Return an exit code
A short Linux syscall payload returns decimal 42. Inspect the syscall number, status register, and expected process exit status.
EXAMPLES / ONE MECHANISM AT A TIME
Small programs.
Visible mechanisms.
Fifteen experiments with actual literal sources, byte tables, and reproducible checks. Choose the execution environment first, then follow what each byte does.
ELF anatomy: inspect headers, segments and entry bytes →
01 / THE LINUX SYSCALL INTERFACE
A process, a register,
an observable result.
These ELF files need Linux x86-64. Python adds a non-executable ELF container around the unchanged handwritten payload. Payload sizes below exclude that header. Expected nonzero exit statuses are part of the demonstrations.
Make a calculation visible
Add values in a register, then expose the result through the process exit status. The byte table ties each immediate to the arithmetic.
Write a message
Use the Linux write syscall with an explicitly encoded string address and length, then terminate through the exit syscall.
Count through a loop
Follow a counter and a backwards relative branch. The displacement is authored in the literal bytes rather than resolved from a label.
Choose a branch
Compare register values and use a conditional jump to select the result. Inspect which flag condition makes the branch happen.
Return 42 in eight bytes
A smaller handwritten exit-status payload beside the 12-byte baseline. Compare packed source sizes and encoding choices in the size lab; native Linux execution evidence is tracked separately.
02 / BEFORE AN OPERATING SYSTEM
Firmware, memory,
and a first sector.
Use legacy-BIOS x86 system emulation in QEMU. Smaller payloads are packaged into sectors; disk-read and monitor images also include a separately handwritten loader and padded second stage. They are not UEFI programs.
The complete 512-byte beginning
Segment and stack setup, BIOS text output, COM1 serial mirroring, message bytes, padding, and signature all appear in the canonical source.
Read one key
Ask BIOS for a key and display the character. The emulated keyboard is a firmware service, with different behavior from a Linux syscall.
Write directly to VGA
Store character and attribute bytes in VGA text memory. Inspect segment addressing and the difference between character data and its color attribute.
Read a second stage
A separately handwritten loader and payload demonstrate BIOS disk reads and a success message. Inspect the carry-flag error path in the source.
Enter a tiny monitor
Read and edit a bounded command buffer, match commands, display help, and inspect memory within the documented monitor limits. This is an experiment, not a general debugger.
Cross into protected mode
A separately loaded literal stage installs a GDT, enables 32-bit code, writes and reads actual RAM, and dispatches a software interrupt through an IDT gate. IRETD returns before the success halt. This runs in QEMU, beyond the browser's 16-bit model.
A shell that loads another program
Nine commands expose bounded keyboard editing, actual RAM reads and writes, a register snapshot, and BIOS disk loading. The five-sector image combines the loader, shell and separately authored returning app. Its behavior has actual QEMU checks.
Load, compute 42, and return
The shell loads this payload at physical 0x9000. It computes 7 × 6, stores the resulting byte 2A at 0x0601, prints that result and returns to the shell. This .bin is not independently bootable; use the shell image and its run command.
03 / DATA BECOMES AN INSTRUCTION
One writer bit.
A different live operand.
Rewrite a future instruction
Store 61 over a future MOV operand containing 41, jump to it, and emit lowercase a. A separate literal one-bit control emits A. QEMU verifies code RAM, serial and VGA; the source file and read-only image stay unchanged.