What is the default register state when program launches (asm, linux)?

by

This depends entirely on the ABI for each platform. Since you mention eax and ebx let’s see what’s the case for x86 (as of Linux v5.17.5). In fs/binfmt_elf.c, inside load_elf_binary(), the kernel checks if the ABI specifies any requirements for register values at program loading:

/*
 * The ABI may specify that certain registers be set up in special
 * ways (on i386 %edx is the address of a DT_FINI function, for
 * example.  In addition, it may also specify (eg, PowerPC64 ELF)
 * that the e_entry field is the address of the function descriptor
 * for the startup routine, rather than the address of the startup
 * routine itself.  This macro performs whatever initialization to
 * the regs structure is required as well as any relocations to the
 * function descriptor entries when executing dynamically links apps.
 */

It then calls ELF_PLAT_INIT, which is a macro defined for each architecture in arch/xxx/include/elf.h. For x86, it does the following:

#define ELF_PLAT_INIT(_r, load_addr)        \
    do {                                    \
        _r->bx = 0; _r->cx = 0; _r->dx = 0; \
        _r->si = 0; _r->di = 0; _r->bp = 0; \
        _r->ax = 0;                         \
    } while (0)

So, when your statically-linked ELF binary is loaded on Linux x86, you could count on all register values being equal to zero. Doesn’t mean you should, though. 🙂

Dynamic linking

Note that executing a dynamically linked binary actually runs dynamic linker code in your process before execution reaches your _start (ELF entry point). This can and does leave garbage in registers, as allowed by the ABI. Except of course for the stack pointer ESP/RSP and atexit hook EDX/RDX.

More Related Contents:

  1. What are the calling conventions for UNIX & Linux system calls (and user-space functions) on i386 and x86-64
  2. Assembling 32-bit binaries on a 64-bit system (GNU toolchain)
  3. Where is the x86-64 System V ABI documented?
  4. What registers are preserved through a linux x86-64 function call
  5. Nasm segmentation fault on RET in _start
  6. How to print a number in assembly NASM?
  7. How are the fs/gs registers used in Linux AMD64?
  8. What is better “int 0x80” or “syscall” in 32-bit code on Linux?
  9. Hello, world in assembly language with Linux system calls?
  10. Minimal executable size now 10x larger after linking than 2 years ago, for tiny programs?
  11. Assembly compiled executable using INT 0x80 on Ubuntu on Windows Subsystem for Linux doesn’t produce output
  12. How do I disassemble raw 16-bit x86 machine code?
  13. How to print a character in Linux x86 NASM?
  14. Using gdb to single-step assembly code outside specified executable causes error “cannot find bounds of current function”
  15. Why can’t I mmap(MAP_FIXED) the highest virtual page in a 32-bit Linux process on a 64-bit kernel?
  16. Assembly segmentation fault after making a system call, at the end of my code
  17. How to calculate time for an asm delay loop on x86 linux?
  18. Trying to understand gcc’s complicated stack-alignment at the top of main that copies the return address
  19. Running 32 bit assembly code on a 64 bit Linux & 64 bit Processor : Explain the anomaly
  20. Responsibility of stack alignment in 32-bit x86 assembly
  21. Write system call won’t print characters from a register
  22. Why do x86-64 Linux system calls modify RCX, and what does the value mean?
  23. Calling printf in x86_64 using GNU assembler
  24. Linux default behavior of executable .data section changed between 5.4 and 5.9?
  25. What parts of this HelloWorld assembly code are essential if I were to write the program in assembly?
  26. Why do virtual memory addresses for linux binaries start at 0x8048000?
  27. What is the purpose of segment registers in x86 protected mode?
  28. What’s the best way to remember the x86-64 System V arg register order?
  29. Linux x64: why does r10 come before r8 and r9 in syscalls?
  30. How to know if a register is a “general purpose register”?

Leave a Comment