liminfoSystem Call Reference
Free reference guide: System Call Reference
About System Call Reference
The Linux System Call Reference is a searchable cheat sheet covering essential Linux kernel system calls with their x86 (32-bit) and x64 (64-bit) syscall numbers, function signatures, and practical C code examples. It organizes system calls into six categories: File I/O (open, read, write, close, stat, lseek), Process management (fork, execve, exit, wait4, getpid), Memory (mmap, munmap, mprotect, brk), Network sockets (socket, connect, bind, listen, accept, sendto, recvfrom), Signals (kill, rt_sigaction, alarm), and IPC (pipe, shared memory, dup2).
This reference is designed for systems programmers, kernel developers, CTF competitors, exploit developers, and computer science students studying operating systems. Each entry shows the exact syscall number for both x86 and x64 architectures, making it invaluable for assembly-level programming and reverse engineering.
All content loads instantly in your browser with zero server dependencies. The interface supports keyword search, category filtering, dark mode, and responsive layouts for comfortable reading on any device.
Key Features
- Complete x86 (eax) and x64 (rax) syscall numbers for each system call
- Practical C code examples showing correct function signatures and usage patterns
- File I/O syscalls: open, read, write, close, stat, lseek with flag constants
- Process management: fork, execve, exit, wait4 with child process handling examples
- Memory management: mmap, munmap, mprotect, brk with protection flag combinations
- Network socket programming: TCP client/server setup with socket, bind, listen, accept
- Signal handling: kill, rt_sigaction, alarm with handler registration patterns
- IPC mechanisms: pipe, shared memory (shmget/shmat), and file descriptor duplication (dup2)
Frequently Asked Questions
What system calls are included in this reference?
The reference covers 24 essential Linux system calls organized into six categories: File (open, read, write, close, stat, lseek), Process (fork, execve, exit, wait4, getpid/getppid), Memory (mmap, munmap, mprotect, brk), Network (socket, connect, bind, listen/accept, sendto/recvfrom), Signal (kill, rt_sigaction, alarm), and IPC (pipe, shmget/shmat, dup2).
Does this reference include both 32-bit and 64-bit syscall numbers?
Yes. Each entry lists the x86 32-bit syscall number (passed via eax register) and the x64 64-bit syscall number (passed via rax register). For example, write is eax=4 on x86 and rax=1 on x64. This is essential for assembly programming and exploit development.
How can I use this reference for exploit development or CTF challenges?
The reference provides the exact syscall numbers and argument conventions needed for writing shellcode. Key entries like execve (rax=59), dup2 for file descriptor redirection, mprotect for marking memory executable, and socket/connect for reverse shells give you the building blocks for common exploitation techniques.
What network programming syscalls are covered?
The Network category covers the complete TCP client/server workflow: socket creation (AF_INET, SOCK_STREAM), connect with sockaddr_in setup, bind to a port, listen with backlog, accept for incoming connections, and sendto/recvfrom for UDP communication. Each includes full C code and the x64 syscall number.
How is the memory management section useful?
The Memory section covers mmap for anonymous and file-backed memory mapping with protection flags (PROT_READ, PROT_WRITE, PROT_EXEC), munmap for cleanup, mprotect for changing page permissions at runtime (critical for JIT and shellcode execution), and brk/sbrk for heap management.
Can I search for a specific syscall by name or number?
Yes. Use the search bar to type any syscall name (like "fork" or "mmap") or even a syscall number. The reference filters results in real time. You can also browse by category to explore all syscalls in a specific domain like File or Network.
Is this reference suitable for university operating systems courses?
Absolutely. The reference covers the core system calls taught in OS courses including process creation with fork/execve, file descriptor management, memory mapping, inter-process communication with pipes and shared memory, and signal handling. The C code examples are classroom-ready.
Are the code examples complete and compilable?
The examples show the essential function calls with correct argument types and return value handling. They are designed as concise, copy-ready snippets that demonstrate the syscall interface. You may need to add standard headers (unistd.h, sys/socket.h, etc.) and a main function for a complete compilable program.