I was in the process of doing babyshell level 4, and while I solved it, there's a gap in my understanding. I don't understand how registers get translated to machine code, and I have yet to find the correct Google Search incantation to help with this ("x86_64 assembly register numbers" doesn't yield anything that looks right).
For example, to prepare to call execve:
0: 48 c7 c0 3b 00 00 00 mov rax, 0x3b
0: b8 3b 00 00 00 mov eax, 0x3b
This makes no sense to me. Where do the bytes "48 c7 c0" come from? Why is the second form "b8" entirely different, despite eax just being the lower 4 bytes of rax? And why is "88" (or 0x58) not anywhere, even though http://ref.x86asm.net/coder64.html
says that the opcode for mov is 88?
Thank you in advance, if anyone can shed some light!