Linux shellcode for ARM

Shellcodes on ARM systems are very similar to the shellcodes that use the Intel instruction set. It's even easier for the shellcode authors to write in ARM as they don't have to use call/pop instructions or fstenv to get the absolute address. In ARM assembly language, you can access the program counter register (pc) directly from the code, which makes this even simpler. Instead of int 0x80 or syscall, the shellcode uses svc #0 or svc #1 to execute a system function. An example of ARM shellcode for executing a local shell is as follows:

_start:
    add r0, pc, #12
    mov r1, #0
    mov r2, #0
    mov r7, #11  ;execve system call ID
    svc #1
.ascii "/bin/sh\0"

In the preceding code, the shellcode sets r0 with the program counter (pc) + 12 to point to the /bin/sh string. Then, it sets the remaining arguments for the execve system call and calls the svc instruction to execute the code.