const char sc[] = // "\x31\xdb" // xor %ebx,%ebx "\xf7\xe3" // mul %ebx "\x66\x8c\xe1" // mov %fs,%cx "\x80\xf9\x1f" // cmp $0x1f,%cl "\x74\x23" // je 80480cf "\x80\xf9\x2f" // cmp $0x2f,%cl "\x74\x2b" // je 80480dc "\x38\xc1" // cmp %al,%cl "\x74\x34" // je 80480e9 "\xeb\x3d" // jmp 80480f4 // "\xb2\x08" // mov $0x8,%dl "\xeb\x02" // jmp 80480bd // "\xb2\x06" // mov $0x6,%dl // "\xb0\x04" // mov $0x4,%al "\xfe\xc3" // inc %bl "\x59" // pop %ecx "\x52" // push %edx "\x51" // push %ecx "\x53" // push %ebx "\x50" // push %eax "\xcd\x80" // int $0x80 "\xb0\x01" // mov $0x1,%al "\x4b" // dec %ebx "\x53" // push %ebx "\x50" // push %eax "\xcd\x80" // int $0x80 // "\xe8\xe3\xff\xff\xff" // call 80480b7 "OpenBSD\n" "\xe8" // "\xe8\xd6\xff\xff\xff" // call 80480b7 "FreeBSD\n" "\xe8" // "\xe8\xcd\xff\xff\xff" // call 80480bb "Linux\n" "\xe8\xbe" // "\xe8\xbe\xff\xff\xff" // call 80480b7 "Unknown\n" ; int main() { void (*fp)(); fp = (void(*)())sc; printf("Length: %d\n",strlen(sc)); (void)(*fp)(); printf("Made it past the shellcode"); }