title: Why do x86-64 Linux system calls modify RCX, and what does the value mean?
body: <p>I'm trying to allocate some memory in linux with <code>sys_brk</code> syscall. Here is what I tried:</p>
  
  <pre><code>BYTES_TO_ALLOCATE equ 0x08
  
  section .text
      global _start
  
  _start:
      mov rax, 12
      mov rdi, BYTES_TO_ALLOCATE
      syscall
  
      mov rax, 60
      syscall
  </code></pre>
  
  <p>The thing is as per linux calling convention I expected the return value to be in <code>rax</code> register (pointer to the allocated memory). I ran this in gdb and after making <code>sys_brk</code> syscall I noticed the following register contents</p>
  
  <p>Before syscall</p>
  
  <pre><code>rax            0xc      12
  rbx            0x0      0
  rcx            0x0      0
  rdx            0x0      0
  rsi            0x0      0
  rdi            0x8      8
  </code></pre>
  
  <p>After syscall</p>
  
  <pre><code>rax            0x401000 4198400
  rbx            0x0      0
  rcx            0x40008c 4194444 ; &lt;---- What does this value mean?
  rdx            0x0      0
  rsi            0x0      0
  rdi            0x8      8
  </code></pre>
  
  <p>I do not quite understand the value in the <code>rcx</code> register in this case. Which one to use as a pointer to the beginning of 8 bytes I allocated with <code>sys_brk</code>?</p>