{"action":"closed","issue":{"url":"https://api.github.com/repos/eteran/edb-debugger/issues/209","labels_url":"https://api.github.com/repos/eteran/edb-debugger/issues/209/labels{/name}","comments_url":"https://api.github.com/repos/eteran/edb-debugger/issues/209/comments","events_url":"https://api.github.com/repos/eteran/edb-debugger/issues/209/events","html_url":"https://github.com/eteran/edb-debugger/issues/209","id":103696208,"number":209,"title":"SYSENTER-powered system calls are not analyzed","user":{"login":"10110111","id":6376882,"avatar_url":"https://avatars.githubusercontent.com/u/6376882?v=3","gravatar_id":"","url":"https://api.github.com/users/10110111","html_url":"https://github.com/10110111","followers_url":"https://api.github.com/users/10110111/followers","following_url":"https://api.github.com/users/10110111/following{/other_user}","gists_url":"https://api.github.com/users/10110111/gists{/gist_id}","starred_url":"https://api.github.com/users/10110111/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/10110111/subscriptions","organizations_url":"https://api.github.com/users/10110111/orgs","repos_url":"https://api.github.com/users/10110111/repos","events_url":"https://api.github.com/users/10110111/events{/privacy}","received_events_url":"https://api.github.com/users/10110111/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/eteran/edb-debugger/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-08-28T10:44:43Z","updated_at":"2015-08-29T03:11:36Z","closed_at":"2015-08-29T03:11:36Z","body":"While `int 0x80` syscalls are analyzed normally, i586 Linux 2.6.? systems also support `sysenter`-powered ones, which are not analyzed by EDB at all. Here's a test app (use fasm to compile):\r\n\r\n````\r\nformat ELF executable\r\nsegment readable executable\r\n    mov edx, msgLen\r\n    mov ecx, msg\r\n    mov ebx, 1 ; stdout\r\n    mov eax, 4 ; sys_write\r\n\r\n    ; sysenter support\r\n    push sysenterRet ; return EIP\r\n    push ecx         ; these three are popped by the point where sysexit lands\r\n    push edx\r\n    push ebp\r\n    mov ebp,esp      ; apparently, esp is written to from ebp before/by sysexit\r\n    sysenter\r\n    int3\r\nsysenterRet:\r\n    nop\r\n    mov eax, 1 ; sys_exit\r\n    mov ebx,183 ; exit code\r\n\r\n    ; Why is ebp==esp needed for exit?!\r\n    ; Anyway, this seems to be the only thing needed to satisfy the kernel\r\n    mov ebp,esp\r\n    sysenter\r\n    int3\r\nmsg:\r\n    db \"Hello with sysenter!\",10\r\nmsgLen = $-msg\r\n````"}}