Syscall Search
Search by name, number, or parameter
Comprehensive Linux syscall reference for x86-64, ARM64, and ARM32 architectures. This syscall table provides assembly code examples for exploit development, reverse engineering, binary exploitation, and low-level programming. Perfect for security researchers, penetration testers, and CTF players working with IoT devices, embedded systems, and Linux kernel exploitation.
PARAMETERS
ASSEMBLY EXAMPLE
; read syscall (0)
mov rax, 0
mov rdi, value ; unsigned int fd
mov rsi, value ; char *buf
mov rdx, value ; size_t count
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; write syscall (1)
mov rax, 1
mov rdi, value ; unsigned int fd
mov rsi, [addr] ; const char *buf
mov rdx, value ; size_t count
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; open syscall (2)
mov rax, 2
mov rdi, [addr] ; const char *filename
mov rsi, value ; int flags
mov rdx, value ; umode_t mode
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; close syscall (3)
mov rax, 3
mov rdi, value ; unsigned int fd
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; stat syscall (4)
mov rax, 4
mov rdi, [addr] ; const char *filename
mov rsi, value ; struct stat *statbuf
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; fstat syscall (5)
mov rax, 5
mov rdi, value ; unsigned int fd
mov rsi, value ; struct stat *statbuf
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; lstat syscall (6)
mov rax, 6
mov rdi, [addr] ; const char *filename
mov rsi, value ; struct stat *statbuf
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; poll syscall (7)
mov rax, 7
mov rdi, value ; struct pollfd *ufds
mov rsi, value ; unsigned int nfds
mov rdx, value ; int timeout
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; lseek syscall (8)
mov rax, 8
mov rdi, value ; unsigned int fd
mov rsi, value ; off_t offset
mov rdx, value ; unsigned int whence
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; mmap syscall (9)
mov rax, 9
mov rdi, value ; unsigned long addr
mov rsi, value ; unsigned long len
mov rdx, value ; unsigned long prot
mov r10, value ; unsigned long flags
mov r8, value ; unsigned long fd
mov r9, value ; unsigned long pgoff
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; mprotect syscall (10)
mov rax, 10
mov rdi, value ; unsigned long start
mov rsi, value ; size_t len
mov rdx, value ; unsigned long prot
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; munmap syscall (11)
mov rax, 11
mov rdi, value ; unsigned long addr
mov rsi, value ; size_t len
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; brk syscall (12)
mov rax, 12
mov rdi, value ; unsigned long brk
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; rt_sigaction syscall (13)
mov rax, 13
mov rdi, value ; int sig
mov rsi, [addr] ; const struct sigaction *act
mov rdx, value ; struct sigaction *oact
mov r10, value ; size_t sigsetsize
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; rt_sigprocmask syscall (14)
mov rax, 14
mov rdi, value ; int how
mov rsi, value ; sigset_t *set
mov rdx, value ; sigset_t *oset
mov r10, value ; size_t sigsetsize
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; rt_sigreturn syscall (15)
mov rax, 15
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; ioctl syscall (16)
mov rax, 16
mov rdi, value ; unsigned int fd
mov rsi, value ; unsigned int cmd
mov rdx, value ; unsigned long arg
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; pread64 syscall (17)
mov rax, 17
mov rdi, value ; unsigned int fd
mov rsi, value ; char *buf
mov rdx, value ; size_t count
mov r10, value ; loff_t pos
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; pwrite64 syscall (18)
mov rax, 18
mov rdi, value ; unsigned int fd
mov rsi, [addr] ; const char *buf
mov rdx, value ; size_t count
mov r10, value ; loff_t pos
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; readv syscall (19)
mov rax, 19
mov rdi, value ; unsigned long fd
mov rsi, [addr] ; const struct iovec *vec
mov rdx, value ; unsigned long vlen
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; writev syscall (20)
mov rax, 20
mov rdi, value ; unsigned long fd
mov rsi, [addr] ; const struct iovec *vec
mov rdx, value ; unsigned long vlen
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; access syscall (21)
mov rax, 21
mov rdi, [addr] ; const char *filename
mov rsi, value ; int mode
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; pipe syscall (22)
mov rax, 22
mov rdi, value ; int *fildes
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; select syscall (23)
mov rax, 23
mov rdi, value ; int n
mov rsi, value ; fd_set *inp
mov rdx, value ; fd_set *outp
mov r10, value ; fd_set *exp
mov r8, value ; struct timeval *tvp
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; sched_yield syscall (24)
mov rax, 24
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; mremap syscall (25)
mov rax, 25
mov rdi, value ; unsigned long addr
mov rsi, value ; unsigned long old_len
mov rdx, value ; unsigned long new_len
mov r10, value ; unsigned long flags
mov r8, value ; unsigned long new_addr
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; msync syscall (26)
mov rax, 26
mov rdi, value ; unsigned long start
mov rsi, value ; size_t len
mov rdx, value ; int flags
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; mincore syscall (27)
mov rax, 27
mov rdi, value ; unsigned long start
mov rsi, value ; size_t len
mov rdx, value ; unsigned char *vec
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; madvise syscall (28)
mov rax, 28
mov rdi, value ; unsigned long start
mov rsi, value ; size_t len
mov rdx, value ; int behavior
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; dup syscall (32)
mov rax, 32
mov rdi, value ; unsigned int fildes
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; dup2 syscall (33)
mov rax, 33
mov rdi, value ; unsigned int oldfd
mov rsi, value ; unsigned int newfd
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; pause syscall (34)
mov rax, 34
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; nanosleep syscall (35)
mov rax, 35
mov rdi, value ; struct timespec *rqtp
mov rsi, value ; struct timespec *rmtp
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; alarm syscall (37)
mov rax, 37
mov rdi, value ; unsigned int seconds
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; getpid syscall (39)
mov rax, 39
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; socket syscall (41)
mov rax, 41
mov rdi, value ; int family
mov rsi, value ; int type
mov rdx, value ; int protocol
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; connect syscall (42)
mov rax, 42
mov rdi, value ; int fd
mov rsi, value ; struct sockaddr *uservaddr
mov rdx, value ; int addrlen
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; accept syscall (43)
mov rax, 43
mov rdi, value ; int fd
mov rsi, value ; struct sockaddr *upeer_sockaddr
mov rdx, value ; int *upeer_addrlen
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; sendto syscall (44)
mov rax, 44
mov rdi, value ; int fd
mov rsi, value ; void *buff
mov rdx, value ; size_t len
mov r10, value ; unsigned flags
mov r8, value ; struct sockaddr *addr
mov r9, value ; int addr_len
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; recvfrom syscall (45)
mov rax, 45
mov rdi, value ; int fd
mov rsi, value ; void *ubuf
mov rdx, value ; size_t size
mov r10, value ; unsigned flags
mov r8, value ; struct sockaddr *addr
mov r9, value ; int *addr_len
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; sendmsg syscall (46)
mov rax, 46
mov rdi, value ; int fd
mov rsi, value ; struct msghdr *msg
mov rdx, value ; unsigned flags
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; recvmsg syscall (47)
mov rax, 47
mov rdi, value ; int fd
mov rsi, value ; struct msghdr *msg
mov rdx, value ; unsigned int flags
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; bind syscall (49)
mov rax, 49
mov rdi, value ; int fd
mov rsi, value ; struct sockaddr *umyaddr
mov rdx, value ; int addrlen
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; listen syscall (50)
mov rax, 50
mov rdi, value ; int fd
mov rsi, value ; int backlog
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; setsockopt syscall (54)
mov rax, 54
mov rdi, value ; int fd
mov rsi, value ; int level
mov rdx, value ; int optname
mov r10, value ; char *optval
mov r8, value ; int optlen
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; getsockopt syscall (55)
mov rax, 55
mov rdi, value ; int fd
mov rsi, value ; int level
mov rdx, value ; int optname
mov r10, value ; char *optval
mov r8, value ; int *optlen
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; clone syscall (56)
mov rax, 56
mov rdi, value ; unsigned long clone_flags
mov rsi, value ; unsigned long newsp
mov rdx, value ; int *parent_tidptr
mov r10, value ; unsigned long tls
mov r8, value ; int *child_tidptr
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; fork syscall (57)
mov rax, 57
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; vfork syscall (58)
mov rax, 58
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; execve syscall (59)
mov rax, 59
mov rdi, [addr] ; const char *filename
mov rsi, [addr] ; const char *const *argv
mov rdx, [addr] ; const char *const *envp
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; exit syscall (60)
mov rax, 60
mov rdi, value ; int error_code
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; wait4 syscall (61)
mov rax, 61
mov rdi, value ; pid_t upid
mov rsi, value ; int *stat_addr
mov rdx, value ; int options
mov r10, value ; struct rusage *ru
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; kill syscall (62)
mov rax, 62
mov rdi, value ; pid_t pid
mov rsi, value ; int sig
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; uname syscall (63)
mov rax, 63
mov rdi, value ; struct old_utsname *name
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; getdents syscall (78)
mov rax, 78
mov rdi, value ; unsigned int fd
mov rsi, value ; struct linux_dirent *dirent
mov rdx, value ; unsigned int count
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; getcwd syscall (79)
mov rax, 79
mov rdi, value ; char *buf
mov rsi, value ; unsigned long size
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; chdir syscall (80)
mov rax, 80
mov rdi, [addr] ; const char *filename
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; rename syscall (82)
mov rax, 82
mov rdi, [addr] ; const char *oldname
mov rsi, [addr] ; const char *newname
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; mkdir syscall (83)
mov rax, 83
mov rdi, [addr] ; const char *pathname
mov rsi, value ; umode_t mode
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; rmdir syscall (84)
mov rax, 84
mov rdi, [addr] ; const char *pathname
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; creat syscall (85)
mov rax, 85
mov rdi, [addr] ; const char *pathname
mov rsi, value ; umode_t mode
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; link syscall (86)
mov rax, 86
mov rdi, [addr] ; const char *oldname
mov rsi, [addr] ; const char *newname
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; unlink syscall (87)
mov rax, 87
mov rdi, [addr] ; const char *pathname
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; symlink syscall (88)
mov rax, 88
mov rdi, [addr] ; const char *oldname
mov rsi, [addr] ; const char *newname
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; readlink syscall (89)
mov rax, 89
mov rdi, [addr] ; const char *path
mov rsi, value ; char *buf
mov rdx, value ; int bufsiz
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; chmod syscall (90)
mov rax, 90
mov rdi, [addr] ; const char *filename
mov rsi, value ; umode_t mode
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; getuid syscall (102)
mov rax, 102
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; getgid syscall (104)
mov rax, 104
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; setuid syscall (105)
mov rax, 105
mov rdi, value ; uid_t uid
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; setgid syscall (106)
mov rax, 106
mov rdi, value ; gid_t gid
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; geteuid syscall (107)
mov rax, 107
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; getegid syscall (108)
mov rax, 108
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; getdents64 syscall (217)
mov rax, 217
mov rdi, value ; unsigned int fd
mov rsi, value ; struct linux_dirent64 *dirent
mov rdx, value ; unsigned int count
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; exit_group syscall (231)
mov rax, 231
mov rdi, value ; int error_code
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; openat syscall (257)
mov rax, 257
mov rdi, value ; int dfd
mov rsi, [addr] ; const char *filename
mov rdx, value ; int flags
mov r10, value ; umode_t mode
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; newfstatat syscall (262)
mov rax, 262
mov rdi, value ; int dfd
mov rsi, [addr] ; const char *filename
mov rdx, value ; struct stat *statbuf
mov r10, value ; int flag
syscall
; Return value in raxPARAMETERS
ASSEMBLY EXAMPLE
; getrandom syscall (318)
mov rax, 318
mov rdi, value ; char *buf
mov rsi, value ; size_t count
mov rdx, value ; unsigned int flags
syscall
; Return value in raxAbout Linux System Calls
System calls (syscalls) are the fundamental interface between user-space applications and the Linux kernel. Understanding syscalls is essential for low-level programming, shellcode development, return-oriented programming (ROP), and exploiting vulnerabilities in Linux systems across different architectures including x86-64, ARM64 (aarch64), and ARM32 (EABI).
Each architecture uses different registers for syscall arguments: x86-64 uses rax/rdi/rsi/rdx/r10/r8/r9, ARM64 uses x8/x0-x5, and ARM32 uses r7/r0-r6. This reference includes accurate syscall numbers and parameter mappings verified against official Linux kernel sources, making it reliable for security research, exploit development, and reverse engineering tasks.
Use this syscall reference for building exploits, understanding binary behavior, writing shellcode, analyzing malware, CTF competitions, penetration testing, and learning low-level Linux internals. All syscall data is sourced from the latest Linux kernel syscall tables to ensure accuracy for modern exploitation techniques.