2

What does following syntax do in GASM?

*%gs:0x10

I know that call *%gs:0x10 call will __kernel_vsyscall, but i don't know what *%register:value do.

It's NASM equivalent looks like this: call DWORD PTR gs:0x10

1
  • 1
    in call gs:0x10, gs:0x10 is a memory operand. gs:0x10 is an address where the address to jump to is stored. This is a memory indirect call to an absolute address. GS is the segment selector to do the memory reference through. Jan 17, 2017 at 7:28

1 Answer 1

4

It's a near absolute indirect (FF /2) call to the target of the pointer in gs:0x10.
Note that gs is a selector register, not a general purpose register (see Protected mode).
The instruction read the DWORD at the offset 0x10 (relative to segment gs) and makes a call to its value.
A direct call would have another effect entirely, possibly involving call gates.


gs:0x10 is where libc copies the address of __kernel_vsyscall during its initialization.

The AT&T syntax for the control transfer instructions is

Branch addressing using registers or memory operands must be prefixed by a '*'. To specify a "far" control tranfers, a 'l' must be prefixed, as in ljmp, lcall, etc. For example,

GAS syntax          NASM syntax
==========          ===========

jmp *100            jmp  near [100]
call *100           call near [100]
jmp *%eax           jmp  near eax
jmp *%ecx           call near ecx
jmp *(%eax)         jmp  near [eax]
call *(%ebx)        call near [ebx]
ljmp *100           jmp  far  [100]
lcall *100          call far  [100]
ljmp *(%eax)        jmp  far  [eax]
lcal *(%ebx)        call far  [ebx]
ret                 retn
lret                retf
lret $0x100         retf 0x100

Segment-offset pointers are specified using the following format:

jmp $segment, $offset
7
  • Thanks, I understand it know. Do you know how to call __kernel_vsyscall on x64 systems? What is equivalent of call *%gs:0x10 in x64? Jan 17, 2017 at 16:46
  • @user7428910 It's easier on x64, use the instruction syscall. A more informative guide is here Jan 17, 2017 at 20:15
  • Yeah, I know it. syscall is normal way on x64, but I am interested in using __kernel_vsyscall, pure curiosity Jan 17, 2017 at 20:28
  • @user7428910 The vDSO mapped for x64 processes does not export the __kernel_vsyscall symbol (look at the man page linked, there is a section specific per architecture). For 32-bit processes in compat-mode you can do as you would on x86. Jan 17, 2017 at 20:35
  • Ok, I understand. Jan 17, 2017 at 20:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.