mac OS与iOS的系统调用

Posted 2021-12-08 FarmGuo

mac OS 上 x86 使用syscall，32位 int 0x80。
中断号定义在#import <sys/syscall.h>

调用分几种
syscall_sw.h的定义

#define SYSCALL_CLASS_NONE	0	/* Invalid */
#define SYSCALL_CLASS_MACH	1	/* Mach */	
#define SYSCALL_CLASS_UNIX	2	/* Unix/BSD */
#define SYSCALL_CLASS_MDEP	3	/* Machine-dependent */
#define SYSCALL_CLASS_DIAG	4	/* Diagnostics */
#define SYSCALL_CLASS_IPC	5	/* Mach IPC */

/* Macros to simpllfy constructing syscall numbers. */
#define SYSCALL_CONSTRUCT_MACH(syscall_number) \\
			((SYSCALL_CLASS_MACH << SYSCALL_CLASS_SHIFT) | \\
			 (SYSCALL_NUMBER_MASK & (syscall_number)))
#define SYSCALL_CONSTRUCT_UNIX(syscall_number) \\
			((SYSCALL_CLASS_UNIX << SYSCALL_CLASS_SHIFT) | \\
			 (SYSCALL_NUMBER_MASK & (syscall_number)))
#define SYSCALL_CONSTRUCT_MDEP(syscall_number) \\
			((SYSCALL_CLASS_MDEP << SYSCALL_CLASS_SHIFT) | \\
			 (SYSCALL_NUMBER_MASK & (syscall_number)))
#define SYSCALL_CONSTRUCT_DIAG(syscall_number) \\
			((SYSCALL_CLASS_DIAG << SYSCALL_CLASS_SHIFT) | \\
			 (SYSCALL_NUMBER_MASK & (syscall_number)))

对于Mach调用，调用的中断号是：中断号+ (1<<24)
对于Unix调用，调用的中断号是：中断号+ (2<<24)
exit的中断号是1，所以调用时的rax参数是0x2000001。
rdi是调用exit的参数

libsystem_kernel.dylib`mach_msg_trap:
0x7fff6bf982b0 <+0>: movq %rcx, %r10
0x7fff6bf982b3 <+3>: movl $0x100001f, %eax ; imm = 0x100001F
0x7fff6bf982b8 <+8>: syscall
-> 0x7fff6bf982ba <+10>: retq
0x7fff6bf982bb <+11>: nop

   rax = 0x000000000100001f
   rbx = 0x0000000000002303
   rcx = 0x0000000000000c00
   rdx = 0x0000000000000000
   rdi = 0x00007ffee2a6dee0
   rsi = 0x0000000007000806
   rbp = 0x00007ffee2a6dd50
   rsp = 0x00007ffee2a6dcf8
    r8 = 0x0000000000002303
    r9 = 0x00000000ffffffff
   r10 = 0x0000000000000c00
   r11 = 0x0000000000000346
   r12 = 0x0000000007000806
   r13 = 0x0000000000000c00
   r14 = 0x00007ffee2a6dee0
   r15 = 0x00000000ffffffff
   rip = 0x00007fff6bf982b8  libsystem_kernel.dylib`mach_msg_trap + 8
rflags = 0x0000000000000246
    cs = 0x000000000000002b
    fs = 0x0000000000000000
    gs = 0x0000000000000000

arm64上，x16保存调用号，svc #0x80表示系统调用，x0表示调用的参数

libsystem_kernel.dylib`mach_msg_trap:
0x1b967855c <+0>: mov x16, #-0x1f
0x1b9678560 <+4>: svc #0x80
-> 0x1b9678564 <+8>: ret

    x0 = 0x000000016f5e7f70
    x1 = 0x0000000000000003
    x2 = 0x0000000000000028
    x3 = 0x0000000000000140
    x4 = 0x0000000000000603
    x5 = 0x0000000000000000
    x6 = 0x0000000000000000
    x7 = 0x0000000000000000
    x8 = 0x00000000fffffbbf
    x9 = 0x0000000000000044
   x10 = 0x000000016f5ebe53
   x11 = 0x00000001f28ca6dd  "ASL_DISABLE"
   x12 = 0x0000000000000053
   x13 = 0x0000000000000041
   x14 = 0x0000000000000005
   x15 = 0x000000000000000c
   x16 = 0xffffffffffffffe1
   x17 = 0x6ae100016f5e8450
   x18 = 0x0000000000000000
   x19 = 0x0000000000000000
   x20 = 0x0000000000000000
   x21 = 0x0000000000000603
   x22 = 0x0000000000000140
   x23 = 0x000000016f5e7f70
   x24 = 0x0000000000000003
   x25 = 0x0000000000000028
   x26 = 0x0000000000000003
   x27 = 0x00000002052ac000  __pthread_head
   x28 = 0x0000000100ad8580  dyld`_main_thread
    fp = 0x000000016f5e7f60
    lr = 0x00000001b9678bfc  libsystem_kernel.dylib`mach_msg + 76
    sp = 0x000000016f5e7f10
    pc = 0x00000001b9678560  libsystem_kernel.dylib`mach_msg_trap + 4
  cpsr = 0x80000000

https://github.com/apple/darwin-xnu/blob/main/osfmk/mach/syscall_sw.h
https://opensource.apple.com/source/xnu/xnu-1504.3.12/bsd/kern/syscalls.master
https://www.bilibili.com/read/cv9033324
https://opensource.apple.com/source/xnu/xnu-4570.1.46/osfmk/mach/i386/syscall_sw.h.auto.html