How it works...

Before we dive into the code, let's pause a moment to understand IA64 system calls compared to IA32 system calls. IA64 system calls use different registers than IA32 system calls, which is evident by the assembly code in this recipe. Generally speaking, here's what each register is responsible for:

  • RAX: This register, like EAX in IA32, is responsible for holding the system call number, which can be found in /usr/include/x86_64-linux-gnu/asm/unistd_64.h. This register also holds any return value as a result of making the system call.
  • RDI: This register holds the first parameter to the system call.
  • RSI: This register holds the second parameter to the system call.
  • RDX: This register holds the third parameter to the system call. ...

Get Binary Analysis Cookbook now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.