GPRs to pass something else? [1] System V ABI, page 29 (last line) and 30, https:/&#
5. 5.▲
   by bd01 2y ago

   This is pretty bad. Let's start with the very first instruction: mov rax, 1 An actual "mov rax, 1" would assemble to 48 B8 01 00 00 00 00 00 00 00, a whopping TEN bytes. nasm will optimize this to the equivalent "