How to call 32-bit code from 64-bit in Linux?

procedure Call32BitCode;{$IFDEF FPC}nostackframe;{$ENDIF} assembler;asm LEA RCX,@@Dest[RIP] LEA RBX,@@Next[RIP] PUSH RAX PUSH RDX MOV EAX,SS LEA RDX,[RSP+8*2] XCHG RAX,[RSP+8*1] // SS XCHG RDX,[RSP+8*0] // RSP PUSH $0202 // RFL PUSH $0023 // CS DB $51 // PUSH ECX=RIP DB $48,$CF // IRETQ @@Dest: PUSH $0033 // CS DB $53 // PUSH EBX=EIP DB $FF,$D0,$90 // CALL EAX DB $CB // RETF @@Next: end;

I think it kinda works, at least it should reach the @@Dest label with CS register set to 0x23.

However PUSH $0033 produces SIGSEGV because ESP points to an arbitrary address (probably with no memory pages mapped). In the original code ESP is truncated from RSP that points above 4G space.

As a quick hack I have added some space allocated inside ELF for the CPU stack and couple of instructions to get the 'Hello world!' message.

Code:

format ELF64 executable
entry start

segment readable executable

start:
        lea     rsp, [sspace]
        LEA     RCX,[@@Dest]
        LEA     RBX,[@@Next]
        PUSH    RAX
        PUSH    RDX
        MOV     EAX,SS
        LEA     RDX,[RSP+8*2]
        XCHG    RAX,[RSP+8*1]   ;// SS
        XCHG    RDX,[RSP+8*0]   ;// RSP
        lea     eax, [hello]
        PUSH    $0202           ;// RFL
        PUSH    $0023           ;// CS
        DB      $51             ;// PUSH ECX=RIP
        DB      $48,$CF         ;// IRETQ
@@Dest: PUSH    $0033           ;// CS
        DB      $53             ;// PUSH EBX=EIP
        DB      $FF,$D0,$90     ;// CALL EAX
        DB      $CB             ;// RETF
@@Next:

use32
hello:
        mov     eax, 4
        mov     ebx, 1
        mov     ecx, msg
        mov     edx, msg_size
        int     0x80

        mov     eax, 1
        xor     ebx, ebx
        int     0x80

segment readable writeable

msg db 'Hello world!', 0xA
msg_size = $-msg

rq 256
sspace:

Please note it exits process with int 0x80 and RETF is newer executed.

Here is some more info about the topic http://blog.dolezel.info/2017/02/running-32-bit-code-in-64-bit-linux.html
We need also set DS register to 0x2b to allow memory access.