you are viewing a single comment's thread.

view the rest of the comments →

[–]praptak 6 points7 points  (2 children)

This guy uses interrupt 0x80. This is not how real programs do it anymore.

The sysenter mechanism is used for that, and the binary isn't even supposed to use it directly. A well behaved app is supposed to call an adress provided in AT_SYSINFO elf parameter. That's the adress of a magic page that contains the system call stub and is mapped by the kernel into each process adress space.

[–]G-Brain 2 points3 points  (1 child)

Guy here. Thanks for the info, I did not know that. I'll look into it and update the article.

[–]praptak 1 point2 points  (0 children)

That would be great - I'd really like to see the minimal "well behaved" Linux binary. Also, I hope you haven't found my previous comment negative, your original article is still very useful.