DEV Community: Unknown Rori

Crafting Cross-platform Memory Allocator in C

Unknown Rori — Mon, 04 Aug 2025 12:39:47 +0000

Have you ever wondered on how memory allocation work in most programming languages? Most of the time we do not care about how memory are being handled because we take these feature for granted.

So today in this article we are going to discuss on how memory allocation work by requesting to our operating system, and by doing that we also going to make this allocator work cross-platform.

Table of Content

Interlude
Getting Started
Windows Memory Allocation
Linux Memory Allocation
Malloc and Free
Finishing Thought

Interlude

First off we should install our tools for windows you can install Visual Studio or Msys2, in Linux feel free to use gcc or clang.

So what is allocator?

Allocator is a mechanism that manage and distribute memory to a program, but... why do we need it?

Our program might uses memory more than we original asked for, for example our array might need to be resized, and it's not so efficient if we request memory from OS every time we need.

Why bother on creating this thing?

There are some cases when we are limited on memory space on the hardware or we are on our own without help of standard library, or we love learning stuff.

Getting Started

Okay, so far so good now, let's start creating our project, let's call it blog_malloc, but before that let's create a abstraction or should I say helper function that return a requested memory from operating system.

First off, we should create file called blog_memory.h we are going to use concept called stb, why we should do this? because it's much simpler than handling complex dependency if we can just include single header file right?

Let's start by setting up classic macro so we didn't accidentally redefine it when we import it on our project along with macro for default implementation.

#ifndef     BLOG_MEMORY_H
#define     BLOG_MEMORY_H

#ifdef BLOG_MEMORY_IMPLEMENTATION
// our implementation detail
#endif

#endif      // BLOG_MEMORY_H

Our ifndef is compile time macro that everything inside it will exist if BLOG_MEMORY_H not defined, but when we define it, it will not include it again, and then we got ifdef this macro is the same as ifndef but in reverse if the BLOG_MEMORY_IMPLEMENTATION is defined then everything inside of it till #endif will exist.

'Kay now we need to define struct that will hold our memory page and chunk, but what is page and chunk?

There is quite loose definition for Chunk but Chunk is just data either in the disk or RAM or the thing we are processing, and for Page is block of memory in RAM that usually be aligned within 4 Kib and it handled by the operating system.

But why do we need to align it?

We need these alignment because our OS or should I say our hardware always read on these increment (4 - 8 bytes based on architecture), so if we miss align our memory our hardware require 2 read access to our memory which can be slow, and some hardware expect aligned data as well such as 128 bit operation.

All right time to write our abstraction, firstly we need our malloc and free function definition, we can just copy from stdlib pretty straight forward.

// stuff

#include <stddef.h>

void* blog_malloc(size_t size);
void blog_free(void* ptr);

#ifdef BLOG_MEMORY_IMPLEMENTATION
// our implementation detail
#endif // BLOG_MEMORY_IMPLEMENTATION

// stuff

Good, now we need a way for us to know what the state of memory we requested since we are the one who manage it of course.

So before we start how, should we layout our memory on the heap, we can use the concept of the Page as our bookshelf and our Chunk as our book. since we need to know the state of our book, like is it being borrowed or how big our bookshelf is.

With this layout we can define a struct that act like a header for our memory page or chunk, let's put it inside our implementation.

// stuff
typedef struct blog_memory_chunk {
    size_t  capacity;
    char    flags;

    struct blog_memory_chunk* next;
} BlogMemoryChunk;

typedef struct blog_memory_page {
    size_t  capacity;

    struct blog_memory_page* next;
    BlogMemoryChunk*         child;
} BlogMemoryPage;
// stuff

As you might notice that our memory chunk has flags which will we use to check if the chunk is in use or not, these struct will act like header for our memory and for next and child we are going to use it to help handle multiple instance of BlogMemoryPage or BlogMemoryChunk.

We should also put a constants for our in use flag.

#define BLOCK_USE               0b10000000

The concept we are going to use is Linked List because since we are going to have many of our BlogMemoryChunk and BlogMemoryPage we can't store it as an array because we don't know the exact size, but with Linked List we can use pointer to point the next BlogMemoryChunk or BlogMemoryPage that's why we need child and next inside our struct, let me visualize it.

As you can see our ptr will point to next data until the ptr is NULL which we can confidently say that our list is finished, this approach is simpler but if you are cool guy who worried about performance the big O notation of this algorithm is O(n).

Right, next stop is we need function that abstract our call to OS for new memory and put it inside our implementation, let's call it blog_request_memory_page and blog_free_memory_page for freeing the memory.

// stuff

#ifdef BLOG_MEMORY_IMPLEMENTATION

BlogMemoryPage* blog_request_memory_page(size_t capacity)
{
    // TODO: Implementation
}

void blog_free_memory_page(BlogMemoryPage* ptr)
{
    // TODO: Implementation
}


#endif // BLOG_MEMORY_IMPLEMENTATION


// stuff

We also accepting capacity but we will need to align later, let's create a macro that handle these memory alignment and put it above our memory header struct.

#define ALIGN(x, align) (((x) + ((align) - 1)) & ~((align) - 1))

These simple macro will help us to align given x with size of alignment, so if we put x is 4 and our alignment is 64, these macro will return 64 because 4 is below 64, and these alignment only work properly in the power of 2.

So now, how do we make this function to be able to operate different operating system seamlessly? that's right we can use macro for it, we can check the macro that identify OS in this awesome resource.

// stuff
BlogMemoryPage* blog_request_memory_page(size_t capacity)
{
#if defined(_WIN32) || defined(_WIN64)
    // TODO : Implementation
#elif defined(__linux__)
    // TODO : Implementation
#else
    #error "Unsupported OS"
#endif
}

void blog_free_memory_page(BlogMemoryPage* ptr)
{
#if defined(_WIN32) || defined(_WIN64)
    // TODO : Implementation
#elif defined(__linux__)
    // TODO : Implementation
#else
    #error "Unsupported OS"
#endif
}
// stuff

If you are not sleeping right now, the defined is just a way for us to check if the _WIN32 is defined by our compiler or by ourself, and error is just way for us to tell the compiler if you reach this part then throw an error.

We also need to put this macro to have conditional import on our implementation.

#if defined(_WIN32) || defined(_WIN64)
    // TODO
#elif defined(__linux__)
    // TODO
#else
    #error "Unsupported OS"
#endif

All right onto next part - Windows | Linux.

Windows Memory Allocation

Now we come to fun part, how do we request memory in Windows?

Looking at microsoft documentation we can use VirtualAlloc to request memory from windows and VirtualFree for freeing memory, we will use MEM_COMMIT to commit our memory for usage and PAGE_READWRITE to allow us to read and write onto that memory.

BlogMemoryPage* blog_request_memory_page(size_t capacity)
{
#if defined(_WIN32) || defined(_WIN64)
    capacity = ALIGN(capacity + sizeof(BlogMemoryPage), 4096);

    BlogMemoryPage* page = (BlogMemoryPage*)VirtualAlloc(NULL, capacity, MEM_COMMIT, PAGE_READWRITE);


    if (page == NULL) return NULL;

    page->capacity = capacity - sizeof(BlogMemoryPage);
    page->child = NULL;
    page->next = NULL;

    return page;
#elif defined(__linux__)
    // Implementation
#else
    #error "Unsupported OS"
#endif
}

Please note that the page we are allocating only store the capacity it can hold so it doesn't hold the total of the memory it has, we also setting our child (BlogMemoryChunk) to NULL since we don't have any data yet and next as null because there is no BlogMemoryPage after this yet.

After that we can add our VirtualFree to our free function.

void blog_free_memory_page(BlogMemoryPage* ptr)
{
#if defined(_WIN32) || defined(_WIN64)
    VirtualFree(ptr, 0, MEM_RELEASE);
#elif defined(__linux__)
    // Implementation
#else
    #error "Unsupported OS"
#endif
}

Since we want to release the memory we need to set the second parameter as 0 to release all the memory of that page.

Don't forget to include the windows header

#if defined(_WIN32) || defined(_WIN64)
    #include <Windows.h>
#elif defined(__linux__)
    // TODO
#else
    #error "Unsupported OS"
#endif

Linux Memory Allocation

Now we come to fun part, how do we request memory in Linux?

In the man page there is called mmap, these function allow us to request memory from the OS, it has lot of feature it can create mapping to file, creating shared access but let's talk mapping on the other time but we can use these to allocate memory from OS.

So we can use it like this.

// stuff
BlogMemoryPage* blog_request_memory_page(size_t capacity)
{
#if defined(_WIN32) || defined(_WIN64)
    // Implementation
#elif defined(__linux__)
    capacity = ALIGN(capacity + sizeof(BlogMemoryPage), 4096);

    BlogMemoryPage* page = (BlogMemoryPage*)mmap(
        NULL, 
        capacity, 
        PROT_READ | PROT_WRITE, 
        MAP_ANONYMOUS | MAP_PRIVATE, 
        -1, 
        0
    );

    if (page == MAP_FAILED) return NULL;

    page->capacity = capacity - sizeof(BlogMemoryPage);
    page->child = NULL;
    page->next = NULL;

    return page;
#else
    #error "Unsupported OS"
#endif
}
// stuff

Since we want our memory is only readable and write-able we can use PROT_READ and PROT_WRITE, we also want our mapping is private too, these function will return NULL if it fail to allocate, don't forget we need to align it 4 Kib too.

We also need to free it too, it's quite easy.

void blog_free_memory_page(BlogMemoryPage* ptr)
{
#if defined(_WIN32) || defined(_WIN64)
    // Implementation
#elif defined(__linux__)
    munmap(ptr, ptr->capacity + sizeof(BlogMemoryPage));
#else
    #error "Unsupported OS"
#endif
}

We need to pass our pointer and capacity to allow munmap to deallocate.

Don't forget to include the mman header to allow us to use mmap.

#if defined(_WIN32) || defined(_WIN64)
    // TODO
#elif defined(__linux__)
    #include <sys/mman.h>
#else
    #error "Unsupported OS"
#endif

Malloc and Free

All right we should have working blog_request_memory_page and blog_free_memory_page, now come to fun part.

How do we implement the malloc and free?

We can start by defining our number one page and set it as null, we can use this as foundation along with our function implementation of blog_malloc and blog_free, make sure to put this stuff inside the implementation section.

BlogMemoryPage *__ALLOCATOR = NULL;

void* blog_malloc(size_t size) { }

void blog_free(void* ptr) { }

Firstly we need to align the size first, since we are in 64-bit we can go 8 bytes alignment.

size = ALIGN(size, 8);

We can start by checking the __ALLOCATOR is NULL or not blog_malloc and if null then we will allocate it.

void* blog_malloc(size_t size)
{
    size = ALIGN(size, 8);
    if (__ALLOCATOR == NULL) {
        __ALLOCATOR = blog_request_memory_page(size);
        if (__ALLOCATOR == NULL) return NULL;
    }
}

This will ensure us that our __ALLOCATOR always is valid and since our implementation of blog_request_memory_page is automatically align it with 4 Kib we can safely pass size as parameter.

Next part is checking that our page has slot for new memory chunk, but firstly we need to get the chunk first, we can do it via pointer arithmetic.

BlogMemoryChunk *current_chunk = (BlogMemoryChunk)(__ALLOCATOR + 1);

We can use plus 1 to skip the current BlogMemoryPage and we just cast it into BlogMemoryChunk, next we need to initialize it and then return the pointer to the caller but don't forget to skip the BlogMemoryChunk by using plus 1, we don't want the end user modify our header.

void* blog_malloc(size_t size)
{
    // stuff

    BlogMemoryChunk *current_chunk = (BlogMemoryChunk*)(__ALLOCATOR + 1);
    current_chunk->capacity = size;
    current_chunk->flags = BLOCK_USE;
    current_chunk->next = NULL;
    __ALLOCATOR->child = current_chunk;

    return current_chunk + 1;
}

now this is the simplest and dumbest thing that this function can do, but let's see if we get proper address.

Create main.c and with this basic example code.

#include <stdio.h>

#define BLOG_MEMORY_IMPLEMENTATION
#include "../blog_memory.h"

int main()
{
    char *ptr = (char*)blog_malloc(4);
    if (ptr == NULL) {
        printf("Memory allocation fail\n");
        return -1;
    }
    printf("Allocated: %p\n", ptr);


    ptr[0] = 'H';
    ptr[1] = 'i';
    ptr[2] = '!';
    ptr[3] = '\0';
    printf("%s\n", ptr);

    return 0;
}

If everything is all right and it should print Hi! along with memory address, under the hood blog_malloc will actually give 8 bytes because of the alignment.

Okay now we need to free it, if we don't free it we got memory leak, let's implement our blog_free function, it actually simple, we just set the flag as free one by removing the bit that indicate being use.

void blog_free(void* ptr)
{
    BlogMemoryChunk* current = ((BlogMemoryChunk*)ptr) - 1;
    current->flags = current->flags & (~BLOCK_USE);
}

We are using bit masking by negating the BLOCK_USE and use and to remove the bits that set BLOCK_USE inside current->flags.

By using these flag technique we can reuse old BlogMemoryChunk without worrying another allocation from OS.

Now if we do another memory allocation it will corrupt our current allocated memory because we didn't make search for empty space, so we need to rewrite our blog_malloc.

et's start by searching empty spot inside our BlogMemoryPage, we can use while loop .

// stuff
size = ALIGN(size, 8);
if (__ALLOCATOR == NULL) {
    __ALLOCATOR = blog_request_memory_page(size);
    if (__ALLOCATOR == NULL) return NULL;
}

BlogMemoryChunk* chunk = __ALLOCATOR->child;
BlogMemoryChunk* last  = NULL;
while (chunk) {
    last = chunk;
    chunk = chunk->next;
}

if (last == NULL) {
    BlogMemoryChunk *current_chunk = (BlogMemoryChunk*)(__ALLOCATOR + 1);
    current_chunk->capacity = size;
    current_chunk->flags = BLOCK_USE;
    current_chunk->next = NULL;
    __ALLOCATOR->child = current_chunk;

    return current_chunk + 1;
}

BlogMemoryChunk *current_chunk = (BlogMemoryChunk*)((char*)(last + 1) + last->capacity);
current_chunk->capacity = size;
current_chunk->flags = BLOCK_USE;
current_chunk->next = NULL;
last->next = current_chunk;

return current_chunk + 1;

// stuff

With this loop we can loop over our Linked List BlogMemoryChunk until we get NULL and then in the bottom, if we got last == NULL basically we are new to the page so we use the pointer of __ALLOCATOR as a base, if not then we use the last pointer, and make sure we skip the last BlogMemoryChunk and it's content by using these pointer arithmetic, last + 1 will skip the header struct and it cast into char* so we can skip capacity of the last chunk and then we cast it into BlogMemoryChunk*.

With this setup we got new chunk, but we might overflow our page if we keep continue like this so we need to calculate the current allocated BlogMemoryChunk when we loop, and then we will do check.

// stuff
size_t allocated = 0;
BlogMemoryChunk* chunk = __ALLOCATOR->child;
BlogMemoryChunk* last  = NULL;
while (chunk) {
    allocated += chunk->capacity + sizeof(BlogMemoryChunk);

    last = chunk;
    chunk = chunk->next;
}

if (allocated + sizeof(BlogMemoryChunk) + size >= __ALLOCATOR->capacity) {
    return NULL; // We need to request new page
}
// stuff

Now we are missing one thing, if you are not sleeping you might be remember that when we free we don't deallocate on OS level but just setting the flag right? We can check flag on BlogMemoryChunk as we loop.

// stuff
while (chunk) {
    allocated += chunk->capacity + sizeof(BlogMemoryChunk);
    if (!(chunk->flags & BLOCK_USE) && chunk->capacity >= size) {
        chunk->flags |= BLOCK_USE;
        return chunk + 1;
    }

    last = chunk;
    chunk = chunk->next;
}
// stuff

Yatta, now we can reuse old BlogMemoryChunk now.

But are we forgetting something? yeah if we are out of space on our page we need to allocate new page. We can approach the solution in many way but we are going to divide our problem into smaller one first.

We have

Allocate allocator if null
Allocate a chunk if it have empty slot
Allocate new page and append it to parent next pointer
Go back to number 2

We can start by creating utility function that handle allocating allocator if null.

static BlogMemoryPage* __blog_init_allocator(size_t capacity)
{
    if (__ALLOCATOR != NULL) return __ALLOCATOR;
    __ALLOCATOR = blog_request_memory_page(capacity);
    return __ALLOCATOR;
}

By using static keyword we can say that this function is only exist on that file so with current setup it can only be accessed inside main.c.

Now next part is to allocate chunk if it have empty slot, we can create a function that received the BlogMemoryPage and return a pointer of new BlogMemoryChunk.

static BlogMemoryChunk* __blog_allocate_chunk_on_page(size_t capacity, BlogMemoryPage* page)
{
    size_t allocated = 0;
    BlogMemoryChunk* chunk = page->child;
    BlogMemoryChunk* last  = NULL;
    while (chunk) {
        allocated += chunk->capacity + sizeof(BlogMemoryChunk);
        if (!(chunk->flags & BLOCK_USE) && chunk->capacity >= capacity) {
            chunk->flags |= BLOCK_USE;
            return chunk + 1;
        }

        last = chunk;
        chunk = chunk->next;
    }

    if (allocated + sizeof(BlogMemoryChunk) + capacity >= page->capacity) {
        return NULL;
    }

    if (last == NULL) {
        BlogMemoryChunk *current_chunk = (BlogMemoryChunk*)(page + 1);
        current_chunk->capacity = capacity;
        current_chunk->flags = BLOCK_USE;
        current_chunk->next = NULL;
        page->child = current_chunk;

        return current_chunk;
    }


    BlogMemoryChunk *current_chunk = (BlogMemoryChunk*)((char*)(last + 1) + last->capacity);
    current_chunk->capacity = capacity;
    current_chunk->flags = BLOCK_USE;
    current_chunk->next = NULL;
    last->next = current_chunk;


    return current_chunk;
}

you might notice that this is actually code from our blog_malloc with exception of instead of using __ALLOCATOR we use page from parameter.

Next part is allocating new page if we need, since we know that our function that return new BlogMemoryChunk return NULL if it doesn't have enough space we can do this on our blog_malloc.

void* blog_malloc(size_t size)
{
    size = ALIGN(size, 8);
    if (__blog_init_allocator(size) == NULL) return NULL;

    BlogMemoryChunk* ptr = __blog_allocate_chunk_on_page(size, __ALLOCATOR);

    BlogMemoryPage* page = __ALLOCATOR;
    while(ptr == NULL) {
        if (page->next == NULL) {
            page->next = blog_request_memory_page(size);

            if (page->next == NULL) return NULL;
        }

        page = page->next;
        ptr = __blog_allocate_chunk_on_page(size, page);
    }

    return ptr + 1;
}

We change our initialization for our allocator at the beginning of the function, and we loop through our page Linked List if we found the NULL in the next ptr we just ask the OS for new page, don't forget to add 1 before we return the pointer, we don't want the user to modify header freely.

If we try our code in main.c instead of 4 we use 4096 as the size...

We got infinite loop, this is flaw on current implementation, because the size doesn't account our BlogMemoryChunk header struct so it just keep allocating new page until we run out of memory.

The fix is kinda simple we just add our size of our BlogMemoryChunk before we request new memory page.

// stuff
if (page->next == NULL) {
    page->next = blog_request_memory_page(size + sizeof(BlogMemoryChunk));

    if (page->next == NULL) return NULL;
}
// stuff

That's it we finished this whole ordeal and if you are not sleeping congratulation for reaching this part!

Finishing Thought

We are successfully craft our own allocator, it was interesting recreational programming session, we learn a lot of stuff from Linked List, API from OS, memory alignment.

There still lot of improvement or optimization we can made or maybe edge cases that we didn't dealt with and we still missing freeing our page but that is not necessarily required for short live application but if you want to create that I will leave it as homework.

The entire source code can be accessed on this url :
https://github.com/UnknownRori/blog_memory

That's it from me folks if there are feedback let me know. So go on do whatever you usually do. Cheers!

Crafting C-like printf in assembly

Unknown Rori — Fri, 18 Jul 2025 11:31:41 +0000

Ever wondered how printf("Hello world!") work under the hood? in the high level languages we take formatted output for granted but what if you had to implement it from scratch in assembly? in this posts we are going dark and explore world of assembly.

Formatted output can be deceptively simple on the surface but surprisingly complex under the hood, even the simplest thing like printf("%d", 42) lies parsing, variable argument handling, formatting, and all which managed by luxuries of standard library provided by C runtime.

Table of Content

Getting Started
Interlude
Basic Hello World Printf
Variable argument Printf
Afterword

Getting Started

Before we begin we should install our tools, at this time I will be using FASM and Linux (whatever is fine), FASM is pretty lightweight and easy to use but if you are using Windows it work seamlessly except for the syscall.

But what is syscall?

syscall is way of us developer to request a service from operating system, it can be hardware related, execution of process and other kind of thing, why do we have this? because for security, process or an app aren't allowed to access this kind of stuff freely, what kind of bad stuff it will happen right?

Interlude

Before we even begin writing we must need to define our intend to FASM since we are in Linux and we also wanted for 64 bit (I'm not in the mood for 32 bit) so we need to put this magic text on the first line of our main.asm file.

format elf64 executable

Next is our entry point of our code, usually it start at _start not main but we can define it whatever we want.

format elf64 executable
entry _start

But before we even start writing our code we must define our application layout this is where our code, constant data will live in the executable, these layout or segment also need additional parameter like is it allowed to be read or to be execute or to be write into.

We will define 3 of them, first one will be where to store our hello world string, the second one will be to store our global variable, and the third is where our code will live.

; ... stuff from before
segment readable

segment readable writable

segment readable executable

All right cool now we can start writing our code, but wait we don't have function in assembly.

That's right, to create a function we need to use our imagination by using label. But what is Label? label is a way for us to create bookmark instead remembering the memory address in our code so we can reference it later like jumping to that specific part, as you can see we can use these label to create a function since we are just calling it and then go back.

; ...stuff from before
segment readable executable
_start:

If we try to compile it using fasm main.asm main and then running it we can see that the output is terminated by signal SIGSEGV (Address boundary error) basically we are outside our allowed access, But why? well since this is just empty executable file, the label _start is at the doorstep of allowed access provided by our operating system.

But before we thinking about that we need to way to exit our program gracefully by opening these awesome resources, based on these we can see syscall exit, we can also see that rax, rdi, etc, these are our registers, a thing like fixed variable we can read and write inside our CPU.

Okay cool, now how do we exit?

First we need to set out rax to 60 because that is our syscall exit is, and then set our rdi to our exit code, for example 40, how do we specify the register? by using mov instruction to move our constant data into our register.

; ...stuff from before
_start:
    mov rax, 60 ; our syscall exit
    mov rdi, 40 ; exit code
    syscall

If we try to compile it we will see nothing but if you are using shell like bash you can type echo $? to show the last exit code of previous program, it should output 40.

But before we can do hello world we need to define our data first, we will define it inside our readable segment, we also need to use label to help reference it later.

; ...stuff
segment readable
    helloWorld: db "Hello, World", 10, 0
    helloWorldLen = $-helloWorld
; ...stuff

You may notice that there is helloWorldLen we will need it when we call our syscall it will need our length of the string we want to print, the $- is used to get the length of helloWorld until helloWorldLen, and there is also 10, 0 in the code, 10 is for next line and 0 for null terminator to specify that it's the end of the string. db is a FASM instruction for define byte to allow us write anything with size of a byte into that label since our string is just ASCII we can confidently use byte.

Now, how to do "hello world" in assembly by using these constant variable? it actually simple, in the linux syscall there is thing called write these thing is allow us to write in the file descriptor, the file descriptor we are interested is 1 because that is our terminal.

; ...stuff
segment readable executable
_start:
    mov rax, 1 ; syscall write
    mov rdi, 1 ; Stdout
    mov rsi, helloWorld ; load address of helloWorld
    mov rdx, helloWorldLen ; fetch data on the address of helloWorldLen
    syscall
; ...our syscall exit

If you try to compile it it will output Hello World, congratulation!

Basic Hello World Printf

Now come to the fun part writing basic hello world but printf. Firstly we need to rewrite our constant and our global variable to help us later down the line, but don't forget to remove our first hello world syscall too.

; ...stuff
segment readable
    hello: db "Hello, %s", 10, 0
    world: db "World", 0

segment readable writable
    buffer: rb 1024
; ...stuff

buffer global variable will be used on our printf to copy the string before we print to the terminal, these allow us to just call 1 syscall, it's for optimization since syscall can be slow but in this case we are just lazy dev and ask the OS sparingly.

We also need label printf too, we put it on top of the _start and we use instruction call to call our "function" or label.

; ...stuff
segment readable executable
printf:

_start:
    call printf

    mov rax, 60 ; syscall exit
    mov rdi, 40 ; Exit code
    syscall

If you try to compile these you will probably get SIGSEGV because in assembly code is run top to bottom so if we call our printf it will jump to printf and since it's empty it will go down and run code since the below it is call printf it will just recursively call itself and causing stack overflow (yo stack overflow mentioned), to return it to the caller we need use ret instruction to return, but how it work under the hood?

There is called stack that stored our data (local variable), address, when we call it will actually push the current address of execution to the stack and then jump to specified memory address, when we ret it will pop the stack and use that as return address.

Okay so we just add ret to our code.

; ...stuff
printf:
    ret
; ...stuff

Voila, no SIGSEGV. now we need to think what our function parameter should have, for starter let's start by using rax as our pointer to the address we want to print. But you may notice that syscall write require us to provide the length too, we can loop the data on that address and find null terminator while doing that we can increment a counter and copy it into our buffer in global variable.

; ...stuff
_start:
    mov rax, hello
    call printf
; ...stuff

But before all the fun stuff, how do we loop? well... there is no loop in assembly.

We can use label to specify the location and instead of using call we use jmp instruction, something like this.

; ...other stuff
printf:
.iter_loop:
    jmp .iter_loop ; [new stuff]
    ret
; ...other stuff

But wait! if you try run this code it will loop indefinitely, so while we at it we need prepare our other register to act as counter, but we need to preserve it, why? Because maybe in other part of our code they might use them for something important and we don't want to trash them. But we don't want to store everything on global right? we can use the stack by using push instruction to push data from register into stack just like how call push return address and near at the end before ret we need to pop it to restore it.

; ...stuff

; Print stuff like C printf (but budget)
; @params   rax - const char* (pointer to string)
printf:
    push rdx ; [new stuff]
.iter_loop:
    jmp .iter_loop

    pop rdx ; [new stuff]
    ret
; ...stuff

Now we can set up our counter register in peace, by using xor instruction we can zero out our register value if we xor it by itself.

; ...other stuff
printf:
    push rdx
    xor rdx, rdx ; [new stuff]
; ...stuff

Now after all of that we can use data from address inside rax and compare it with 0 as it was our null terminator, and to fetch get data from address we use [address] in mov instruction, since our data is in byte we need to specify it using byte on our byte [address] and also use register that can only store byte (8 bit) since all of our register is 8 byte (64 bit), for this case let's trash register r10 8 bit variant r10b.

; ...other stuff
printf:
    push rdx
    xor rdx, rdx 
.iter_loop:
    mov r10b, byte [rax] ; [new stuff]
    jmp .iter_loop

; ...stuff

Wait now, we are not done yet we are going to compare if the r10b is now with our 0 and then we jump out to label so we don't stuck in infinite loop, we can use cmp instruction to compare between 2 value either it's register with register or with constant.

; ...stuff
.iter_loop:
    mov r10b, byte [rax]
    cmp r10b, 0
; ...stuff

But after comparing we need to do with the result of comparison, the result is on flag register which we usually cannot access freely, by using other version of jmp we can use it to create branch in our code since we want that value of r10b is equal we need to use je for jump if equal.

; ...stuff
.iter_loop:
    mov r10b, byte [rax]
    cmp r10b, 0
    je .done
.done:
    pop rdx
    ret
; ...stuff

Now if we try to run this it will still loop forever because we didn't increment our pointer in rax and also counter, we can use inc instruction to increment it by one.

; ...stuff
.iter_loop:
    mov r10b, byte [rax]
    cmp r10b, 0
    je .done
    inc rdx ; [new stuff]
    inc rax ; [new stuff]
    jmp .iter_loop
; ...stuff

If we try to run this now.... nothing happen and we do not loop forever, finally.

Next step is to copy the data to the buffer it's actually simple because we just reverse the mov operation like in .iter_loop but in reverse and store it into buffer instead of rax, for nice readability let's add .push_char.

; ...stuff
printf:
    push rdx

    xor rdx, rdx
.iter_loop:
    mov r10b, byte [rax]
    cmp r10b, 0
    je .done

; [new stuff]
.push_char:
    mov byte [buffer], r10b
    inc rdx
    inc rax
    jmp .iter_loop
.done:
    pop rdx
    ret

; ...stuff

Now you may notice that we just keep updating value inside buffer without incrementing the index, we can use rcx to store the base pointer of buffer and then increment it when after the we push the char to the buffer.

; ...stuff
printf:
    push rdx
    push rcx ; [new stuff]

    xor rdx, rdx
    mov rcx, buffer ; [new stuff]
.iter_loop:
    mov r10b, byte [rax]
    cmp r10b, 0
    je .done
.push_char:
    mov byte [rcx], r10b ; [new stuff]
    inc rcx ; [new stuff]
    inc rdx
    inc rax
    jmp .iter_loop
.done:
    pop rcx ; [new stuff]
    pop rdx
    ret
; ...stuff

Now lastly we need to call our os to write the thing in buffer since the length is already stored inside rdx we don't need to specify it manually

; ...stuff
.done:
; [new stuff]
    mov rax, 1
    mov rdi, 1
    mov rsi, buffer
    syscall

    pop rcx
    pop rdx
    ret
; ...stuff

If you compile and run it Hello %s should be printed on the terminal, congratulation! address inside rax has successfully copied into buffer.

Variable argument Printf

Okay now the fun part how do we get variable parameter inside our printf function? if we take a look on os dev website regarding on the list of the register there are at least 14 register that we can play around, and we already use up 4.

No need to rack our brain on the control flow hell, we can use the stack and dynamically calculate our next parameter. so basically we know that we push stuff on the stack 64 bit register 2 times and there is also return address.

We can visualize our stack at that moment.

On the picture above you might notice that our stack is inverted because that is the fact, the image before are just for easy visualization.

There is register called rsp and rbp these guys are the one who keeping track each time we push something it will decrement rsp so it will goes down. If we push our parameter before we call it will look like this.

Now we can see where are we going, since all of our push (and call) is storing at least 8 byte we can use our rbx register to use rsp and add by 8 three times we will land on the &world.

So we can update our code before calling printf and set rbx to the first params.

; ...stuff
; Print stuff like C printf (but budget)
; @params   rax - const char* (pointer to string)
; @params   stack (8 bytes each, last push is first params)
; @trash    rbx, r10
printf:
    push rdx
    push rcx

    xor rdx, rdx
    mov rcx, buffer
    mov rbx, [rsp+(8*3)] ; [new stuff]
; ...stuff
_start:
    mov rax, hello
    push world
    call printf
; ...stuff

After all that stuff we can focus on parsing we can add additional cmp instruction after the null terminator byte check and add label for special symbol, like this.

; ...stuff
.iter_loop:
    mov r10b, byte [rax]
    cmp r10b, 0
    je .done
; [new stuff]
    cmp r10b, '%'
    jne .push_char
.symbol:

.push_char:
    mov byte [rcx], r10b
; ...stuff

So what is jne? it same as je but not equal one, notice the n word at middle.

Next we can increment our rax to next char and check if it was s if not we just jump to .iter_loop to continue our printing.

; ...stuff
.symbol:
    inc rax
    mov r10b, byte [rax]
    cmp r10b, 's'
    jne .iter_loop
; ...stuff

So next part is simple use the rbx get the character we want and copy it into our buffer.

; ...stuff
.symbol:
    inc rax
    mov r10b, byte [rax]
    cmp r10b, 's'
    jne .iter_loop
.string_symbol:
    mov r10b, byte [rbx] ; [new stuff]
    mov [rcx], r10b ; [new stuff]
; ...stuff

If we compile it now it should print Hello W, not yet our "Hello World" but still progress, we forgetting about our loop, pretty simple to add.

; ...stuff
.string_symbol:
    mov r10b, byte [rbx]
    cmp r10b, 0
    je .iter_loop

    mov [rcx], r10b

    inc rcx
    inc rdx
    jmp .string_symbol
; ...stuff

If we try to run it now....

Bam! we got another SIGSEGV now we really forgetting to increment our rbx register, silly me. Don't worry our modern OS can handle this kind of stuff pretty well, we just need to update our code

; ...stuff
.string_symbol:
    mov r10b, byte [rbx]
    cmp r10b, 0
    je .iter_loop

    mov [rcx], r10b

    inc rbx ; [new stuff]
    inc rcx
    inc rdx
    jmp .string_symbol
; ...stuff

Okay cool now if we run it it should print Hello Worlds so where that s coming from? well if you recalling the data we define it before it was Hello %s so, we forgetting incrementing our rax when we enter the .symbol, easy fix.

; ...stuff
.symbol:
    inc rax
    mov r10b, byte [rax]
    cmp r10b, 's'
    jne .iter_loop
    inc rax ; [new stuff]
; ...stuff

Now we are done! but are we forgetting something? yes how about 2 parameter, since we are using stack we can just push another address to act as parameter, we can add additional constant like this.

; ...stuff
segment readable
    hello: db "Hello, %s. %s", 10, 0
    world: db "World", 0
    goodDay: db "It was a good day", 0
; ...stuff

And then we push it before our world

; ...stuff
_start:
    mov rax, hello
    push goodDay ; [new stuff]
    push world
    call printf
; ...stuff

Now if we try to run now.... well it didn't output the new string. well we are forgetting something... that's right we are incrementing our rbx but we never change it's address to next parameter, it's actually simple we just add 8 byte to it right?

Well you are not entirely wrong, what should we do is save our rbx to different register and then increment it so we don't skip parameter, we are going to trash another register let's say r11.

; ...stuff
.symbol:
    ; ...stuff
    ; [new stuff]
    mov r11, rbx
    add rbx, 8
.string_symbol:
    mov r10b, byte [r11] ; [new stuff]
    cmp r10b, 0
    je .iter_loop

    mov [rcx], r10b

    inc r11 ; [new stuff]
    inc rcx
    inc rdx
    jmp .string_symbol
; ...stuff

If we try to run it now... well seem like our It inside our goodDay variable is missing, well what did we do wrong this time?

Actually we are loading our address to rbx is wrong for all this time, since mov is for moving data and not for loading proper memory address. So how do we load proper address? there is instruction called lea and it literally mean Load Effective Address.

    lea rbx, [rsp+(8*3)]

if we run it now.. well now our output is jumbled mess, what is wrong now?

If you recall it now our rbx is proper address now, and we need to get it using [] when moving it into our r11.

; ...stuff
.symbol:
    ; ...stuff
    mov r11, [rbx] ; [new stuff]
    add rbx, 8
.string_symbol:
    ; ...stuff

Okay, I think we are done now, let's run it again and see what happen...

Yatta, it print Hello, World. It was a good day now we got our first proper variable parameter for our printf!

Okay now we are just need to display a number now... do you think we end right here, no.

Let's update our constant to include %d format specifier. And update our printf call.

; ...stuff
segment readable
    hello: db "Hello, %s %d. %s", 10, 0
    world: db "World", 0
    goodDay: db "It was a good day", 0
; ...stuff
_start:
    push goodDay
    push 42
    push world
    call printf
; ...stuff

We want to treat our number as is not as pointer to an address.

So let's start by adding our parsing to include d character now, it will look like this.

; ...stuff
.symbol:
    inc rax
    mov r10b, byte [rax]
    cmp r10b, 's'
    je .prep_string_symbol ; [new stuff]
    cmp r10b, 'd' ; [new stuff]
    jne .iter_loop ; [new stuff]
.number_symbol:

.prep_string_symbol: ; [new stuff]
    inc rax
    mov r11, [rbx]
    add rbx, 8
.string_symbol:
    ; ...stuff

If you are recall in ASCII that number start at 48, so we can just add the number with 48, but firstly we need to get the data from stack first.

; ...stuff
    inc rax
    mov r11, [rbx]
    add rbx, 8

.number_symbol:

; ...stuff

So we need to loop and divide it by 10 get the remainder and convert it into ASCII, pretty simple.

To divide we use div instruction, this require rax to be thing that we divide, but wait Isn't where our parameter at? we can just push it into the stack to save it, but it also use rdx we just trash register r12 to store it as our temporary counter, but where are divisor? we are going to use r10.

; ...stuff
    inc rax
    mov r11, [rbx]
    add rbx, 8

    push rax
    mov r12, rdx
    mov r10, 10
    mov rax, r11 ; [new stuff]
.number_symbol:
    xor rdx, rdx ; clear out every operation
    div r10

    test rax, rax
    jnz .number_symbol

    pop rax
    mov r12, rdx
    jmp .iter_loop

; ...stuff

Now we just need to push it into our buffer the converted version by adding number of 48 or just use '0' for ease readability. pretty simple update.

; ...stuff
.number_symbol:
    xor rdx, rdx
    div r10
    add dl, '0' ; [new stuff]

    ; [new stuff]
    mov byte [rcx], dl
    inc r12
    inc rcx

    test rax, rax
    jnz .number_symbol
; ...stuff

Now if you run it now and not sleeping on this whole ordeal it will output Hello, World 24. It was a good day wait, the number is inverted! that's right we need to flip it, to make it easier we just create another buffer.

; ...stuff
segment readable writable
    buffer: rb 1024
    bufferNum: rb 1024 ; [new stuff]
    bufferNumLen = $-bufferNum ; [new stuff]
; ...stuff

Right now we just need to change instead of rcx we will use the new buffer to store it but in reverse, firstly we need to preserve our rcx and use to store end address of bufferNum. We also want to decrement the it since we are doing it in reverse.

; ...stuff
    push rax
    push rcx ; [new stuff]
    mov rcx, buffer + bufferNumLen ; [new stuff]
    mov r12, rdx
    mov r10, 10
    mov rax, r11
.number_symbol:
    xor rdx, rdx
    div r10
    add dl, '0'

    mov byte [rcx], dl
    dec rcx ; [new stuff]

    test rax, rax
    jnz .number_symbol

    pop rcx ; [new stuff]
    pop rax
    mov rdx, r12
    jmp .iter_loop
; ...stuff

Right we just need to copy these inverted data into main buffer.
Firstly we are need to pop old rcx into somewhere, for example r11 and then use it to fill the number buffer into it and increment it the counter.

; ...stuff
    jnz .number_symbol

    pop r11 ; old buffer
    pop rax ; our params fmt
    mov rdx, r12
.copy_number:
; [new stuff]
    mov r10b, byte [rcx]
    mov [r11], r10b
    inc rcx ;  increment the bufferNum
    inc r11
    inc rdx
    cmp rcx, buffer + bufferNumLen + 1
    jnz .copy_number

    mov rcx, r11
    jmp .iter_loop
; ...stuff

That's it we are done!

Afterword

It was interesting journey we are taking, learning a bit of how CPU and memory work. For other format I will leave at you guys as home work starting with hex format and then pointer one.

That's it from me folks if there are feedback let me know. So go on do whatever you usually do.