.global _start _start: movl $11, %eax call next next: movl (%esp), %ebx addl $(_cmd-next), %ebx int $0x80 _cmd: .ascii "/bin/sh" .byte 0