Shellcode assembler and library

Shellcode is machine code you inject and jump to. It only works when the memory it lands in is executable, so on any binary with NX enabled the answer is ROP instead - check that first with the binary analyzer.

When it does apply, shellcode is the most direct path there is: no gadget hunting, no libc leak, no version matching. You write the syscall you want and jump to it. Everything difficult about shellcode is therefore about surviving the journey into memory intact.

The constraints that shape it

• Null bytes. If your input path is a C string function, a single \x00 truncates the payload. xor rax, rax instead of mov rax, 0 is the canonical fix.
• Length. The buffer is what it is. The classic 64-bit execve("/bin/sh") fits in 23 bytes.
• Character restrictions. Input filtered to alphanumerics needs alphanumeric shellcode, which is a real and well-documented craft.
• Position independence. Shellcode does not know where it landed, so it must not use absolute addresses. On 64-bit, RIP-relative addressing makes this easy.

xor  rsi, rsi          ; argv = NULL
push rsi
mov  rdi, 0x68732f2f6e69622f   ; "/bin//sh"
push rdi
push rsp
pop  rdi               ; rdi -> "/bin//sh"
xor  rdx, rdx          ; envp = NULL
push 59
pop  rax               ; syscall number for execve
syscall