IRET Clarification

[Nessphoro]

I just want to clarify something.

When IRET returns it pops EIP , and all the general purpose registers off the stack? So if I change the EIP and some other stuff - I should technically "return" to the different place and start executing from there?

[jnc100]

IRET pops EIP, CS and EFLAGS from the stack in protected mode. In other modes it pops these +/- extra stuff e.g. SS and the other segment selectors (see the Intel docs). It never pops all the general purpose registers (you have to save and restore them yourself within the interrupt handler). The ability to change the EIP value stored on the stack prior to IRET is one of the most important parts in most x86 task switchers.

Regards,
John.

[bluemoon]

The behavior of IRET is well documented on the manual:

Code: Select all

PROTECTED-MODE:
IF OperandSize 32 THEN
    IF top 12 bytes of stack not within stack limits THEN
        #SS(0);
    FI;
    tempEIP <- Pop();
    tempCS <- Pop();
    tempEFLAGS <- Pop();

Which part confused you?

[Nessphoro]

Alright thanks