Linux. create thread in assembler

Question

ASM code

 PROT_READ          equ     1
 PROT_WRITE         equ     2
 PROT_EXEC          equ     4
 PROT_NONE          equ     0

 MAP_SHARED         equ     1
 MAP_PRIVATE        equ     2
 MAP_FIXED          equ     10h
 MAP_TYPE           equ     0Fh
 MAP_FILE           equ     0
 MAP_ANON           equ     20h
 MAP_ANONYMOUS      equ     MAP_ANON
 MAP_32BIT          equ     40h
 MAP_NORESERVE      equ     4000h
 MAP_GROWSDOWN      equ     0100h
 MAP_DENYWRITE      equ     0800h
 MAP_EXECUTABLE     equ     1000h
 MAP_LOCKED         equ     2000h
 MAP_POPULATE       equ     8000h
 MAP_NONBLOCK       equ     10000h
 MAP_STACK          equ     20000h
 MAP_HUGETLB        equ     40000h

 CLONE_VM               equ     00000100h
 CLONE_FS               equ     00000200h
 CLONE_FILES            equ     00000400h
 CLONE_SIGHAND          equ     00000800h
 CLONE_PTRACE           equ     00002000h
 CLONE_VFORK            equ     00004000h
 CLONE_PARENT           equ     00008000h
 CLONE_THREAD           equ     00010000h
 CLONE_NEWNS            equ     00020000h
 CLONE_SYSVSEM          equ     00040000h
 CLONE_SETTLS           equ     00080000h
 CLONE_PARENT_SETTID    equ     00100000h
 CLONE_CHILD_CLEARTID   equ     00200000h
 CLONE_DETACHED         equ     00400000h
 CLONE_UNTRACED         equ     00800000h
 CLONE_CHILD_SETTID     equ     01000000h
 CLONE_NEWUTS           equ     04000000h
 CLONE_NEWIPC           equ     08000000h
 CLONE_NEWUSER          equ     10000000h
 CLONE_NEWPID           equ     20000000h
 CLONE_NEWNET           equ     40000000h
 CLONE_IO               equ     80000000h
 SIGCHLD                equ     17

 stdout             equ     1

 STACK_SIZE         equ     1024 * 200

 .data

     msg0               db 10, "thread created", 10

 .code

 _start:

main proc

         mov rdi, 0
         mov rsi, 4095
         mov rdx, PROT_WRITE or PROT_READ
         mov r10, MAP_ANONYMOUS or MAP_PRIVATE or MAP_GROWSDOWN
         mov r8, -1
         mov r9, 0

         mov rax, 9 ; mmap
         syscall

         lea rdi, [thread]
         lea rsi, [rax + STACK_SIZE - 8]
         mov rdx, SIGCHLD or CLONE_FS or CLONE_FILES or CLONE_SIGHAND or CLONE_VM
         mov r10, 0

         mov rax, 56 ; clone
         syscall

         jmp $

main endp

thread proc

         mov rdi, stdout
         mov rsi, offset msg0
         mov rdx, sizeof msg0

         mov rax, 1 ; SYS_WRITE
         syscall

     mov rax, 0
     ret

thread endp

end

Its not working return oxffffffffffffffea after call clone

I'm a bit confused here. How are you assembling this? What assembler?JWASM? You should be able to use `strace` to view the system calls, their parameters, and return value. — Michael Petch, Jul 19 '18 at 03:35
SYS_clone acts more like `fork`. It seems your arguments are out of order as well. The [clone docs](http://man7.org/linux/man-pages/man2/clone.2.html) say for x86-64 that it is `clone(unsigned long flags, void *child_stack, int *ptid, int *ctid, unsigned long newtls);` you seem to have RDI and RSI reversed. I think part of the problem here may be a misconception that the raw system call SYS_clone works like the LIBC `clone` function. They don't work the same. I suggest looking at the clone docs link I provided earlier in this comment.. — Michael Petch, Jul 19 '18 at 04:20
okay. i understand now. but this new prototype have no arg for void addr for thread entrypoint. — h goe, Jul 19 '18 at 04:49
*no arg for void addr for thread entrypoint.* That's because it works like `fork()`: it returns twice, once in the parent and once in the new thread. Check the return value and jump wherever you want in the new thread. Or look at the asm for glibc's `pthread` create function. — Peter Cordes, Jul 19 '18 at 04:52
I have placed some code on my server. It is based on what you had that may work for you: http://www.capp-sysware.com/misc/stackoverflow/51413851/thread_func.asm . I have done no code cleanup, but is proof of concept. I created a create_thread function that takes a thread function pointer and the child stack pointer and uses a bit of a stack trick with the child to call the thread function. — Michael Petch, Jul 19 '18 at 05:09
@hgoe: I didn't say to call it from *your* asm, I said to disassemble the function in `libc.so.6` to see how glibc does it. (Or look at the glibc source.) Once you see how it works, you can write your own code instead of calling it. — Peter Cordes, Jul 19 '18 at 05:25
Regarding your followup question about exiting the child process, here is a slightly different variant of my previous answer: http://www.capp-sysware.com/misc/stackoverflow/51413851/thread_func_3.asm — Michael Petch, Aug 22 '18 at 01:46

Linux. create thread in assembler

0 Answers0