The Goal: execve("/bin/sh", NULL, NULL)

• On Linux, a program requests kernel services via a system call (syscall).
• To spawn a shell, shellcode invokes execve, which replaces the current process image with /bin/sh.
• On x86-64, arguments go in registers and the syscall instruction transfers control to the kernel.