> For the complete documentation index, see [llms.txt](https://www.ctfrecipes.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.ctfrecipes.com/pwn/general-knowledge/syscall.md).

# Syscall

A **sys**tem **call** is a request made by a program to the kernel to perform a specific function, such as input/output operations, memory allocation, or process control.

**Syscalls** are typically made through an **interrupt instruction**, which is a special type of instruction that stops the execution and transfers control to the kernel. The kernel then performs the requested service and returns control to the program once it is completed.

{% hint style="info" %}
Certain syscalls are similar to libc functions such as `open()`, `fork()` or `read()`; this is because these functions are simply syscalls wrappers, making it much easier for programmers.
{% endhint %}

{% hint style="success" %}
[Here](https://chromium.googlesource.com/chromiumos/docs/+/master/constants/syscalls.md) is a list of syscalls for x86/x64  and arm architectures
{% endhint %}

## Make a Syscall

The instruction used to make a system call vary for each instruction set architecture. Here is some example : 

* [x86](/pwn/architectures/x86-x64/instruction-set.md) --> `int x080`
* [x64](/pwn/architectures/x86-x64/instruction-set.md) --> `syscall` os `sysenter`
* [aarch32](/pwn/architectures/aarch32/instruction-set.md) --> `svc`
* etc.

Once the **syscall instruction** is called, the kernel will check the value stored into a specific register ( [accumulator register](/pwn/architectures/x86-x64/registers.md) for x86/x64 i.e. EAX or RAX ) - **This is the syscall number** which defines **what syscall gets run**. 

Parameters are stored into the others register dependent of each syscall needs. 

{% hint style="info" %}
Nowaday syscalls aren't realy used for standard call such as `exit` or `write` due to `vDSO.`

**`vDSO` is a mechanism used to accelerate certain system calls** in Linux by providing a memory area allocated in user space **that exposes some kernel functionality in a safe manner.**
{% endhint %}