shellco — null-free XOR-halved shellcode

spbctf

Task: shellcode runner with three constraints — no NUL bytes, even length, and XOR of first half of bytes equal to XOR of second half. Solution: take a 23-byte null-free execve('/bin/sh') payload and concatenate it with itself (46 bytes, even length, halves identical, so XORs trivially match); pad the remainder of the 0x1000 read with NULs so read() returns immediately, then send shell commands on the same stdin.