Assembly Language for Beginners

6.4 Linux

mov ebx,1 ; file descriptor. 1 is for stdout

mov eax,4 ; syscall number. 4 is for sys_write

int 0x80

mov eax,1 ; syscall number. 1 is for sys_exit

int 0x80

section .data

msg db 'Hello, world!',0xa

len equ $ - msg

Compilation:

nasm -f elf32 1.s

ld 1.o

The full list of syscalls in Linux:http://go.yurichev.com/17319.

For system calls interception and tracing in Linux, strace(7.2.3 on page 791) can be used.

6.3.2 Windows.

Here they are called viaint 0x2eor using the special x86 instructionSYSENTER.

The full list of syscalls in Windows:http://go.yurichev.com/17320.

Further reading:

“Windows Syscall Shellcode” by Piotr Bania:http://go.yurichev.com/17321.

6.4 Linux

6.4.1 Position-independent code

While analyzing Linux shared (.so) libraries, one may frequently spot this code pattern:

Listing 6.20: libc-2.17.so x86

.text:0012D5E3 __x86_get_pc_thunk_bx proc near ; CODE XREF: sub_17350+3

.text:0012D5E3 ; sub_173CC+4 ...

.text:0012D5E3 mov ebx, [esp+0]

.text:0012D5E6 retn

.text:0012D5E6 __x86_get_pc_thunk_bx endp

...

.text:000576C0 sub_576C0 proc near ; CODE XREF: tmpfile+73

...

.text:000576C0 push ebp

.text:000576C1 mov ecx, large gs:0

.text:000576C8 push edi

.text:000576C9 push esi

.text:000576CA push ebx

.text:000576CB call __x86_get_pc_thunk_bx

.text:000576D0 add ebx, 157930h

.text:000576D6 sub esp, 9Ch

...

.text:000579F0 lea eax, (a__gen_tempname - 1AF000h)[ebx] ; "__gen_tempname"

.text:000579F6 mov [esp+0ACh+var_A0], eax

.text:000579FA lea eax, (a__SysdepsPosix - 1AF000h)[ebx] ; "../sysdeps/⤦

Çposix/tempname.c"

.text:00057A00 mov [esp+0ACh+var_A8], eax