See objects.txt for info about the object model in the kernel. Syscalls are called with int64. == Calls to objects When eax != 0, the value of eax is the ID of an object in the process's handle list. In that case, ebx is the number of the method to be called, and ecx, edx, esi, edi are the parameters. == Calls to other stuff When int64 is called with eax = 0, it's identified as a normal syscall from the following list: The identifier of the called function is in ebx, parameters are in ecx, edx, esi, edi. Syscall list : id=ebx Name Parameters Description 1 thread_exit none Signal kernel that current thread has finished 2 schedule none Switch to next thread (might be the current one) 3 thread_sleep ecx: time (int) msecs Tell kernel to put current thread to sleep 4 process_exit ecx: return value (int) Tell kernel to end current process, cleaning up everything 5 printk ecx: addr of a string Print a message to screen 6 thread_new ecx: entry point Creates a new thread edx: data pointer esi: stack pointer 7 irq_wait ecx: irq number Waits for an IRQ (requires privilege PL_DRIVER) 8 proc_priv none Returns current process privilege level 9 sbrk ecx: size Allocates some memory 10 brk ecx: new_end Allocates/frees some memory 11 mmap (see linux specs) NOT IMPLEMENTED 12 munmap (see linux specs) NOT IMPLEMENTED 13 ... UNUSED (yet) 19 20 open ecx: ptr to path str Looks for an object in the hierarchy, returns a handle 21 open_relative ecx: ptr to path str Looks for an object using a given root object edx: base object handle 22 close ecx: object handle Close handle to an object 23 get_methods ecx: ptr to iface name Gets the numbers of the methods in an interface str edx: ptr to where to store If a processes wishes to exit with an error code, it HAS to use process_exit. thread_exit will do nothing.