1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Encoder::Xor
7

8
  def initialize
9
    super(
10
      'Name' => 'PPC LongXOR Encoder',
11
      'Description' => %q{
12
        This encoder is ghandi's PPC dword xor encoder with some size tweaks
13
        by HDM.
14
      },
15
      'Author' => [ 'ddz', 'hdm' ],
16
      'Arch' => ARCH_PPC,
17
      'License' => MSF_LICENSE,
18
      'Decoder' => {
19
        'KeySize' => 4,
20
        'BlockSize' => 4,
21
        'KeyPack' => 'N'
22
      })
23
  end
24

25
  #
26
  # Returns the decoder stub that is adjusted for the size of
27
  # the buffer being encoded
28
  #
29
  def decoder_stub(_state)
30
    [
31
      0x7ca52a79,     # 0x1da8 <main>:          xor.    r5,r5,r5
32
      0x4082fffd,     # 0x1dac <main+4>:        bnel+   0x1da8 <main>
33
      0x7fe802a6,     # 0x1db0 <main+8>:        mflr    r31
34
      0x3bff07fa,     # 0x1db4 <main+12>:       addi    r31,r31,2042
35
      0x38a5f84a,     # 0x1db8 <main+16>:       addi    r5,r5,-1974
36
      0x3cc09999,     # 0x1dbc <main+20>:       lis     r6, hi16(key)
37
      0x60c69999,     # 0x1dc0 <main+24>:       ori     r6,r6, lo16(key)
38
      0x388507ba,     # 0x1dc4 <main+28>:       addi    r4,r5,1978
39
      0x7c8903a6,     # 0x1dc8 <main+32>:       mtctr   r4
40
      0x809ff84a,     # 0x1dcc <main+36>:       lwz     r4,-1974(r31)
41
      0x7c843278,     # 0x1dd0 <main+40>:       xor     r4,r4,r6
42
      0x909ff84a,     # 0x1dd4 <main+44>:       stw     r4,-1974(r31)
43
      0x7c05f8ac,     # 0x1dd8 <main+48>:       dcbf    r5,r31
44
      0x7cff04ac,     # 0x1ddc <main+52>:       sync
45
      0x7c05ffac,     # 0x1de0 <main+56>:       icbi    r5,r31
46
      0x3bc507ba,     # 0x1de4 <main+60>:       addi    r30,r5,1978
47
      0x7ffff215,     # 0x1de8 <main+64>:       add.    r31,r31,r30
48
      0x4220ffe0,     # 0x1dec <main+68>:       bdnz-   0x1dcc <main+36>
49
      0x4cff012c,     # 0x1df0 <main+72>:       isync
50
    ].pack('N*')
51
  end
52

53
  #
54
  # Fix up the decoder stub now
55
  #
56
  def encode_finalize_stub(state, stub)
57
    icount = state.buf.length / 4
58

59
    stub[30, 2] = [ 1974 + icount ].pack('n')
60
    stub[22, 2] = [ state.key.to_i ].pack('N')[0, 2]
61
    stub[26, 2] = [ state.key.to_i ].pack('N')[2, 2]
62

63
    stub
64
  end
65
end
66

67