Syscall Mechanics (x86-64)

Updated 13 Sep 2026

•
What it is
- •
  The Linux x86-64 convention for calling the kernel directly: put the syscall number in rax, load its arguments, then execute syscall.
•
How it works
- •
  On Linux x86-64, rax holds the syscall number; arguments use rdi, rsi, rdx, r10, r8, r9. The instruction clobbers rcx and r11; the result returns in rax.
- •
```
rax  = syscall number
rdi  = arg1     rsi  = arg2     rdx  = arg3
r10  = arg4     r8   = arg5     r9   = arg6
syscall          ; traps into the kernel, result returned in rax
```
- •
  Encountered so far: open (rax=2), sendfile (rax=40), chmod (rax=90), and execve (rax=59, covered conceptually in the intro video for spawning /bin/sh).
•
When to use it
- •
  Any time you're writing shellcode with no libc leak, or a challenge explicitly restricts you to raw instructions (no calls into a resolved libc).
- •
  Legacy alternatives exist (int 0x80, sysenter) but modern x86-64 Linux shellcode should default to syscall.
•
Examples
- •
  open("/flag", 0): rax=2, rdi=path, rsi=0; the returned file descriptor is in rax.
- •
  sendfile(1, fd, NULL, 100): rax=40, rdi=1, rsi=fd, rdx=0, r10=100.

pwntools

from pwn import constants
print(constants.SYS_open, constants.SYS_sendfile)

catch syscall
info registers rax rdi rsi rdx r10