retnq

Near return, 64-bit

Pops a 64-bit near return address into rip and jumps there, then adds the optional imm16 to rsp.

x86-64 and later

Intel's reference: RET

CFPFAFZFSFDFOF –––––––
  • Changes no flag

Forms

  • retnq
  • retnq

Operands

imm16
An unsigned 16-bit byte count, 0 to 65535, added to the stack pointer after the return address is popped.

In 64-bit mode it pops an 8-byte return address from [rsp] into rip and advances rsp by 8. ret and retn are synonyms; the q suffix explicitly requests the 64-bit form.

The optional sole operand is an unsigned 16-bit count of additional bytes to remove from the stack after popping the return address. For example, ret 16 advances rsp by 24 in total. A negative spelling does not subtract stack space: encoded 0xffff means cleanup of 65535 bytes.

global _start

section .text
_start:
        mov rax, 12
        mov rbx, 5
        mov rcx, 3
        mov rsi, 9

        retnq 5

        mov rax, 60         ; syscall 60: exit
        xor rdi, rdi
        syscall