x86 vs x86-64

Syscall register conventions

32-bit syscalls go through int 0x80, 64-bit through syscall. Number in eax/rax, the rest of the args in completely different registers:

Remember: arg 4 is r10, not rcx — syscall clobbers (overwrites) rcx (and r11) itself.

Common syscall numbers

The same call has a different number in each mode:

Examples

write hello world, 32-bit:

mov eax, 4          ; sys_write
mov ebx, 1          ; stdout
mov ecx, msg        ; buffer
mov edx, len        ; length
int 0x80

write hello world, 64-bit:

mov rax, 1          ; sys_write
mov rdi, 1          ; stdout
mov rsi, msg        ; buffer
mov rdx, len        ; length
syscall

exit, 32-bit:

mov eax, 1          ; sys_exit
mov ebx, 0          ; exit code
int 0x80

exit, 64-bit:

mov rax, 60         ; sys_exit
mov rdi, 0          ; exit code
syscall

Stuff to remember

• e prefix vs r prefix, plus 64-bit gets extra r8-r15
• args land in different registers entirely — can't just copy-paste a 32-bit syscall
• numbers differ per mode (write: 4 vs 1)
• instruction changes too: int 0x80 <-> syscall