1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
###
7
#
8
# SingleByte
9
# ----------
10
#
11
# This class implements simple NOP generator for PowerPC
12
#
13
###
14
class MetasploitModule < Msf::Nop
15

16
  def initialize
17
    super(
18
      'Name' => 'Simple',
19
      'Alias' => 'ppc_simple',
20
      'Description' => 'Simple NOP generator',
21
      'Author' => 'hdm',
22
      'License' => MSF_LICENSE,
23
      'Arch' => ARCH_PPC)
24

25
    register_advanced_options(
26
      [
27
        OptBool.new('RandomNops', [ false, 'Generate a random NOP sled', true ])
28
      ]
29
    )
30
  end
31

32
  def generate_sled(length, opts)
33
    badchars = opts['BadChars'] || ''
34
    random = opts['Random'] || datastore['RandomNops']
35

36
    if random
37
      1.upto(1024) do |_i|
38
        regs_d = (rand(0x8000 - 0x0800) + 0x0800).to_i
39
        regs_b = [regs_d].pack('n').unpack('B*')[0][1, 15]
40
        flag_o = rand(2).to_i
41
        flag_r = rand(2).to_i
42

43
        pcword = ["011111#{regs_b}#{flag_o}100001010#{flag_r}"].pack('B*')
44
        failed = false
45

46
        pcword.each_byte do |c|
47
          failed = true if badchars.include?(c.chr)
48
        end
49

50
        next if failed
51

52
        return (pcword * (length / 4))[0, length]
53
      end
54
    end
55

56
    return ("\x60" * length)[0, length]
57
  end
58
end
59

60