execvestack.nasm

; EXECVE
;   RDX = 0x00
;   RSI = 0x00
;   RDI = address of '//bin/sh', 0x00 (the extra slash is just for rounding to 8 bytes)

section .text

global _start

    _start:
        
        xor rdx, rdx    ; rdx = 0x00
        mov rsi, rdx    ; rdi = 0x00

        push rdx        ; places the final null byte for the '//bin/sh' string
        
        ; echo -n "//bin/sh" | rev | xxd ==> 6873 2f6e 6962 2f2f
        ; can't push an immediate 64bit value, must go through a reg
        mov rax, 0x68732f6e69622f2f
        push rax
        mov rdi, rsp ; load string address into rdi
        
        xor rax, rax
        add rax, 0x3b ; syscall number
        syscall