[Register or Login to view code]
The shellcode actually looks quite well written (although shows hallmarks of being partially produced with a compiler). I've basically got a good handle now on how it all works, although I've not got an lv2 dump so some of it's guesswork. e.g. at offset 0xc4, there's a call to 0x800000000007c01c which I think is memcpy, but I'm just assuming that for now.
For disassembly tips, 0x12-0x80 is PIC code, entry r3=start of file+0x1000.
0x80-0x1ac add offset 0x8000000000700000 to start of file
0x1ac-0x6f0 add offset 0x8000000000050990 to start of file.
If you can get your head around the various relocations the code undergoes, it's fairly easy code to follow.
This is a standard prologue for a stack frame - it's saving registers on the stack.
Spot on. This table (terminated by .long 0) is a table of addresses to which 0x8000000000000000 is added and then patched by the next 4 bytes (helpfully easily disassembled). You'll see the 3 instructions that get written here are sequential.
It sets bits 32-47 (note on ppc bits are numbered MSB 0, LSB 63). I'll explain the most common idiom used in the shellcode: