myexecls:
xor %ecx,%ecx # exc is 0
pushl %ecx # null - third parameter to execve
jmp strangejump # go get address of data (string "/bin/ls")
skippy: pop %eax # eax is now the address of "/bin/ls"
movb %cl,7(%eax) # null terminate the string
movl %eax, 8(%eax) # stores the adress of "bin/ls" as first element of array
movl %ecx,12(%eax) # stores a null as second array element
leal 8(%eax),%ebx # ebx is address of the array
pushl %ebx # push address (2nd parameter to execve)
pushl %eax # push address of "/bin/ls" as first parameter
xor %eax,%eax
movb $59,%al # eax = 59 (SYS_execve)
pushl %eax
int $0x80 # system call
# we never exepect to get here!
strangejump:
call skippy
.byte '/','b,'i','n','/','l','s',1,1,1,1,1,1,1,1,1,1,1,1