The server allocates an rwx memory page, reads your shellcode into it, and jumps to it. You must write x86-64 assembly that: Opens /home/asm/this_is_pwnable.kr_flag with syscall open (rax=2), reads file contents into a buffer with syscall read (rax=0), then writes the buffer to stdout with syscall write (rax=1). Assemble with nasm, send the raw bytes via netcat.