Assembly & Low-Level

A register is a tiny, extremely fast storage slot inside the processor. On x86-64 the general-purpose registers are 64 bits wide with names like rax, rdi, and rsi. Two have special roles: rsp is the stack pointer and rip is the instruction pointer, which holds the address of the next instruction the CPU will run.

Put the syscall number in rax, the arguments in rdi, rsi, and rdx in order, and execute the syscall instruction. The kernel performs the service and returns a result in rax. For example, write is syscall number 1 and exit is number 60, which together let a program print a line and end cleanly.

Shellcode is a small, self-contained chunk of machine code, historically one that launched a shell. Unlike an ordinary program it must usually be position-independent and free of a separate data section, because of where it runs. Those constraints make writing it an excellent exercise in registers, the stack, and syscalls.

Because of NX or DEP, which mark data regions such as the stack as non-executable. The CPU refuses to run instructions from there. Combined with ASLR, which randomises memory layout, and seccomp, which restricts syscalls, modern defences directly target the mechanisms this lesson explains.

Most security work involves reading assembly to understand what a compiler or attacker produced. Writing small programs is how you learn to read fluently, because it builds intuition for what each pattern means. This course teaches both, with a strong focus on reading disassembly from the middle lessons onward.

The syscall instruction is always the two bytes 0f 05 on x86-64. Recognising this pair lets you spot a kernel call instantly in any disassembly. The legacy 32-bit interrupt int 0x80 is cd 80 instead, and the two use different syscall numbers, so you must not mix them.