modules/nops/loongarch64/simple.rb - master - githubmirror/metasploit-framework

modules/nops/loongarch64/simple.rb
135 строк6 KB
bcoles
Add support for LoongArch64 payloads
23 ноя 2025, 09:22
23 ноя 2025, 09:222e000c2
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

# This class implements a simple NOP generator for LoongArch 64-bit (Little Endian)
class MetasploitModule < Msf::Nop

  def initialize
    super(
      'Name' => 'Simple',
      'Alias' => 'loongarch64_simple',
      'Description' => 'Simple NOP generator',
      'License' => MSF_LICENSE,
      'Author' => ['bcoles'],
      'Arch' => ARCH_LOONGARCH64)
    register_advanced_options([
      OptBool.new('RandomNops', [false, 'Generate a random NOP sled', true]),
    ])
  end

  def generate_sled(length, opts)
    badchars = opts['BadChars'] || ''
    random = opts['Random'] || datastore['RandomNops']

    # Safe NULL-free nops using general purpose registers ($r12 - $r31)
    # All instructions are NULL-free from the base ISA,
    # excluding optional extensions (FPU, LSX, LASX, ...)
    nops = [
      [0x03c0018c].pack('V'),    # xori $t0, $t0, 0
      [0x03c001ad].pack('V'),    # xori $t1, $t1, 0
      [0x03c001ce].pack('V'),    # xori $t2, $t2, 0
      [0x03c001ef].pack('V'),    # xori $t3, $t3, 0
      [0x03c00210].pack('V'),    # xori $t4, $t4, 0
      [0x03c00231].pack('V'),    # xori $t5, $t5, 0
      [0x03c00252].pack('V'),    # xori $t6, $t6, 0
      [0x03c00273].pack('V'),    # xori $t7, $t7, 0
      [0x03c00294].pack('V'),    # xori $t8, $t8, 0
      [0x03c002b5].pack('V'),    # xori $r21, $r21, 0
      [0x03c002d6].pack('V'),    # xori $fp, $fp, 0
      [0x03c002f7].pack('V'),    # xori $s0, $s0, 0
      [0x03c00318].pack('V'),    # xori $s1, $s1, 0
      [0x03c00339].pack('V'),    # xori $s2, $s2, 0
      [0x03c0035a].pack('V'),    # xori $s3, $s3, 0
      [0x03c0037b].pack('V'),    # xori $s4, $s4, 0
      [0x03c0039c].pack('V'),    # xori $s5, $s5, 0
      [0x03c003bd].pack('V'),    # xori $s6, $s6, 0
      [0x03c003de].pack('V'),    # xori $s7, $s7, 0
      [0x03c003ff].pack('V'),    # xori $s8, $s8, 0

      [0x0380018c].pack('V'),    # ori $t0, $t0, 0
      [0x038001ad].pack('V'),    # ori $t1, $t1, 0
      [0x038001ce].pack('V'),    # ori $t2, $t2, 0
      [0x038001ef].pack('V'),    # ori $t3, $t3, 0
      [0x03800210].pack('V'),    # ori $t4, $t4, 0
      [0x03800231].pack('V'),    # ori $t5, $t5, 0
      [0x03800252].pack('V'),    # ori $t6, $t6, 0
      [0x03800273].pack('V'),    # ori $t7, $t7, 0
      [0x03800294].pack('V'),    # ori $t8, $t8, 0
      [0x038002b5].pack('V'),    # ori $r21, $r21, 0
      [0x038002d6].pack('V'),    # ori $fp, $fp, 0
      [0x038002f7].pack('V'),    # ori $s0, $s0, 0
      [0x03800318].pack('V'),    # ori $s1, $s1, 0
      [0x03800339].pack('V'),    # ori $s2, $s2, 0
      [0x0380035a].pack('V'),    # ori $s3, $s3, 0
      [0x0380037b].pack('V'),    # ori $s4, $s4, 0
      [0x0380039c].pack('V'),    # ori $s5, $s5, 0
      [0x038003bd].pack('V'),    # ori $s6, $s6, 0
      [0x038003de].pack('V'),    # ori $s7, $s7, 0
      [0x038003ff].pack('V'),    # ori $s8, $s8, 0

      [0x02c0018c].pack('V'),    # addi.d $t0, $t0, 0
      [0x02c001ad].pack('V'),    # addi.d $t1, $t1, 0
      [0x02c001ce].pack('V'),    # addi.d $t2, $t2, 0
      [0x02c001ef].pack('V'),    # addi.d $t3, $t3, 0
      [0x02c00210].pack('V'),    # addi.d $t4, $t4, 0
      [0x02c00231].pack('V'),    # addi.d $t5, $t5, 0
      [0x02c00252].pack('V'),    # addi.d $t6, $t6, 0
      [0x02c00273].pack('V'),    # addi.d $t7, $t7, 0
      [0x02c00294].pack('V'),    # addi.d $t8, $t8, 0
      [0x02c002b5].pack('V'),    # addi.d $r21, $r21, 0
      [0x02c002d6].pack('V'),    # addi.d $fp, $fp, 0
      [0x02c002f7].pack('V'),    # addi.d $s0, $s0, 0
      [0x02c00318].pack('V'),    # addi.d $s1, $s1, 0
      [0x02c00339].pack('V'),    # addi.d $s2, $s2, 0
      [0x02c0035a].pack('V'),    # addi.d $s3, $s3, 0
      [0x02c0037b].pack('V'),    # addi.d $s4, $s4, 0
      [0x02c0039c].pack('V'),    # addi.d $s5, $s5, 0
      [0x02c003bd].pack('V'),    # addi.d $s6, $s6, 0
      [0x02c003de].pack('V'),    # addi.d $s7, $s7, 0
      [0x02c003ff].pack('V'),    # addi.d $s8, $s8, 0

      [0x0280018c].pack('V'),    # addi.w $t0, $t0, 0
      [0x028001ad].pack('V'),    # addi.w $t1, $t1, 0
      [0x028001ce].pack('V'),    # addi.w $t2, $t2, 0
      [0x028001ef].pack('V'),    # addi.w $t3, $t3, 0
      [0x02800210].pack('V'),    # addi.w $t4, $t4, 0
      [0x02800231].pack('V'),    # addi.w $t5, $t5, 0
      [0x02800252].pack('V'),    # addi.w $t6, $t6, 0
      [0x02800273].pack('V'),    # addi.w $t7, $t7, 0
      [0x02800294].pack('V'),    # addi.w $t8, $t8, 0
      [0x028002b5].pack('V'),    # addi.w $r21, $r21, 0
      [0x028002d6].pack('V'),    # addi.w $fp, $fp, 0
      [0x028002f7].pack('V'),    # addi.w $s0, $s0, 0
      [0x02800318].pack('V'),    # addi.w $s1, $s1, 0
      [0x02800339].pack('V'),    # addi.w $s2, $s2, 0
      [0x0280035a].pack('V'),    # addi.w $s3, $s3, 0
      [0x0280037b].pack('V'),    # addi.w $s4, $s4, 0
      [0x0280039c].pack('V'),    # addi.w $s5, $s5, 0
      [0x028003bd].pack('V'),    # addi.w $s6, $s6, 0
      [0x028003de].pack('V'),    # addi.w $s7, $s7, 0
      [0x028003ff].pack('V'),    # addi.w $s8, $s8, 0
    ]

    # Remove nops containing BadChars
    nops.delete_if do |nop|
      nop.bytes.any? { |byte| badchars.force_encoding('BINARY').include?(byte.chr) }
    end

    # Give up if no safe nops are available
    return if nops.empty?

    # Use random instructions for all NOPs
    if random
      sled = ''
      (length / 4).times do
        sled << nops.sample
      end
      return sled
    end

    # Use a single instruction for all NOPs
    return (nops.sample * (length / 4))
  end
end