Index: docs/linux_system_calls.md |
diff --git a/docs/linux_system_calls.md b/docs/linux_system_calls.md |
index 17ada7e036b609700ce55c0281081b06b3cf7bab..2b9e8314a899edbd4346c8e7879cc2fefbc46e8c 100644 |
--- a/docs/linux_system_calls.md |
+++ b/docs/linux_system_calls.md |
@@ -30,11 +30,14 @@ telling the processor how many bytes kernel\_vsyscall has pushed onto the stack |
in it's prologue. For example, one of the symbol files looks somewhat like the |
following: |
-MODULE Linux x86 random\_debug\_id linux-gate.so PUBLIC 400 0 kernel\_vsyscall |
+``` |
+MODULE Linux x86 random_debug_id linux-gate.so |
+PUBLIC 400 0 kernel_vsyscall |
STACK WIN 4 100 1 1 0 0 0 0 0 1 |
+``` |
-The PUBLIC line indicates that kernel\_vsyscall is at offset 400 (in bytes) from |
-the beginning of linux-gate.so. The STACK line indicates the size of the |
+The `PUBLIC` line indicates that kernel\_vsyscall is at offset 400 (in bytes) |
+from the beginning of linux-gate.so. The `STACK` line indicates the size of the |
function(100), how many bytes it pushes(1), and how many bytes it pops(1). The |
last 1 indicates that EBP is pushed onto the stack before being used by the |
function. |