🐧 Linux Syscalls & Interrupts

In Linux Assembly programming, a syscall (system call) is your gateway to ask the kernel to do stuff for you — like reading files, writing output, or exiting the program. This is done using software interrupts, typically int 0x80 on 32-bit x86 systems.

When you invoke int 0x80, you’re triggering an interrupt that hands control to the Linux kernel. The kernel then looks at the value in the eax register to decide which syscall you want to run. Parameters go in other registers like ebx, ecx, and edx. Once the syscall is done, control returns back to your program.

⚙️ Common Syscall Numbers (x86)

1 — sys_exit: Exit the program
4 — sys_write: Write to a file descriptor (e.g. stdout)
3 — sys_read: Read from a file descriptor
5 — sys_open: Open a file

📚 Example: Print "Hello, World!"

section .data
    msg db "Hello, World!", 0xA  ; Message plus newline
    len equ $ - msg              ; Length of message

section .text
    global _start

_start:
    mov eax, 4          ; sys_write
    mov ebx, 1          ; stdout (file descriptor 1)
    mov ecx, msg        ; pointer to message
    mov edx, len        ; message length
    int 0x80            ; call kernel

    mov eax, 1          ; sys_exit
    mov ebx, 0          ; exit code 0
    int 0x80            ; call kernel

🖥️ Simulated Output

Hello, World!

💡 Pro Tip: In 64-bit Linux, syscalls use the syscall instruction instead of int 0x80, and parameters go in different registers like rdi, rsi, rdx.