2021-08-31 02:10:17 -04:00
|
|
|
Linux syscall calling convention:
|
|
|
|
rax - syscall number
|
|
|
|
rdi, rsi, rdx, r10, r8, r9 - arguments
|
2021-08-30 15:11:04 -07:00
|
|
|
return value placed in rax
|
|
|
|
|
2021-08-31 02:10:17 -04:00
|
|
|
Instruction set:
|
2021-08-30 15:11:04 -07:00
|
|
|
|
|
|
|
mov rax, imm64
|
|
|
|
>48 b8 IMM64
|
2021-08-31 17:16:30 -04:00
|
|
|
xor eax, eax (sets rax to 0, much shorter than mov rax, 0)
|
|
|
|
>31 c0
|
2022-01-06 11:57:55 -05:00
|
|
|
xor edx, edx
|
|
|
|
>31 d2
|
2021-08-30 15:11:04 -07:00
|
|
|
mov rdest, rsrc
|
|
|
|
ax bx cx dx sp bp si di
|
|
|
|
0 3 1 2 4 5 6 7
|
|
|
|
>48 89 (dest | src << 3 | 0xc0)
|
|
|
|
mov r8, rax (for syscalls)
|
|
|
|
>49 89 c0
|
|
|
|
mov r9, rax (for syscalls)
|
|
|
|
>49 89 c1
|
|
|
|
mov r10, rax (for syscalls)
|
|
|
|
>49 89 c2
|
|
|
|
xchg rax, rbx
|
|
|
|
>48 93
|
|
|
|
mov qword [rbx], rax
|
|
|
|
>48 89 03
|
|
|
|
mov rax, qword [rbx]
|
|
|
|
>48 8b 03
|
2021-08-31 17:16:30 -04:00
|
|
|
mov dword [rbx], eax
|
|
|
|
>89 03
|
|
|
|
mov eax, dword [rbx]
|
|
|
|
>8b 03
|
|
|
|
mov word [rbx], ax
|
|
|
|
>66 89 03
|
|
|
|
mov ax, word [rbx]
|
|
|
|
>66 8b 03
|
|
|
|
mov byte [rbx], al
|
|
|
|
>88 03
|
|
|
|
mov al, byte [rbx]
|
|
|
|
>8a 03
|
2021-11-21 17:23:09 -05:00
|
|
|
mov rax, qword [rbp+imm32]
|
2022-01-06 13:53:52 -05:00
|
|
|
>48 8b 85 IMM32 (note: imm may be negative)
|
|
|
|
lea rax, [rbp+imm32]
|
|
|
|
>48 8d 85 IMM32 (note: imm may be negative)
|
2022-01-06 23:29:59 -05:00
|
|
|
lea rsp, [rbp+imm32]
|
|
|
|
>48 8d a5 IMM32 (note: imm may be negative)
|
2021-11-21 17:23:09 -05:00
|
|
|
mov qword [rbp+imm32], rax
|
2022-01-06 13:53:52 -05:00
|
|
|
>48 89 85 IMM32 (note: imm may be negative)
|
2022-01-06 13:13:12 -05:00
|
|
|
mov qword [rsp+imm32], rax
|
|
|
|
>48 89 84 24 IMM32 (note: imm may be negative)
|
2021-11-21 17:23:09 -05:00
|
|
|
mov qword [rsp], rbp
|
|
|
|
>48 89 2c 24
|
|
|
|
mov rbp, qword [rsp]
|
|
|
|
>48 8b 2c 24
|
|
|
|
mov ebx, imm32
|
|
|
|
>bb IMM32
|
2021-08-30 15:11:04 -07:00
|
|
|
neg rax
|
|
|
|
>48 f7 d8
|
|
|
|
add rax, rbx
|
|
|
|
>48 01 d8
|
2022-01-06 11:57:55 -05:00
|
|
|
sub rax, rbx
|
|
|
|
>48 29 d8
|
2021-08-30 15:11:04 -07:00
|
|
|
imul rbx
|
|
|
|
>48 f7 eb
|
|
|
|
idiv rbx
|
|
|
|
>48 f7 fb
|
|
|
|
mul rbx
|
|
|
|
>48 f7 e3
|
|
|
|
div rbx
|
|
|
|
>48 f7 f3
|
|
|
|
not rax
|
|
|
|
>48 f7 d0
|
|
|
|
and rax, rbx
|
|
|
|
>48 21 d8
|
|
|
|
or rax, rbx
|
|
|
|
>48 09 d8
|
|
|
|
xor rax, rbx
|
|
|
|
>48 31 d8
|
|
|
|
shl rax, cl
|
|
|
|
>48 d3 e0
|
|
|
|
shl rax, imm8
|
|
|
|
>48 c1 e0 IMM8
|
|
|
|
shr rax, cl
|
|
|
|
>48 d3 e8
|
|
|
|
shr rax, imm8
|
|
|
|
>48 c1 e8 IMM8
|
|
|
|
sar rax, cl
|
2021-11-13 13:12:38 -05:00
|
|
|
>48 d3 f8
|
2021-08-30 15:11:04 -07:00
|
|
|
sar rax, imm8
|
|
|
|
>48 c1 f8 IMM8
|
|
|
|
sub rsp, imm32
|
|
|
|
>48 81 ec IMM32
|
2021-11-21 17:23:09 -05:00
|
|
|
add rsp, imm32
|
|
|
|
>48 81 c4 IMM32
|
2021-08-30 15:11:04 -07:00
|
|
|
cmp rax, rbx
|
|
|
|
>48 39 d8
|
|
|
|
test rax, rax
|
|
|
|
>48 85 c0
|
|
|
|
jmp rel32
|
|
|
|
>e9 REL32
|
|
|
|
je rel32
|
|
|
|
>0f 84 REL32
|
|
|
|
jne rel32
|
|
|
|
>0f 85 REL32
|
|
|
|
jl rel32
|
|
|
|
>0f 8c REL32
|
|
|
|
jg rel32
|
|
|
|
>0f 8f REL32
|
2022-01-06 17:37:02 -05:00
|
|
|
jle rel32
|
|
|
|
>0f 8e REL32
|
|
|
|
jge rel32
|
|
|
|
>0f 8d REL32
|
2021-08-30 15:11:04 -07:00
|
|
|
jb rel32
|
|
|
|
>0f 82 REL32
|
2021-09-01 14:58:37 -04:00
|
|
|
ja rel32
|
|
|
|
>0f 87 REL32
|
2022-01-06 17:37:02 -05:00
|
|
|
jbe rel32
|
|
|
|
>0f 86 REL32
|
|
|
|
jae rel32
|
|
|
|
>0f 83 REL32
|
2021-08-30 15:11:04 -07:00
|
|
|
call rax
|
|
|
|
>ff d0
|
|
|
|
ret
|
|
|
|
>c3
|
|
|
|
syscall
|
|
|
|
>0f 05
|
2021-11-09 20:53:55 -05:00
|
|
|
nop
|
|
|
|
>90
|
2021-11-10 12:55:41 -05:00
|
|
|
(more will be added as needed)
|
2021-11-21 17:23:09 -05:00
|
|
|
|
|
|
|
to be removed:
|
|
|
|
mov qword [rsp], rax
|
|
|
|
>48 89 04 24
|
|
|
|
mov rax, qword [rsp]
|
|
|
|
>48 8b 04 24
|