merrychap / shellen

:cherry_blossom: Interactive shellcoding environment to easily craft shellcodes
MIT License
888 stars 97 forks source link

wrong system call ABI on x86-64 Linux #22

Closed f0rki closed 3 years ago

f0rki commented 3 years ago

I think the ABI for x86-64 system calls on Linux is wrong. For example, when I search for the sendfile system call:

ssize_t sendfile(int out_fd, int in_fd, off_t *offset, size_t count);

I get the following output from shellen:

L:asm:x86_64 > sys sendfile

╔══════════╦══════╦═══════╦════════╦═════════╦═══════╗
║ NAME     ║ RAX  ║ RCX   ║ RDI    ║ RDX     ║ RSI   ║
╠══════════╬══════╬═══════╬════════╬═════════╬═══════╣
║ sendfile ║ 0x28 ║ count ║ out_fd ║ *offset ║ in_fd ║
╚══════════╩══════╩═══════╩════════╩═════════╩═══════╝

However, according to man 2 syscall the fourth parameter is passed in r10

      Arch/ABI      arg1  arg2  arg3  arg4  arg5  arg6  arg7  Notes
       ──────────────────────────────────────────────────────────────
[...]
       x86-64        rdi   rsi   rdx   r10   r8    r9    -

My system is a Ubuntu 20.04 with Kernel 5.4.0.