Last year (2024), someone modified the syscalls2 plugin to swap the profile if a 32-bit system call was encountered in a linux x86_64 guest. Problem is, the implementation assumes the guest is Intel (which insists sysenter and "int 0x80" are for 32-bit system calls, and syscall is only for 64-bit calls). If you have an amd64 linux guest, then syscall is also used for 32-bit calls (see pg. 474 of https://docs.amd.com/v/u/en-US/40332-PUB_4.08).
I can see in my example recording of a 32-bit binary from a guest running debian64 on amd64 that sys_read is executed via system call 3 and the syscall instruction (which indeed is sys_read in 32-bit x86 linux), but syscalls2 identifies it as sys_close (which is what system call 3 is in 64-bit linux). The 32-bit binary works just fine - it does what it is supposed to do - it's just that the syscalls2 plugin doesn't properly recognize what it is doing.
Is there some reason why Intel was chosen for the implementation of executing 32-bit binaries on a 64-bit linux guest and AMD64 was ignored?
Are there any plans to add the ability to process AMD64 properly?
Last year (2024), someone modified the syscalls2 plugin to swap the profile if a 32-bit system call was encountered in a linux x86_64 guest. Problem is, the implementation assumes the guest is Intel (which insists sysenter and "int 0x80" are for 32-bit system calls, and syscall is only for 64-bit calls). If you have an amd64 linux guest, then syscall is also used for 32-bit calls (see pg. 474 of https://docs.amd.com/v/u/en-US/40332-PUB_4.08).
I can see in my example recording of a 32-bit binary from a guest running debian64 on amd64 that sys_read is executed via system call 3 and the syscall instruction (which indeed is sys_read in 32-bit x86 linux), but syscalls2 identifies it as sys_close (which is what system call 3 is in 64-bit linux). The 32-bit binary works just fine - it does what it is supposed to do - it's just that the syscalls2 plugin doesn't properly recognize what it is doing.
Is there some reason why Intel was chosen for the implementation of executing 32-bit binaries on a 64-bit linux guest and AMD64 was ignored?
Are there any plans to add the ability to process AMD64 properly?