flat assembler
Message board for the users of flat assembler.

Index > Linux > Linux Syscalls: Return values of Registers and Flags

Author
Thread Post new topic Reply to topic
chastitywhiterose



Joined: 13 Oct 2025
Posts: 13
chastitywhiterose 19 Oct 2025, 05:12
I have been dabbling in Linux Assembly using interrupt 0x80. The reference I use is here:

https://www.chromium.org/chromium-os/developer-library/reference/linux-constants/syscalls/#x86-32-bit

However, this just tells me the names of the calls and a basic idea of what the registers should contain. If not for some tutorials with comments, I probably would not have figured out as much as I have. What I don't know is which registers and flags are modified when I use the calls. I mostly just use read and write calls along with the exit calls. Is there the Linux equivalent of Ralf Brown's list?
Post 19 Oct 2025, 05:12
View user's profile Send private message Send e-mail Reply with quote
macomics



Joined: 26 Jan 2021
Posts: 1197
Location: Russia
macomics 19 Oct 2025, 09:42
Use gdb script
Write it to a file or add it to the end of this file.: ~/.gdbinit
Code:
define dregs
  printf "\e[1;1H\e[10000C\e[16D\e[30;47mEAX=\e[94;47m%04X%02X%02X\e[2;1H\e[10000C\e[16D\e[30;47mEBX=\e[94;47m%04X%02X%02X\e[3;1H\e[10000C\e[16D\e[30;47mECX=\e[94;47m%04X%02X%02X\e[4;1H\e[10000C\e[16D\e[30;47mEDX=\e[94;47m%04X%02X%02X\e[5;1H\e[10000C\e[16D\e[30;47mESP=\e[94;47m%04X%04X\e[6;1H\e[10000C\e[16D\e[30;47mEBP=\e[94;47m%04X%04X\e[7;1H\e[10000C\e[16D\e[30;47mESI=\e[94;47m%04X%04X\e[8;1H\e[10000C\e[16D\e[30;47mEDI=\e[94;47m%04X%04X\e[9;1H\e[10000C\e[16D\e[30;47mEIP=\e[94;47m%08X\e[9;1H", (unsigned short)((unsigned)$eax >> 16), (unsigned char)$ah, (unsigned char)$al, (unsigned short)((unsigned)$ebx >> 16), (unsigned char)$bh, (unsigned char)$bl, (unsigned short)((unsigned)$ecx >> 16), (unsigned char)$ch, (unsigned char)$cl, (unsigned short)((unsigned)$edx >> 16), (unsigned char)$dh, (unsigned char)$dl, (unsigned short)((unsigned)$esp >> 16), (unsigned short)$sp, (unsigned short)((unsigned)$ebp >> 16), (unsigned short)$bp, (unsigned short)((unsigned)$esi >> 16), (unsigned short)$si, (unsigned short)((unsigned)$edi >> 16), (unsigned short)$di, (unsigned)$pc
end

define showflags
  printf "%08X\e[1B\e[9D%X%X%X%X%X%X%X%X%X\e[1B\e[9DDTIOSZAPC", $eflags, (unsigned)(((unsigned)$eflags >> 10) & 1), (unsigned)(((unsigned)$eflags >> 8) & 1), (unsigned)(((unsigned)$eflags >> 9) & 1), (unsigned)(((unsigned)$eflags >> 11) & 1), (unsigned)(((unsigned)$eflags >> 7) & 1), (unsigned)(((unsigned)$eflags >> 6) & 1), (unsigned)(((unsigned)$eflags >> 4) & 1), (unsigned)(((unsigned)$eflags >> 2) & 1), (unsigned)(((unsigned)$eflags >> 0) & 1)
end    


You can use this command sequence to run in the gdb. Just change the ./fasm in two places to the name of your executable file.
Code:
$ cp ~/.gdbinit ~/.gdbinit.old && readelf -h ./fasm | grep 'Address' | awk '{print "break *"$NF}' >> ~/.gdbinit && gdb -q ./fasm && mv ~/.gdbinit.old ~/.gdbinit    

If gdb was launched using the command I suggested, then it is enough to execute the run or r command and execution will stop at the entry point to the program.
In gdb, you will have two new user commands in addition to the existing (inconvenient) info registers.
dregs for displaying 32-bit registers with formatting on the screen
showflags for displaying the flags register as a set of signed bits

ADD: You can clearly see how the registers change after the int 0x80 command.

(only the eax changes)
Post 19 Oct 2025, 09:42
View user's profile Send private message Reply with quote
chastitywhiterose



Joined: 13 Oct 2025
Posts: 13
chastitywhiterose 20 Oct 2025, 01:28
I should learn how to use GDB. I have never actually used a debugger and this might be a good time to learn.
Post 20 Oct 2025, 01:28
View user's profile Send private message Send e-mail Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2025, Tomasz Grysztar. Also on GitHub, YouTube.

Website powered by rwasa.