Class 04 · KP 07 / 18

Conceptual execve Shellcode (x86-64)

; Standard textbook execve("/bin/sh", NULL, NULL) on x86-64.
; Goal: RAX=59, RDI=&"/bin/sh", RSI=0, RDX=0, then syscall.

    xor    rdx, rdx        ; RDX = 0  (envp = NULL)
    xor    rsi, rsi        ; RSI = 0  (argv = NULL)

    ; "/bin/sh" is 7 bytes; push it as an 8-byte value ending in 0.
    mov    rbx, 0x68732f6e69622f  ; ASCII "/bin/sh" (little-endian)
    push   rdx               ; push a NULL terminator
    push   rbx               ; push the string bytes
    mov    rdi, rsp          ; RDI -> pointer to "/bin/sh" on the stack

    xor    rax, rax          ; clear RAX (avoids null immediate)
    mov    al, 59            ; RAX = 59  (execve syscall number)
    syscall                  ; invoke the kernel: execve(...)

Key Takeaway

Build the string on the stack, point RDI at it, set the syscall number in AL, zero the rest, and syscall.