Skip to content

Instantly share code, notes, and snippets.

@vxcute
Last active May 3, 2024 01:46
Show Gist options
  • Save vxcute/426e0cf9596a592e3ed14a2a303863c3 to your computer and use it in GitHub Desktop.
Save vxcute/426e0cf9596a592e3ed14a2a303863c3 to your computer and use it in GitHub Desktop.
;; a 64-bit ELF file from scratch using FASM that prints a hello world
use64
ELFCLASS64 = 0x2
ELFDATA2LSB = 0x1
EV_CURRENT = 0x1
ELF_ABI_SYSV = 0x1
ET_EXEC = 0x2
EM_X86_64 = 0x3e
EV_CURRENT = 0x1
PT_LOAD = 0x1
ehdr:
db 0x7F, "ELF", ELFCLASS64, ELFDATA2LSB, ELF_ABI_SYSV
rb 9
dw ET_EXEC ; e_type
dw EM_X86_64 ; e_machine
dd EV_CURRENT ; e_version
dq 0x400000 + code ; e_entry
dq phdr ; e_phoff
dq 0 ; e_shoff
dd 0 ; e_flags
dw phdr - ehdr ; e_ehsize
dw code - phdr ; e_phentsize
dw 1 ; e_phnum
dw 64 ; e_shentsize
dw 0 ; e_shnum
dw 0 ; e_shstrndx
phdr:
dd PT_LOAD ; p_type
dd 5 ; p_flags (PF_R | PF_X)
dq 0 ; p_offset (text segment always starts at offset 0)
dq 0x400000 ; p_vaddr
dq 0x400000 ; p_paddr
dq 0x88
dq 0x88
dq 0x1000
code:
push rbp
mov rbp, rsp
sub rsp, 13
mov byte [rsp+0], 'H'
mov byte [rsp+1], 'e'
mov byte [rsp+2], 'l'
mov byte [rsp+3], 'l'
mov byte [rsp+4], 'o'
mov byte [rsp+5], ','
mov byte [rsp+6], ' '
mov byte [rsp+7], 'W'
mov byte [rsp+8], 'o'
mov byte [rsp+9], 'r'
mov byte [rsp+10], 'l'
mov byte [rsp+11], 'd'
mov byte [rsp+12], 0xA
mov rax, 1
mov rdi, 1
lea rsi, [rsp]
mov rdx, 13
syscall
mov rax, 60
mov rdi, 1337
syscall
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment