iretd
Interrupt return, 32-bit
Returns from an interrupt by popping eip, cs and eflags as 4-byte values, and in 64-bit mode esp and ss as well.
386 and later
CFPFAFZFSFTFIFDFOF ●●●●●●●●●
- ● set from the result
- CF Loaded from the stack.
- PF Loaded from the stack.
- AF Loaded from the stack.
- ZF Loaded from the stack.
- SF Loaded from the stack.
- TF Loaded from the stack.
- IF Loaded from the stack only with the privilege to change it, which a Linux program lacks.
- DF Loaded from the stack.
- OF Loaded from the stack.
Forms
iretd
In 64-bit mode it also pops esp and ss, 20 bytes in all, and loads only 32-bit eip and esp, so a 64-bit handler returns with iretq instead.
global _start
section .text
_start:
mov rax, 12
mov rbx, 5
mov rcx, 3
mov rsi, 9
iretd
mov rax, 60 ; syscall 60: exit
xor rdi, rdi
syscall