Home/ Questions/Q 8322219
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-08T23:18:35+00:00

I want to simulate a iret condition on a Linux x86_64 server. I found

  • 0

I want to simulate a iret condition on a Linux x86_64 server.
I found there are three instructions

  1. iret:operand size 16
  2. iretd:operand size 32
  3. iretq:operand size 64

I can’t tell the difference of them,and which one to use.
thanks for anyone’s help!!

I have another question about simulate iret,can you have a look?http://stackoverflow.com/questions/11756274/how-to-simulate-a-iret-on-linux-x86-64

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    From this link:

    IRET returns from an interrupt (hardware or software) by means of
    popping IP (or EIP), CS, and the flags off the stack and then
    continuing execution from the new CS:IP.

    IRETW pops IP, CS and the flags as 2 bytes each, taking 6 bytes off
    the stack in total. IRETD pops EIP as 4 bytes, pops a further 4 bytes
    of which the top two are discarded and the bottom two go into CS, and
    pops the flags as 4 bytes as well, taking 12 bytes off the stack.

    IRET is a shorthand for either IRETW or IRETD, depending on the
    default BITS setting at the time.

    Very similar is also for IRETQ

    • 0