1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
# This class implements a simple NOP generator for LoongArch 64-bit (Little Endian)
7
class MetasploitModule < Msf::Nop
8

9
  def initialize
10
    super(
11
      'Name' => 'Simple',
12
      'Alias' => 'loongarch64_simple',
13
      'Description' => 'Simple NOP generator',
14
      'License' => MSF_LICENSE,
15
      'Author' => ['bcoles'],
16
      'Arch' => ARCH_LOONGARCH64)
17
    register_advanced_options([
18
      OptBool.new('RandomNops', [false, 'Generate a random NOP sled', true]),
19
    ])
20
  end
21

22
  def generate_sled(length, opts)
23
    badchars = opts['BadChars'] || ''
24
    random = opts['Random'] || datastore['RandomNops']
25

26
    # Safe NULL-free nops using general purpose registers ($r12 - $r31)
27
    # All instructions are NULL-free from the base ISA,
28
    # excluding optional extensions (FPU, LSX, LASX, ...)
29
    nops = [
30
      [0x03c0018c].pack('V'),    # xori $t0, $t0, 0
31
      [0x03c001ad].pack('V'),    # xori $t1, $t1, 0
32
      [0x03c001ce].pack('V'),    # xori $t2, $t2, 0
33
      [0x03c001ef].pack('V'),    # xori $t3, $t3, 0
34
      [0x03c00210].pack('V'),    # xori $t4, $t4, 0
35
      [0x03c00231].pack('V'),    # xori $t5, $t5, 0
36
      [0x03c00252].pack('V'),    # xori $t6, $t6, 0
37
      [0x03c00273].pack('V'),    # xori $t7, $t7, 0
38
      [0x03c00294].pack('V'),    # xori $t8, $t8, 0
39
      [0x03c002b5].pack('V'),    # xori $r21, $r21, 0
40
      [0x03c002d6].pack('V'),    # xori $fp, $fp, 0
41
      [0x03c002f7].pack('V'),    # xori $s0, $s0, 0
42
      [0x03c00318].pack('V'),    # xori $s1, $s1, 0
43
      [0x03c00339].pack('V'),    # xori $s2, $s2, 0
44
      [0x03c0035a].pack('V'),    # xori $s3, $s3, 0
45
      [0x03c0037b].pack('V'),    # xori $s4, $s4, 0
46
      [0x03c0039c].pack('V'),    # xori $s5, $s5, 0
47
      [0x03c003bd].pack('V'),    # xori $s6, $s6, 0
48
      [0x03c003de].pack('V'),    # xori $s7, $s7, 0
49
      [0x03c003ff].pack('V'),    # xori $s8, $s8, 0
50

51
      [0x0380018c].pack('V'),    # ori $t0, $t0, 0
52
      [0x038001ad].pack('V'),    # ori $t1, $t1, 0
53
      [0x038001ce].pack('V'),    # ori $t2, $t2, 0
54
      [0x038001ef].pack('V'),    # ori $t3, $t3, 0
55
      [0x03800210].pack('V'),    # ori $t4, $t4, 0
56
      [0x03800231].pack('V'),    # ori $t5, $t5, 0
57
      [0x03800252].pack('V'),    # ori $t6, $t6, 0
58
      [0x03800273].pack('V'),    # ori $t7, $t7, 0
59
      [0x03800294].pack('V'),    # ori $t8, $t8, 0
60
      [0x038002b5].pack('V'),    # ori $r21, $r21, 0
61
      [0x038002d6].pack('V'),    # ori $fp, $fp, 0
62
      [0x038002f7].pack('V'),    # ori $s0, $s0, 0
63
      [0x03800318].pack('V'),    # ori $s1, $s1, 0
64
      [0x03800339].pack('V'),    # ori $s2, $s2, 0
65
      [0x0380035a].pack('V'),    # ori $s3, $s3, 0
66
      [0x0380037b].pack('V'),    # ori $s4, $s4, 0
67
      [0x0380039c].pack('V'),    # ori $s5, $s5, 0
68
      [0x038003bd].pack('V'),    # ori $s6, $s6, 0
69
      [0x038003de].pack('V'),    # ori $s7, $s7, 0
70
      [0x038003ff].pack('V'),    # ori $s8, $s8, 0
71

72
      [0x02c0018c].pack('V'),    # addi.d $t0, $t0, 0
73
      [0x02c001ad].pack('V'),    # addi.d $t1, $t1, 0
74
      [0x02c001ce].pack('V'),    # addi.d $t2, $t2, 0
75
      [0x02c001ef].pack('V'),    # addi.d $t3, $t3, 0
76
      [0x02c00210].pack('V'),    # addi.d $t4, $t4, 0
77
      [0x02c00231].pack('V'),    # addi.d $t5, $t5, 0
78
      [0x02c00252].pack('V'),    # addi.d $t6, $t6, 0
79
      [0x02c00273].pack('V'),    # addi.d $t7, $t7, 0
80
      [0x02c00294].pack('V'),    # addi.d $t8, $t8, 0
81
      [0x02c002b5].pack('V'),    # addi.d $r21, $r21, 0
82
      [0x02c002d6].pack('V'),    # addi.d $fp, $fp, 0
83
      [0x02c002f7].pack('V'),    # addi.d $s0, $s0, 0
84
      [0x02c00318].pack('V'),    # addi.d $s1, $s1, 0
85
      [0x02c00339].pack('V'),    # addi.d $s2, $s2, 0
86
      [0x02c0035a].pack('V'),    # addi.d $s3, $s3, 0
87
      [0x02c0037b].pack('V'),    # addi.d $s4, $s4, 0
88
      [0x02c0039c].pack('V'),    # addi.d $s5, $s5, 0
89
      [0x02c003bd].pack('V'),    # addi.d $s6, $s6, 0
90
      [0x02c003de].pack('V'),    # addi.d $s7, $s7, 0
91
      [0x02c003ff].pack('V'),    # addi.d $s8, $s8, 0
92

93
      [0x0280018c].pack('V'),    # addi.w $t0, $t0, 0
94
      [0x028001ad].pack('V'),    # addi.w $t1, $t1, 0
95
      [0x028001ce].pack('V'),    # addi.w $t2, $t2, 0
96
      [0x028001ef].pack('V'),    # addi.w $t3, $t3, 0
97
      [0x02800210].pack('V'),    # addi.w $t4, $t4, 0
98
      [0x02800231].pack('V'),    # addi.w $t5, $t5, 0
99
      [0x02800252].pack('V'),    # addi.w $t6, $t6, 0
100
      [0x02800273].pack('V'),    # addi.w $t7, $t7, 0
101
      [0x02800294].pack('V'),    # addi.w $t8, $t8, 0
102
      [0x028002b5].pack('V'),    # addi.w $r21, $r21, 0
103
      [0x028002d6].pack('V'),    # addi.w $fp, $fp, 0
104
      [0x028002f7].pack('V'),    # addi.w $s0, $s0, 0
105
      [0x02800318].pack('V'),    # addi.w $s1, $s1, 0
106
      [0x02800339].pack('V'),    # addi.w $s2, $s2, 0
107
      [0x0280035a].pack('V'),    # addi.w $s3, $s3, 0
108
      [0x0280037b].pack('V'),    # addi.w $s4, $s4, 0
109
      [0x0280039c].pack('V'),    # addi.w $s5, $s5, 0
110
      [0x028003bd].pack('V'),    # addi.w $s6, $s6, 0
111
      [0x028003de].pack('V'),    # addi.w $s7, $s7, 0
112
      [0x028003ff].pack('V'),    # addi.w $s8, $s8, 0
113
    ]
114

115
    # Remove nops containing BadChars
116
    nops.delete_if do |nop|
117
      nop.bytes.any? { |byte| badchars.force_encoding('BINARY').include?(byte.chr) }
118
    end
119

120
    # Give up if no safe nops are available
121
    return if nops.empty?
122

123
    # Use random instructions for all NOPs
124
    if random
125
      sled = ''
126
      (length / 4).times do
127
        sled << nops.sample
128
      end
129
      return sled
130
    end
131

132
    # Use a single instruction for all NOPs
133
    return (nops.sample * (length / 4))
134
  end
135
end
136

137