execve on score

execute program

sys_execve(const char *filename, const char *const *argv, const char *const *envp)
number221 (0xdd)
abicommon
entry pointsys_execve
sinceLinux 3.7 or earlier (3.7 is the first release scanned for score)
man pageexecve(2)
sourceelixir.bootlin.com

Registers

registervalue
r27221, the syscall number
r4const char *filename
r5const char *const *argv
r6const char *const *envp
r4the return value

Then run syscall to enter the kernel.

r7 is the error flag and r4 then holds the positive error number.

This architecture was removed from the Linux kernel in Linux 4.17. The newest release with a syscall table here is Linux 4.16. The other removed architectures live on the historical architectures page.

Same syscall on other architectures

Get this as JSON: https://api.syscall.sh/v2/syscalls/score/execve?kernel=all