syscall.sh / x86 / memfd_secret

memfd_secret

create an anonymous RAM-based file to access secret memory regions

sys_memfd_secret(unsigned int flags)

number	447 (0x1bf)
abi	i386
entry point	`sys_memfd_secret`
since	Linux 5.14
man page	memfd_secret(2)
source	elixir.bootlin.com

Registers

register	value
`eax`	447, the syscall number
`ebx`	unsigned int flags
`eax`	the return value

Then run int 0x80 to enter the kernel.

Same syscall on other architectures

x64 447
arm64 447
riscv64 447
x32 1073742271
loongarch64 447
s390x 447

Get this as JSON: https://api.syscall.sh/v2/syscalls/x86/memfd_secret