I recommend a slightly different way to cleanup the stack after a system call. The problem with using add is that it clears the carry bit used to indicate an error. So either lea or a number of pops (if you have a spare register) is preferable: they don't touch any flags. For instance, you could have
bsd 5,filename,0 ;open read-only
jc error
with a macro that hides all gory details
macro bsd n,[arg] {
common
local i
i = 0
reverse
push arg
i = i + 1
common
push eax
mov eax,n
int 0x80
if n <> 1
if i <= 2
times i+1 pop ebx ;3 bytes or less
else
lea esp,[esp+4*(i+1)] ;4 bytes
end if
end if
}
|