Showing preview only (9,466K chars total). Download the full file or copy to clipboard to get everything.
Repository: Gallopsled/pwntools
Branch: dev
Commit: 0386e8a8ee10
Files: 1386
Total size: 8.8 MB
Directory structure:
gitextract_ig0lwdlw/
├── .gitattributes
├── .github/
│ ├── ISSUE_TEMPLATE/
│ │ ├── bug_report.md
│ │ ├── feature_request.md
│ │ └── question.md
│ ├── ISSUE_TEMPLATE.md
│ ├── PULL_REQUEST_TEMPLATE.md
│ ├── dependabot.yml
│ └── workflows/
│ ├── changelog.yml
│ ├── ci.yml
│ ├── docker.yml
│ ├── lint.yml
│ ├── merge-conflict.yml
│ └── pylint.yml
├── .gitignore
├── .isort.cfg
├── .readthedocs.yaml
├── .sublime-settings
├── CHANGELOG.md
├── CONTRIBUTING.md
├── DOCKER.md
├── LICENSE-pwntools.txt
├── MANIFEST.in
├── README.md
├── SECURITY.md
├── TESTING.md
├── docs/
│ ├── .gitignore
│ ├── Makefile
│ ├── requirements.txt
│ └── source/
│ ├── about.rst
│ ├── adb.rst
│ ├── args.rst
│ ├── asm.rst
│ ├── atexception.rst
│ ├── atexit.rst
│ ├── commandline.rst
│ ├── conf.py
│ ├── config.rst
│ ├── constants.rst
│ ├── context.rst
│ ├── dynelf.rst
│ ├── elf/
│ │ ├── config.rst
│ │ ├── corefile.rst
│ │ └── elf.rst
│ ├── elf.rst
│ ├── encoders.rst
│ ├── exception.rst
│ ├── filepointer.rst
│ ├── filesystem.rst
│ ├── flag.rst
│ ├── fmtstr.rst
│ ├── gdb.rst
│ ├── globals.rst
│ ├── index.rst
│ ├── install/
│ │ ├── binutils.rst
│ │ └── headers.rst
│ ├── install.rst
│ ├── intro.rst
│ ├── libc/
│ │ └── glibc.rst
│ ├── libc.rst
│ ├── libcdb.rst
│ ├── log.rst
│ ├── memleak.rst
│ ├── protocols.rst
│ ├── qemu.rst
│ ├── regsort.rst
│ ├── replacements.rst
│ ├── rop/
│ │ ├── ret2dlresolve.rst
│ │ ├── rop.rst
│ │ └── srop.rst
│ ├── rop.rst
│ ├── runner.rst
│ ├── shellcraft/
│ │ ├── aarch64.rst
│ │ ├── amd64.rst
│ │ ├── arm.rst
│ │ ├── common.rst
│ │ ├── i386.rst
│ │ ├── loongarch64.rst
│ │ ├── mips.rst
│ │ ├── riscv64.rst
│ │ └── thumb.rst
│ ├── shellcraft.rst
│ ├── term/
│ │ └── readline.rst
│ ├── term.rst
│ ├── testexample.rst
│ ├── timeout.rst
│ ├── tubes/
│ │ ├── buffer.rst
│ │ ├── processes.rst
│ │ ├── serial.rst
│ │ ├── sockets.rst
│ │ └── ssh.rst
│ ├── tubes.rst
│ ├── ui.rst
│ ├── update.rst
│ ├── useragents.rst
│ ├── util/
│ │ ├── crc.rst
│ │ ├── cyclic.rst
│ │ ├── fiddling.rst
│ │ ├── getdents.rst
│ │ ├── hashes.rst
│ │ ├── iters.rst
│ │ ├── lists.rst
│ │ ├── misc.rst
│ │ ├── net.rst
│ │ ├── packing.rst
│ │ ├── proc.rst
│ │ ├── safeeval.rst
│ │ ├── sh_string.rst
│ │ └── web.rst
│ └── windbg.rst
├── examples/
│ ├── README.md
│ ├── android.py
│ ├── args.py
│ ├── asm.py
│ ├── attach.py
│ ├── clean_and_log.py
│ ├── fmtstr/
│ │ ├── Makefile
│ │ ├── exploit.py
│ │ ├── exploit2.py
│ │ ├── printf-loop.c
│ │ ├── printf-loop.native
│ │ ├── printf-loop.native32
│ │ ├── printf.aarch64
│ │ ├── printf.arm
│ │ ├── printf.c
│ │ ├── printf.mips
│ │ ├── printf.mips64
│ │ ├── printf.mips64el
│ │ ├── printf.mipsel
│ │ ├── printf.native
│ │ ├── printf.native32
│ │ ├── printf.ppc
│ │ ├── printf.ppc64
│ │ └── printf.sparc64
│ ├── gdb_api.py
│ ├── gen-README.py
│ ├── indented.py
│ ├── listen_uroboros.py
│ ├── options.py
│ ├── port_forward.py
│ ├── readline_completers.py
│ ├── remote.py
│ ├── remote_gdb_debugging.py
│ ├── sigreturn_corefile_aarch64.py
│ ├── sigreturn_corefile_amd64.py
│ ├── sigreturn_corefile_arm.py
│ ├── sigreturn_corefile_i386.py
│ ├── spinners.py
│ ├── splash.py
│ ├── ssh.py
│ ├── text.py
│ └── yesno.py
├── extra/
│ ├── bash_completion.d/
│ │ ├── README.md
│ │ ├── install.sh
│ │ ├── pwn
│ │ └── shellcraft
│ ├── docker/
│ │ ├── Makefile
│ │ ├── README.md
│ │ ├── base/
│ │ │ └── Dockerfile
│ │ ├── beta/
│ │ │ └── Dockerfile
│ │ ├── dev/
│ │ │ └── Dockerfile
│ │ ├── develop/
│ │ │ ├── 10-import.py
│ │ │ ├── Dockerfile
│ │ │ └── ipython_config.py
│ │ └── stable/
│ │ └── Dockerfile
│ ├── textmate/
│ │ ├── README.md
│ │ ├── pwntools.YAML-tmLanguage
│ │ └── pwntools.tmLanguage
│ └── zsh_completion/
│ ├── README.md
│ ├── _pwn
│ └── install.zsh
├── pwn/
│ ├── __init__.py
│ └── toplevel.py
├── pwnlib/
│ ├── __init__.py
│ ├── abi.py
│ ├── adb/
│ │ ├── __init__.py
│ │ ├── adb.py
│ │ ├── bootimg.py
│ │ ├── bootloader.py
│ │ └── protocol.py
│ ├── args.py
│ ├── asm.py
│ ├── atexception.py
│ ├── atexit.py
│ ├── commandline/
│ │ ├── __init__.py
│ │ ├── asm.py
│ │ ├── checksec.py
│ │ ├── common.py
│ │ ├── constgrep.py
│ │ ├── cyclic.py
│ │ ├── debug.py
│ │ ├── disablenx.py
│ │ ├── disasm.py
│ │ ├── elfdiff.py
│ │ ├── elfpatch.py
│ │ ├── errno.py
│ │ ├── hex.py
│ │ ├── libcdb.py
│ │ ├── main.py
│ │ ├── phd.py
│ │ ├── pwnstrip.py
│ │ ├── scramble.py
│ │ ├── shellcraft.py
│ │ ├── template.py
│ │ ├── unhex.py
│ │ ├── update.py
│ │ └── version.py
│ ├── config.py
│ ├── constants/
│ │ ├── LICENSE.txt
│ │ ├── __init__.py
│ │ ├── cgc/
│ │ │ ├── __init__.py
│ │ │ └── thumb.py
│ │ ├── constant.py
│ │ ├── darwin/
│ │ │ ├── __init__.py
│ │ │ ├── aarch64.py
│ │ │ └── amd64.py
│ │ ├── freebsd.py
│ │ └── linux/
│ │ ├── __init__.py
│ │ ├── aarch64.py
│ │ ├── alpha.py
│ │ ├── amd64.py
│ │ ├── arm.py
│ │ ├── i386.py
│ │ ├── ia64.py
│ │ ├── loongarch64.py
│ │ ├── mips.py
│ │ ├── powerpc.py
│ │ ├── powerpc64.py
│ │ ├── riscv64.py
│ │ ├── s390.py
│ │ ├── s390x.py
│ │ ├── sparc.py
│ │ ├── sparc64.py
│ │ └── thumb.py
│ ├── context/
│ │ └── __init__.py
│ ├── data/
│ │ ├── __init__.py
│ │ ├── crcsums.txt
│ │ ├── elf/
│ │ │ ├── __init__.py
│ │ │ ├── fmtstr/
│ │ │ │ ├── Makefile
│ │ │ │ ├── __init__.py
│ │ │ │ ├── i386
│ │ │ │ └── vuln.c
│ │ │ ├── relro/
│ │ │ │ ├── __init__.py
│ │ │ │ ├── test-x86-full
│ │ │ │ ├── test-x86-full-nodt
│ │ │ │ ├── test-x86-none
│ │ │ │ ├── test-x86-none-now
│ │ │ │ ├── test-x86-none-now-nodt
│ │ │ │ └── test-x86-partial
│ │ │ ├── ret2dlresolve/
│ │ │ │ ├── Makefile
│ │ │ │ ├── __init__.py
│ │ │ │ ├── amd64
│ │ │ │ ├── i386
│ │ │ │ └── vuln.c
│ │ │ ├── test-aarch64
│ │ │ ├── test-aarch64-big
│ │ │ ├── test-aarch64-big-pie
│ │ │ ├── test-aarch64-big-relro
│ │ │ ├── test-aarch64-big-relro-pie
│ │ │ ├── test-aarch64-pie
│ │ │ ├── test-aarch64-relro
│ │ │ ├── test-aarch64-relro-pie
│ │ │ ├── test-arm
│ │ │ ├── test-arm-big
│ │ │ ├── test-arm-big-pie
│ │ │ ├── test-arm-big-relro
│ │ │ ├── test-arm-big-relro-pie
│ │ │ ├── test-arm-pie
│ │ │ ├── test-arm-relro
│ │ │ ├── test-arm-relro-pie
│ │ │ ├── test-mips-big
│ │ │ ├── test-mips-big-pie
│ │ │ ├── test-mips-big-pie-relro
│ │ │ ├── test-mips-big-relro
│ │ │ ├── test-riscv64
│ │ │ ├── test-riscv64-pie
│ │ │ ├── test-riscv64-relro
│ │ │ ├── test-riscv64-relro-pie
│ │ │ ├── test-thumb
│ │ │ ├── test-thumb-big
│ │ │ ├── test-thumb-big-pie
│ │ │ ├── test-thumb-big-relro
│ │ │ ├── test-thumb-big-relro-pie
│ │ │ ├── test-thumb-pie
│ │ │ ├── test-thumb-relro
│ │ │ ├── test-thumb-relro-pie
│ │ │ ├── test-x32
│ │ │ ├── test-x32-pie
│ │ │ ├── test-x32-relro
│ │ │ ├── test-x32-relro-pie
│ │ │ ├── test-x64
│ │ │ ├── test-x64-cfp
│ │ │ ├── test-x64-pie
│ │ │ ├── test-x64-relro
│ │ │ ├── test-x64-relro-pie
│ │ │ ├── test-x86
│ │ │ ├── test-x86-cfp
│ │ │ ├── test-x86-pie
│ │ │ ├── test-x86-relro
│ │ │ └── test-x86-relro-pie
│ │ ├── includes/
│ │ │ ├── LICENSE.txt
│ │ │ ├── cgc/
│ │ │ │ └── arm.h
│ │ │ ├── darwin/
│ │ │ │ ├── aarch64.h
│ │ │ │ └── amd64.h
│ │ │ ├── freebsd.h
│ │ │ ├── generator/
│ │ │ │ ├── freebsd/
│ │ │ │ │ ├── common.h
│ │ │ │ │ ├── machine/
│ │ │ │ │ │ ├── _align.h
│ │ │ │ │ │ ├── _limits.h
│ │ │ │ │ │ └── signal.h
│ │ │ │ │ ├── sys/
│ │ │ │ │ │ ├── _iovec.h
│ │ │ │ │ │ ├── _sigset.h
│ │ │ │ │ │ ├── _sockaddr_storage.h
│ │ │ │ │ │ ├── _timespec.h
│ │ │ │ │ │ ├── _types.h
│ │ │ │ │ │ ├── cdefs.h
│ │ │ │ │ │ ├── errno.h
│ │ │ │ │ │ ├── fcntl.h
│ │ │ │ │ │ ├── mman.h
│ │ │ │ │ │ ├── signal.h
│ │ │ │ │ │ ├── socket.h
│ │ │ │ │ │ ├── stat.h
│ │ │ │ │ │ ├── syscall.h
│ │ │ │ │ │ ├── time.h
│ │ │ │ │ │ └── unistd.h
│ │ │ │ │ └── vm/
│ │ │ │ │ └── vm.h
│ │ │ │ ├── generate_constants.sh
│ │ │ │ ├── linux/
│ │ │ │ │ ├── aarch64.h
│ │ │ │ │ ├── alpha.h
│ │ │ │ │ ├── amd64.h
│ │ │ │ │ ├── arm.h
│ │ │ │ │ ├── common.h
│ │ │ │ │ ├── diet/
│ │ │ │ │ │ ├── aarch64/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── alpha/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── arm/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── asm/
│ │ │ │ │ │ │ ├── aarch64-sigcontext.h
│ │ │ │ │ │ │ ├── alpha-sigcontext.h
│ │ │ │ │ │ │ ├── arm-sigcontext.h
│ │ │ │ │ │ │ ├── i386-sigcontext.h
│ │ │ │ │ │ │ ├── ia64-sigcontext.h
│ │ │ │ │ │ │ ├── mips-sigcontext.h
│ │ │ │ │ │ │ ├── parisc-sigcontext.h
│ │ │ │ │ │ │ ├── ppc-sigcontext.h
│ │ │ │ │ │ │ ├── s390-sigcontext.h
│ │ │ │ │ │ │ ├── sigcontext.h
│ │ │ │ │ │ │ ├── sparc-sigcontext.h
│ │ │ │ │ │ │ ├── types.h
│ │ │ │ │ │ │ └── x86_64-sigcontext.h
│ │ │ │ │ │ ├── endian.h
│ │ │ │ │ │ ├── errno.h
│ │ │ │ │ │ ├── fcntl.h
│ │ │ │ │ │ ├── i386/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── ia64/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── inttypes.h
│ │ │ │ │ │ ├── linuxnet.h
│ │ │ │ │ │ ├── loongarch64/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── mips/
│ │ │ │ │ │ │ ├── mips-asm.h
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── mips64/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── mipsel/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── parisc/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── ppc/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── ppc64/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── ppc64le/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── riscv64/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── s390/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── s390x/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── signal.h
│ │ │ │ │ │ ├── sparc/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── sparc64/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── stddef.h
│ │ │ │ │ │ ├── stdint.h
│ │ │ │ │ │ ├── string.h
│ │ │ │ │ │ ├── sys/
│ │ │ │ │ │ │ ├── cdefs.h
│ │ │ │ │ │ │ ├── fsuid.h
│ │ │ │ │ │ │ ├── mman.h
│ │ │ │ │ │ │ ├── ptrace.h
│ │ │ │ │ │ │ ├── select.h
│ │ │ │ │ │ │ ├── socket.h
│ │ │ │ │ │ │ ├── stat.h
│ │ │ │ │ │ │ ├── time.h
│ │ │ │ │ │ │ ├── types.h
│ │ │ │ │ │ │ ├── ucontext.h
│ │ │ │ │ │ │ └── uio.h
│ │ │ │ │ │ ├── unistd.h
│ │ │ │ │ │ ├── x32/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ └── x86_64/
│ │ │ │ │ │ ├── syscalls.h
│ │ │ │ │ │ └── syscalls32.h
│ │ │ │ │ ├── i386.h
│ │ │ │ │ ├── ia64.h
│ │ │ │ │ ├── loongarch64.h
│ │ │ │ │ ├── mips.h
│ │ │ │ │ ├── powerpc.h
│ │ │ │ │ ├── powerpc64.h
│ │ │ │ │ ├── riscv64.h
│ │ │ │ │ ├── s390.h
│ │ │ │ │ ├── s390x.h
│ │ │ │ │ ├── sparc.h
│ │ │ │ │ ├── sparc64.h
│ │ │ │ │ ├── syscall_map.h
│ │ │ │ │ └── thumb.h
│ │ │ │ └── load_constants.py
│ │ │ └── linux/
│ │ │ ├── aarch64.h
│ │ │ ├── alpha.h
│ │ │ ├── amd64.h
│ │ │ ├── arm.h
│ │ │ ├── i386.h
│ │ │ ├── ia64.h
│ │ │ ├── loongarch64.h
│ │ │ ├── mips.h
│ │ │ ├── powerpc.h
│ │ │ ├── powerpc64.h
│ │ │ ├── riscv64.h
│ │ │ ├── s390.h
│ │ │ ├── s390x.h
│ │ │ ├── sparc.h
│ │ │ ├── sparc64.h
│ │ │ └── thumb.h
│ │ ├── syscalls/
│ │ │ ├── Makefile
│ │ │ ├── generate.py
│ │ │ └── generate_darwin.py
│ │ ├── templates/
│ │ │ └── pwnup.mako
│ │ └── useragents/
│ │ ├── LICENSE.txt
│ │ ├── download-useragents.py
│ │ └── useragents.txt
│ ├── device.py
│ ├── dynelf.py
│ ├── elf/
│ │ ├── __init__.py
│ │ ├── config.py
│ │ ├── corefile.py
│ │ ├── datatypes.py
│ │ ├── elf.py
│ │ ├── maps.py
│ │ └── plt.py
│ ├── encoders/
│ │ ├── __init__.py
│ │ ├── amd64/
│ │ │ ├── __init__.py
│ │ │ └── delta.py
│ │ ├── arm/
│ │ │ ├── __init__.py
│ │ │ ├── alphanumeric/
│ │ │ │ ├── ARM_Instructions.py
│ │ │ │ ├── __init__.py
│ │ │ │ ├── alphanum_byte.py
│ │ │ │ ├── alphanumeric.py
│ │ │ │ ├── builder.py
│ │ │ │ └── random_funcs.py
│ │ │ └── xor.py
│ │ ├── encoder.py
│ │ ├── i386/
│ │ │ ├── __init__.py
│ │ │ ├── ascii_shellcode.py
│ │ │ ├── delta.py
│ │ │ └── xor.py
│ │ └── mips/
│ │ ├── __init__.py
│ │ └── xor.py
│ ├── exception.py
│ ├── filepointer.py
│ ├── filesystem/
│ │ ├── __init__.py
│ │ ├── path.py
│ │ └── ssh.py
│ ├── flag/
│ │ ├── __init__.py
│ │ └── flag.py
│ ├── fmtstr.py
│ ├── gdb.py
│ ├── gdb_api_bridge.py
│ ├── gdb_faketerminal.py
│ ├── internal/
│ │ ├── __init__.py
│ │ └── dochelper.py
│ ├── lexer.py
│ ├── libc/
│ │ ├── __init__.py
│ │ └── glibc.py
│ ├── libcdb.py
│ ├── log.py
│ ├── memleak.py
│ ├── protocols/
│ │ ├── __init__.py
│ │ └── adb/
│ │ └── __init__.py
│ ├── py2compat.py
│ ├── qemu.py
│ ├── regsort.py
│ ├── replacements.py
│ ├── rop/
│ │ ├── __init__.py
│ │ ├── call.py
│ │ ├── gadgets.py
│ │ ├── ret2csu.py
│ │ ├── ret2dlresolve.py
│ │ ├── rop.py
│ │ └── srop.py
│ ├── runner.py
│ ├── shellcraft/
│ │ ├── __init__.py
│ │ ├── internal.py
│ │ ├── registers.py
│ │ └── templates/
│ │ ├── __doc__
│ │ ├── aarch64/
│ │ │ ├── __doc__
│ │ │ ├── breakpoint.asm
│ │ │ ├── crash.asm
│ │ │ ├── darwin/
│ │ │ │ ├── __doc__
│ │ │ │ ├── cat.asm
│ │ │ │ ├── cat2.asm
│ │ │ │ ├── open.asm
│ │ │ │ ├── syscall.asm
│ │ │ │ └── syscalls/
│ │ │ │ ├── __doc__
│ │ │ │ ├── execve.asm
│ │ │ │ ├── exit.asm
│ │ │ │ ├── getdirentries64.asm
│ │ │ │ ├── getxattr.asm
│ │ │ │ ├── lseek.asm
│ │ │ │ ├── read.asm
│ │ │ │ └── write.asm
│ │ │ ├── freebsd/
│ │ │ │ ├── __doc__
│ │ │ │ └── syscall.asm
│ │ │ ├── infloop.asm
│ │ │ ├── linux/
│ │ │ │ ├── __doc__
│ │ │ │ ├── cat.asm
│ │ │ │ ├── cat2.asm
│ │ │ │ ├── connect.asm
│ │ │ │ ├── dupio.asm
│ │ │ │ ├── dupsh.asm
│ │ │ │ ├── echo.asm
│ │ │ │ ├── forkexit.asm
│ │ │ │ ├── killparent.asm
│ │ │ │ ├── loader.asm
│ │ │ │ ├── loader_append.asm
│ │ │ │ ├── open.asm
│ │ │ │ ├── readn.asm
│ │ │ │ ├── setresuid.asm
│ │ │ │ ├── sh.asm
│ │ │ │ ├── socket.asm
│ │ │ │ ├── stage.asm
│ │ │ │ └── syscall.asm
│ │ │ ├── memcpy.asm
│ │ │ ├── mov.asm
│ │ │ ├── push.asm
│ │ │ ├── pushstr.asm
│ │ │ ├── pushstr_array.asm
│ │ │ ├── setregs.asm
│ │ │ └── xor.asm
│ │ ├── amd64/
│ │ │ ├── __doc__
│ │ │ ├── crash.asm
│ │ │ ├── darwin/
│ │ │ │ ├── __doc__
│ │ │ │ ├── cat.asm
│ │ │ │ ├── cat2.asm
│ │ │ │ ├── open.asm
│ │ │ │ ├── syscall.asm
│ │ │ │ └── syscalls/
│ │ │ │ ├── __doc__
│ │ │ │ ├── execve.asm
│ │ │ │ ├── exit.asm
│ │ │ │ ├── getdirentries64.asm
│ │ │ │ ├── getxattr.asm
│ │ │ │ ├── lseek.asm
│ │ │ │ ├── read.asm
│ │ │ │ └── write.asm
│ │ │ ├── freebsd/
│ │ │ │ ├── __doc__
│ │ │ │ ├── amd64_to_i386.asm
│ │ │ │ └── syscall.asm
│ │ │ ├── infloop.asm
│ │ │ ├── itoa.asm
│ │ │ ├── linux/
│ │ │ │ ├── __doc__
│ │ │ │ ├── amd64_to_i386.asm
│ │ │ │ ├── bindsh.asm
│ │ │ │ ├── cat.asm
│ │ │ │ ├── cat2.asm
│ │ │ │ ├── connect.asm
│ │ │ │ ├── connectstager.asm
│ │ │ │ ├── dupio.asm
│ │ │ │ ├── dupsh.asm
│ │ │ │ ├── echo.asm
│ │ │ │ ├── egghunter.asm
│ │ │ │ ├── findpeer.asm
│ │ │ │ ├── findpeersh.asm
│ │ │ │ ├── findpeerstager.asm
│ │ │ │ ├── forkbomb.asm
│ │ │ │ ├── forkexit.asm
│ │ │ │ ├── getpid.asm
│ │ │ │ ├── killparent.asm
│ │ │ │ ├── listen.asm
│ │ │ │ ├── loader.asm
│ │ │ │ ├── loader_append.asm
│ │ │ │ ├── membot.asm
│ │ │ │ ├── migrate_stack.asm
│ │ │ │ ├── mmap_rwx.asm
│ │ │ │ ├── read.asm
│ │ │ │ ├── read_upto.asm
│ │ │ │ ├── readfile.asm
│ │ │ │ ├── readinto.asm
│ │ │ │ ├── readloop.asm
│ │ │ │ ├── readn.asm
│ │ │ │ ├── readptr.asm
│ │ │ │ ├── recvsize.asm
│ │ │ │ ├── setregid.asm
│ │ │ │ ├── setresuid.asm
│ │ │ │ ├── setreuid.asm
│ │ │ │ ├── sh.asm
│ │ │ │ ├── socket.asm
│ │ │ │ ├── stage.asm
│ │ │ │ ├── stager.asm
│ │ │ │ ├── strace_dos.asm
│ │ │ │ ├── syscall.asm
│ │ │ │ └── writeloop.asm
│ │ │ ├── memcpy.asm
│ │ │ ├── mov.asm
│ │ │ ├── nop.asm
│ │ │ ├── popad.asm
│ │ │ ├── push.asm
│ │ │ ├── pushad.asm
│ │ │ ├── pushstr.asm
│ │ │ ├── pushstr_array.asm
│ │ │ ├── ret.asm
│ │ │ ├── setregs.asm
│ │ │ ├── strcpy.asm
│ │ │ ├── strlen.asm
│ │ │ ├── trap.asm
│ │ │ ├── windows/
│ │ │ │ ├── __doc__
│ │ │ │ ├── cmd.asm
│ │ │ │ ├── getexport.asm
│ │ │ │ ├── getprocaddress.asm
│ │ │ │ ├── kernel32base.asm
│ │ │ │ ├── ntdllbase.asm
│ │ │ │ ├── peb.asm
│ │ │ │ ├── teb.asm
│ │ │ │ └── winexec.asm
│ │ │ └── xor.asm
│ │ ├── arm/
│ │ │ ├── __doc__
│ │ │ ├── crash.asm
│ │ │ ├── freebsd/
│ │ │ │ ├── __doc__
│ │ │ │ └── syscall.asm
│ │ │ ├── infloop.asm
│ │ │ ├── itoa.asm
│ │ │ ├── linux/
│ │ │ │ ├── __doc__
│ │ │ │ ├── cacheflush.asm
│ │ │ │ ├── cat.asm
│ │ │ │ ├── cat2.asm
│ │ │ │ ├── connect.asm
│ │ │ │ ├── dir.asm
│ │ │ │ ├── dupio.asm
│ │ │ │ ├── dupsh.asm
│ │ │ │ ├── echo.asm
│ │ │ │ ├── egghunter.asm
│ │ │ │ ├── forkbomb.asm
│ │ │ │ ├── forkexit.asm
│ │ │ │ ├── killparent.asm
│ │ │ │ ├── open_file.asm
│ │ │ │ ├── setresuid.asm
│ │ │ │ ├── sh.asm
│ │ │ │ └── syscall.asm
│ │ │ ├── memcpy.asm
│ │ │ ├── mov.asm
│ │ │ ├── nop.asm
│ │ │ ├── push.asm
│ │ │ ├── pushstr.asm
│ │ │ ├── pushstr_array.asm
│ │ │ ├── ret.asm
│ │ │ ├── setregs.asm
│ │ │ ├── to_thumb.asm
│ │ │ ├── trap.asm
│ │ │ ├── udiv_10.asm
│ │ │ └── xor.asm
│ │ ├── common/
│ │ │ ├── __doc__
│ │ │ ├── freebsd/
│ │ │ │ └── __doc__
│ │ │ ├── label.asm
│ │ │ └── linux/
│ │ │ ├── __doc__
│ │ │ ├── kill.asm
│ │ │ ├── sleep.asm
│ │ │ └── syscalls/
│ │ │ ├── __doc__
│ │ │ ├── _llseek.asm
│ │ │ ├── _newselect.asm
│ │ │ ├── _sysctl.asm
│ │ │ ├── accept.asm
│ │ │ ├── accept4.asm
│ │ │ ├── access.asm
│ │ │ ├── acct.asm
│ │ │ ├── add_key.asm
│ │ │ ├── adjtimex.asm
│ │ │ ├── afs_syscall.asm
│ │ │ ├── alarm.asm
│ │ │ ├── arch_prctl.asm
│ │ │ ├── arch_specific_syscall.asm
│ │ │ ├── arm_fadvise64_64.asm
│ │ │ ├── arm_sync_file_range.asm
│ │ │ ├── bdflush.asm
│ │ │ ├── bind.asm
│ │ │ ├── bpf.asm
│ │ │ ├── break_.asm
│ │ │ ├── brk.asm
│ │ │ ├── cachectl.asm
│ │ │ ├── cacheflush.asm
│ │ │ ├── capget.asm
│ │ │ ├── capset.asm
│ │ │ ├── chdir.asm
│ │ │ ├── chmod.asm
│ │ │ ├── chown.asm
│ │ │ ├── chown32.asm
│ │ │ ├── chroot.asm
│ │ │ ├── clock_adjtime.asm
│ │ │ ├── clock_adjtime64.asm
│ │ │ ├── clock_getres.asm
│ │ │ ├── clock_getres_time64.asm
│ │ │ ├── clock_gettime.asm
│ │ │ ├── clock_gettime64.asm
│ │ │ ├── clock_nanosleep.asm
│ │ │ ├── clock_nanosleep_time64.asm
│ │ │ ├── clock_settime.asm
│ │ │ ├── clock_settime64.asm
│ │ │ ├── clone.asm
│ │ │ ├── clone3.asm
│ │ │ ├── close.asm
│ │ │ ├── close_range.asm
│ │ │ ├── connect.asm
│ │ │ ├── copy_file_range.asm
│ │ │ ├── creat.asm
│ │ │ ├── create_module.asm
│ │ │ ├── delete_module.asm
│ │ │ ├── dup.asm
│ │ │ ├── dup2.asm
│ │ │ ├── dup3.asm
│ │ │ ├── epoll_create.asm
│ │ │ ├── epoll_create1.asm
│ │ │ ├── epoll_ctl.asm
│ │ │ ├── epoll_ctl_old.asm
│ │ │ ├── epoll_pwait.asm
│ │ │ ├── epoll_pwait2.asm
│ │ │ ├── epoll_wait.asm
│ │ │ ├── epoll_wait_old.asm
│ │ │ ├── eventfd.asm
│ │ │ ├── eventfd2.asm
│ │ │ ├── execve.asm
│ │ │ ├── execveat.asm
│ │ │ ├── exit.asm
│ │ │ ├── exit_group.asm
│ │ │ ├── faccessat.asm
│ │ │ ├── faccessat2.asm
│ │ │ ├── fadvise64.asm
│ │ │ ├── fadvise64_64.asm
│ │ │ ├── fallocate.asm
│ │ │ ├── fanotify_init.asm
│ │ │ ├── fanotify_mark.asm
│ │ │ ├── fchdir.asm
│ │ │ ├── fchmod.asm
│ │ │ ├── fchmodat.asm
│ │ │ ├── fchown.asm
│ │ │ ├── fchown32.asm
│ │ │ ├── fchownat.asm
│ │ │ ├── fcntl.asm
│ │ │ ├── fcntl64.asm
│ │ │ ├── fdatasync.asm
│ │ │ ├── fgetxattr.asm
│ │ │ ├── finit_module.asm
│ │ │ ├── flistxattr.asm
│ │ │ ├── flock.asm
│ │ │ ├── fork.asm
│ │ │ ├── fremovexattr.asm
│ │ │ ├── fsconfig.asm
│ │ │ ├── fsetxattr.asm
│ │ │ ├── fsmount.asm
│ │ │ ├── fsopen.asm
│ │ │ ├── fspick.asm
│ │ │ ├── fstat.asm
│ │ │ ├── fstat64.asm
│ │ │ ├── fstatat.asm
│ │ │ ├── fstatat64.asm
│ │ │ ├── fstatfs.asm
│ │ │ ├── fstatfs64.asm
│ │ │ ├── fsync.asm
│ │ │ ├── ftime.asm
│ │ │ ├── ftruncate.asm
│ │ │ ├── ftruncate64.asm
│ │ │ ├── futex.asm
│ │ │ ├── futex_time64.asm
│ │ │ ├── futimesat.asm
│ │ │ ├── get_kernel_syms.asm
│ │ │ ├── get_mempolicy.asm
│ │ │ ├── get_robust_list.asm
│ │ │ ├── get_thread_area.asm
│ │ │ ├── getcpu.asm
│ │ │ ├── getcwd.asm
│ │ │ ├── getdents.asm
│ │ │ ├── getdents64.asm
│ │ │ ├── getegid.asm
│ │ │ ├── getegid32.asm
│ │ │ ├── geteuid.asm
│ │ │ ├── geteuid32.asm
│ │ │ ├── getgid.asm
│ │ │ ├── getgid32.asm
│ │ │ ├── getgroups.asm
│ │ │ ├── getgroups32.asm
│ │ │ ├── getitimer.asm
│ │ │ ├── getpeername.asm
│ │ │ ├── getpgid.asm
│ │ │ ├── getpgrp.asm
│ │ │ ├── getpid.asm
│ │ │ ├── getpmsg.asm
│ │ │ ├── getppid.asm
│ │ │ ├── getpriority.asm
│ │ │ ├── getrandom.asm
│ │ │ ├── getresgid.asm
│ │ │ ├── getresgid32.asm
│ │ │ ├── getresuid.asm
│ │ │ ├── getresuid32.asm
│ │ │ ├── getrlimit.asm
│ │ │ ├── getrusage.asm
│ │ │ ├── getsid.asm
│ │ │ ├── getsockname.asm
│ │ │ ├── getsockopt.asm
│ │ │ ├── gettid.asm
│ │ │ ├── gettimeofday.asm
│ │ │ ├── getuid.asm
│ │ │ ├── getuid32.asm
│ │ │ ├── getxattr.asm
│ │ │ ├── gtty.asm
│ │ │ ├── ia32_arch_prctl.asm
│ │ │ ├── ia32_io_pgetevents.asm
│ │ │ ├── ia32_rseq.asm
│ │ │ ├── ia32_statx.asm
│ │ │ ├── idle.asm
│ │ │ ├── init_module.asm
│ │ │ ├── inotify_add_watch.asm
│ │ │ ├── inotify_init.asm
│ │ │ ├── inotify_init1.asm
│ │ │ ├── inotify_rm_watch.asm
│ │ │ ├── io_cancel.asm
│ │ │ ├── io_destroy.asm
│ │ │ ├── io_getevents.asm
│ │ │ ├── io_pgetevents.asm
│ │ │ ├── io_pgetevents_time64.asm
│ │ │ ├── io_setup.asm
│ │ │ ├── io_submit.asm
│ │ │ ├── io_uring_enter.asm
│ │ │ ├── io_uring_register.asm
│ │ │ ├── io_uring_setup.asm
│ │ │ ├── ioctl.asm
│ │ │ ├── ioperm.asm
│ │ │ ├── iopl.asm
│ │ │ ├── ioprio_get.asm
│ │ │ ├── ioprio_set.asm
│ │ │ ├── ipc.asm
│ │ │ ├── kcmp.asm
│ │ │ ├── kexec_file_load.asm
│ │ │ ├── kexec_load.asm
│ │ │ ├── keyctl.asm
│ │ │ ├── kill.asm
│ │ │ ├── landlock_add_rule.asm
│ │ │ ├── landlock_create_ruleset.asm
│ │ │ ├── landlock_restrict_self.asm
│ │ │ ├── lchown.asm
│ │ │ ├── lchown32.asm
│ │ │ ├── lgetxattr.asm
│ │ │ ├── link.asm
│ │ │ ├── linkat.asm
│ │ │ ├── listen.asm
│ │ │ ├── listxattr.asm
│ │ │ ├── llistxattr.asm
│ │ │ ├── lock.asm
│ │ │ ├── lookup_dcookie.asm
│ │ │ ├── lremovexattr.asm
│ │ │ ├── lseek.asm
│ │ │ ├── lsetxattr.asm
│ │ │ ├── lstat.asm
│ │ │ ├── lstat64.asm
│ │ │ ├── madvise.asm
│ │ │ ├── madvise1.asm
│ │ │ ├── mbind.asm
│ │ │ ├── membarrier.asm
│ │ │ ├── memfd_create.asm
│ │ │ ├── migrate_pages.asm
│ │ │ ├── mincore.asm
│ │ │ ├── mkdir.asm
│ │ │ ├── mkdirat.asm
│ │ │ ├── mknod.asm
│ │ │ ├── mknodat.asm
│ │ │ ├── mlock.asm
│ │ │ ├── mlock2.asm
│ │ │ ├── mlockall.asm
│ │ │ ├── mmap.asm
│ │ │ ├── mmap2.asm
│ │ │ ├── modify_ldt.asm
│ │ │ ├── mount.asm
│ │ │ ├── mount_setattr.asm
│ │ │ ├── move_mount.asm
│ │ │ ├── move_pages.asm
│ │ │ ├── mprotect.asm
│ │ │ ├── mpx.asm
│ │ │ ├── mq_getsetattr.asm
│ │ │ ├── mq_notify.asm
│ │ │ ├── mq_open.asm
│ │ │ ├── mq_timedreceive.asm
│ │ │ ├── mq_timedreceive_time64.asm
│ │ │ ├── mq_timedsend.asm
│ │ │ ├── mq_timedsend_time64.asm
│ │ │ ├── mq_unlink.asm
│ │ │ ├── mremap.asm
│ │ │ ├── msgctl.asm
│ │ │ ├── msgget.asm
│ │ │ ├── msgrcv.asm
│ │ │ ├── msgsnd.asm
│ │ │ ├── msync.asm
│ │ │ ├── multiplexer.asm
│ │ │ ├── munlock.asm
│ │ │ ├── munlockall.asm
│ │ │ ├── munmap.asm
│ │ │ ├── name_to_handle_at.asm
│ │ │ ├── nanosleep.asm
│ │ │ ├── newfstatat.asm
│ │ │ ├── nfsservctl.asm
│ │ │ ├── nice.asm
│ │ │ ├── oldfstat.asm
│ │ │ ├── oldlstat.asm
│ │ │ ├── oldolduname.asm
│ │ │ ├── oldstat.asm
│ │ │ ├── olduname.asm
│ │ │ ├── open.asm
│ │ │ ├── open_by_handle_at.asm
│ │ │ ├── open_tree.asm
│ │ │ ├── openat.asm
│ │ │ ├── openat2.asm
│ │ │ ├── pause.asm
│ │ │ ├── pciconfig_iobase.asm
│ │ │ ├── pciconfig_read.asm
│ │ │ ├── pciconfig_write.asm
│ │ │ ├── perf_event_open.asm
│ │ │ ├── personality.asm
│ │ │ ├── pidfd_getfd.asm
│ │ │ ├── pidfd_open.asm
│ │ │ ├── pidfd_send_signal.asm
│ │ │ ├── pipe.asm
│ │ │ ├── pipe2.asm
│ │ │ ├── pivot_root.asm
│ │ │ ├── pkey_alloc.asm
│ │ │ ├── pkey_free.asm
│ │ │ ├── pkey_mprotect.asm
│ │ │ ├── poll.asm
│ │ │ ├── ppoll.asm
│ │ │ ├── ppoll_time64.asm
│ │ │ ├── prctl.asm
│ │ │ ├── pread.asm
│ │ │ ├── pread64.asm
│ │ │ ├── preadv.asm
│ │ │ ├── preadv2.asm
│ │ │ ├── prlimit64.asm
│ │ │ ├── process_madvise.asm
│ │ │ ├── process_vm_readv.asm
│ │ │ ├── process_vm_writev.asm
│ │ │ ├── prof.asm
│ │ │ ├── profil.asm
│ │ │ ├── pselect6.asm
│ │ │ ├── pselect6_time64.asm
│ │ │ ├── ptrace.asm
│ │ │ ├── putpmsg.asm
│ │ │ ├── pwrite.asm
│ │ │ ├── pwrite64.asm
│ │ │ ├── pwritev.asm
│ │ │ ├── pwritev2.asm
│ │ │ ├── query_module.asm
│ │ │ ├── quotactl.asm
│ │ │ ├── read.asm
│ │ │ ├── readahead.asm
│ │ │ ├── readdir.asm
│ │ │ ├── readlink.asm
│ │ │ ├── readlinkat.asm
│ │ │ ├── readv.asm
│ │ │ ├── reboot.asm
│ │ │ ├── recv.asm
│ │ │ ├── recvfrom.asm
│ │ │ ├── recvmmsg.asm
│ │ │ ├── recvmmsg_time64.asm
│ │ │ ├── recvmsg.asm
│ │ │ ├── remap_file_pages.asm
│ │ │ ├── removexattr.asm
│ │ │ ├── rename.asm
│ │ │ ├── renameat.asm
│ │ │ ├── renameat2.asm
│ │ │ ├── request_key.asm
│ │ │ ├── reserved221.asm
│ │ │ ├── reserved82.asm
│ │ │ ├── restart_syscall.asm
│ │ │ ├── riscv_flush_icache.asm
│ │ │ ├── rmdir.asm
│ │ │ ├── rseq.asm
│ │ │ ├── rtas.asm
│ │ │ ├── sched_get_priority_max.asm
│ │ │ ├── sched_get_priority_min.asm
│ │ │ ├── sched_getaffinity.asm
│ │ │ ├── sched_getattr.asm
│ │ │ ├── sched_getparam.asm
│ │ │ ├── sched_getscheduler.asm
│ │ │ ├── sched_rr_get_interval.asm
│ │ │ ├── sched_rr_get_interval_time64.asm
│ │ │ ├── sched_setaffinity.asm
│ │ │ ├── sched_setattr.asm
│ │ │ ├── sched_setparam.asm
│ │ │ ├── sched_setscheduler.asm
│ │ │ ├── sched_yield.asm
│ │ │ ├── seccomp.asm
│ │ │ ├── security.asm
│ │ │ ├── select.asm
│ │ │ ├── semctl.asm
│ │ │ ├── semget.asm
│ │ │ ├── semop.asm
│ │ │ ├── semtimedop.asm
│ │ │ ├── semtimedop_time64.asm
│ │ │ ├── send.asm
│ │ │ ├── sendfile.asm
│ │ │ ├── sendfile64.asm
│ │ │ ├── sendmmsg.asm
│ │ │ ├── sendmsg.asm
│ │ │ ├── sendto.asm
│ │ │ ├── set_mempolicy.asm
│ │ │ ├── set_robust_list.asm
│ │ │ ├── set_thread_area.asm
│ │ │ ├── set_tid_address.asm
│ │ │ ├── setdomainname.asm
│ │ │ ├── setfsgid.asm
│ │ │ ├── setfsgid32.asm
│ │ │ ├── setfsuid.asm
│ │ │ ├── setfsuid32.asm
│ │ │ ├── setgid.asm
│ │ │ ├── setgid32.asm
│ │ │ ├── setgroups.asm
│ │ │ ├── setgroups32.asm
│ │ │ ├── sethostname.asm
│ │ │ ├── setitimer.asm
│ │ │ ├── setns.asm
│ │ │ ├── setpgid.asm
│ │ │ ├── setpriority.asm
│ │ │ ├── setregid.asm
│ │ │ ├── setregid32.asm
│ │ │ ├── setresgid.asm
│ │ │ ├── setresgid32.asm
│ │ │ ├── setresuid.asm
│ │ │ ├── setresuid32.asm
│ │ │ ├── setreuid.asm
│ │ │ ├── setreuid32.asm
│ │ │ ├── setrlimit.asm
│ │ │ ├── setsid.asm
│ │ │ ├── setsockopt.asm
│ │ │ ├── settimeofday.asm
│ │ │ ├── setuid.asm
│ │ │ ├── setuid32.asm
│ │ │ ├── setxattr.asm
│ │ │ ├── sgetmask.asm
│ │ │ ├── shmat.asm
│ │ │ ├── shmctl.asm
│ │ │ ├── shmdt.asm
│ │ │ ├── shmget.asm
│ │ │ ├── shutdown.asm
│ │ │ ├── sigaction.asm
│ │ │ ├── sigaltstack.asm
│ │ │ ├── signal.asm
│ │ │ ├── signalfd.asm
│ │ │ ├── signalfd4.asm
│ │ │ ├── sigpending.asm
│ │ │ ├── sigprocmask.asm
│ │ │ ├── sigqueueinfo.asm
│ │ │ ├── sigreturn.asm
│ │ │ ├── sigsuspend.asm
│ │ │ ├── sigtimedwait.asm
│ │ │ ├── sigtimedwait_time64.asm
│ │ │ ├── socket.asm
│ │ │ ├── socketcall.asm
│ │ │ ├── socketcall_accept.asm
│ │ │ ├── socketcall_bind.asm
│ │ │ ├── socketcall_connect.asm
│ │ │ ├── socketcall_getpeername.asm
│ │ │ ├── socketcall_getsockname.asm
│ │ │ ├── socketcall_getsockopt.asm
│ │ │ ├── socketcall_listen.asm
│ │ │ ├── socketcall_recv.asm
│ │ │ ├── socketcall_recvfrom.asm
│ │ │ ├── socketcall_recvmsg.asm
│ │ │ ├── socketcall_send.asm
│ │ │ ├── socketcall_sendmsg.asm
│ │ │ ├── socketcall_sendto.asm
│ │ │ ├── socketcall_setsockopt.asm
│ │ │ ├── socketcall_shutdown.asm
│ │ │ ├── socketcall_socket.asm
│ │ │ ├── socketcall_socketpair.asm
│ │ │ ├── socketpair.asm
│ │ │ ├── splice.asm
│ │ │ ├── spu_create.asm
│ │ │ ├── spu_run.asm
│ │ │ ├── ssetmask.asm
│ │ │ ├── stat.asm
│ │ │ ├── stat64.asm
│ │ │ ├── statfs.asm
│ │ │ ├── statfs64.asm
│ │ │ ├── statx.asm
│ │ │ ├── stime.asm
│ │ │ ├── stty.asm
│ │ │ ├── subpage_prot.asm
│ │ │ ├── swapcontext.asm
│ │ │ ├── swapoff.asm
│ │ │ ├── swapon.asm
│ │ │ ├── switch_endian.asm
│ │ │ ├── symlink.asm
│ │ │ ├── symlinkat.asm
│ │ │ ├── sync.asm
│ │ │ ├── sync_file_range.asm
│ │ │ ├── sync_file_range2.asm
│ │ │ ├── syncfs.asm
│ │ │ ├── sys_kexec_load.asm
│ │ │ ├── syscall.asm
│ │ │ ├── sysfs.asm
│ │ │ ├── sysinfo.asm
│ │ │ ├── syslog.asm
│ │ │ ├── sysmips.asm
│ │ │ ├── sysriscv.asm
│ │ │ ├── tee.asm
│ │ │ ├── tgkill.asm
│ │ │ ├── tgsigqueueinfo.asm
│ │ │ ├── time.asm
│ │ │ ├── timer_create.asm
│ │ │ ├── timer_delete.asm
│ │ │ ├── timer_getoverrun.asm
│ │ │ ├── timer_gettime.asm
│ │ │ ├── timer_gettime64.asm
│ │ │ ├── timer_settime.asm
│ │ │ ├── timer_settime64.asm
│ │ │ ├── timerfd.asm
│ │ │ ├── timerfd_create.asm
│ │ │ ├── timerfd_gettime.asm
│ │ │ ├── timerfd_gettime64.asm
│ │ │ ├── timerfd_settime.asm
│ │ │ ├── timerfd_settime64.asm
│ │ │ ├── times.asm
│ │ │ ├── tkill.asm
│ │ │ ├── truncate.asm
│ │ │ ├── truncate64.asm
│ │ │ ├── tuxcall.asm
│ │ │ ├── ugetrlimit.asm
│ │ │ ├── ulimit.asm
│ │ │ ├── umask.asm
│ │ │ ├── umount.asm
│ │ │ ├── umount2.asm
│ │ │ ├── uname.asm
│ │ │ ├── unlink.asm
│ │ │ ├── unlinkat.asm
│ │ │ ├── unshare.asm
│ │ │ ├── uselib.asm
│ │ │ ├── userfaultfd.asm
│ │ │ ├── ustat.asm
│ │ │ ├── utime.asm
│ │ │ ├── utimensat.asm
│ │ │ ├── utimensat_time64.asm
│ │ │ ├── utimes.asm
│ │ │ ├── vfork.asm
│ │ │ ├── vhangup.asm
│ │ │ ├── vm86.asm
│ │ │ ├── vm86old.asm
│ │ │ ├── vmsplice.asm
│ │ │ ├── vserver.asm
│ │ │ ├── wait4.asm
│ │ │ ├── waitid.asm
│ │ │ ├── waitpid.asm
│ │ │ ├── write.asm
│ │ │ └── writev.asm
│ │ ├── i386/
│ │ │ ├── __doc__
│ │ │ ├── breakpoint.asm
│ │ │ ├── cgc/
│ │ │ │ ├── __doc__
│ │ │ │ ├── allocate.asm
│ │ │ │ ├── cat.asm
│ │ │ │ ├── deallocate.asm
│ │ │ │ ├── fdwait.asm
│ │ │ │ ├── random.asm
│ │ │ │ ├── receive.asm
│ │ │ │ ├── sendfile.asm
│ │ │ │ ├── syscall.asm
│ │ │ │ ├── terminate.asm
│ │ │ │ └── transmit.asm
│ │ │ ├── crash.asm
│ │ │ ├── epilog.asm
│ │ │ ├── freebsd/
│ │ │ │ ├── __doc__
│ │ │ │ ├── acceptloop_ipv4.asm
│ │ │ │ ├── i386_to_amd64.asm
│ │ │ │ ├── sh.asm
│ │ │ │ └── syscall.asm
│ │ │ ├── function.asm
│ │ │ ├── getpc.asm
│ │ │ ├── infloop.asm
│ │ │ ├── itoa.asm
│ │ │ ├── linux/
│ │ │ │ ├── __doc__
│ │ │ │ ├── acceptloop_ipv4.asm
│ │ │ │ ├── cat.asm
│ │ │ │ ├── cat2.asm
│ │ │ │ ├── connect.asm
│ │ │ │ ├── connectstager.asm
│ │ │ │ ├── dir.asm
│ │ │ │ ├── dupio.asm
│ │ │ │ ├── dupsh.asm
│ │ │ │ ├── echo.asm
│ │ │ │ ├── egghunter.asm
│ │ │ │ ├── findpeer.asm
│ │ │ │ ├── findpeersh.asm
│ │ │ │ ├── findpeerstager.asm
│ │ │ │ ├── forkbomb.asm
│ │ │ │ ├── forkexit.asm
│ │ │ │ ├── i386_to_amd64.asm
│ │ │ │ ├── killparent.asm
│ │ │ │ ├── loader.asm
│ │ │ │ ├── loader_append.asm
│ │ │ │ ├── mprotect_all.asm
│ │ │ │ ├── pidmax.asm
│ │ │ │ ├── readfile.asm
│ │ │ │ ├── readn.asm
│ │ │ │ ├── recvsize.asm
│ │ │ │ ├── setregid.asm
│ │ │ │ ├── setresuid.asm
│ │ │ │ ├── setreuid.asm
│ │ │ │ ├── sh.asm
│ │ │ │ ├── socket.asm
│ │ │ │ ├── socketcall.asm
│ │ │ │ ├── stage.asm
│ │ │ │ ├── stager.asm
│ │ │ │ └── syscall.asm
│ │ │ ├── memcpy.asm
│ │ │ ├── mov.asm
│ │ │ ├── nop.asm
│ │ │ ├── prolog.asm
│ │ │ ├── push.asm
│ │ │ ├── pushstr.asm
│ │ │ ├── pushstr_array.asm
│ │ │ ├── ret.asm
│ │ │ ├── setregs.asm
│ │ │ ├── stackarg.asm
│ │ │ ├── stackhunter.asm
│ │ │ ├── stackhunter_helper.asm
│ │ │ ├── strcpy.asm
│ │ │ ├── strlen.asm
│ │ │ ├── trap.asm
│ │ │ └── xor.asm
│ │ ├── loongarch64/
│ │ │ ├── __doc__
│ │ │ ├── linux/
│ │ │ │ ├── __doc__
│ │ │ │ └── syscall.asm
│ │ │ ├── mov.asm
│ │ │ ├── nop.asm
│ │ │ ├── push.asm
│ │ │ ├── pushstr.asm
│ │ │ ├── pushstr_array.asm
│ │ │ ├── setregs.asm
│ │ │ ├── trap.asm
│ │ │ └── xor.asm
│ │ ├── mips/
│ │ │ ├── __doc__
│ │ │ ├── freebsd/
│ │ │ │ ├── __doc__
│ │ │ │ └── syscall.asm
│ │ │ ├── linux/
│ │ │ │ ├── __doc__
│ │ │ │ ├── bindsh.asm
│ │ │ │ ├── cat.asm
│ │ │ │ ├── cat2.asm
│ │ │ │ ├── connect.asm
│ │ │ │ ├── dupio.asm
│ │ │ │ ├── dupsh.asm
│ │ │ │ ├── echo.asm
│ │ │ │ ├── findpeer.asm
│ │ │ │ ├── findpeersh.asm
│ │ │ │ ├── forkbomb.asm
│ │ │ │ ├── forkexit.asm
│ │ │ │ ├── killparent.asm
│ │ │ │ ├── listen.asm
│ │ │ │ ├── readfile.asm
│ │ │ │ ├── setresuid.asm
│ │ │ │ ├── sh.asm
│ │ │ │ ├── stager.asm
│ │ │ │ └── syscall.asm
│ │ │ ├── mov.asm
│ │ │ ├── nop.asm
│ │ │ ├── push.asm
│ │ │ ├── pushstr.asm
│ │ │ ├── pushstr_array.asm
│ │ │ ├── setregs.asm
│ │ │ └── trap.asm
│ │ ├── powerpc/
│ │ │ ├── __doc__
│ │ │ └── linux/
│ │ │ └── __doc__
│ │ ├── riscv64/
│ │ │ ├── __doc__
│ │ │ ├── linux/
│ │ │ │ ├── __doc__
│ │ │ │ ├── cat2.asm
│ │ │ │ ├── open.asm
│ │ │ │ └── syscall.asm
│ │ │ ├── mov.asm
│ │ │ ├── nop.asm
│ │ │ ├── push.asm
│ │ │ ├── pushstr.asm
│ │ │ ├── pushstr_array.asm
│ │ │ ├── setregs.asm
│ │ │ ├── trap.asm
│ │ │ └── xor.asm
│ │ └── thumb/
│ │ ├── __doc__
│ │ ├── crash.asm
│ │ ├── freebsd/
│ │ │ ├── __doc__
│ │ │ └── syscall.asm
│ │ ├── infloop.asm
│ │ ├── itoa.asm
│ │ ├── linux/
│ │ │ ├── __doc__
│ │ │ ├── bindsh.asm
│ │ │ ├── cat.asm
│ │ │ ├── cat2.asm
│ │ │ ├── connect.asm
│ │ │ ├── connectstager.asm
│ │ │ ├── dupio.asm
│ │ │ ├── dupsh.asm
│ │ │ ├── echo.asm
│ │ │ ├── findpeer.asm
│ │ │ ├── findpeersh.asm
│ │ │ ├── findpeerstager.asm
│ │ │ ├── forkbomb.asm
│ │ │ ├── forkexit.asm
│ │ │ ├── killparent.asm
│ │ │ ├── listen.asm
│ │ │ ├── loader.asm
│ │ │ ├── loader_append.asm
│ │ │ ├── readfile.asm
│ │ │ ├── readn.asm
│ │ │ ├── recvsize.asm
│ │ │ ├── setresuid.asm
│ │ │ ├── sh.asm
│ │ │ ├── stage.asm
│ │ │ ├── stager.asm
│ │ │ └── syscall.asm
│ │ ├── memcpy.asm
│ │ ├── mov.asm
│ │ ├── nop.asm
│ │ ├── popad.asm
│ │ ├── push.asm
│ │ ├── pushad.asm
│ │ ├── pushstr.asm
│ │ ├── pushstr_array.asm
│ │ ├── ret.asm
│ │ ├── setregs.asm
│ │ ├── to_arm.asm
│ │ ├── trap.asm
│ │ └── udiv_10.asm
│ ├── term/
│ │ ├── __init__.py
│ │ ├── completer.py
│ │ ├── key.py
│ │ ├── keyconsts.py
│ │ ├── keymap.py
│ │ ├── readline.py
│ │ ├── spinners.py
│ │ ├── term.py
│ │ ├── termcap.py
│ │ ├── text.py
│ │ ├── unix_termcap.py
│ │ └── windows_termcap.py
│ ├── testexample.py
│ ├── timeout.py
│ ├── tubes/
│ │ ├── __init__.py
│ │ ├── buffer.py
│ │ ├── listen.py
│ │ ├── process.py
│ │ ├── remote.py
│ │ ├── serialtube.py
│ │ ├── server.py
│ │ ├── sock.py
│ │ ├── ssh.py
│ │ └── tube.py
│ ├── ui.py
│ ├── update.py
│ ├── useragents.py
│ ├── util/
│ │ ├── __init__.py
│ │ ├── crc/
│ │ │ ├── __init__.py
│ │ │ └── known.py
│ │ ├── cyclic.py
│ │ ├── fiddling.py
│ │ ├── getdents.py
│ │ ├── hashes.py
│ │ ├── iters.py
│ │ ├── lists.py
│ │ ├── misc.py
│ │ ├── net.py
│ │ ├── packing.py
│ │ ├── proc.py
│ │ ├── safeeval.py
│ │ ├── sh_string.py
│ │ ├── splash.py
│ │ └── web.py
│ ├── version.py
│ └── windbg.py
├── pyproject.toml
├── setup.py
└── travis/
├── coverage_chdir.py
├── docker/
│ ├── .gitignore
│ ├── 10-import.py
│ ├── Dockerfile
│ ├── Dockerfile.travis
│ ├── Makefile
│ ├── README.md
│ ├── doctest3
│ ├── ipython_config.py
│ ├── run.sh
│ └── tmux.sh
├── install.sh
├── libcdb_nginx_cache.conf
├── setup_avd.sh
├── setup_avd_fast.sh
└── ssh_setup.sh
================================================
FILE CONTENTS
================================================
================================================
FILE: .gitattributes
================================================
pwnlib/data/* linguist-vendored
================================================
FILE: .github/ISSUE_TEMPLATE/bug_report.md
================================================
---
name: Bug report
about: Create a report to help us improve
title: ''
labels: backport-required, bug
assignees: ''
---
Thanks for contributing to Pwntools!
## Update Pwntools First
When reporting an issue, be sure that you are running the latest released version of pwntools (`pip install --upgrade pwntools`).
## Debug Output
Having the extra debug output really helps us, and might help you diagnose the problem yourself.
When submitting an issue that has output from Pwntools, make sure to run your script as shown below, to enable the extra debugging data.
```sh
$ python exploit.py DEBUG LOG_FILE=log.txt
```
You should see `[DEBUG]` statements that show what's happening behind the scenes:
```
[+] Starting local process '/bin/sh' argv=['sh'] : pid 16823
[DEBUG] Sent 0x7 bytes:
'whoami\n'
[DEBUG] Sent 0x5 bytes:
'exit\n'
[+] Receiving all data: Done (11B)
[DEBUG] Received 0xb bytes:
'crashheap\n'
[*] Process '/bin/sh' stopped with exit code 0 (pid 16823)
```
## Verify on Ubuntu
If possible, please verify that your issue occurs on 64-bit Ubuntu 22.04. We provide a Dockerfile based on Ubuntu 22.04 via `docker.io` to make this super simple, no VM required!
```sh
# Download the Docker image
$ docker pull pwntools/pwntools:stable
# Boot the image
$ docker run -it pwntools/pwntools:stable
pwntools@7dc3ef409476:~$ python
>>> from pwn import *
>>> # Test your code here
```
================================================
FILE: .github/ISSUE_TEMPLATE/feature_request.md
================================================
---
name: Feature request
about: Suggest an idea for this project
title: ''
labels: feature
assignees: ''
---
Thanks for contributing to Pwntools! Ideas from the community help make Pwntools an amazing tool for everybody.
If you've got an idea for a new feature, please provide information about:
* What the feature does
* Why the feature should exist
* What tests should be included
If you think you can write the feature yourself, please submit a Pull Request and we can review your changes!
================================================
FILE: .github/ISSUE_TEMPLATE/question.md
================================================
---
name: Question
about: Ask us a question about Pwntools
title: ''
labels: question
assignees: ''
---
Thanks for using Pwntools! If you have a question, here are some tips that will make it easier for us to help you.
## Check the Documentation
Pwntools has REALLY extensive documentation. Please check there first! https://docs.pwntools.com
## Debug Output
If you're having an issue with an exploit, run your script with full debugging output, i.e. `python exploit.py DEBUG`. This may help you to see what's happening under the hood, and the debug output will help to diagnose any issues you're encountering.
================================================
FILE: .github/ISSUE_TEMPLATE.md
================================================
# Pwntools Issue Template
Thanks for contributing to Pwntools!
When reporting an issue, be sure that you are running the latest released version of pwntools (`pip install --upgrade pwntools`).
Please verify that your issue occurs on 64-bit Ubuntu 22.04. You can use the Dockerfile on `docker.io` for quick testing.
```
$ docker pull pwntools/pwntools:stable
$ docker run -it pwntools/pwntools:stable
```
If possible, provide a proof-of-concept which demonstrates the problem. Include any binaries or scripts necessary to reproduce the issue, and please include the full debug output via setting the environment variable `PWNLIB_DEBUG=1`.
================================================
FILE: .github/PULL_REQUEST_TEMPLATE.md
================================================
# Pwntools Pull Request
Thanks for contributing to Pwntools! Take a moment to look at [`CONTRIBUTING.md`][contributing] to make sure you're familiar with Pwntools development.
Please provide a high-level explanation of what this pull request is for.
## Testing
Pull Requests that introduce new code should try to add doctests for that code. See [`TESTING.md`][testing] for more information.
## Target Branch
Depending on what the PR is for, it needs to target a different branch.
You can always [change the branch][change] after you create the PR if it's against the wrong branch.
| Branch | Type of PR |
| -------- | ---------------------------------------------------------------- |
| `dev` | New features, and enhancements
| `dev` | Documentation fixes and new tests
| `stable` | Bug fixes that affect the current `stable` branch
| `beta` | Bug fixes that affect the current `beta` branch, but not `stable`
| `dev` | Bug fixes for code that has never been released
[contributing]: https://github.com/Gallopsled/pwntools/blob/dev/CONTRIBUTING.md
[testing]: https://github.com/Gallopsled/pwntools/blob/dev/TESTING.md
[change]: https://github.com/blog/2224-change-the-base-branch-of-a-pull-request
## Changelog
After creating your Pull Request, please add and push a commit that updates the changelog for the appropriate branch.
You can look at the existing changelog for examples of how to do this.
================================================
FILE: .github/dependabot.yml
================================================
version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
# Check for updates to GitHub Actions every month
interval: "monthly"
groups:
github-actions:
dependency-type: "production"
================================================
FILE: .github/workflows/changelog.yml
================================================
name: Changelog
on:
pull_request:
paths:
- pwnlib/**
- pwn/**
env:
GITHUB_BASE: origin/${{ github.event.pull_request.base.ref }}
jobs:
check:
strategy:
matrix:
os: [ubuntu-latest]
runs-on: ${{ matrix.os }}
timeout-minutes: 5
steps:
- uses: actions/checkout@v6
with:
fetch-depth: 0
- name: Check changelog for updates
run: |
if git log --stat ${GITHUB_BASE}..HEAD | grep CHANGELOG.md; then
echo 'Changelog updated :D'
else
if git log --stat ${GITHUB_BASE}..HEAD pwnlib pwn | grep '++\|--'; then
echo 'Major changes detected, changelog required!'
false
else
echo 'Minor changes detected, no changelog required!'
fi
fi
================================================
FILE: .github/workflows/ci.yml
================================================
name: Continuous Integration
on: [push, pull_request]
jobs:
test:
strategy:
matrix:
python_version: ['3.10', '3.12', '3.13', '3.14']
os: [ubuntu-latest]
runs-on: ${{ matrix.os }}
timeout-minutes: 30
services:
libcdb-cache:
image: nginx
volumes:
- /home/runner/libcdb-cache:/var/cache/nginx
ports:
- 3000:3000 # https://debuginfod.elfutils.org proxy cache
- 3001:3001 # https://libc.rip/ proxy cache
- 3002:3002 # http://archive.ubuntu.com/ proxy cache
- 3003:3003 # https://gitlab.com/ proxy cache
- 3004:3004 # https://debuginfod.ubuntu.com/ proxy cache
env:
DEBUGINFOD_URLS: "http://localhost:3000/ http://localhost:3004/"
PWN_LIBCRIP_URL: http://localhost:3001/
PWN_UBUNTU_ARCHIVE_URL: http://localhost:3002/
PWN_GITLAB_LIBCDB_URL: http://localhost:3003/
steps:
- uses: actions/checkout@v6
with:
fetch-depth: 20
- name: Git History
run: |
git fetch origin
git log --oneline --graph -10
- name: Fix libcdb-cache permissions
id: fix-perms
run: |
sudo chown -R runner:runner /home/runner/libcdb-cache
echo "date=$(/bin/date -u "+%Y%m%d%H%M%S")" >> $GITHUB_OUTPUT
- name: Cache for libcdb requests
uses: actions/cache@v5
with:
path: ~/libcdb-cache
key: libcdb-python${{ matrix.python_version }}-${{ steps.fix-perms.outputs.date }}
restore-keys: |
libcdb-python${{ matrix.python_version }}-
libcdb-
- name: Install libcdb-cache service config
run: |
sudo chown -R 101:101 /home/runner/libcdb-cache
container_id=$(docker ps --all --filter volume=/home/runner/libcdb-cache --no-trunc --format "{{.ID}}")
docker cp ./travis/libcdb_nginx_cache.conf $container_id:/etc/nginx/nginx.conf
docker restart $container_id
- name: Install RPyC for gdb
run: |
# The version packaged in python3-rpyc is too old on Ubuntu 24.04
# We use ^6.0 from pip.
sudo apt-get update && sudo apt-get install -y python3-pip gdb gdbserver
/usr/bin/python -m pip install --break-system-packages rpyc || /usr/bin/python -m pip install rpyc
gdb --batch --quiet --nx --nh --ex 'py import rpyc; print(rpyc.version.version)'
- name: Set up Python ${{ matrix.python_version }}
uses: actions/setup-python@v6
with:
python-version: ${{ matrix.python_version }}
cache: 'pip'
cache-dependency-path: |
**/pyproject.toml
**/requirements*.txt
- name: Verify tag against version
if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags')
env:
GITHUB_REF: ${{ github.event.ref }}
run: |
set -x
GITHUB_TAG=${GITHUB_REF#refs/tags/}
echo "$GITHUB_TAG" | grep -E '^[0-9.]*(beta[0-9])?$'
vsetup=$(grep -o "version\\s*=\\s*[\"'].*[\"'],$" setup.py | grep -o "[0-9][^\"']*")
vpwnlib=$(grep -o "__version__\\s*=\\s*[\"'].*[\"']$" pwnlib/version.py | grep -o "[0-9][^\"']*")
[ "$vsetup" = "$vpwnlib" ]
[ "$GITHUB_TAG" = "$vsetup" ]
- name: Install Linux dependencies
run: |
sudo apt-get update
sudo apt-get install -y --no-install-recommends -o Acquire::Retries=3 \
ash bash-static dash ksh mksh zsh \
gdb gdbserver socat \
binutils-multiarch qemu-user-static \
binutils-aarch64-linux-gnu \
binutils-arm-linux-gnueabihf \
binutils-mips-linux-gnu \
binutils-mipsel-linux-gnu \
binutils-msp430 \
binutils-powerpc-linux-gnu \
binutils-s390x-linux-gnu \
binutils-sparc64-linux-gnu \
binutils-riscv64-linux-gnu \
binutils-loongarch64-linux-gnu \
gcc-multilib \
libc6-dbg \
elfutils \
patchelf
# Print diagnostics to help when Corefile doctests fail.
- name: Testing Corefiles
run: |
ulimit -a
ulimit -c unlimited
cat /proc/sys/kernel/core_pattern
cat /proc/sys/kernel/core_uses_pid
( cd $(mktemp -d); sh -c 'kill -11 $$' || true; ls -la ./*core* /var/crash/*.crash /var/lib/apport/coredump/core* || coredumpctl list sh) || true
- name: Set up SSH
run: |
travis/ssh_setup.sh
- name: Install dependencies
run: |
pip install --upgrade pip
pip install --upgrade wheel build
pip install --upgrade flake8 appdirs
pip install --upgrade --editable .
- name: Sanity checks
run: PWNLIB_NOTERM=1 python -bb -c 'from pwn import *; print(pwnlib.term.term_mode)'
- name: Install documentation dependencies
run: pip install -r docs/requirements.txt
- name: Disable yama ptrace_scope
run: |
echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope # required by some gdb doctests
- name: Coverage doctests
run: |
# Python version installed using setup-python interferes with gdb's python
# by setting LD_LIBRARY_PATH and gdb's python becoming unable to load built-in modules
# like _socket. This is a workaround.
unset LD_LIBRARY_PATH
PWNLIB_NOTERM=1 python -bb -m coverage run -m sphinx -b doctest docs/source docs/build/doctest
- name: Coverage running examples
run: |
export TERM=linux
set -x
python -bb travis/coverage_chdir.py examples/fmtstr examples/fmtstr/exploit.py
python -bb travis/coverage_chdir.py examples/fmtstr examples/fmtstr/exploit2.py || : # can fail randomly?
python -bb -m coverage run examples/asm.py
python -bb -m coverage run examples/asm.py
python -bb -m coverage run examples/text.py
# for f in examples/sigreturn_corefile_*.py; do coverage run "$f"; done # XXX something is wrong
- name: Coverage running commandline tools
run: |
export TERM=linux
pwn() { ( set +x; cmd=$1; shift; PYTHONUNBUFFERED=1 exec python -bb -m coverage run -m pwnlib.commandline."$cmd" "$@" ) }
set -x
pwn cyclic 32
pwn cyclic -l 0x62616161
pwn cyclic -a ab
echo
pwn shellcraft --list |tail
pwn shellcraft -l --syscalls |tail
pwn shellcraft -l execve
pwn shellcraft -l execve + exit
pwn shellcraft --show i386.linux.loader_append
pwn shellcraft --show i386.linux.loader_append + i386.linux.sh
pwn shellcraft -f asm --color amd64.linux.sh
pwn shellcraft -f asm --color amd64.linux.setreuid + amd64.linux.cat /etc/passwd
pwn shellcraft -f asm --color amd64.linux.setreuid = amd64.linux.cat /key+secret --delim =
pwn shellcraft -f elf amd64.linux.syscalls.exit 0 </dev/null |pwn hex
pwn shellcraft -f elf amd64.linux.cat /etc/passwd + amd64.linux.syscalls.exit 0 </dev/null |pwn hex
pwn shellcraft -f i --color amd64.linux.cat /etc/passwd </dev/null
pwn shellcraft -f i --color amd64.linux.cat /etc/passwd + amd64.linux.sh </dev/null
pwn shellcraft -f c amd64.linux.syscalls.exit 0 </dev/null
pwn shellcraft -f c amd64.linux.cat /etc/passwd + amd64.linux.syscalls.exit 0 </dev/null
pwn shellcraft -f str aarch64.linux.sh </dev/null
pwn shellcraft -abr -f elf -o /dev/null amd64.linux.cat /etc/passwd </dev/null
pwn shellcraft -nzr thumb.linux.syscalls.execve /bin/cat '["/bin/cat", "/etc/os-release"]' </dev/null
pwn shellcraft -fp aarch64.trap
pwn disasm --color ff3424c3ebfe
pwn asm -f hex nop
pwn hex ABCD
pwn hex ABCD --separator ' '
pwn hex ABCD --prefix '\x'
pwn hex ABCD -p '0x' -s ' '
pwn hex abcd
pwn unhex 4141 4141
cat /dev/urandom | pwn phd --color -c 256 -s 2
pwn phd -l 0x3d --color=always /etc/os-release
pwn checksec /bin/bash
(ulimit -v 500000 && pwn checksec /bin/bash)
pwn errno 2
pwn errno -1
pwn errno EADDRINUSE
pwn constgrep -c freebsd -m ^PROT_ '3 + 4'
pwn constgrep ^MAP_ 0
pwn constgrep -e O_RDWR
pwn constgrep C
pwn libcdb file /lib/x86_64-linux-gnu/libc.so.6
pwn libcdb lookup puts 5f0 __libc_start_main_ret d0a
pwn libcdb hash b229d1da1e161f95e839cf90cded5f719e5de308
- name: Build source and wheel distributions
run: |
python -m build
- uses: actions/upload-artifact@v7
if: matrix.python_version == '3.10'
with:
name: packages
path: dist/
include-hidden-files: true
- uses: actions/upload-artifact@v7
with:
name: coverage-${{ matrix.python_version }}
path: .coverage*
include-hidden-files: true
- name: Fix libcdb-cache permissions
run: |
container_id=$(docker ps --filter volume=/home/runner/libcdb-cache --no-trunc --format "{{.ID}}")
docker stop $container_id
sudo chown -R runner:runner /home/runner/libcdb-cache
android-test:
runs-on: ubuntu-latest
timeout-minutes: 30
continue-on-error: true
steps:
- uses: actions/checkout@v6
- name: Set up Python 3.12
uses: actions/setup-python@v6
with:
python-version: '3.12'
cache: 'pip'
cache-dependency-path: |
**/pyproject.toml
**/requirements*.txt
- name: Install Linux dependencies
run: |
sudo apt-get update
sudo apt-get install -y --no-install-recommends -o Acquire::Retries=3 \
gdb gdbserver socat \
qemu-user-static \
binutils-aarch64-linux-gnu \
binutils-arm-linux-gnueabihf \
libc6-dbg
- name: Cache for avd
uses: actions/cache@v5
id: cache-avd
with:
path: |
~/.android
/usr/local/lib/android/sdk/emulator
/usr/local/lib/android/sdk/platform-tools
/usr/local/lib/android/sdk/system-images
key: ${{ matrix.os }}-cache-avd-${{ hashFiles('travis/setup_avd*.sh') }}
restore-keys: |
${{ matrix.os }}-cache-avd-
- name: Install Android AVD
run: |
sudo usermod -aG kvm $USER
source travis/setup_avd_fast.sh
sed -i 's/skip_android = True/skip_android = False/' docs/source/conf.py
set | grep ^PATH >.android.env
- name: Install dependencies
run: |
pip install --upgrade pip
pip install --upgrade wheel build
pip install --upgrade flake8 appdirs
pip install --upgrade --editable .
- name: Sanity checks
run: PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
- name: Install documentation dependencies
run: pip install -r docs/requirements.txt
- name: Coverage Doctests (Android Only)
run: |
source .android.env
PWNLIB_NOTERM=1 coverage run -m sphinx -b doctest docs/source docs/build/doctest docs/source/adb.rst
- uses: actions/upload-artifact@v7
with:
name: coverage-android
path: .coverage*
include-hidden-files: true
windows-test:
runs-on: windows-latest
timeout-minutes: 30
continue-on-error: true
steps:
- uses: actions/checkout@v6
- name: Set up Python 3.12
uses: actions/setup-python@v6
with:
python-version: '3.12'
- name: Install dependencies
run: |
pip install --upgrade pip
pip install --upgrade --editable .
- name: Install documentation dependencies
run: pip install -r docs/requirements.txt
- name: Sanity checks
run: |
python -bb -c 'from pwn import *'
python -bb examples/text.py
- name: Coverage doctests
run: |
python -bb -m coverage run -m sphinx -b doctest docs/source docs/build/doctest
- uses: actions/upload-artifact@v7
with:
name: coverage-windows
path: .coverage*
include-hidden-files: true
upload-coverage:
runs-on: ubuntu-latest
needs: test
steps:
- uses: actions/checkout@v6
with:
fetch-depth: 20
- uses: actions/download-artifact@v8
with:
pattern: coverage-*
merge-multiple: true
- name: Install coveralls
run: |
pip install --break-system-packages tomli coveralls || pip install tomli coveralls
- name: Upload coverage to coveralls.io
run: |
coverage combine
COVERALLS_REPO_TOKEN=PP20MEgztXIQJJTguQwe2jeCh6Bm4lkbv coveralls
staging-merge:
runs-on: ubuntu-latest
if: github.repository_owner == 'Gallopsled' && github.event_name == 'push' && startsWith(github.event.ref, 'refs/heads/') && endsWith(github.event.ref, '-staging')
needs: test
steps:
- uses: actions/checkout@v6
with:
fetch-depth: 20
- name: Push changes to protected branch
env:
GITHUB_REF: ${{ github.event.ref }}
run: |
BRANCH=${GITHUB_REF#refs/heads/}
TARGET=${BRANCH%-staging}
git branch -f "$TARGET"
git push origin "$TARGET"
git push origin --delete "$BRANCH"
pypi:
runs-on: ubuntu-latest
if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags')
permissions:
id-token: write
needs: test
steps:
- name: Download artifacts
uses: actions/download-artifact@v8
with:
name: packages
path: dist
- name: Publish package
uses: pypa/gh-action-pypi-publish@release/v1
- if: failure()
run: ls -R
================================================
FILE: .github/workflows/docker.yml
================================================
name: Publish Docker images
on:
push:
branches:
- dev
- beta
- stable
workflow_dispatch:
jobs:
publish:
runs-on: ubuntu-latest
if: github.repository_owner == 'Gallopsled'
steps:
# Required for subdirectories in Git context
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4
- name: Login to Docker Hub
uses: docker/login-action@v4
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_PASSWORD }}
- name: Build and push base image
uses: docker/build-push-action@v6
if: github.event_name == 'workflow_dispatch'
with:
context: "{{defaultContext}}:extra/docker/base"
push: true
tags: pwntools/pwntools:base
- name: Build and push stable image
uses: docker/build-push-action@v6
if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/stable')
with:
context: "{{defaultContext}}:extra/docker/stable"
push: true
tags: pwntools/pwntools:stable
- name: Build and push beta image
uses: docker/build-push-action@v6
if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/beta')
with:
context: "{{defaultContext}}:extra/docker/beta"
push: true
tags: pwntools/pwntools:beta
- name: Build and push dev image
uses: docker/build-push-action@v6
if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/dev')
with:
context: "{{defaultContext}}:extra/docker/dev"
push: true
tags: |
pwntools/pwntools:dev
pwntools/pwntools:latest
- name: Build and push ci image
uses: docker/build-push-action@v6
if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/dev')
with:
context: "{{defaultContext}}:travis/docker"
push: true
tags: pwntools/pwntools:ci
================================================
FILE: .github/workflows/lint.yml
================================================
name: Lint
on: [push, pull_request]
jobs:
lint:
strategy:
matrix:
python-version: ['3.10']
os: [ubuntu-latest]
runs-on: ${{ matrix.os }}
timeout-minutes: 30
steps:
- uses: actions/checkout@v6
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v6
with:
python-version: ${{ matrix.python-version }}
cache: 'pip'
cache-dependency-path: |
**/pyproject.toml
**/requirements*.txt
- name: Critical lint
run: |
pip install flake8
flake8 . --count --select=E9,F63,F7,E71 --show-source --statistics --exclude=android-?dk # TODO: Add F82
- name: Style lint
run: |
flake8 pwnlib setup.py docs travis --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
flake8 examples --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics --ignore='F403,F405'
flake8 pwn --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics --ignore='F401,F403,F405'
- name: Minimum Python version check
run: |
pip install vermin
vermin -vvv --no-tips -t=3.10- --violations ./pwnlib ./pwn
================================================
FILE: .github/workflows/merge-conflict.yml
================================================
name: Check for merge markers
on:
pull_request:
types: [synchronize]
env:
GITHUB_BASE: origin/${{ github.event.pull_request.base.ref }}
jobs:
mergecheck:
strategy:
matrix:
os: [ubuntu-latest]
runs-on: ${{ matrix.os }}
timeout-minutes: 5
steps:
- uses: actions/checkout@v6
with:
fetch-depth: 0
- name: Check for merge conflict markers commited
run: |
if git show ${GITHUB_BASE}..HEAD | grep -EB15 --color=always '^\+\+(>>>>>|=====|<<<<<)'; then
echo 'WARNING: Merge marker commits found in history.'
if git diff ${GITHUB_BASE}..HEAD | grep -EB15 --color=always '^\+(>>>>>|=====|<<<<<)'; then
echo 'ERROR: Merge markers still present! Do something!'
exit 1
fi
else
echo 'Congrats! All the merges you did were clean or resolved correctly :)'
fi
================================================
FILE: .github/workflows/pylint.yml
================================================
name: PyLint
on: [pull_request]
jobs:
build:
strategy:
matrix:
python-version: ['3.10']
os: [ubuntu-latest]
runs-on: ${{ matrix.os }}
timeout-minutes: 30
steps:
- uses: actions/checkout@v6
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v6
with:
python-version: ${{ matrix.python-version }}
cache: 'pip'
cache-dependency-path: |
**/pyproject.toml
**/requirements*.txt
- name: PyLint
run: |
set -x
pip install 'pylint<4'
pip install --upgrade -e .
run_pylint() { pylint --exit-zero --errors-only pwnlib -f parseable | cut -d ' ' -f2- | sed 's/line [0-9]\+/line XXXX/g'; }
run_pylint > current.txt
git fetch origin
git checkout origin/"$GITHUB_BASE_REF"
run_pylint > base.txt
if diff base.txt current.txt | grep '>'; then
false
fi
================================================
FILE: .gitignore
================================================
*.o
*.hi
*.pyc
*~
*.swp
.ropeproject
*.pdf
*/auto/*
*/bin/*
docs/build
build
MANIFEST
dist
venv
.vscode
.idea
*.egg-info
*.core
.coverage
.coverage.*
.idea
__pycache__
!.github
.DS_Store
================================================
FILE: .isort.cfg
================================================
[settings]
indent=' '
not_skip = __init__.py
force_single_line = 1
================================================
FILE: .readthedocs.yaml
================================================
# https://docs.readthedocs.io/en/stable/config-file/v2.html
version: 2
build:
os: ubuntu-22.04
tools:
python: "3.12"
sphinx:
configuration: docs/source/conf.py
python:
install:
- requirements: docs/requirements.txt
================================================
FILE: .sublime-settings
================================================
{
"default_encoding": "UTF-8",
"ensure_newline_at_eof_on_save": true,
"tab_size": 4,
"translate_tabs_to_spaces": true,
"trim_trailing_white_space_on_save": true
}
================================================
FILE: CHANGELOG.md
================================================
# Changelog
This changelog only includes added major features and changes. Bugfixes and
minor changes are omitted.
## Release History
The table below shows which release corresponds to each branch, and what date the version was released.
| Version | Branch | Release Date |
| ---------------- | -------- | ---------------------- |
| [5.0.0](#500-dev) | `dev` |
| [4.15.0](#4150-stable) | `stable` | Oct 12, 2025
| [4.14.1](#4141) | | Mar 24, 2025
| [4.14.0](#4140) | | Jan 15, 2025
| [4.13.1](#4131) | | Sep 29, 2024
| [4.13.0](#4130) | | Aug 12, 2024
| [4.12.0](#4120) | | Feb 22, 2024
| [4.11.1](#4111) | | Nov 14, 2023
| [4.11.0](#4110) | | Sep 15, 2023
| [4.10.0](#4100) | | May 21, 2023
| [4.9.0](#490) | | Dec 29, 2022
| [4.8.0](#480) | | Apr 21, 2022
| [4.7.1](#471) | | Apr 20, 2022
| [4.7.0](#470) | | Nov 15, 2021
| [4.6.0](#460) | | Jul 12, 2021
| [4.5.1](#451) | | May 30, 2021
| [4.5.0](#450) | | Apr 30, 2021
| [4.4.0](#440) | | Mar 29, 2021
| [4.3.1](#431) | | Nov 29, 2020
| [4.3.0](#430) | | Oct 20, 2020
| [4.2.0](#420) | | Jul 3, 2020
| [4.1.7](#417) | | Jun 30, 2020
| [4.1.5](#415) | | Jun 27, 2020
| [4.1.4](#414) | | Jun 26, 2020
| [4.1.3](#413) | | Jun 23, 2020
| [4.1.2](#412) | | Jun 5, 2020
| [4.1.1](#411) | | Jun 3, 2020
| [4.1.0](#410) | | May 8, 2020
| [4.0.1](#401) | | Jan 22, 2020
| [4.0.0](#400) | | Jan 09, 2020
| [3.13.0](#3130) | | Nov 5, 2019
| [3.12.2](#3122) | | Jan 8, 2019
| [3.12.1](#3121) | | Sept 17, 2018
| [3.12.0](#3120) | | Feb 22, 2018
| [3.11.0](#3110) | | Jan 3, 2018
| [3.10.0](#3100) | | Oct 25, 2017
| [3.9.2](#392) | | Oct 5, 2017
| [3.9.1](#391) | | Sep 28, 2017
| [3.9.0](#390) | | Sep 11, 2017
| [3.8.0](#380) | | Jul 29, 2017
| [3.7.1](#371) | | Jul 14, 2017
| [3.7.0](#370) | | Jun 19, 2017
| [3.6.1](#361) | | May 12, 2017
| [3.6.0](#360) | | May 8, 2017
| [3.5.1](#351) | | Apr 15, 2017
| [3.5.0](#350) | | Mar 26, 2017
| [3.4.1](#341) | | Feb 17, 2017
| [3.4.0](#340) | | Feb 13, 2017
| [3.3.4](#334) | | Jan 12, 2016
| [3.3.3](#333) | | Jan 10, 2016
| [3.3.2](#332) | | Jan 10, 2016
| [3.3.1](#331) | | Jan 10, 2016
| [3.3.0](#330) | | Dec 24, 2016
| [3.2.1](#321) | | Dec 24, 2016
| [3.2.0](#320) | | Nov 12, 2016
| [3.1.1](#311) | | Oct 23, 2016
| [3.1.0](#310) | | Oct 2, 2016
| [3.0.4](#304) | | Sept 19, 2016
| [3.0.3](#303) | | Sept 18, 2016
| [3.0.2](#302) | | Sept 6, 2016
| [3.0.1](#301) | | Aug 20, 2016
| [3.0.0](#300) | | Aug 20, 2016
| [2.2.0](#220) | | Jan 5, 2015
## 5.0.0 (`dev`)
- [#2677][2677] refactor: replace unsafe eval with safeeval.const in ROP cache loading
- [#2675][2675] feat(term): add zellij support
- [#2652][2652] Make setting the context.terminal to kitty more user friendly
- [#2638][2638] feat: add disable_corefiles context option
- [#2627][2627] remove pwnlib.util.iters.lookahead (broken anyway)
- [#2598][2598] aarch64: Fix ABI definition
- [#2419][2419] riscv: avoid compressed instructions (if you need compressed, use .option rvc)
- [#2551][2551] Detect when kitty is being used as terminal
- [#2519][2519] Drop Python 2.7 support / Require Python 3.10
- [#2507][2507] Add `+LINUX` and `+WINDOWS` doctest options and start proper testing on Windows
- [#2522][2522] Support starting a kitty debugging window with the 'kitten' command
- [#2524][2524] Raise EOFError during `process.recv` when stdout closes on Windows
- [#2526][2526] Properly make use of extra arguments in `packing` utilities. `sign` parameter requires keyword syntax to specify it.
- [#2517][2517] Allow to passthru kwargs on `ssh.__getattr__` convenience function to fix SSH motd problems
- [#2530][2530] Do NOT error when passing directory arguments in `checksec` commandline tool.
- [#2529][2529] Add LoongArch64 support
- [#2506][2506] ROP: fix `ROP(ELF(exe)).leave` is `None` in some ELF
- [#2504][2504] doc: add example case for `tuple` (host, port pair) in `gdb.attach`
- [#2546][2546] ssh: Allow passing disabled_algorithms keyword argument from ssh to paramiko
- [#2538][2538] Add `ssh -L` / `ssh.connect_remote()` workaround when `AllowTcpForwarding` is disabled
- [#2574][2574] Allow creating an ELF from in-memory bytes
- [#2575][2575] Detect when Terminator is being used as terminal
- [#2578][2578] Add gnome-terminal, Alacritty, Ttilix for run_in_new_terminal
- [#2590][2590] Add support for finding corefiles under WSL2
- [#2496][2496] Add linux ko file search support
- [#2542][2542] Decode `_IO_*` flags in `FileStructure` member
- [#2592][2592] pwnlib.config: Fix customization of `context.timeout`
- [#2608][2608] Abort on `libcdb file libc.so --unstrip` if eu-unstrip is not installed
- [#2611][2611] Cleanup `pwnlib.lexer` exports and imports
- [#2610][2610] Fix `log.progress` ignoring `context.log_console`
- [#2615][2615] tube/process: Fix redirecting stderr to stdout on Windows
- [#2639][2639] ROP: Remove stdout and argv workaround in ROPgadget invocation
- [#2630][2630] support `preexec_fn` in `debug()`
- [#2641][2641] support preexec_args in process
- [#2646][2646] fix(libcdb-cli): return early if no matched libc found
- [#2629][2629] Add `terminate()` method to process class that sends SIGTERM
- [#2643][2643] Refactor getdents.py, add support for SYS_getdents64
- [#2647][2647] packing: Add `overlap` to overlap structures easily
- [#2669][2669] asm: try native binutils before fallback architectures
- [#2673][2673] Add libc module for libc-related functions
- [#2680][2680] Cleanup Python 2 legacy
- [#2687][2687] Add (un)pack shorthands for 40-56 bit numbers `u48()`/`p48()`
- [#2699][2699] Fix `tty` and `raw` arguments in `ssh.process()`
[2677]: https://github.com/Gallopsled/pwntools/pull/2677
[2675]: https://github.com/Gallopsled/pwntools/pull/2675
[2652]: https://github.com/Gallopsled/pwntools/pull/2652
[2638]: https://github.com/Gallopsled/pwntools/pull/2638
[2627]: https://github.com/Gallopsled/pwntools/pull/2627
[2598]: https://github.com/Gallopsled/pwntools/pull/2598
[2419]: https://github.com/Gallopsled/pwntools/pull/2419
[2551]: https://github.com/Gallopsled/pwntools/pull/2551
[2519]: https://github.com/Gallopsled/pwntools/pull/2519
[2507]: https://github.com/Gallopsled/pwntools/pull/2507
[2522]: https://github.com/Gallopsled/pwntools/pull/2522
[2524]: https://github.com/Gallopsled/pwntools/pull/2524
[2526]: https://github.com/Gallopsled/pwntools/pull/2526
[2517]: https://github.com/Gallopsled/pwntools/pull/2517
[2530]: https://github.com/Gallopsled/pwntools/pull/2530
[2529]: https://github.com/Gallopsled/pwntools/pull/2529
[2506]: https://github.com/Gallopsled/pwntools/pull/2506
[2504]: https://github.com/Gallopsled/pwntools/pull/2504
[2546]: https://github.com/Gallopsled/pwntools/pull/2546
[2538]: https://github.com/Gallopsled/pwntools/pull/2538
[2574]: https://github.com/Gallopsled/pwntools/pull/2574
[2575]: https://github.com/Gallopsled/pwntools/pull/2575
[2578]: https://github.com/Gallopsled/pwntools/pull/2578
[2590]: https://github.com/Gallopsled/pwntools/pull/2590
[2496]: https://github.com/Gallopsled/pwntools/pull/2496
[2542]: https://github.com/Gallopsled/pwntools/pull/2542
[2592]: https://github.com/Gallopsled/pwntools/pull/2592
[2608]: https://github.com/Gallopsled/pwntools/pull/2608
[2611]: https://github.com/Gallopsled/pwntools/pull/2611
[2610]: https://github.com/Gallopsled/pwntools/pull/2610
[2615]: https://github.com/Gallopsled/pwntools/pull/2615
[2639]: https://github.com/Gallopsled/pwntools/pull/2639
[2630]: https://github.com/Gallopsled/pwntools/pull/2630
[2641]: https://github.com/Gallopsled/pwntools/pull/2641
[2646]: https://github.com/Gallopsled/pwntools/pull/2646
[2629]: https://github.com/Gallopsled/pwntools/pull/2629
[2643]: https://github.com/Gallopsled/pwntools/pull/2643
[2647]: https://github.com/Gallopsled/pwntools/pull/2647
[2669]: https://github.com/Gallopsled/pwntools/pull/2669
[2673]: https://github.com/Gallopsled/pwntools/pull/2673
[2680]: https://github.com/Gallopsled/pwntools/pull/2680
[2687]: https://github.com/Gallopsled/pwntools/pull/2687
[2699]: https://github.com/Gallopsled/pwntools/pull/2699
## 4.15.0 (`stable`)
- [#2508][2508] Ignore a warning when compiling with asm on nix
- [#2471][2471] Properly close spawned kitty window
- [#2358][2358] Cache output of `asm()`
- [#2457][2457] Catch exception of non-ELF files in checksec.
- [#2444][2444] Add `ELF.close()` to release resources
- [#2413][2413] libcdb: improve the search speed of `search_by_symbol_offsets` in local libc-database
- [#2470][2470] Fix waiting for gdb under WSL2
- [#2479][2479] Support extracting libraries from Docker image in `pwn template`
- [#2483][2483] Only print `checksec` output of `ELF.libc` when it was printed for the `ELF` already
- [#2482][2482] Throw error when using `sni` and setting `server_hostname` manually in `remote`
- [#2478][2478] libcdb-cli: add `--offline-only`, refactor unstrip and add fetch parser for download libc-database
- [#2484][2484] Allow to disable caching
- [#2291][2291] Fix attaching to a gdbserver with tuple `gdb.attach(('0.0.0.0',12345))`
- [#2410][2410] Add `tube.upload_manually` to upload files in chunks
- [#2502][2502] Fix loading ELF files without valid .dynamic section
- [#2476][2476] Deprecate 'keepends' argument in favor of 'drop' in `tube.recvline*`
- [#2364][2364] Deprecate direct commandline scripts invocation and exclude nonsense ones
- [#2570][2570] Fix `pwn template` to skip Docker library extraction for statically linked binaries
- [#2545][2545] SSH: fix download/upload with -1 exit status
- [#2567][2567] Fix mistakenly parsing of ld-linux error messages.
- [#2576][2576] regsort: respect register aliases
- [#2595][2595] libcdb: Add Ubuntu and Debian debuginfod servers to default list
- [#2593][2593] Use unicorn on macOS w/ SIP enabled
- [#2587][2587] Support longer function names in Windows `getexport` shellcode
- [#2596][2596] Ignore `colored_traceback` error when TERM envvar is unset
- [#2579][2579] Fix poll error in `process.libs()` and clean up maps parsing
- [#2602][2602] Allow setting debugger path via context.gdb_binary
- [#2609][2609] Fix log level of child remotes of `server` tube
- [#2612][2612] Fix lookup of binutils for `mipsel` architecture
- [#2624][2624] Fix regression: gdbserver can't handle command-line argument containing whitespace
[2508]: https://github.com/Gallopsled/pwntools/pull/2508
[2471]: https://github.com/Gallopsled/pwntools/pull/2471
[2358]: https://github.com/Gallopsled/pwntools/pull/2358
[2457]: https://github.com/Gallopsled/pwntools/pull/2457
[2444]: https://github.com/Gallopsled/pwntools/pull/2444
[2413]: https://github.com/Gallopsled/pwntools/pull/2413
[2470]: https://github.com/Gallopsled/pwntools/pull/2470
[2479]: https://github.com/Gallopsled/pwntools/pull/2479
[2483]: https://github.com/Gallopsled/pwntools/pull/2483
[2482]: https://github.com/Gallopsled/pwntools/pull/2482
[2478]: https://github.com/Gallopsled/pwntools/pull/2478
[2484]: https://github.com/Gallopsled/pwntools/pull/2484
[2291]: https://github.com/Gallopsled/pwntools/pull/2291
[2410]: https://github.com/Gallopsled/pwntools/pull/2410
[2502]: https://github.com/Gallopsled/pwntools/pull/2502
[2476]: https://github.com/Gallopsled/pwntools/pull/2476
[2364]: https://github.com/Gallopsled/pwntools/pull/2364
[2570]: https://github.com/Gallopsled/pwntools/pull/2570
[2545]: https://github.com/Gallopsled/pwntools/pull/2545
[2567]: https://github.com/Gallopsled/pwntools/pull/2567
[2576]: https://github.com/Gallopsled/pwntools/pull/2576
[2595]: https://github.com/Gallopsled/pwntools/pull/2595
[2593]: https://github.com/Gallopsled/pwntools/pull/2593
[2587]: https://github.com/Gallopsled/pwntools/pull/2587
[2596]: https://github.com/Gallopsled/pwntools/pull/2596
[2579]: https://github.com/Gallopsled/pwntools/pull/2579
[2602]: https://github.com/Gallopsled/pwntools/pull/2602
[2609]: https://github.com/Gallopsled/pwntools/pull/2609
[2612]: https://github.com/Gallopsled/pwntools/pull/2612
[2624]: https://github.com/Gallopsled/pwntools/pull/2624
## 4.14.1 (`stable`)
- [#2451][2451] Show symbols defined to value 0 (start of file)
- [#2533][2533] Fix installation on Python 3.5 and lower
- [#2518][2518] fix: update apport coredump path handling for CorefileFinder
- [#2552][2552] Fix memcpy shellcraft template off-by-one
- [#2559][2559] Fix parsing corefile with missing auxv
- [#2562][2562] Fix syntax highlighting of multiline comments in ASM
- [#2565][2565] Exclude broken Unicorn
[2451]: https://github.com/Gallopsled/pwntools/pull/2451
[2533]: https://github.com/Gallopsled/pwntools/pull/2533
[2518]: https://github.com/Gallopsled/pwntools/pull/2518
[2552]: https://github.com/Gallopsled/pwntools/pull/2552
[2559]: https://github.com/Gallopsled/pwntools/pull/2559
[2562]: https://github.com/Gallopsled/pwntools/pull/2562
[2565]: https://github.com/Gallopsled/pwntools/pull/2565
## 4.14.0
- [#2356][2356] Add local libc database provider for libcdb
- [#2360][2360] Add offline parameter for `search_by_hash` series function
- [#2388][2388] libcdb: add `offline_only` to `search_by_symbol_offsets`
- [#2374][2374] libcdb.unstrip_libc: debug symbols are fetched only if not present
- [#2327][2327] Add basic support to debug processes on Windows
- [#2437][2437] Support asm/disasm on Windows
- [#2330][2330] Change `context.newline` when setting `context.os` to `"windows"`
- [#2322][2322] Add basic RISCV64 shellcraft support
- [#2376][2376] Return buffered data on first EOF in tube.readline()
- [#2371][2371] Add functions for retrieving process mappings
- [#2398][2398] Add support for generating multiple shellcodes at a time in shellcraft
- [#2389][2389] Fix passing bytes to `context.log_file` and `crc.BitPolynom`
- [#2391][2391] Fix error message when passing invalid kwargs to `xor`
- [#2387][2387] Convert apport_corefile() output from bytes-like object to string
- [#2415][2415] Add shellcraft template for IPv6 socket
- [#2405][2405] Add "none" ssh authentication method
- [#2427][2427] Document behaviour of remote()'s sni argument as string.
- [#2382][2382] added optional port, gdb_args and gdbserver_args parameters to gdb.debug()
- [#2435][2435] Speed up gdbserver handshake in gdb.debug()
- [#2436][2436] Add resolution_addr parameter to Ret2dlresolvePayload
- [#2497][2497] Fix remote.fromsocket() to handle AF_INET6 socket
[2436]: https://github.com/Gallopsled/pwntools/pull/2436
[2371]: https://github.com/Gallopsled/pwntools/pull/2371
[2360]: https://github.com/Gallopsled/pwntools/pull/2360
[2356]: https://github.com/Gallopsled/pwntools/pull/2356
[2374]: https://github.com/Gallopsled/pwntools/pull/2374
[2327]: https://github.com/Gallopsled/pwntools/pull/2327
[2322]: https://github.com/Gallopsled/pwntools/pull/2322
[2330]: https://github.com/Gallopsled/pwntools/pull/2330
[2389]: https://github.com/Gallopsled/pwntools/pull/2389
[2391]: https://github.com/Gallopsled/pwntools/pull/2391
[2376]: https://github.com/Gallopsled/pwntools/pull/2376
[2387]: https://github.com/Gallopsled/pwntools/pull/2387
[2388]: https://github.com/Gallopsled/pwntools/pull/2388
[2398]: https://github.com/Gallopsled/pwntools/pull/2398
[2415]: https://github.com/Gallopsled/pwntools/pull/2415
[2405]: https://github.com/Gallopsled/pwntools/pull/2405
[2427]: https://github.com/Gallopsled/pwntools/pull/2405
[2382]: https://github.com/Gallopsled/pwntools/pull/2382
[2435]: https://github.com/Gallopsled/pwntools/pull/2435
[2437]: https://github.com/Gallopsled/pwntools/pull/2437
[2497]: https://github.com/Gallopsled/pwntools/pull/2497
## 4.13.1
- [#2445][2445] Fix parsing the PLT on Windows
- [#2466][2466] Fix PLT emulation with Unicorn 2.1.0
- [#2466][2466] Switch to PyPi Simple API for update checks
- [#2467][2467] Fix loading at all on Windows
- [#2469][2469] GDB 15+ rpyc detection
[2445]: https://github.com/Gallopsled/pwntools/pull/2445
[2466]: https://github.com/Gallopsled/pwntools/pull/2466
[2467]: https://github.com/Gallopsled/pwntools/pull/2467
[2469]: https://github.com/Gallopsled/pwntools/pull/2469
## 4.13.0
- [#2242][2242] Term module revamp: activating special handling of terminal only when necessary
- [#2277][2277] elf: Resolve more relocations into GOT entries
- [#2281][2281] FIX: Getting right amount of data for search fix
- [#2293][2293] Add x86 CET status to checksec output
- [#1763][1763] Allow to add to the existing environment in `process` instead of replacing it
- [#2307][2307] Fix `pwn libcdb file` crashing if "/bin/sh" string was not found
- [#2309][2309] Detect challenge binary and libc in `pwn template`
- [#2308][2308] Fix WinExec shellcraft to make sure it's 16 byte aligned
- [#2279][2279] Make `pwn template` always set context.binary
- [#2310][2310] Add support to start a process on Windows
- [#2335][2335] Add lookup optimizations in DynELF
- [#2334][2334] Speed up disasm commandline tool with colored output
- [#2328][2328] Lookup using $PATHEXT file extensions in `which` on Windows
- [#2189][2189] Explicitly define p64/u64 functions for IDE support
- [#2339][2339] Fix: Allow setting attributes on gdb Breakpoints
- [#2323][2323] Retry failed lookups after one week in libcdb
- [#2325][2325] Match against local system libc first in libcdb
- [#2336][2336] Add `ELF.stripped` and `ELF.debuginfo` properties
- [#2161][2161] Add basic support for darwin shellcraft/asm/disasm/run_shellcode/run_assembly
- [#2161][2161] Fix freebsd amd64 SyscallABI
- [#2160][2161] Fix invalid shellcraft.mov on arm64
- [#2284][2161] Fix invalid shellcraft.pushstr_array on arm64
- [#2345][2345] Fix pwn constgrep when it matches a non-constant type
- [#2338][2338] Fix: follow symlink for libs on ssh connection
- [#2341][2341] Launch GDB correctly in iTerm on Mac
- [#2268][2268] Add a `flatten` argument to `ssh.libs`
- [#2347][2347] Fix/workaround Unicorn Engine 1GB limit that calls exit()
- [#2233][2233] Fix gdb.debug: exe parameter now respected, allow empty argv
- [#2373][2373] Fix displaying bright color variation in terminal output
- [#2378][2378] Don't go though a shell in `gdb.debug`
[2242]: https://github.com/Gallopsled/pwntools/pull/2242
[2277]: https://github.com/Gallopsled/pwntools/pull/2277
[2281]: https://github.com/Gallopsled/pwntools/pull/2281
[2293]: https://github.com/Gallopsled/pwntools/pull/2293
[1763]: https://github.com/Gallopsled/pwntools/pull/1763
[2307]: https://github.com/Gallopsled/pwntools/pull/2307
[2309]: https://github.com/Gallopsled/pwntools/pull/2309
[2308]: https://github.com/Gallopsled/pwntools/pull/2308
[2279]: https://github.com/Gallopsled/pwntools/pull/2279
[2310]: https://github.com/Gallopsled/pwntools/pull/2310
[2335]: https://github.com/Gallopsled/pwntools/pull/2335
[2334]: https://github.com/Gallopsled/pwntools/pull/2334
[2328]: https://github.com/Gallopsled/pwntools/pull/2328
[2189]: https://github.com/Gallopsled/pwntools/pull/2189
[2339]: https://github.com/Gallopsled/pwntools/pull/2339
[2323]: https://github.com/Gallopsled/pwntools/pull/2323
[2325]: https://github.com/Gallopsled/pwntools/pull/2325
[2336]: https://github.com/Gallopsled/pwntools/pull/2336
[2161]: https://github.com/Gallopsled/pwntools/pull/2161
[2345]: https://github.com/Gallopsled/pwntools/pull/2345
[2338]: https://github.com/Gallopsled/pwntools/pull/2338
[2341]: https://github.com/Gallopsled/pwntools/pull/2341
[2268]: https://github.com/Gallopsled/pwntools/pull/2268
[2347]: https://github.com/Gallopsled/pwntools/pull/2347
[2233]: https://github.com/Gallopsled/pwntools/pull/2233
[2373]: https://github.com/Gallopsled/pwntools/pull/2373
[2378]: https://github.com/Gallopsled/pwntools/pull/2378
## 4.12.0
- [#2202][2202] Fix `remote` and `listen` in sagemath
- [#2117][2117] Add -p (--prefix) and -s (--separator) arguments to `hex` command
- [#2221][2221] Add shellcraft.sleep template wrapping SYS_nanosleep
- [#2219][2219] Fix passing arguments on the stack in shellcraft syscall template
- [#2212][2212] Add `--libc libc.so` argument to `pwn template` command
- [#2257][2257] Allow creation of custom templates for `pwn template` command
- [#2225][2225] Allow empty argv in ssh.process()
- [#2349][2349] Fix term.readline omitting a trailing \n
- [#2352][2352] add `RETURN_CONST` as an allowed `_const_code` in safeeval
[2202]: https://github.com/Gallopsled/pwntools/pull/2202
[2117]: https://github.com/Gallopsled/pwntools/pull/2117
[2221]: https://github.com/Gallopsled/pwntools/pull/2221
[2219]: https://github.com/Gallopsled/pwntools/pull/2219
[2212]: https://github.com/Gallopsled/pwntools/pull/2212
[2257]: https://github.com/Gallopsled/pwntools/pull/2257
[2225]: https://github.com/Gallopsled/pwntools/pull/2225
[2349]: https://github.com/Gallopsled/pwntools/pull/2349
[2352]: https://github.com/Gallopsled/pwntools/pull/2352
## 4.11.1
- [#2271][2271] FIX: Generated shebang with path to python invalid if path contains spaces
- [#2272][2272] Fix `tube.clean_and_log` not logging buffered data
- [#2281][2281] FIX: Getting right amount of data for search fix
- [#2287][2287] Fix `_countdown_handler` not invoking `timeout_change`
- [#2294][2294] Fix atexit SEGV in aarch64 loader
[2271]: https://github.com/Gallopsled/pwntools/pull/2271
[2272]: https://github.com/Gallopsled/pwntools/pull/2272
[2281]: https://github.com/Gallopsled/pwntools/pull/2281
[2287]: https://github.com/Gallopsled/pwntools/pull/2287
[2294]: https://github.com/Gallopsled/pwntools/pull/2294
## 4.11.0
- [#2185][2185] make fmtstr module able to create payload without $ notation
- [#2103][2103] Add search for libc binary by leaked function addresses `libcdb.search_by_symbol_offsets()`
- [#2177][2177] Support for RISC-V 64-bit architecture
- [#2186][2186] Enhance `ELF.nx` and `ELF.execstack`
- [#2129][2129] Handle `context.newline` correctly when typing in `tube.interactive()`
- [#2214][2214] Fix bug at ssh.py:`download` and `download_file` with relative paths
- [#2241][2241] Fix ssh.process not setting ssh_process.cwd attribute
- [#2261][2261] Fix corefile module after pyelftools update
[2185]: https://github.com/Gallopsled/pwntools/pull/2185
[2103]: https://github.com/Gallopsled/pwntools/pull/2103
[2177]: https://github.com/Gallopsled/pwntools/pull/2177
[2186]: https://github.com/Gallopsled/pwntools/pull/2186
[2129]: https://github.com/Gallopsled/pwntools/pull/2129
[2214]: https://github.com/Gallopsled/pwntools/pull/2214
[2241]: https://github.com/Gallopsled/pwntools/pull/2241
[2261]: https://github.com/Gallopsled/pwntools/pull/2261
## 4.10.0
In memoriam — [Zach Riggle][zach] — long time contributor and maintainer of Pwntools.
- [#2062][2062] make pwn cyclic -l work with entry larger than 4 bytes
- [#2092][2092] shellcraft: dup() is now called dupio() consistently across all supported arches
- [#2093][2093] setresuid() in shellcraft uses current euid by default
- [#2125][2125] Allow tube.recvregex to return capture groups
- [#2144][2144] Removes `p2align 2` `asm()` headers from `x86-32`, `x86-64` and `mips` architectures to avoid inconsistent instruction length when patching binaries
[2062]: https://github.com/Gallopsled/pwntools/pull/2062
[2092]: https://github.com/Gallopsled/pwntools/pull/2092
[2093]: https://github.com/Gallopsled/pwntools/pull/2093
[2125]: https://github.com/Gallopsled/pwntools/pull/2125
[2144]: https://github.com/Gallopsled/pwntools/pull/2144
[zach]: https://github.com/zachriggle
## 4.9.0
- [#1975][1975] Add libcdb commandline tool
- [#1979][1979] Add `js_escape()` and `js_unescape()` to `util.fiddling`
- [#2011][2011] Fix tube's debug output of same byte compression
- [#2023][2023] Support KDE Konsole in run_in_new_terminal function
- [#2027][2027] Fix ELF.libc_start_main_return with glibc 2.34
- [#2033][2033] Quote file and core path in generated GDB script
- [#2035][2035] Change Buffer's parent class to object
- [#2037][2037] Allow SSH tunnel to be treated like a TCP socket (with 'raw=True')
- [#2123][2123] Fix ROP without a writeable cache directory
- [#2124][2124] Fix `tube.recvpred()` timeout argument
[1975]: https://github.com/Gallopsled/pwntools/pull/1975
[1979]: https://github.com/Gallopsled/pwntools/pull/1979
[2011]: https://github.com/Gallopsled/pwntools/pull/2011
[2023]: https://github.com/Gallopsled/pwntools/pull/2023
[2027]: https://github.com/Gallopsled/pwntools/pull/2027
[2033]: https://github.com/Gallopsled/pwntools/pull/2033
[2035]: https://github.com/Gallopsled/pwntools/pull/2035
[2037]: https://github.com/Gallopsled/pwntools/pull/2037
[2123]: https://github.com/Gallopsled/pwntools/pull/2123
[2124]: https://github.com/Gallopsled/pwntools/pull/2124
## 4.8.0
- [#1922][1922] Fix logic in `wait_for_debugger`
- [#1828][1828] libcdb: Load debug info and unstrip libc binary
- [#1939][1939] Fix error in validating log levels
- [#1981][1981] Fix `cyclic_find()` to make it work with large int values
[1922]: https://github.com/Gallopsled/pwntools/pull/1922
[1828]: https://github.com/Gallopsled/pwntools/pull/1828
[1939]: https://github.com/Gallopsled/pwntools/pull/1939
[1981]: https://github.com/Gallopsled/pwntools/pull/1981
## 4.7.1
- [#1784][1784] Use temporary cache directory when persistent cache cannot be used
- [#1973][1973] ELF symbols can be looked up by bytes values
- several bugfixes ([#2012][2012], [#2031][2031], [#1912][1912], [#1961][1961],
[#2007][2007], [#2040][2040], [#2051][2051])
[1784]: https://github.com/Gallopsled/pwntools/pull/1784
[1912]: https://github.com/Gallopsled/pwntools/pull/1912
[1961]: https://github.com/Gallopsled/pwntools/pull/1961
[1973]: https://github.com/Gallopsled/pwntools/pull/1973
[2007]: https://github.com/Gallopsled/pwntools/pull/2007
[2012]: https://github.com/Gallopsled/pwntools/pull/2012
[2031]: https://github.com/Gallopsled/pwntools/pull/2031
[2040]: https://github.com/Gallopsled/pwntools/pull/2040
[2051]: https://github.com/Gallopsled/pwntools/pull/2051
## 4.7.0
- [#1733][1733] Update libc headers -> more syscalls available!
- [#1876][1876] add `self.message` and change `sys.exc_type` to `sys.exec_info()` in PwnlibException
- [#1877][1877] encoders error message handles when `avoid` is bytes in python3
- [#1891][1891] Keep ROP gadgets when setting registers via setattr/call
- [#1892][1892] Silence SIGPIPE error for "pwn phd"
- [#1893][1893] Fix bytes warning in "pwn cyclic"
- [#1897][1897] Add basic support for RISC-V
- [#1903][1903] Add zsh completion script
- [#1904][1904] Add bash completion script
- [#1906][1906] Defer import of several modules to save on startup time
- [#1921][1921] Add basic support for the bare-metal ARM specific toolchain
- [#1995][1995] Add `shellcraft.*.linux.cat2`, which uses alloc+read+write instead of sendfile
[1733]: https://github.com/Gallopsled/pwntools/pull/1733
[1876]: https://github.com/Gallopsled/pwntools/pull/1876
[1877]: https://github.com/Gallopsled/pwntools/pull/1877
[1891]: https://github.com/Gallopsled/pwntools/pull/1891
[1892]: https://github.com/Gallopsled/pwntools/pull/1892
[1893]: https://github.com/Gallopsled/pwntools/pull/1893
[1897]: https://github.com/Gallopsled/pwntools/pull/1897
[1903]: https://github.com/Gallopsled/pwntools/pull/1903
[1904]: https://github.com/Gallopsled/pwntools/pull/1904
[1906]: https://github.com/Gallopsled/pwntools/pull/1906
[1921]: https://github.com/Gallopsled/pwntools/pull/1921
[1995]: https://github.com/Gallopsled/pwntools/pull/1995
## 4.6.0
- [#1429][1429] Add a mechanism for ret2csu (originally #1138)
- [#1566][1566] Add `ignore_config` argument to `pwnlib.tubes.ssh` and improve `allow_agent` implementation
- [#1652][1652] Add `process.readmem` and `process.writemem`
- [#1739][1739] Add/fix shellcraft.linux.kill() / shellcraft.linux.killparent()
- [#1746][1746] Prefer Python3 over Python2 for spawning remote processes over SSH
- [#1751][1751] Fix process() with executable relative to cwd
- [#1753][1753] major change: less unconditional imports in pwnlib
- [#1776][1776] mips: do not use $t0 temporary variable in dupio
- [#1846][1846] support launching GDB in more different terminals
[1429]: https://github.com/Gallopsled/pwntools/pull/1429
[1566]: https://github.com/Gallopsled/pwntools/pull/1566
[1652]: https://github.com/Gallopsled/pwntools/pull/1652
[1739]: https://github.com/Gallopsled/pwntools/pull/1739
[1746]: https://github.com/Gallopsled/pwntools/pull/1746
[1751]: https://github.com/Gallopsled/pwntools/pull/1751
[1753]: https://github.com/Gallopsled/pwntools/pull/1753
[1776]: https://github.com/Gallopsled/pwntools/pull/1776
[1846]: https://github.com/Gallopsled/pwntools/pull/1846
## 4.5.1
- [#1902][1902] Always specify -F and -P for tmux in `run_in_new_terminal`
[1902]: https://github.com/Gallopsled/pwntools/pull/1902
## 4.5.0
- [#1261][1261] Misc `run_in_new_terminal` improvements (notably gdb terminated by default)
- [#1695][1695] Allow using GDB Python API
- [#1735][1735] Python 3.9 support in safeeval
- [#1738][1738] Which function support custom search path
- process also looks now at `env['PATH']` to find the path for the executable
- [#1742][1742] New `baremetal` os to debug binaries executed with qemu-system-$(arch)
- [#1757][1757] update cache directories
- [#1758][1758] Remove eval from cli
- [#1780][1780] Re-add Python2 to the official Dockerfile
- [#1941][1941] Disable all Android tests, `pwnlib.adb` is no longer supported in CI
- [#1811][1811] Remove unnecessary `pwn.toplevel.__all__`
- [#1827][1827] Support `$XDG_CONFIG_HOME` dir for `pwn.conf`
- [#1841][1841] Add colored_traceback
- [#1839][1839] run_in_new_terminal now creates a runner script if given a list or tuple
- [#1833][1833] Add pwnlib.filesystem module
- [#1852][1852] Fix `atexit` on Python 3
- [#1883][1883] ROP gadget verifier accounts for 2 character registers
[1261]: https://github.com/Gallopsled/pwntools/pull/1261
[1695]: https://github.com/Gallopsled/pwntools/pull/1695
[1735]: https://github.com/Gallopsled/pwntools/pull/1735
[1738]: https://github.com/Gallopsled/pwntools/pull/1738
[1742]: https://github.com/Gallopsled/pwntools/pull/1742
[1757]: https://github.com/Gallopsled/pwntools/pull/1757
[1758]: https://github.com/Gallopsled/pwntools/pull/1758
[1780]: https://github.com/Gallopsled/pwntools/pull/1780
[1941]: https://github.com/Gallopsled/pwntools/pull/1941
[1811]: https://github.com/Gallopsled/pwntools/pull/1811
[1827]: https://github.com/Gallopsled/pwntools/pull/1827
[1841]: https://github.com/Gallopsled/pwntools/pull/1841
[1839]: https://github.com/Gallopsled/pwntools/pull/1839
[1833]: https://github.com/Gallopsled/pwntools/pull/1833
[1852]: https://github.com/Gallopsled/pwntools/pull/1852
[1883]: https://github.com/Gallopsled/pwntools/pull/1883
## 4.4.0
- [#1541][1541] Use `context.newline` for tubes by default
- [#1602][1602] Fix bytes handling in ssh tubes
- [#1606][1606] Fix `asm()` and `disasm()` for MSP430, S390
- [#1616][1616] Fix `cyclic` cli for 64 bit integers
- [#1632][1632] Enable usage of Pwntools in jupyter
- [#1633][1633] Open a shell if `pwn template` cannot download the remote file
- [#1644][1644] Enable and support SNI for SSL-wrapped tubes
- [#1651][1651] Make `pwn shellcraft` faster
- [#1654][1654] Docker images (`pwntools/pwntools:stable` etc) now use Python3 by default, and includes assemblers for a few common architectures
- [#1667][1667] Add i386 encoder `ascii_shellcode` (Fixed docs in #1693)
- Fix syscall instruction lists for SROP on `i386` and `amd64`
- Fix migration to another ROP
- [#1673][1673] Add `base=` argument to `ROP.chain()` and `ROP.dump()`
- [#1675][1675] Gdbserver now correctly accepts multiple libraries in `LD_PRELOAD` and `LD_LIBRARY_PATH`
- [#1678][1678] ROPGadget multibr
- [#1682][1682] ROPGadget multibr fix
- [#1687][1687] Actually import `requests` when doing `from pwn import *`
- [#1688][1688] Add `__setattr__` and `__call__` interfaces to `ROP` for setting registers
- [#1692][1692] Remove python2 shebangs where appropriate
- [#1703][1703] Update libcdb buildid offsets for amd64 and i386
- [#1704][1704] Try https://libc.rip/ for libcdb lookup
[1541]: https://github.com/Gallopsled/pwntools/pull/1541
[1602]: https://github.com/Gallopsled/pwntools/pull/1602
[1606]: https://github.com/Gallopsled/pwntools/pull/1606
[1616]: https://github.com/Gallopsled/pwntools/pull/1616
[1632]: https://github.com/Gallopsled/pwntools/pull/1632
[1633]: https://github.com/Gallopsled/pwntools/pull/1633
[1644]: https://github.com/Gallopsled/pwntools/pull/1644
[1651]: https://github.com/Gallopsled/pwntools/pull/1651
[1654]: https://github.com/Gallopsled/pwntools/pull/1654
[1667]: https://github.com/Gallopsled/pwntools/pull/1667
[1673]: https://github.com/Gallopsled/pwntools/pull/1673
[1675]: https://github.com/Gallopsled/pwntools/pull/1675
[1678]: https://github.com/Gallopsled/pwntools/pull/1678
[1682]: https://github.com/Gallopsled/pwntools/pull/1679
[1687]: https://github.com/Gallopsled/pwntools/pull/1687
[1688]: https://github.com/Gallopsled/pwntools/pull/1688
[1692]: https://github.com/Gallopsled/pwntools/pull/1692
[1703]: https://github.com/Gallopsled/pwntools/pull/1703
[1704]: https://github.com/Gallopsled/pwntools/pull/1704
## 4.3.1
- [#1732][1732] Fix shellcraft SSTI vulnerability (first major pwntools vuln!)
[1732]: https://github.com/Gallopsled/pwntools/pull/1732
## 4.3.0
- [#1576][1576] Add `executable=` argument to `ELF.search`
- [#1584][1584] Add `jmp_esp`/`jmp_rsp` attribute to `ROP`
- [#1592][1592] Fix over-verbose logging of process() environment
- [#1593][1593] Colorize output of `pwn template`
- [#1601][1601] Add `pwn version` command line tool
- [#1605][1605] Add to `fiddling.hexdump` a way to suppress the total at the end
- [#1613][1613] Permit `--password` for `pwn template`
- [#1616][1616] Fix `cyclic` cli for 64 bit integers
- [#1564][1564] Fix `asm()` and `disasm()` for PowerPC64, MIPS64, Sparc64
- [#1621][1621] Permit negative values in flat() and fit()
[1576]: https://github.com/Gallopsled/pwntools/pull/1576
[1584]: https://github.com/Gallopsled/pwntools/pull/1584
[1592]: https://github.com/Gallopsled/pwntools/pull/1592
[1593]: https://github.com/Gallopsled/pwntools/pull/1593
[1601]: https://github.com/Gallopsled/pwntools/pull/1601
[1605]: https://github.com/Gallopsled/pwntools/pull/1605
[1613]: https://github.com/Gallopsled/pwntools/pull/1613
[1616]: https://github.com/Gallopsled/pwntools/pull/1616
[1564]: https://github.com/Gallopsled/pwntools/pull/1564
[1621]: https://github.com/Gallopsled/pwntools/pull/1621
## 4.2.1
- [#1625][1625] GDB now properly loads executables with QEMU
- [#1663][1663] Change lookup algorithm of `adb.which`
- [#1699][1699] Fix broken linux shellcraft templates
[1625]: https://github.com/Gallopsled/pwntools/pull/1625
[1699]: https://github.com/Gallopsled/pwntools/pull/1699
## 4.2.0
- [#1436][1436] Add ret2dlresolve automation
- [fecf9f] tubes.ssh.process() no longer requires python 2 installed on remote (still requires python, though)
- Miscellanous improvements to DynElf and fmtstr leaker (see examples/fmtstr/exploit2.py)
- [#1454][1454] Support for windows console colors
[1436]: https://github.com/Gallopsled/pwntools/pull/1436
[fecf9f]: http://github.com/Gallopsled/pwntools/commit/fecf9f
[1454]: https://github.com/Gallopsled/pwntools/pull/1454
## 4.1.7 (`stable`)
- [#1615][1615] Fix aarch64 pushstr and pushstr_array
[1615]: https://github.com/Gallopsled/pwntools/pull/1454
## 4.1.5
- [#1517][1517] flat(..., filler=) is fixed for `str` values and Python2 `bytes`
[1517]: https://github.com/Gallopsled/pwntools/pull/1517
## 4.1.4
- [#1698][1609] Fix issues in `packing.flat` with mis-ordred fields
[1609]: https://github.com/Gallopsled/pwntools/pull/1609
## 4.1.3
- [#1590][1590] Fix `gdb.attach()` for `remote`, `listen`, `ssh` tubes
- Also fix `run_in_new_terminal` for Py2 unicode strings
- [#1595][1595] Fix ssh.process(timeout=)
[1590]: https://github.com/Gallopsled/pwntools/pull/1590
[1595]: https://github.com/Gallopsled/pwntools/pull/1595
## 4.1.2
- Pwntools requires `six` v.1.12.0 or higher
## 4.1.1
- Fix PLT resolution by locking unicorn <1.0.2rc4 (#1538)
- Fix wrong ELF/context unpack handling (c4c11a37)
- Fix updating of ELF.functions addresses after changing ELF.address #1512 (#1513)
- Update Corefile warnings and replace asserts with normal checks (#1526)
- several py2-py3 issues (#1451)
- Fix cyclic command
## 4.1.0
- [#1316][1316] Fix connect shellcraft in python 3
- [#1323][1323] Fix issues related with debugging
- [#1001][1001] Enhance `unlock_bootloader` with better status messages
- [#1389][1389] remove old dependencies
- [#1241][1241] Launch QEMU with sysroot if specified
- [#1218][1218] Support for FileStructure exploitation
[1316]: https://github.com/Gallopsled/pwntools/pull/1316
[1323]: https://github.com/Gallopsled/pwntools/pull/1323
[1001]: https://github.com/Gallopsled/pwntools/pull/1001
[1389]: https://github.com/Gallopsled/pwntools/pull/1389
[1241]: https://github.com/Gallopsled/pwntools/pull/1241
[1218]: https://github.com/Gallopsled/pwntools/pull/1218
## 4.0.1
- [#1412][1412] `recvline_pred()` and similar do not reorder data
- Bypass unicorn-engine/unicorn#1100 and unicorn-engine/unicorn#1170 requiring unstable package
[1412]: https://github.com/Gallopsled/pwntools/pull/1412
## 4.0.0
- **Python 3 support! <3**
- [#1402][1402] Fix serialtube in python 3
- [#1391][1391] Fix process.libs
- [#1317][1317] Tubes with `context.encoding`
- [#1216][1216] Improve format string generator
- [#1285][1285] Add freebsd generic syscall templates
- [76413f][76413f] Add pwnlib.adb.bootimg for 'ANDROID!' format boot.img images
- [#1202][1202] Docker: Kill 14 layers in pwntools base images
- [#1182][1182] shellcraft.dupio() for mips
[1402]: https://github.com/Gallopsled/pwntools/pull/1402
[1391]: https://github.com/Gallopsled/pwntools/pull/1391
[1317]: https://github.com/Gallopsled/pwntools/pull/1317
[1285]: https://github.com/Gallopsled/pwntools/pull/1285
[1216]: https://github.com/Gallopsled/pwntools/pull/1216
[1202]: https://github.com/Gallopsled/pwntools/pull/1202
[1182]: https://github.com/Gallopsled/pwntools/pull/1182
[76413f]: https://github.com/Gallopsled/pwntools/commit/76413f
## 3.13.0
- [#1204][1204] Reduce ROP cache filename length
- [#1175][1175] Fix nested SSH connectors
- [#1355][1355] Fix 'break' syscall
- [#1277][1277] Fix timeout parameter passing in sendlineafter and other similar functions
- [#1292][1292] Provide correct arch name to gdb for sparc64
[1175]: https://github.com/Gallopsled/pwntools/pull/1175
[1204]: https://github.com/Gallopsled/pwntools/pull/1204
[1277]: https://github.com/Gallopsled/pwntools/pull/1277
[1292]: https://github.com/Gallopsled/pwntools/pull/1292
[1355]: https://github.com/Gallopsled/pwntools/pull/1355
## 3.12.2
- [#1242][1242] Use IntervalTree 2.xx, disallow use of 3.xx
- [#1243][1243] Fix a typo that caused an exception when executing a binary with `process()` which returns `-ENOEXEC` and the system does not have `qemu-user` binaries installed.
[1242]: https://github.com/Gallopsled/pwntools/pull/1242
[1243]: https://github.com/Gallopsled/pwntools/pull/1243
## 3.12.1
- [#1198][1198] More compatibility fixes for pyelftools==0.25, and pin Sphinx<1.8.0 since it causes testing errors
- [#1191][1191] Fix compatibility with pyelftools==0.25
- [#1159][1159] Fix check for `/proc/.../status`
- [#1162][1162] Fix broken package versions
- [#1150][1150] Fix exception raised when a cache file is missing
- [#1156][1156] Fix ROP gadget selection logic involving `int` and `syscall` instructions
- [#1152][1152] Fix QEMU LD_PREFIX calculation (wrong parameter passed)
- [#1155][1155] Use Ubuntu Trusty for all CI builds
- [#1131][1131] Add "libc-" to libc prefixes in `process` tubes
- [#1125][1125] Fix a typo
- [#1121][1121] Fix tests which were broken by an upstream Sphinx change
- [#1104][1104] Add `DynELF.dump()` for dumping remote ELF files
- [#1101][1101] Set `context.os` via `context.binary`, useful for Android exploitation
- [5fdc08][5fdc08] Work around broken `pidof` on Android
- [63dfed][63dfed] Print warning when Corefile deletion fails instead of throwing an exception
- [#1094][1094] Make hexdump output alignment more consistent
- [#1096][1096] `flat()` and `fit()` are now the same function
[1198]: https://github.com/Gallopsled/pwntools/pull/1198
[1191]: https://github.com/Gallopsled/pwntools/pull/1191
[1159]: https://github.com/Gallopsled/pwntools/pull/1159
[1162]: https://github.com/Gallopsled/pwntools/pull/1162
[1150]: https://github.com/Gallopsled/pwntools/pull/1150
[1156]: https://github.com/Gallopsled/pwntools/pull/1156
[1152]: https://github.com/Gallopsled/pwntools/pull/1152
[1155]: https://github.com/Gallopsled/pwntools/pull/1155
[1131]: https://github.com/Gallopsled/pwntools/pull/1131
[1125]: https://github.com/Gallopsled/pwntools/pull/1125
[1121]: https://github.com/Gallopsled/pwntools/pull/1121
[1104]: https://github.com/Gallopsled/pwntools/pull/1104
[1101]: https://github.com/Gallopsled/pwntools/pull/1101
[1094]: https://github.com/Gallopsled/pwntools/pull/1094
[1096]: https://github.com/Gallopsled/pwntools/pull/1096
[5fdc08]: https://github.com/Gallopsled/pwntools/commit/5fdc08
[63dfed]: https://github.com/Gallopsled/pwntools/commit/63dfed
## 3.12.0
- [#1083][1083] Better error messages for `gdb` when `LD_PRELOAD` is incorrect
- [#1085][1085] Add support for extracting Android `BOOTLDR!` images
- [#1075][1075] Add support for detecting GNU Screen for `run_in_new_terminal`
- [#1074][1074] Add support for running `pwntools-gdb` wrapper script instead of `gdb`
- [#1068][1068] Work around very old OpenSSL versions which don't have sha256 support *AND* don't exit with an error code when trying to use it
- [#1067][1067] Add `pwnlib.tubes.server` module, which adds a reusable `server` listener
- [#1063][1063] Add support for labels in `fit()`, allowing dynamic contents to be injected. (This feature is really cool, check out the pull request!)
[1083]: https://github.com/Gallopsled/pwntools/pull/1083
[1085]: https://github.com/Gallopsled/pwntools/pull/1085
[1075]: https://github.com/Gallopsled/pwntools/pull/1075
[1074]: https://github.com/Gallopsled/pwntools/pull/1074
[1068]: https://github.com/Gallopsled/pwntools/pull/1068
[1067]: https://github.com/Gallopsled/pwntools/pull/1067
[1063]: https://github.com/Gallopsled/pwntools/pull/1063
## 3.11.0
- [#1044][1044] Enhancements to ROP
+ Much better support for 64-bit Intel (amd64) ROP
+ ROP gadget selection is optimized to favor multi-pops instead of multiple single-pop gadgets
+ Added support for blacklisting byte values in ROP gadget addresses
- [#1049][1049] Enhancements to `cyclic`
+ `context` now has two additional attributes, `cyclic_alphabet` and `cyclic_length`, which correspond to the arguments `alphabet` and `n` to `cyclic()` and `cyclic_find()` and related routines.
+ The motivation for this change is to allow setting the `alphabet` globally, so that any padding / patterns generated internally to pwntools can be controlled. The specific motivation is blacklisting values in ROP padding.
- [#1052][1052] Enhancements for detecting `QEMU_LD_PREFIX` used by QEMU user-mode emulation for sysroots
- [#1035][1035] Minor documentation changes
- [#1032][1032] Enhancements to `pwn template`
- [#1031][1031] More accurate `Coredump.fault_addr` on amd64
- [#1084][1084] Fix broken tests due to `ftp.debian.org` going down
[1044]: https://github.com/Gallopsled/pwntools/pull/1044
[1049]: https://github.com/Gallopsled/pwntools/pull/1049
[1052]: https://github.com/Gallopsled/pwntools/pull/1052
[1035]: https://github.com/Gallopsled/pwntools/pull/1035
[1032]: https://github.com/Gallopsled/pwntools/pull/1032
[1031]: https://github.com/Gallopsled/pwntools/pull/1031
[1084]: https://github.com/Gallopsled/pwntools/pull/1084
## 3.10.0
- [#1007][1007] Add support for setting a `gdbinit` file in the context
- [#1055][1055] Fixes for `Corefile` stack parsing, speed up `ELF.string()`
- [#1057][1057] Fix a variable name typo in `DynELF` logging which results in an exception being thrown
- [#1058][1058] Fix an edge case in `ssh_process.exe`
[1007]: https://github.com/Gallopsled/pwntools/pull/1007
[1055]: https://github.com/Gallopsled/pwntools/pull/1055
[1057]: https://github.com/Gallopsled/pwntools/pull/1057
[1058]: https://github.com/Gallopsled/pwntools/pull/1058
## 3.9.2
- [#1043][1043] Do not attempt to populate the libraries used by statically-linked binaries
[1043]: https://github.com/Gallopsled/pwntools/pull/1043
## 3.9.1
- [#1038][1038] Fix an issue with `process()` where glibc would buffer data internally, causing a hang on `select()`
- [#1036][1036] Fix Travis CI logging verbosity
- [#1029][1029] Fix some `unicode` issues when using the `readline` command history in `tube.interactive()`
[1038]: https://github.com/Gallopsled/pwntools/pull/1038
[1036]: https://github.com/Gallopsled/pwntools/pull/1036
[1029]: https://github.com/Gallopsled/pwntools/pull/1029
## 3.9.0
- [#1003][1003] Make `concat_all` faster while also simplifying it's logic
- [#1014][1014] Fix for overwritten env when parsing core file
- [#1023][1023] Fixes to Travis CI
[1003]: https://github.com/Gallopsled/pwntools/pull/1003
[1014]: https://github.com/Gallopsled/pwntools/pull/1014
[1023]: https://github.com/Gallopsled/pwntools/pull/1023
## 3.8.0
- [#981][981] Fixed RELRO detection logic
- [#986][986] Enhancements to DynELF for controlling usage of LibcDB
- A few documentation fixes
- A few fixes for the Docker image
[981]: https://github.com/Gallopsled/pwntools/pull/981
[986]: https://github.com/Gallopsled/pwntools/pull/986
## 3.7.1
- [#998][998] Fix a bug where integer values could not be set in `.pwn.conf`.
[998]: https://github.com/Gallopsled/pwntools/pull/998
## 3.7.0
- [#933][933] DynELF works better with different base addresses
- [#952][952] A few small fixes were made to `pwn template`, and the CRC database was updated.
- [5c72d62c][5c72d62c] Updated the CRC database
[933]: https://github.com/Gallopsled/pwntools/pull/933
[952]: https://github.com/Gallopsled/pwntools/pull/952
[5c72d62c]: https://github.com/Gallopsled/pwntools/commit/5c72d62c
## 3.6.1
- [#979][979]+[1a4a1e1][1a4a1e1] Fixed [#974][974], a bug related to the terminal handling and numlock.
- [#980][980] Fixed the `pwn template` command.
[974]: https://github.com/Gallopsled/pwntools/issues/974
[979]: https://github.com/Gallopsled/pwntools/pull/979
[980]: https://github.com/Gallopsled/pwntools/pull/980
[1a4a1e1]: https://github.com/Gallopsled/pwntools/commit/1a4a1e1
## 3.6.0
- [#895][895] Added a Dockerfile to simplify testing setup and allow testing on OSX
- [#897][897] Fixed some incorrect AArch64 syscals
- [#893][893] Added the `pwnlib.config` module
+ Configuration options can now be set in `~/.pwn.conf`
+ This replaces the old, **undocumented** mechanism for changing logging colors. Only @br0ns and @ebeip90 were likely using this.
+ More information is available in the documentation [here](http://docs.pwntools.com/en/dev/config.html).
- [#899][899] Pwntools now uses Unicorn Engine to emulate PLT instructions to ensure correct mapping of PIE / RELRO binaries.
- [#904][904] Enhancements to the accuracy of the `pwn checksec` command.
- [#905][905] Added a `pwn debug` command-line utility which automates the process of `gdb.attach(process(...))` to spawn GDB
+ More information is available in the documentation [here](http://docs.pwntools.com/en/dev/commandline.html#pwn-debug)
- [#919][919] Added a `pwn template` command-line utility to simplify the process of bootstrapping a new exploit.
+ More information is available in the documentation [here](http://docs.pwntools.com/en/dev/commandline.html#pwn-template).
- [#948][948] Fix unnecessary warning for Core files
- [#954][954] Fix list processing in `~/.pwn.conf`
- [#967][967] Respect `TERM_PROGRAM` for `run_in_new_terminal`
- [#970][970] Fix overly-aggressive corefile caching
[947]: https://github.com/Gallopsled/pwntools/pull/947
[948]: https://github.com/Gallopsled/pwntools/pull/948
[954]: https://github.com/Gallopsled/pwntools/pull/954
[960]: https://github.com/Gallopsled/pwntools/pull/960
[967]: https://github.com/Gallopsled/pwntools/pull/967
[968]: https://github.com/Gallopsled/pwntools/pull/968
[970]: https://github.com/Gallopsled/pwntools/pull/970
[895]: https://github.com/Gallopsled/pwntools/pull/895
[897]: https://github.com/Gallopsled/pwntools/pull/897
[893]: https://github.com/Gallopsled/pwntools/pull/893
[899]: https://github.com/Gallopsled/pwntools/pull/899
[904]: https://github.com/Gallopsled/pwntools/pull/904
[905]: https://github.com/Gallopsled/pwntools/pull/905
[919]: https://github.com/Gallopsled/pwntools/pull/919
## 3.5.1
- [#945][945] Speed up ssh via caching checksec results (fixes [#944][944])
- [#950][950] Fixes a bug where setting `context.arch` does not have an effect on `adb.compile()` output architecture
[944]: https://github.com/Gallopsled/pwntools/issues/944
[945]: https://github.com/Gallopsled/pwntools/pull/945
[950]: https://github.com/Gallopsled/pwntools/pull/950
## 3.5.0
- [b584ca3][b584ca3] Fixed an issue running `setup.py` on ARM
- [#822][822] Enabled relative leaks with `MemLeak`
+ This should be useful for e.g. heap-relative leaks
- [#832][832] Changed all internal imports to use absolute imports (no functional changes)
- [a12d0b6][a12d0b6] Move `STDOUT`, `PIPE`, `PTY` constants to globals
+ `process(..., stdin=process.PTY)` --> `process(..., stdin=PTY)`
- [#828][828] Use `PR_SET_PTRACER` for all `process()` and `ssh.process()` instances
+ This simplifies debugging on systems with YAMA ptrace enabled
- Various documentation enhancements
+ In particular, the [gdb][gdb], [elf][elf], and [ssh][ssh] docs are much better
- [#833][833] Performance enhancements for `adb` module
- [d0267f3][d0267f3] `packing.fit()` now treats large offsets as cyclic patterns (e.g. `0x61616161` behaves the same as `"aaaa"`)
- [#835][835] Added `ssh.checksec`
+ Reports the kernel version and other relevant information on connection
- [#857][857] Slightly shortened `execve` shellcode
- [300f8e0][300f8e0] Slightly speed up processing of large ELF files
- [#861][861] Adds support for extracting `IKCONFIG` configs from Linux kernel images, and extends `checksec` to report on any insecure configurations discovered
- [#871][871] Moves all of the basic syscall templates to `shellcraft/common` and exposes them via symlinks. Closed [#685][685]
+ Should not have any visible effects from any documented APIs
+ `shellcraft.arch.os.syscall_function()` still works the same
+ We now have the ability to differentiate between the `connect` syscall, and a TCP `connect` helper
- [#887][887] `sh_string` now returns a quoted empty string `''` rather than just an empty string
- [#839][839] Exposes a huge amount of functionality via corefiles which was not previously availble. See the [docs][corefile_docs] for examples.
+ `process().corefile` will automatically instantiate a Corefile for the process
+ QEMU-emulated processes are supported
+ Native processes are supported, including extraction of coredumps from `apport` crash logs
+ Native processes can be dumped *while running*, in a manner similar to `GDB`'s `gcore` script
- [#875][857] Added [documentation][aarch64] (and tests) for AArch64 shellcode
- [#882][882] The `ROP` class now respects `context.bytes` instead of using the hard-coded value of `4` (fixed [#879][879])
- [#869][869] Added several fields to the `process` class (`uid`, `gid`, `suid`, `sgid`) which are recorded at execution time, based on the file permissions
- [#868][868] Changed the way that `ssh.process()` works internally, and it now returns a more specialized class, `ssh_process`.
+ Added `ssh_process.corefile` for fetching remote corefiles
+ Added `ssh_process.ELF` for getting an ELF of the remote executable
+ The `uid`, `gid`, and `suid`, and `sgid` which are recorded at execution time, based on the file permissions
- [#865][865] Fixes `ELF.read` to support contiguous memory reads across non-contiguous file-backed segments
- [#862][862] Adds a `symlink=` argument to `ssh.set_working_directory`, which will automatically symlink all of the files in the "old" working directory into the "new" working directory
[ssh]: http://docs.pwntools.com/en/dev/tubes/ssh.html
[gdb]: http://docs.pwntools.com/en/dev/gdb.html
[elf]: http://docs.pwntools.com/en/dev/elf.html
[corefile_docs]: http://docs.pwntools.com/en/dev/elf/corefile.html
[aarch64]: http://docs.pwntools.com/en/dev/shellcraft/aarch64.html
[685]: https://github.com/Gallopsled/pwntools/pull/685
[822]: https://github.com/Gallopsled/pwntools/pull/822
[828]: https://github.com/Gallopsled/pwntools/pull/828
[832]: https://github.com/Gallopsled/pwntools/pull/832
[833]: https://github.com/Gallopsled/pwntools/pull/833
[835]: https://github.com/Gallopsled/pwntools/pull/835
[839]: https://github.com/Gallopsled/pwntools/pull/839
[857]: https://github.com/Gallopsled/pwntools/pull/857
[861]: https://github.com/Gallopsled/pwntools/pull/861
[862]: https://github.com/Gallopsled/pwntools/pull/862
[865]: https://github.com/Gallopsled/pwntools/pull/865
[868]: https://github.com/Gallopsled/pwntools/pull/868
[869]: https://github.com/Gallopsled/pwntools/pull/869
[871]: https://github.com/Gallopsled/pwntools/pull/871
[875]: https://github.com/Gallopsled/pwntools/pull/857
[879]: https://github.com/Gallopsled/pwntools/issues/879
[882]: https://github.com/Gallopsled/pwntools/pull/882
[887]: https://github.com/Gallopsled/pwntools/pull/887
[b584ca3]: https://github.com/Gallopsled/pwntools/commit/b584ca3
[a12d0b6]: https://github.com/Gallopsled/pwntools/commit/a12d0b6
[d0267f3]: https://github.com/Gallopsled/pwntools/commit/d0267f3
[300f8e0]: https://github.com/Gallopsled/pwntools/commit/300f8e0
## 3.4.1
- [#894][894] Fix a bug when using `gdb.debug()` over ssh.
- [e021f57][e021f57] Fix a bug ([#891][891]) in `rop` when needing to insert padding to fix alignment
[e021f57]: https://github.com/Gallopsled/pwntools/commit/e021f57
[894]: https://github.com/Gallopsled/pwntools/pull/894
[891]: https://github.com/Gallopsled/pwntools/issues/891
## 3.4.0
- [#800][800] Add `shell=` option to `ssh.process()`
- [#806][806] Add `context.buffer_size` for fine-tuning `tube` performance
+ Also adds `buffer_fill_size=` argument for all tubes
- [b83a6c7][b83a6c7] Fix undocumented `process.leak` function
- [546061e][546061e] Modify `coredump_filter` of all spawned processes, so that core dumps are more complete
- [#809][809] Add several functions to `adb` (`unlink`, `mkdir`, `makedirs`, `isdir`, `exists`)
- [#817][817] Make disconnection detection more robust
[800]: https://github.com/Gallopsled/pwntools/pull/800
[806]: https://github.com/Gallopsled/pwntools/pull/806
[809]: https://github.com/Gallopsled/pwntools/pull/809
[817]: https://github.com/Gallopsled/pwntools/pull/817
[5d9792f]: https://github.com/Gallopsled/pwntools/commit/5d9792f
[b83a6c7]: https://github.com/Gallopsled/pwntools/commit/b83a6c7
[546061e]: https://github.com/Gallopsled/pwntools/commit/546061e
## 3.3.4
- [#850][850] and [#846][846] fix issues with `hexdump` and the `phd` command-line utility, when using pipes (e.g. `echo foo | phd`)
- [#852][852] Fixes register ordering in `regsort`
- [#853][853] Fixes the registers restored in `shellcraft.amd64.popad`
[846]: https://github.com/gallopsled/pwntools/pull/846
[850]: https://github.com/gallopsled/pwntools/pull/850
[852]: https://github.com/gallopsled/pwntools/pull/852
[853]: https://github.com/gallopsled/pwntools/pull/853
## 3.3.3
- [#843][843] fixed a bug in `amd64.mov`.
[843]: https://github.com/gallopsled/pwntools/pull/843
## 3.3.2
- [#840][840] fixed a regression introduced by [#837][837].
[840]: https://github.com/gallopsled/pwntools/pull/840
## 3.3.1
- [#833][833] Fixed a performance-impacting bug in the adb module.
- [#837][837] Fixed a bug([#836][836]) causing `hexdump(cyclic=True)` to throw an exception.
[833]: https://github.com/Gallopsled/pwntools/pull/833
[837]: https://github.com/Gallopsled/pwntools/pull/837
[836]: https://github.com/Gallopsled/pwntools/issues/836
## 3.3.0
- [b198ec8][b198ec8] Added `tube.stream()` function, which is like `tube.interact()` without a prompt or keyboard input.
+ Effectively, this is similar to `cat file` and just prints data as fast as it is received.
- [aec3fa6][aec3fa6] Disable update checks against GitHub
+ These checks frequently broke due to GitHub query limits
- [#757][757] Fixed `adb.wait_for_device()` re-use of the same connection
- [f9133b1][f9133b1] Add a `STDERR` magic argument to make logging go to `stderr` instead of `stdout`
+ Usage is e.g. `python foo.py STDERR` or `PWNLIB_STDERR=1 python foo.py`
+ Also adds `context.log_console` to log to any file or terminal
- [67e11a9][67e11a9] Add faster error checking to `cyclic()` when provided very large values
- [5fda658][5fda658] Expose BitPolynom in `globals()`
- [#765][765] Added `-d` option for hex-escaped output for `shellcraft` command-line tool
- [#772][772] Fixed bash completion regressions
- [30c34b7][30c34b7] Fix `ROP.call()` with `Function` objects from `ELF.functions`
- [fa402ce][fa402ce] Add `adb.uptime` and `adb.boot_time`
- [82312ba][82312ba] Add `cyclic_metasploit` and `cyclic_metasploit_find`
[757]: https://github.com/Gallopsled/pwntools/pull/757
[765]: https://github.com/Gallopsled/pwntools/pull/765
[772]: https://github.com/Gallopsled/pwntools/pull/772
[b198ec8]: https://github.com/Gallopsled/pwntools/commit/b198ec8
[aec3fa6]: https://github.com/Gallopsled/pwntools/commit/aec3fa6
[f9133b1]: https://github.com/Gallopsled/pwntools/commit/f9133b1
[67e11a9]: https://github.com/Gallopsled/pwntools/commit/67e11a9
[5fda658]: https://github.com/Gallopsled/pwntools/commit/5fda658
[30c34b7]: https://github.com/Gallopsled/pwntools/commit/30c34b7
[fa402ce]: https://github.com/Gallopsled/pwntools/commit/fa402ce
[82312ba]: https://github.com/Gallopsled/pwntools/commit/82312ba
## 3.2.1
Multiple bug fixes.
- [#783][783] Fix `adb.uninstall` typo
- [#787][787] Added error handling for `ssh.process` argument `preexec_fn`
- [#793][793] Fixed progress message in `remote()` when connections failed
- [#802][802] Fixed partition listing in `adb.partitions`, which accidentally shelled out to the `adb` binary
- [#804][804] Fix error message for 32-bit distributions
- [#805][805] Fix exception in `Core.segments` when a segment has no name
- [#811][811] Fixes and performance improvements for `adb.wait_for_device()`
- [#813][813] Fixed a release script
- [#814][814] Fixed exceptions thrown if the `$HOME` directory is not writable
- [#815][815] Properly handle `None` in `MemLeak`
[783]: https://github.com/Gallopsled/pwntools/pull/783
[787]: https://github.com/Gallopsled/pwntools/pull/787
[793]: https://github.com/Gallopsled/pwntools/pull/793
[802]: https://github.com/Gallopsled/pwntools/pull/802
[804]: https://github.com/Gallopsled/pwntools/pull/804
[805]: https://github.com/Gallopsled/pwntools/pull/805
[811]: https://github.com/Gallopsled/pwntools/pull/811
[813]: https://github.com/Gallopsled/pwntools/pull/813
[814]: https://github.com/Gallopsled/pwntools/pull/814
[815]: https://github.com/Gallopsled/pwntools/pull/815
## 3.2.0
- [#695][695] Fixed a performance regression in `phd`.
- [452605e][452605e] Fixed [#629][629] related to correct removal of temporary files.
- [ea94ee4][ea94ee4] Disallows semi-colons in for the `run_in_terminal` function, since it did not work properly in all cases.
- [6376d07][6376d07] Added the mips shellcode `pushstr_array`.
- [#700][700] Added missing MIPS shellcode documentation to readthedocs, and enabled unit tests
- [#701][701] Command line tools refactored to have a common `pwn` entry point.
+ Added an option to *not* install the traditional `asm`, `disasm`, `checksec`, etc scripts
+ All existing tools can be accessed from the `pwn` command (e.g. `pwn asm nop`).
- [#704][704] The `process` object has a new, optional argument `alarm` for setting a `SIGALRM` timeout for processes.
- [#705][705] Added the Android Emulator to the test suite and Travis CI.
+ Android Emulator is now required for the full test suite
+ Android Emulator tests are skipped if no Android-related changes are detected
- [#711][711] `DynELF` has a new attribute, `heap`, which leaks the current `brk` address (heap base). This is useful for finding heap allocations with dlmalloc-derived allocators like those used by Glibc.
- [#717][717] `sh_string` was rewritten to emit more compact and compatible strings
+ This was achieved by embedding single-quoted non-printable literals
+ Much more testing was added
+ Emitted strings are no longer copy-paste compatible, but work fine with e.g. `tubes` module and the default `subprocess` module
- [#709][709] The `adb` module now directly talks to the `adb` server process via a new module, `adb.protocol`
+ Removes the need to shell out to `adb`
+ Avoids version-compatibility issues with `adb` server vs. client
- [#703][703] Added new methods to `adb`
+ `install` - Installs an APK
+ `uninstall` - Uninstalls a package
+ `packages` - Lists installed packages
- [4893819][4893819] Modified `shellcraft.sh` on all platforms to provide `argv[0]` and set `argc==1`
+ This is needed for systems which have Busybox or other minimal shell for `/bin/sh` which does not behave well with `argc==0` or `argv[0]==NULL`.
- [1e414af][1e414af] Added `connect()` alias for `remote()`
+ For example, `io=connect('google.com', 80)`
+ This also works with `tcp(...)` and `udp(...)` aliases
- [869ec42][869ec42] Added `ssh.read()` and `ssh.write()` aliases
- [2af55c9][2af55c9] `AdbDevice` objects exposed via e.g. `adb.devices()` now offer scoped access to all `adb` module properties
+ It is now possible to e.g. `map(lambda d: d.process(['id']).recvall(), adb.devices())`
[629]: https://github.com/Gallopsled/pwntools/issues/629
[695]: https://github.com/Gallopsled/pwntools/pull/695
[700]: https://github.com/Gallopsled/pwntools/pull/700
[701]: https://github.com/Gallopsled/pwntools/pull/701
[704]: https://github.com/Gallopsled/pwntools/pull/704
[711]: https://github.com/Gallopsled/pwntools/pull/711
[717]: https://github.com/Gallopsled/pwntools/pull/717
[709]: https://github.com/Gallopsled/pwntools/pull/709
[705]: https://github.com/Gallopsled/pwntools/pull/705
[703]: https://github.com/Gallopsled/pwntools/pull/703
[452605e]: https://github.com/Gallopsled/pwntools/commit/452605e854f4870ef5ccfdf7fb110dfd75c50feb
[ea94ee4]: https://github.com/Gallopsled/pwntools/commit/ea94ee4ca5a8060567cc9bd0dc33796a89ad0b95
[6376d07]: https://github.com/Gallopsled/pwntools/commit/6376d072660fb2250f48bd22629bbd7e3c61c758
[1e414af]: https://github.com/Gallopsled/pwntools/commit/1e414afbeb3a01242f4918f111febaa63b640eb7
[869ec42]: https://github.com/Gallopsled/pwntools/commit/869ec42082b4b98958dfe85103da9b101dde7daa
[4893819]: https://github.com/Gallopsled/pwntools/commit/4893819b4c23182da570e2f4ea4c14d73af2c0df
[2af55c9]: https://github.com/Gallopsled/pwntools/commit/2af55c9bc382eca23f89bc0abc7a07c075521f94
## 3.1.1
Fixed a bug in `MemLeak.struct` (PR: #768).
## 3.1.0
A number of smaller bugfixes and documentation tweaks.
## 3.0.4
- Fixed a bug that made 3.0.3 uninstallable (Issue: #751, PR: #752)
## 3.0.3
- Fixed some performance and usability problems with the update system (Issues:
#723, #724, #736. PRs: #729, #738, #747).
- Fixed a bug related to internals in pyelftools (PRs: #730, #746).
- Fixed an issue with travis (Issue: #741, PRs: #743, #744, #745).
## 3.0.2
- Cherry-pick #695, as this was a regression-fix.
- Added a fix for the update checker, as it would suggest prereleases as updates to stable releases.
- Various documentation fixes.
## 3.0.1
A small bugfix release. There were a lot of references to the `master`-branch, however after 3.0.0 we use the names `stable`, `beta` and `dev` for our branches.
## 3.0.0
This was a large release (1305 commits since 2.2.0) with a lot of bugfixes and changes. The Binjitsu project, a fork of Pwntools, was merged back into Pwntools. As such, its features are now available here.
As always, the best source of information on specific features is the comprehensive docs at https://pwntools.readthedocs.org.
This list of changes is non-complete, but covers all of the significant changes which were appropriately documented.
#### Android
Android support via a new `adb` module, `context.device`, `context.adb_host`, and `context.adb_port`.
#### Assembly and Shellcode
- Assembly module enhancements for making ELF modules from assembly or pre-assembled shellcode. See `asm.make_elf` and `asm.make_elf_from_assembly`.
- `asm` and `shellcraft` command-line tools support flags for the new shellcode encoders
- `asm` and `shellcraft` command-line tools support `--debug` flag for automatically launching GDB on the result
- Added MIPS, PowerPC, and AArch64 support to the `shellcraft` module
- Added Cyber Grand Challenge (CGC) support to the `shellcraft` module
- Added syscall wrappers for every Linux syscall for all supported architectures to the `shellcraft` module
+ e.g. `shellcraft.<arch>.gettimeofday`
- (e.g. `shellcraft.i386.linux.`)
- Added in-memory ELF loaders for most supported architectures
+ Only supports statically-linked binaries
+ `shellcraft.<arch>.linux.loader`
#### Context Module
- Added `context.aslr` which controls ASLR on launched processes. This works with both `process()` and `ssh.process()`, and can be specified per-process with the `aslr=` keyword argument.
- Added `context.binary` which automatically sets all `context` variables from an ELF file.
- Added `context.device`, `context.adb`, `context.adb_port`, and `context.adb_host` for connecting to Android devices.
- Added `context.kernel` setting for SigReturn-Oriented-Programming (SROP).
- Added `context.log_file` setting for sending logs to a file. This can be set with the `LOG_FILE` magic command-line option.
- Added `context.noptrace` setting for disabling actions which require `ptrace` support. This is useful for turning all `gdb.debug` and `gdb.attach` options into no-ops, and can be set via the `NOPTRACE` magic command-line option.
- Added `context.proxy` which hooks all connections and sends them to a SOCKS4/SOCKS5. This can be set via the `PROXY` magic command-line option.
- Added `context.randomize` to control randomization of settings like XOR keys and register ordering (default off).
- Added `context.terminal` for setting how to launch commands in a new terminal.
#### DynELF and MemLeak Module
- Added a `DynELF().libc` property which attempt to find the remote libc and download the ELF from LibcDB.
- Added a `DynELF().stack` property which leaks the `__environ` pointer from libc, making it easy to leak stack addresses.
- Added `MemLeak.String` and `MemLeak.NoNewlines` and other related helpers for handling special leakers which cannot e.g. handle newlines in the leaked addresses and which leak a C string (e.g. auto-append a `'\x00'`).
- Enhancements for leaking speed via `MemLeak.compare` to avoid leaking an entire field if we can tell from a partial leak that it does not match what we are searching for.
#### Encoders Module
- Added a `pwnlib.encoders` module for assembled-shellcode encoders/decoders
- Includes position-independent basic XOR encoders
- Includes position-independent delta encoders
- Includes non-position-independent alphanumeric encoders for Intel
- Includes position-independent alphanumeric encoders for ARM/Thumb
#### ELF Module
- Added a `Core` object which can parse core-files, in order to extract / search for memory contents, and extract register states (e.g. `Core('./corefile').eax`).
#### Format Strings
- Added a basic `fmtstr` module for assisting with Format String exploitation
#### GDB Module
- Added support for debugging Android devices when `context.os=='android'`
- Added helpers for debugging shellcode snippets with `gdb.debug_assembly()` and `gdb.debug_shellcode()`
#### ROP Module
- Added support for SigReturn via `pwnlib.rop.srop`
+ Occurs automatically when syscalls are invoked and a function cannot be found
+ SigReturn frames can be constructed manually with `SigreturnFrame()` objects
- Added functional doctests for ROP and SROP
#### Tubes Process Module
- `process()` has many new options, check out the documentation
+ `aslr` controls ASLR
+ `setuid` can disable the effect of setuid, allowing core dumps (useful for extracting crash state via the new `Core()` object)
+ TTY echo and control characters can be enabled via `raw` argument
- `stdout` and `stderr` are now PTYs by default
+ `stdin` can be set to a PTY also via setting `stdin=process.PTY`
#### Tubes SSH Module
- Massive enhancements all over
- `ssh` objects now have a `ssh.process()` method which avoids the need to handle shell expansion via the old `ssh.run()` method
- Files are downloaded via SFTP if available
- New `download` and `upload` methods auto-detect whether the target is a file or directory and acts accordingly
- Added `listen()` method alias for `listen_remote()`
- Added `remote()` method alias for `connect_remote()`
#### Utilities
- Added `fit()` method to combine the functionality of `flat()` with the functionality of `cyclic()`
- Added `negative()` method to negate the value of an integer via two's complement, with respect to the current integer size (`context.bytes`).
- Added `xor_key()` method to generate an XOR key which avoids undesirable bytes over a given input.
- Added a multi-threaded `bruteforce()` implementation, `mbruteforce()`.
- Added `dealarm_shell()` helper to remove the effects of `alarm()` after you've popped a shell.
## 2.2.0
This was a large release with a lot of bugfixes and changes. Only the most significant
are mentioned here.
- Added shellcodes
- Added phd
- Re-added our expansion of itertools
- Added replacements for some semi-broken python standard library modules
- Re-implemented the rop module
- Added a serial tube
- Huge performance gains in the buffering for tubes
- Re-added user agents
- Begun using Travis CI with lots of test
- Removed bundled binutils in favor of documenting how to build them yourselves
- Added support for port forwarding though our SSH module
- Added dependency for capstone and ropgadget
- Added a lots of shellcodes
- Stuff we forgot
- Lots of documentation fixes
- Lots of bugfixes
================================================
FILE: CONTRIBUTING.md
================================================
# Contributing
Github has a great guide for contributing to open source projects:
- [Contributing to a project](https://guides.github.com/activities/forking/)
- [Fork the repository](https://guides.github.com/activities/forking/#fork)
- [Clone your fork](https://guides.github.com/activities/forking/#clone)
- [Making and pushing changes](https://guides.github.com/activities/forking/#making-changes)
- [Making a Pull Request](https://guides.github.com/activities/forking/#making-a-pull-request)
- [Huzzah!](https://guides.github.com/activities/forking/#huzzah)
## pwntools Specifics
In general, we like to keep things documented. You should add documentation to any new functionality, and update it for any changed functionality. Our docstrings use the [Google Style Python Docstrings](https://sphinxcontrib-napoleon.readthedocs.org/en/latest/example_google.html#example-google).
After you have documentation, you should add a [doctest](https://docs.python.org/2/library/doctest.html).
Finally, it is probably a good idea to run the test suite locally before doing
the pull-request to make sure everything works, however this is not a
requirement.
Once you are ready to do a pull-request, you should figure out if your changes
constitutes a new feature or a bugfix in stable or beta. If it is a bugfix in
stable or beta, you should do the pull-request against the branch in question,
and otherwise your pull-request should be against the dev branch.
Once you do the pull-request Travis CI will run the test-suite on it. Once it
passes one of the core developers will look at your pull request, possibly
comment on it and then hopefully merge it into the branch in question.
## Automated Testing
Pull requests against Pwntools require at a minimum that no tests have been broken, and ideally each pull request will include new tests to ensure that all of the functionality works as intended.
You can find more information on testing in [TESTING.md](TESTING.md).
================================================
FILE: DOCKER.md
================================================
# Using Pwntools with Docker
Sometimes it's annoying to set up Pwntools on your workstation, and you want something that Just Works (TM).
[Docker](https://www.docker.com/) is here to the rescue! Using Docker means that you get a nice, standardized Linux environment and don't need to worry about pip or installing dependencies.
## Quick Start
First, install Docker for your OS, which you can find on their [Getting Started](https://www.docker.com/get-started) page.
Next, download and run the Pwntools stable docker image.
```sh
$ docker run -it pwntools/pwntools:stable
```
## Recommended Settings
In order to get the most from your docker image, we need to enable debugging of processes (`--privileged`) and expose the network ports from the guest to the host (`--net=host`).
```sh
$ docker run -it \
--privileged \
--net=host \
--hostname localhost \
--ulimit core=-1:-1 \
pwntools/pwntools:stable
```
## Sharing a Folder
It's really nice to be able to use your preferred native editor, and have the changes show up live inside your Docker image. This is easy to add, thanks to Docker's bind mounts (`--mount type=bind`).
With the command below, your `~/exploits` directory will magically show up inside the Docker image at `/home/pwntools/exploits` so that you can easily run them (from Docker) and edit them (from outside Docker).
```sh
$ mkdir $HOME/exploits
$ vim $HOME/exploits/my_exploit.py
$ docker run -it \
--privileged \
--net=host \
--hostname localhost \
--ulimit core=-1:-1 \
--mount type=bind,source="$HOME/exploits",target=/home/pwntools/exploits \
pwntools/pwntools:stable
$ python3 exploits/my_exploit.py
```
### Windows User Bind Mounts
If you're a Windows user `$HOME` doesn't exist in the same way as on Linux, instead it is `%UserProfile%`. The command from above would look like this, assuming your editor is Visual Studio Code and you have code.exe in your `%PATH%`.
```sh
C:\Users\user> mkdir Desktop\exploits
C:\Users\user> code Desktop\exploits\my_exploit.py
C:\Users\user> docker run -it \
--privileged \
--net=host \
--hostname localhost \
--ulimit core=-1:-1 \
--mount type=bind,source="%UserProfile%\Desktop\exploits",target=/home/pwntools/exploits \
pwntools/pwntools:stable
$ python3 exploits/my_exploit.py
```
================================================
FILE: LICENSE-pwntools.txt
================================================
TL;DR version:
Everything in pwntools is open source. Most is under an MIT license, but a
few pieces are under GPL or a BSD 2-clause licence.
This license covers everything within this project, except for a few pieces
of code that we either did not write ourselves or which we derived from code
that we did not write ourselves. These few pieces have their license specified
in a header, or by a file called LICENSE.txt, which will explain exactly what
it covers. The few relevant pieces of code are all contained inside these
directories:
- pwnlib/constants/
- pwnlib/data/
Copyright (c) 2015 Gallopsled et al.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
================================================
FILE: MANIFEST.in
================================================
graft build
graft examples
graft extra
graft travis
include *.md *.txt *.sh *.yml MANIFEST.in
recursive-include docs *.rst *.png Makefile *.py *.txt
recursive-include pwnlib *.py *.asm *.rst *.md *.txt *.sh __doc__ *.mako
recursive-include pwn *.py *.asm *.rst *.md *.txt *.sh
global-exclude *.pyc
================================================
FILE: README.md
================================================
# pwntools - CTF toolkit
[](https://pypi.python.org/pypi/pwntools/)
[](https://docs.pwntools.com/)
[](https://github.com/Gallopsled/pwntools/actions/workflows/ci.yml?query=branch%3Adev)
[](https://coveralls.io/github/Gallopsled/pwntools?branch=dev)
[](http://choosealicense.com/licenses/mit/)
[](https://repology.org/project/python:pwntools/versions)
[](https://discord.gg/96VA2zvjCB)
[](https://twitter.com/pwntools)
Pwntools is a CTF framework and exploit development library. Written in Python, it is designed for rapid prototyping and development, and intended to make exploit writing as simple as possible.
```python
from pwn import *
context(arch = 'i386', os = 'linux')
r = remote('exploitme.example.com', 31337)
# EXPLOIT CODE GOES HERE
r.send(asm(shellcraft.sh()))
r.interactive()
```
# Documentation
Our documentation is available at [docs.pwntools.com](https://docs.pwntools.com/)
A series of tutorials is also [available online](https://github.com/Gallopsled/pwntools-tutorial#readme)
To get you started, we've provided some example solutions for past CTF challenges in our [write-ups repository](https://github.com/Gallopsled/pwntools-write-ups).
# Installation
Pwntools is best supported on 64-bit Ubuntu LTS releases (22.04 and 24.04). Most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).
Pwntools supports Python 3.10+ since version 5.0.0. Use Pwntools 4.x for older versions as well as Python 2.7. Most of the functionality of pwntools is self-contained and Python-only. You should be able to get running quickly with
```sh
sudo apt-get update
sudo apt-get install python3 python3-pip python3-dev git libssl-dev libffi-dev build-essential
python3 -m pip install --upgrade pip
python3 -m pip install --upgrade pwntools
```
However, some of the features (assembling/disassembling foreign architectures) require non-Python dependencies. For more information, see the [complete installation instructions here](https://docs.pwntools.com/en/stable/install.html).
# Contribution
See [CONTRIBUTING.md](CONTRIBUTING.md)
# Contact and Community
If you have any questions not worthy of a [bug report](https://github.com/Gallopsled/pwntools/issues), join the Discord server at https://discord.gg/96VA2zvjCB
================================================
FILE: SECURITY.md
================================================
# Security Policy
## Supported Versions
| Version | Supported |
| ------------- | ------------------ |
| latest dev | :white_check_mark: |
| latest beta | :white_check_mark: |
| latest stable | :white_check_mark: |
| anything else | :x: |
## Reporting a Vulnerability
The aim of pwntools is exploiting software vulnerabilities, which is an unusual position, but it nevertheless can have its own security issues.
Especially that an attacker (=re-victim) is usually not prepared to be attacked back (by the re-attacker).
The first question to ask yourself is: is this an actual vulnerability?
- can it be triggered by a re-attacker (malicious honeypot pretending to be a vulnerable service)?
- does it impact the attacker (=re-victim)?
- is it serious?
* *availability: medium* means *at least* exhausting RAM or disk space of the attacker (=re-victim)
* *confidentiality: medium* means *at least* reading the filesystem of the attacker (=re-victim)
* *integrity: medium* means *at least* performing uncontrolled actions or data corruption on behalf of the attacker (=re-victim)
* if crucial for some sophisticated exploit chain, it is always serious
* `safe_eval` bypasses **are** serious.
* an example of what was **kind of** serious: [#1732](https://github.com/Gallopsled/pwntools/pull/1732)
- can it be fixed without compromising on Pwntools' usability?
If at least one of the answers is no, then this is NOT a vulnerability, so just file a bug report or feature request, without the weird confidential disclosure dance.
Just e-mail the maintainers. Arusekk is the one that is currently the most excited to fix vulnerabilities.
Or create a CTF task! Prove a point the good old hacker way!
================================================
FILE: TESTING.md
================================================
# Testing
Pwntools makes extensive use of unit tests and integration tests to ensure everything is in working order, and no regressions occur.
## Test Suite
To run the test suite, it is best to use Ubuntu 22.04 or 24.04, and run the following commands. **Be aware** that this will add a user to the machine, and create a public key for SSH login!
```sh
bash travis/install.sh
bash travis/ssh_setup.sh
pip install --upgrade --editable .
PWNLIB_NOTERM=1 make -C docs doctest
```
## Testing in Docker
A `Dockerfile` has been provided which has a clean testing environment with Ubuntu Jammy. It is very similar to the online Github Actions CI testing environment, but uses a more modern version of Ubuntu.
See `travis/docker/README.md` for more information.
## New Tests
To add a new test to an existing module, just add an inline doctest. If the test needs access to an external module, add the import statement to the `testsetup` block in the corresponding file in `docs/source/<module>.rst`.
To add an entirely new module, create a new `module.rst` and add it to the list in `index.rst`. The best way to see if your tests are actually being run is to add an intentionally-failing test like:
```py
>>> assert False
```
## Example Test Module
The module `pwnlib.testexample` exists to demonstrate how everything is tied together. The only files which were modified to add this example module and run its tests automatically are:
- `pwnlib/testexample.py`
- `docs/source/testexample.rst`
- `docs/source/index.rst`
## Shellcode and ROP
These are both less easy to test, as they require actually executing code, or loading real binaries. In order to make the process simpler, the `runner` library was created to wrap common tasks. For an example of testing shellcode with these helpers, see [exit.asm](pwnlib/shellcraft/templates/i386/linux/exit.asm).
Additionally, for loading ELF files on-the-fly, the helpers `ELF.from_bytes` and `ELF.from_assembly` are available.
================================================
FILE: docs/.gitignore
================================================
build
robots.txt
================================================
FILE: docs/Makefile
================================================
# Makefile for Sphinx documentation
#
# You can set these variables from the command line.
SPHINXOPTS =
SPHINXBUILD = sphinx-build
PAPER =
BUILDDIR = build
TAR = tar
# Internal variables.
PAPEROPT_a4 = -D latex_paper_size=a4
PAPEROPT_letter = -D latex_paper_size=letter
ALLSPHINXOPTS = -d $(BUILDDIR)/doctrees $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) source
# the i18n builder cannot share the environment and doctrees with the others
I18NSPHINXOPTS = $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) source
.PHONY: help clean html dirhtml singlehtml pickle json htmlhelp qthelp devhelp epub latex latexpdf text man changes linkcheck doctest gettext dash
help:
@echo "Please use \`make <target>' where <target> is one of"
@echo " html to make standalone HTML files"
@echo " dirhtml to make HTML files named index.html in directories"
@echo " singlehtml to make a single large HTML file"
@echo " pickle to make pickle files"
@echo " json to make JSON files"
@echo " htmlhelp to make HTML files and a HTML help project"
@echo " qthelp to make HTML files and a qthelp project"
@echo " devhelp to make HTML files and a Devhelp project"
@echo " epub to make an epub"
@echo " latex to make LaTeX files, you can set PAPER=a4 or PAPER=letter"
@echo " latexpdf to make LaTeX files and run them through pdflatex"
@echo " text to make text files"
@echo " man to make manual pages"
@echo " texinfo to make Texinfo files"
@echo " info to make Texinfo files and run them through makeinfo"
@echo " gettext to make PO message catalogs"
@echo " dash to make a Dash docset"
@echo " changes to make an overview of all changed/added/deprecated items"
@echo " linkcheck to check all external links for integrity"
@echo " doctest to run all doctests embedded in the documentation (if enabled)"
clean:
-rm -rf $(BUILDDIR)/*
-rm -rf /tmp/user/pwn*
-rm -rf $(HOME)/.cache/.pwntools-cache
-rm -rf /tmp/pwn* 2>/dev/null || true
-rm -rf build
html:
$(SPHINXBUILD) -b html $(ALLSPHINXOPTS) $(BUILDDIR)/html
@echo
@echo "Build finished. The HTML pages are in $(BUILDDIR)/html."
dirhtml:
$(SPHINXBUILD) -b dirhtml $(ALLSPHINXOPTS) $(BUILDDIR)/dirhtml
@echo
@echo "Build finished. The HTML pages are in $(BUILDDIR)/dirhtml."
singlehtml:
$(SPHINXBUILD) -b singlehtml $(ALLSPHINXOPTS) $(BUILDDIR)/singlehtml
@echo
@echo "Build finished. The HTML page is in $(BUILDDIR)/singlehtml."
pickle:
$(SPHINXBUILD) -b pickle $(ALLSPHINXOPTS) $(BUILDDIR)/pickle
@echo
@echo "Build finished; now you can process the pickle files."
json:
$(SPHINXBUILD) -b json $(ALLSPHINXOPTS) $(BUILDDIR)/json
@echo
@echo "Build finished; now you can process the JSON files."
htmlhelp:
$(SPHINXBUILD) -b htmlhelp $(ALLSPHINXOPTS) $(BUILDDIR)/htmlhelp
@echo
@echo "Build finished; now you can run HTML Help Workshop with the" \
".hhp project file in $(BUILDDIR)/htmlhelp."
qthelp:
$(SPHINXBUILD) -b qthelp $(ALLSPHINXOPTS) $(BUILDDIR)/qthelp
@echo
@echo "Build finished; now you can run "qcollectiongenerator" with the" \
".qhcp project file in $(BUILDDIR)/qthelp, like this:"
@echo "# qcollectiongenerator $(BUILDDIR)/qthelp/pwntools.qhcp"
@echo "To view the help file:"
@echo "# assistant -collectionFile $(BUILDDIR)/qthelp/pwntools.qhc"
devhelp:
$(SPHINXBUILD) -b devhelp $(ALLSPHINXOPTS) $(BUILDDIR)/devhelp
@echo
@echo "Build finished."
@echo "To view the help file:"
@echo "# mkdir -p $$HOME/.local/share/devhelp/pwntools"
@echo "# ln -s $(BUILDDIR)/devhelp $$HOME/.local/share/devhelp/pwntools"
@echo "# devhelp"
epub:
$(SPHINXBUILD) -b epub $(ALLSPHINXOPTS) $(BUILDDIR)/epub
@echo
@echo "Build finished. The epub file is in $(BUILDDIR)/epub."
latex:
$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
@echo
@echo "Build finished; the LaTeX files are in $(BUILDDIR)/latex."
@echo "Run \`make' in that directory to run these through (pdf)latex" \
"(use \`make latexpdf' here to do that automatically)."
latexpdf:
$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
@echo "Running LaTeX files through pdflatex..."
$(MAKE) -C $(BUILDDIR)/latex all-pdf
@echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex."
text:
$(SPHINXBUILD) -b text $(ALLSPHINXOPTS) $(BUILDDIR)/text
@echo
@echo "Build finished. The text files are in $(BUILDDIR)/text."
man:
$(SPHINXBUILD) -b man $(ALLSPHINXOPTS) $(BUILDDIR)/man
@echo
@echo "Build finished. The manual pages are in $(BUILDDIR)/man."
texinfo:
$(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo
@echo
@echo "Build finished. The Texinfo files are in $(BUILDDIR)/texinfo."
@echo "Run \`make' in that directory to run these through makeinfo" \
"(use \`make info' here to do that automatically)."
info:
$(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo
@echo "Running Texinfo files through makeinfo..."
make -C $(BUILDDIR)/texinfo info
@echo "makeinfo finished; the Info files are in $(BUILDDIR)/texinfo."
gettext:
$(SPHINXBUILD) -b gettext $(I18NSPHINXOPTS) $(BUILDDIR)/locale
@echo
@echo "Build finished. The message catalogs are in $(BUILDDIR)/locale."
dash:
$(SPHINXBUILD) -b html -d $(BUILDDIR)/doctrees -t dash source $(BUILDDIR)/html
doc2dash $(BUILDDIR)/html -d $(BUILDDIR)/dash -n pwntools -f -I index.html
@echo "Build finished. The Dash docset is in $(BUILDDIR)/dash."
changes:
$(SPHINXBUILD) -b changes $(ALLSPHINXOPTS) $(BUILDDIR)/changes
@echo
@echo "The overview file is in $(BUILDDIR)/changes."
linkcheck:
$(SPHINXBUILD) -b linkcheck $(ALLSPHINXOPTS) $(BUILDDIR)/linkcheck
@echo
@echo "Link check complete; look for any errors in the above output " \
"or in $(BUILDDIR)/linkcheck/output.txt."
doctest:
$(SPHINXBUILD) -b doctest $(ALLSPHINXOPTS) $(BUILDDIR)/doctest
@echo "Testing of doctests in the sources finished, look at the " \
"results in $(BUILDDIR)/doctest/output.txt."
================================================
FILE: docs/requirements.txt
================================================
capstone
coverage[toml]
python-dateutil
doc2dash
docutils>=0.18
intervaltree
isort
mako>=1.0.0
paramiko>=1.15.2
pyelftools>=0.32
pygments>=2.0
pypandoc
pyserial>=2.7
pysocks
psutil
requests>=2.5.1
ropgadget>=5.3
sphinx>=8.1.3, <9
sphinx_rtd_theme
sphinxcontrib-autoprogram<=0.1.5
================================================
FILE: docs/source/about.rst
================================================
About pwntools
========================
Whether you're using it to write exploits, or as part
of another software project will dictate how you use it.
Historically pwntools was used as a sort of exploit-writing DSL. Simply doing
``from pwn import *`` in a previous version of pwntools would bring all sorts of
nice side-effects.
When redesigning pwntools for 2.0, we noticed two contrary goals:
* We would like to have a "normal" python module structure, to allow other
people to familiarize themselves with pwntools quickly.
* We would like to have even more side-effects, especially by putting the
terminal in raw-mode.
To make this possible, we decided to have two different modules. :mod:`pwnlib`
would be our nice, clean Python module, while :mod:`pwn` would be used during
CTFs.
:mod:`pwn` --- Toolbox optimized for CTFs
-----------------------------------------
.. module:: pwn
As stated, we would also like to have the ability to get a lot of these
side-effects by default. That is the purpose of this module. It does
the following:
* Imports everything from the toplevel :mod:`pwnlib` along with
functions from a lot of submodules. This means that if you do
``import pwn`` or ``from pwn import *``, you will have access to
everything you need to write an exploit.
* Calls :func:`pwnlib.term.init` to put your terminal in raw mode
and implements functionality to make it appear like it isn't.
* Setting the :data:`pwnlib.context.log_level` to `"info"`.
* Tries to parse some of the values in :data:`sys.argv` and every
value it succeeds in parsing it removes.
:mod:`pwnlib` --- Normal python library
---------------------------------------
.. module:: pwnlib
This module is our "clean" python-code. As a rule, we do not think that
importing :mod:`pwnlib` or any of the submodules should have any significant
side-effects (besides e.g. caching).
For the most part, you will also only get the bits you import. You for instance would
not get access to :mod:`pwnlib.util.packing` simply by doing ``import
pwnlib.util``.
Though there are a few exceptions (such as :mod:`pwnlib.shellcraft`), that does
not quite fit the goals of being simple and clean, but they can still be
imported without implicit side-effects.
================================================
FILE: docs/source/adb.rst
================================================
.. testsetup:: *
from pprint import pprint
from pwn import *
adb = pwnlib.adb
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['LINUX']
:mod:`pwnlib.adb` --- Android Debug Bridge
=====================================================
.. automodule:: pwnlib.adb.adb
:members:
.. automodule:: pwnlib.adb.protocol
:members:
================================================
FILE: docs/source/args.rst
================================================
.. testsetup:: *
from pwn import *
:mod:`pwnlib.args` --- Magic Command-Line Arguments
=====================================================
.. automodule:: pwnlib.args
:members:
================================================
FILE: docs/source/asm.rst
================================================
.. testsetup:: *
import tempfile
import subprocess
from pwn import *
# TODO: Remove global POSIX flag
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
:mod:`pwnlib.asm` --- Assembler functions
=========================================
.. automodule:: pwnlib.asm
:members:
Internal Functions
-----------------------------------------
These are only included so that their tests are run.
You should never need these.
.. autofunction:: pwnlib.asm.dpkg_search_for_binutils
.. autofunction:: pwnlib.asm.print_binutils_instructions
================================================
FILE: docs/source/atexception.rst
================================================
:mod:`pwnlib.atexception` --- Callbacks on unhandled exception
==============================================================
.. automodule:: pwnlib.atexception
:members:
================================================
FILE: docs/source/atexit.rst
================================================
:mod:`pwnlib.atexit` --- Replacement for atexit
===============================================
.. automodule:: pwnlib.atexit
:members:
================================================
FILE: docs/source/commandline.rst
================================================
.. testsetup:: *
from pwn import *
old = context.defaults.copy()
.. testcleanup:: *
context.defaults.copy = old
Command Line Tools
========================
pwntools comes with a handful of useful command-line utilities which serve as wrappers for some of the internal functionality.
If these tools do not appear to be installed, make sure that you have added ``~/.local/bin`` to your ``$PATH`` environment variable.
.. toctree::
.. autoprogram:: pwnlib.commandline.main:parser
:prog: pwn
================================================
FILE: docs/source/conf.py
================================================
# pwntools documentation build configuration file, created by
# sphinx-quickstart on Wed May 28 15:00:52 2014.
#
# This file is execfile()d with the current directory set to its containing dir.
#
# Note that not all possible configuration values are present in this
# autogenerated file.
#
# All configuration values have a default; values that are commented out
# serve to show the default.
import os
import doctest
import signal
import subprocess
import sys
from datetime import datetime, timezone
build_dash = tags.has('dash')
# If extensions (or modules to document with autodoc) are in another directory,
# add these directories to sys.path here. If the directory is relative to the
# documentation root, use os.path.abspath to make it absolute, like shown here.
sys.path.insert(0, os.path.abspath('../..'))
import pwnlib.update
pwnlib.update.disabled = True
# If your documentation needs a minimal Sphinx version, state it here.
#needs_sphinx = '1.0'
# Add any Sphinx extension module names here, as strings. They can be extensions
# coming with Sphinx (named 'sphinx.ext.*') or your custom ones.
extensions = [
'pwnlib.internal.dochelper',
'sphinx.ext.autodoc',
'sphinx.ext.doctest',
'sphinx.ext.linkcode',
'sphinx.ext.autosummary',
'sphinx.ext.coverage',
'sphinx.ext.todo',
'sphinx.ext.intersphinx',
'sphinx.ext.napoleon',
'sphinxcontrib.autoprogram',
]
# Disable "info" logging directly to stdout by Sphinx
import logging
class SphinxPwnlibFilter(logging.Filter):
def filter(self, record):
if record.name.startswith('pwn'):
return False
if record.name.startswith('paramiko'):
return False
return True
log_filter = SphinxPwnlibFilter()
for i, handler in enumerate(logging.root.handlers):
print("Filtering Sphinx handler", handler)
handler.addFilter(log_filter)
# Napoleon settings
napoleon_use_ivar = True
napoleon_use_rtype = False
doctest_global_setup = '''
import sys, os
os.environ['PWNLIB_NOTERM'] = '1'
os.environ['PWNLIB_RANDOMIZE'] = '0'
import pwnlib.update
import pwnlib.util.fiddling
import logging
pwnlib.update.disabled = True
pwnlib.context.context.reset_local()
pwnlib.context.ContextType.defaults['log_level'] = logging.ERROR
pwnlib.context.ContextType.defaults['randomize'] = False
# pwnlib.context.ContextType.defaults['terminal'] = ['sh', '-c']
pwnlib.util.fiddling.default_style = {}
pwnlib.term.text.when = 'never'
pwnlib.log.install_default_handler()
pwnlib.log.rootlogger.setLevel(1)
# Sphinx modifies sys.stdout, and context.log_terminal has
# a reference to the original instance. We need to update
# it for logging to be captured.
class stdout(object):
def __getattr__(self, name):
return getattr(sys.stdout, name)
def __setattr__(self, name, value):
return setattr(sys.stdout, name, value)
pwnlib.context.ContextType.defaults['log_console'] = stdout()
github_actions = os.environ.get('USER') == 'runner'
travis_ci = os.environ.get('USER') == 'travis'
local_doctest = os.environ.get('USER') == 'pwntools'
skip_android = True
'''
autoclass_content = 'both'
autodoc_member_order = 'groupwise' # 'alphabetical'
# Add any paths that contain templates here, relative to this directory.
templates_path = ['_templates']
doctest_test_doctest_blocks = 'true'
# The suffix of source filenames.
source_suffix = '.rst'
# The encoding of source files.
source_encoding = 'utf-8-sig'
# The master toctree document.
master_doc = 'index'
# General information about the project.
project = u'pwntools'
copyright = u'2016-2026, Gallopsled et al.'
# The version info for the project you're documenting, acts as replacement for
# |version| and |release|, also used in various other places throughout the
# built documents.
#
# The short X.Y version.
release = pwnlib.__version__
version = release.rsplit('.', 1)[0]
# The language for content autogenerated by Sphinx. Refer to documentation
# for a list of supported languages.
#language = None
# There are two options for replacing |today|: either, you set today to some
# non-false value, then it is used:
#today = ''
# Else, today_fmt is used as the format for a strftime call.
#today_fmt = '%B %d, %Y'
# List of patterns, relative to source directory, that match files and
# directories to ignore when looking for source files.
exclude_patterns = []
# The reST default role (used for this markup: `text`) to use for all documents.
#default_role = None
# If true, '()' will be appended to :func: etc. cross-reference text.
#add_function_parentheses = True
# If true, the current module name will be prepended to all description
# unit titles (such as .. function::).
#add_module_names = True
# If true, sectionauthor and moduleauthor directives will be shown in the
# output. They are ignored by default.
#show_authors = False
# The name of the Pygments (syntax highlighting) style to use.
pygments_style = 'sphinx'
# A list of ignored prefixes for module index sorting.
#modindex_common_prefix = []
# -- Options for HTML output ---------------------------------------------------
# The theme to use for HTML and HTML Help pages. See the documentation for
# a list of builtin themes.
html_theme = 'sphinx_rtd_theme'
# Theme options are theme-specific and customize the look and feel of a theme
# further. For a list of options available for each theme, see the
# documentation.
#html_theme_options = {}
# Add any paths that contain custom themes here, relative to this directory.
#html_theme_path = []
# The name for this set of Sphinx documents. If None, it defaults to
# "<project> v<release> documentation".
#html_title = None
# A shorter title for the navigation bar. Default is the same as html_title.
#html_short_title = None
# The name of an image file (relative to this directory) to place at the top
# of the sidebar.
#html_logo = None
# The name of an image file (within the static path) to use as favicon of the
# docs. This file should be a Windows icon file (.ico) being 16x16 or 32x32
# pixels large.
#html_favicon = None
# Add any paths that contain custom static files (such as style sheets) here,
# relative to this directory. They are copied after the builtin static files,
# so a file named "default.css" will overwrite the builtin "default.css".
html_static_path = []
# If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
# using the given strftime format.
#html_last_updated_fmt = '%b %d, %Y'
# If true, SmartyPants will be used to convert quotes and dashes to
# typographically correct entities.
#html_use_smartypants = True
# Custom sidebar templates, maps document names to template names.
#html_sidebars = {}
# Additional templates that should be rendered to pages, maps page names to
# template names.
#html_additional_pages = {}
# If false, no module index is generated.
html_domain_indices = not build_dash
# If false, no index is generated.
html_use_index = not build_dash
# If true, the index is split into individual pages for each letter.
#html_split_index = False
# If true, links to the reST sources are added to the pages.
#html_show_sourcelink = True
# If true, "Created using Sphinx" is shown in the HTML footer. Default is True.
#html_show_sphinx = True
# If true, "(C) Copyright ..." is shown in the HTML footer. Default is True.
#html_show_copyright = True
# If true, an OpenSearch description file will be output, and all pages will
# contain a <link> tag referring to it. The value of this option must be the
# base URL from which the finished HTML is served.
#html_use_opensearch = ''
# This is the file name suffix for HTML files (e.g. ".xhtml").
#html_file_suffix = None
# Output file base name for HTML help builder.
htmlhelp_basename = 'pwntoolsdoc'
# -- Options for LaTeX output --------------------------------------------------
latex_elements = {
# The paper size ('letterpaper' or 'a4paper').
#'papersize': 'letterpaper',
# The font size ('10pt', '11pt' or '12pt').
#'pointsize': '10pt',
# Additional stuff for the LaTeX preamble.
#'preamble': '',
}
# Grouping the document tree into LaTeX files. List of tuples
# (source start file, target name, title, author, documentclass [howto/manual]).
latex_documents = [
('index', 'pwntools.tex', u'pwntools Documentation',
u'2016-2026, Gallopsled et al.', 'manual'),
]
intersphinx_mapping = {'python': ('https://docs.python.org/3/', None),
'paramiko': ('https://docs.paramiko.org/en/stable/', None)}
# The name of an image file (relative to this directory) to place at the top of
# the title page.
#latex_logo = None
# For "manual" documents, if this is true, then toplevel headings are parts,
# not chapters.
#latex_use_parts = False
# If true, show page references after internal links.
#latex_show_pagerefs = False
# If true, show URL addresses after external links.
#latex_show_urls = False
# Documents to append as an appendix to all manuals.
#latex_appendices = []
# If false, no module index is generated.
#latex_domain_indices = True
# -- Options for manual page output --------------------------------------------
# One entry per manual page. List of tuples
# (source start file, name, description, authors, manual section).
man_pages = [
('index', 'pwntools', u'pwntools Documentation',
[u'2016-2026, Gallopsled et al.'], 1)
]
# If true, show URL addresses after external links.
#man_show_urls = False
# -- Options for Texinfo output ------------------------------------------------
# Grouping the document tree into Texinfo files. List of tuples
# (source start file, target name, title, author,
# dir menu entry, description, category)
texinfo_documents = [
('index', 'pwntools', u'pwntools Documentation',
u'', 'pwntools', 'CTF exploit writing toolkit.',
'Miscellaneous'),
]
# Documents to append as an appendix to all manuals.
#texinfo_appendices = []
# If false, no module index is generated.
#texinfo_domain_indices = True
# How to display URL addresses: 'footnote', 'no', or 'inline'.
#texinfo_show_urls = 'footnote'
branch = release
try:
git_branch = subprocess.check_output('git describe --tags', shell = True, universal_newlines = True)
except subprocess.CalledProcessError:
git_branch = '-'
try:
if '-' in git_branch:
branch = subprocess.check_output('git rev-parse HEAD', shell = True, universal_newlines = True).strip()[:10]
except subprocess.CalledProcessError:
pass
def linkcode_resolve(domain, info):
if domain != 'py':
return None
if not info['module']:
return None
import importlib, inspect, types
mod = importlib.import_module(info['module'])
# Try to find the value
val = mod
for k in info['fullname'].split('.'):
val = getattr(val, k, None)
if val is None:
break
# Special case for shellcraft
if info['module'].startswith('pwnlib.shellcraft.'):
filename = 'pwnlib/shellcraft/templates/%s' % val._relpath
# Case for everything else
else:
filename = info['module'].replace('.', '/') + '.py'
if isinstance(val, property):
val = val.fget
if isinstance(val, (types.ModuleType, types.MethodType, types.FunctionType, types.TracebackType, types.FrameType, types.CodeType, type)):
try:
lines, first = inspect.getsourcelines(val)
filename += '#L%d-L%d' % (first, first + len(lines) - 1)
except (IOError, TypeError):
pass
return "https://github.com/Gallopsled/pwntools/blob/%s/%s" % (branch, filename)
# The readthedocs theme is used by the Dash generator. (Can be used for HTML too.)
if build_dash:
# on_rtd is whether we are on readthedocs.org
on_rtd = os.environ.get('READTHEDOCS', None) == 'True'
if not on_rtd: # only import and set the theme if we're building docs locally
import alabaster
html_theme = 'alabaster'
html_theme_path = [alabaster.get_path()]
html_theme_options = { 'nosidebar' : True }
# -- Customization to Sphinx autodoc generation --------------------------------------------
# Test hidden members (e.g. def _foo(...))
def dont_skip_any_doctests(app, what, name, obj, skip, options):
return None
autodoc_default_options = {'special-members': None, 'private-members': None}
# doctest optionflags for platform-specific tests
# they are skipped on other platforms
WINDOWS = doctest.register_optionflag('WINDOWS')
LINUX = doctest.register_optionflag('LINUX')
POSIX = doctest.register_optionflag('POSIX')
# doctest optionflag for tests that haven't been looked at yet
TODO = doctest.register_optionflag('TODO')
import sphinx.ext.doctest
class PlatformDocTestRunner(sphinx.ext.doctest.SphinxDocTestRunner):
def run(self, test, compileflags=None, out=None, clear_globs=True):
original_optionflags = self.optionflags | test.globs.get('doctest_additional_flags', 0)
def filter_platform(example):
optionflags = original_optionflags
if example.options:
for (optionflag, val) in example.options.items():
if val:
optionflags |= optionflag
else:
optionflags &= ~optionflag
if (optionflags & WINDOWS) == WINDOWS and sys.platform != 'win32':
return False
if (optionflags & LINUX) == LINUX and sys.platform != 'linux':
return False
if (optionflags & POSIX) == POSIX and os.name != 'posix':
return False
return True
test.examples[:] = [example for example in test.examples if filter_platform(example)]
return super(PlatformDocTestRunner, self).run(test, compileflags, out, clear_globs)
class PlatformDocTestBuilder(sphinx.ext.doctest.DocTestBuilder):
def __init__(self, *args, **kwargs):
super(PlatformDocTestBuilder, self).__init__(*args, **kwargs)
self._test_runner = None
self._doctree_had_tests = False
@property
def test_runner(self):
return self._test_runner
@test_runner.setter
def test_runner(self, value):
self._test_runner = PlatformDocTestRunner(value._checker, value._verbose, value.optionflags)
def test_doc(self, docname, doctree):
start = datetime.now(timezone.utc).astimezone()
# self._out(f"[{start.isoformat(timespec='milliseconds')}] doctest start: {docname}\n")
self._doctree_had_tests = False
try:
return super(PlatformDocTestBuilder, self).test_doc(docname, doctree)
finally:
# Only print the timestamp if there were actually tests run.
if self._doctree_had_tests:
end = datetime.now(timezone.utc).astimezone()
duration = (end - start).total_seconds()
self._out(f"[{end.isoformat(timespec='milliseconds')} - {duration:.2f}s]\n")
self._doctree_had_tests = False
def test_group(self, group):
# Only called when there are tests to run in the current document.
self._doctree_had_tests = True
return super(PlatformDocTestBuilder, self).test_group(group)
if 'doctest' in sys.argv:
def setup(app):
app.add_builder(PlatformDocTestBuilder, override=True)
# app.connect('autodoc-skip-member', dont_skip_any_doctests)
# monkey patching paramiko due to https://github.com/paramiko/paramiko/pull/1661
import paramiko.client
import binascii
paramiko.client.hexlify = lambda x: binascii.hexlify(x).decode()
paramiko.util.safe_string = lambda x: '' # function result never *actually used*
class EndlessLoop(Exception): pass
if hasattr(signal, 'alarm'):
def alrm_handler(sig, frame):
signal.alarm(180) # three minutes
raise EndlessLoop()
signal.signal(signal.SIGALRM, alrm_handler)
signal.alarm(600) # ten minutes
else:
def sigabrt_handler(signum, frame):
raise EndlessLoop()
# thread.interrupt_main received the signum parameter in Python 3.10
if sys.version_info >= (3, 10):
signal.signal(signal.SIGABRT, sigabrt_handler)
def alrm_handler():
try:
import thread
except ImportError:
import _thread as thread
# pre Python 3.10 this raises a KeyboardInterrupt in the main thread.
# it might not show a traceback in that case, but it will stop the endless loop.
thread.interrupt_main(signal.SIGABRT)
timer = threading.Timer(interval=180, function=alrm_handler) # three minutes
timer.daemon = True
timer.start()
import threading
timer = threading.Timer(interval=600, function=alrm_handler) # ten minutes
timer.daemon = True
timer.start()
================================================
FILE: docs/source/config.rst
================================================
:mod:`pwnlib.config` --- Pwntools Configuration File
====================================================
.. automodule:: pwnlib.config
================================================
FILE: docs/source/constants.rst
================================================
.. testsetup:: *
from pwnlib import constants
from pwnlib.context import context
:mod:`pwnlib.constants` --- Easy access to header file constants
================================================================
.. automodule:: pwnlib.constants
================================================
FILE: docs/source/context.rst
================================================
.. testsetup:: *
from pwn import *
import logging
log = pwnlib.log.getLogger('pwnlib.context')
context.clear()
:mod:`pwnlib.context` --- Setting runtime variables
=====================================================
Many settings in ``pwntools`` are controlled via the global variable :data:`.context`, such as the selected target operating system, architecture, and bit-width.
In general, exploits will start with something like:
.. code-block:: python
from pwn import *
context.arch = 'amd64'
Which sets up everything in the exploit for exploiting a 64-bit Intel binary.
The recommended method is to use ``context.binary`` to automagically set all of the appropriate values.
.. code-block:: python
from pwn import *
context.binary = './challenge-binary'
Module Members
----------------------------------------------------
.. automodule:: pwnlib.context
:members:
================================================
FILE: docs/source/dynelf.rst
================================================
:mod:`pwnlib.dynelf` --- Resolving remote functions using leaks
===============================================================
.. automodule:: pwnlib.dynelf
:members:
================================================
FILE: docs/source/elf/config.rst
================================================
.. testsetup:: *
from pwn import *
from pwnlib.elf.config import parse_kconfig
:mod:`pwnlib.elf.config` --- Kernel Config Parsing
===========================================================
.. automodule:: pwnlib.elf.config
:members:
================================================
FILE: docs/source/elf/corefile.rst
================================================
.. testsetup:: *
from glob import glob
from pwn import *
# The Linux kernel won't overwrite an existing corefile, so in case
# some other part of the doctests caused a segfault and core dump,
# we need to get rid of it before our tests run.
#
# We DONT need to worry about e.g. ./core existing when using Corefile()
# because we always move and rename the corefile to prevent this situation.
if os.path.exists('core'):
os.unlink('core')
# bash-static is a statically linked version of bash, but if $SHELL is not
# set to anything, it decides to up and load ld.so and libc.so which breaks
# our example of showing `corefile.libc == None` for a statically linked bin.
# Set the environment here so it's not in the middle of our tests.
os.environ.setdefault('SHELL', '/bin/sh')
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
:mod:`pwnlib.elf.corefile` --- Core Files
===========================================================
.. automodule:: pwnlib.elf.corefile
.. autoclass:: pwnlib.elf.corefile.Corefile
:members:
:show-inheritance:
.. autoclass:: pwnlib.elf.corefile.Mapping
:members:
================================================
FILE: docs/source/elf/elf.rst
================================================
.. testsetup:: *
from pwn import *
from glob import glob
from pwnlib.elf.maps import CAT_PROC_MAPS_EXIT
import shutil
# TODO: Remove global POSIX flag
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
:mod:`pwnlib.elf.elf` --- ELF Files
===========================================================
.. automodule:: pwnlib.elf.elf
.. autoclass:: pwnlib.elf.elf.ELF
:members:
:show-inheritance:
:inherited-members:
:exclude-members: address_offsets,
get_data,
get_dwarf_info,
get_section,
get_segment,
has_dwarf_info,
iter_sections,
iter_segments
.. autoclass:: pwnlib.elf.elf.Function
:members:
.. autoclass:: pwnlib.elf.elf.dotdict
:members:
================================================
FILE: docs/source/elf.rst
================================================
.. testsetup:: *
from pwnlib.elf import *
from pwnlib.util.misc import which
:mod:`pwnlib.elf` --- ELF Executables and Libraries
===================================================
.. automodule:: pwnlib.elf
ELF Modules
-------------------
.. toctree::
elf/elf
elf/config
elf/corefile
================================================
FILE: docs/source/encoders.rst
================================================
.. testsetup:: *
from pwn import *
# TODO: Remove global POSIX flag
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
:mod:`pwnlib.encoders` --- Encoding Shellcode
===============================================
.. automodule:: pwnlib.encoders.encoder
:members:
.. automodule:: pwnlib.encoders.i386.ascii_shellcode
:members:
:special-members:
:exclude-members: __init__
.. automodule:: pwnlib.encoders.i386.xor
:members:
.. automodule:: pwnlib.encoders.i386.delta
:members:
.. automodule:: pwnlib.encoders.amd64.delta
:members:
.. automodule:: pwnlib.encoders.arm.xor
:members:
.. automodule:: pwnlib.encoders.mips.xor
:members:
================================================
FILE: docs/source/exception.rst
================================================
:mod:`pwnlib.exception` --- Pwnlib exceptions
====================================================
.. automodule:: pwnlib.exception
:members:
================================================
FILE: docs/source/filepointer.rst
================================================
.. testsetup:: *
from pwnlib.filepointer import *
from pwnlib.filepointer import _update_var
:mod:`pwnlib.filepointer` --- `FILE*` structure exploitation
============================================================
.. automodule:: pwnlib.filepointer
:members:
================================================
FILE: docs/source/filesystem.rst
================================================
.. testsetup:: *
import time
from pwnlib.context import context
from pwnlib.tubes.ssh import ssh
from pwnlib.filesystem import *
# TODO: Remove global POSIX flag
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
:mod:`pwnlib.filesystem` --- Manipulating Files Locally and Over SSH
====================================================================
Provides a Python2-compatible :py:mod:`pathlib` interface for paths
on the local filesystem (`.Path`) as well as on remote filesystems,
via SSH (`.SSHPath`).
.. automodule:: pwnlib.filesystem
:members:
================================================
FILE: docs/source/flag.rst
================================================
.. testsetup:: *
from pwn import *
:mod:`pwnlib.flag` --- CTF Flag Management
==========================================
.. automodule:: pwnlib.flag
:members:
================================================
FILE: docs/source/fmtstr.rst
================================================
.. testsetup:: *
from pwn import *
import tempfile
:mod:`pwnlib.fmtstr` --- Format string bug exploitation tools
=============================================================
.. automodule:: pwnlib.fmtstr
:members:
================================================
FILE: docs/source/gdb.rst
================================================
.. testsetup:: *
from pwn import *
context.arch = 'amd64'
context.terminal = [os.path.join(os.path.dirname(pwnlib.__file__), 'gdb_faketerminal.py')]
# TODO: Test on cygwin too
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
:mod:`pwnlib.gdb` --- Working with GDB
======================================
.. automodule:: pwnlib.gdb
:members:
================================================
FILE: docs/source/globals.rst
================================================
.. testsetup:: *
from pwn import *
``from pwn import *``
========================
The most common way that you'll see pwntools used is
>>> from pwn import *
Which imports a bazillion things into the global namespace to make your life easier.
This is a quick list of most of the objects and routines imported, in rough order of importance and frequency of use.
- :mod:`pwnlib.context`
- :data:`pwnlib.context.context`
- Responsible for most of the pwntools convenience settings
- Set `context.log_level = 'debug'` when troubleshooting your exploit
- Scope-aware, so you can disable logging for a subsection of code via :meth:`.ContextType.local`
- ``remote``, ``listen``, ``ssh``, ``process``
- :mod:`pwnlib.tubes`
- Super convenient wrappers around all of the common functionality for CTF challenges
- Connect to anything, anywhere, and it works the way you want it to
- Helpers for common tasks like ``recvline``, ``recvuntil``, ``clean``, etc.
- Interact directly with the application via ``.interactive()``
- ``p32`` and ``u32``
- :mod:`pwnlib.util.packing`
- Useful functions to make sure you never have to remember if ``'>'`` means signed or unsigned for ``struct.pack``, and no more ugly ``[0]`` index at the end.
- Set ``signed`` and ``endian`` in sane manners (also these can be set once on ``context`` and not bothered with again)
- Most common sizes are pre-defined (``u8``, ``u64``, etc), and :func:`pwnlib.util.packing.pack` lets you define your own.
- ``log``
- :mod:`pwnlib.log`
- Make your output pretty!
- ``cyclic`` and ``cyclic_func``
- :mod:`pwnlib.util.cyclic`
- Utilities for generating strings such that you can find the offset of any given substring given only N (usually 4) bytes. This is super useful for straight buffer overflows. Instead of looking at 0x41414141, you could know that 0x61616171 means you control EIP at offset 64 in your buffer.
- ``asm`` and ``disasm``
- :mod:`pwnlib.asm`
- Quickly turn assembly into some bytes, or vice-versa, without mucking about
- Supports any architecture for which you have a binutils installed
- Over 20 different architectures have pre-built binaries at `ppa:pwntools/binutils <https://launchpad.net/~pwntools/+archive/ubuntu/binutils>`_.
- ``shellcraft``
- :mod:`pwnlib.shellcraft`
- Library of shellcode ready to go
- ``asm(shellcraft.sh())`` gives you a shell
- Templating library for reusability of shellcode fragments
- ``ELF``
- :mod:`pwnlib.elf`
- ELF binary manipulation tools, including symbol lookup, virtual memory to file offset helpers, and the ability to modify and save binaries back to disk
- ``DynELF``
- :mod:`pwnlib.dynelf`
- Dynamically resolve functions given only a pointer to any loaded module, and a function which can leak data at any address
- ``ROP``
- :mod:`pwnlib.rop`
- Automatically generate ROP chains using a DSL to describe what you want to do, rather than raw addresses
- ``gdb.debug`` and ``gdb.attach``
- :mod:`pwnlib.gdb`
- Launch a binary under GDB and pop up a new terminal to interact with it. Automates setting breakpoints and makes iteration on exploits MUCH faster.
- Alternately, attach to a running process given a PID, :mod:`pwnlib.tubes` object, or even just a socket that's connected to it
- ``args``
- Dictionary containing all-caps command-line arguments for quick access
- Run via ``python foo.py REMOTE=1`` and ``args['REMOTE'] == '1'``.
- Can also control logging verbosity and terminal fanciness
- `NOTERM`
- `SILENT`
- `DEBUG`
- ``randoms``, ``rol``, ``ror``, ``xor``, ``bits``
- :mod:`pwnlib.util.fiddling`
- Useful utilities for generating random data from a given alphabet, or simplifying math operations that usually require masking off with `0xffffffff` or calling `ord` and `chr` an ugly number of times
- ``net``
- :mod:`pwnlib.util.net`
- Routines for querying about network interfaces
- ``proc``
- :mod:`pwnlib.util.proc`
- Routines for querying about processes
- ``pause``
- It's the new ``getch``
- ``safeeval``
- :mod:`pwnlib.util.safeeval`
- Functions for safely evaluating python code without nasty side-effects.
These are all pretty self explanatory, but are useful to have in the global namespace.
- ``hexdump``
- ``read`` and ``write``
- ``enhex`` and ``unhex``
- ``more``
- ``group``
- ``align`` and ``align_down``
- ``urlencode`` and ``urldecode``
- ``which``
- ``wget``
Additionally, all of the following modules are auto-imported for you. You were going to do it anyway.
- ``os``
- ``sys``
- ``time``
- ``requests``
- ``re``
- ``random``
================================================
FILE: docs/source/index.rst
================================================
pwntools
====================================
``pwntools`` is a CTF framework and exploit development library.
Written in Python, it is designed for rapid prototyping and development,
and intended to make exploit writing as simple as possible.
The primary location for this documentation is at docs.pwntools.com_, which uses
readthedocs_. It comes in three primary flavors:
- Stable_
- Beta_
- Dev_
.. _readthedocs: https://readthedocs.org
.. _docs.pwntools.com: https://docs.pwntools.com/en/latest
.. _Stable: https://docs.pwntools.com/en/stable
.. _Beta: https://docs.pwntools.com/en/beta
.. _Dev: https://docs.pwntools.com/en/dev
Getting Started
---------------
.. toctree::
:maxdepth: 3
:glob:
about
install
intro
globals
commandline
Module Index
------------
Each of the ``pwntools`` modules is documented here.
.. toctree::
:maxdepth: 1
:glob:
adb
args
asm
atexception
atexit
constants
config
context
dynelf
encoders
elf
exception
filepointer
filesystem
flag
fmtstr
gdb
libc
libcdb
log
memleak
protocols
qemu
regsort
replacements
rop
runner
shellcraft
term
timeout
tubes
ui
update
useragents
util/*
windbg
.. toctree::
:hidden:
testexample
.. only:: not dash
Indices and tables
==================
* :ref:`genindex`
* :ref:`modindex`
* :ref:`search`
Bytes
-----
The bytes vs text distinction is so important that it even made it to this main page.
See the pwntools-tutorial_ repo for the latest tutorial finally
explaining the difference once and for all (hopefully).
.. _pwntools-tutorial: https://github.com/Gallopsled/pwntools-tutorial/blob/master/bytes.md
================================================
FILE: docs/source/install/binutils.rst
================================================
Binutils
-------------
Assembly of foreign architectures (e.g. assembling Sparc shellcode on
Mac OS X) requires cross-compiled versions of ``binutils`` to be
installed. We've made this process as smooth as we can.
In these examples, replace ``$ARCH`` with your target architecture (e.g., arm, aarch64, mips64, vax, etc.).
Building `binutils` from source takes about 60 seconds on a modern 8-core machine.
Ubuntu
^^^^^^^^^^^^^^^^
For Ubuntu 12.04 through 15.10, you must first add the pwntools `Personal Package Archive repository <https://launchpad.net/~pwntools/+archive/ubuntu/binutils>`__.
Ubuntu Xenial (16.04) has official packages for most architectures, and does not require this step.
.. code-block:: bash
$ sudo apt-get install software-properties-common
$ sudo apt-add-repository ppa:pwntools/binutils
$ sudo apt-get update
Then, install the binutils for your architecture.
.. code-block:: bash
$ sudo apt-get install binutils-$ARCH-linux-gnu
Mac OS X
^^^^^^^^^^^^^^^^
Mac OS X is just as easy, but requires building binutils from source.
However, we've made ``homebrew`` recipes to make this just two commands.
After installing `brew <https://brew.sh>`__, grab the appropriate
recipe from our `binutils
repo <https://github.com/Gallopsled/pwntools-binutils/>`__.
.. code-block:: bash
$ wget https://raw.githubusercontent.com/Gallopsled/pwntools-binutils/master/macos/binutils-$ARCH.rb
$ brew install ./binutils-$ARCH.rb
Windows
^^^^^^^^^^^^^^^^
Windows support is experimental. You can try installing a prebuilt version of binutils
for your desired architecture from the `GNU Toolchains <https://gnutoolchains.com/>`__ project.
Note: For x86 and x86_64, you should use the `ubuntu toolchain <https://gnutoolchains.com/ubuntu/>`__
instead of the MinGW toolchains due to differences in the commandline handling.
Alternate OSes
^^^^^^^^^^^^^^^^
If you want to build everything by hand, or don't use any of the above
OSes, ``binutils`` is simple to build by hand.
.. code-block:: bash
#!/usr/bin/env bash
V=2.38 # Binutils Version
ARCH=arm # Target architecture
cd ${TMPDIR:-/tmp}
wget -nc https://ftp.gnu.org/gnu/binutils/binutils-$V.tar.gz
wget -nc https://ftp.gnu.org/gnu/binutils/binutils-$V.tar.gz.sig
gpg --keyserver keys.gnupg.net --recv-keys 4AE55E93
gpg --verify binutils-$V.tar.gz.sig
tar xf binutils-$V.tar.gz
mkdir binutils-build
cd binutils-build
export AR=ar
export AS=as
../binutils-$V/configure \
--prefix=${PREFIX:-/usr/local} \
--target=$ARCH-unknown-linux-gnu \
--disable-static \
--disable-multilib \
--disable-werror \
--disable-nls
MAKE=gmake
hash gmake || MAKE=make
$MAKE -j clean all
sudo $MAKE install
================================================
FILE: docs/source/install/headers.rst
================================================
Python Development Headers
-----------------------------
Some of pwntools' Python dependencies require native extensions (for example, Paramiko requires PyCrypto).
In order to build these native extensions, the development headers for Python must be installed.
Ubuntu
^^^^^^^^^^^^^^^^
.. code-block:: bash
$ sudo apt-get install python-dev
Mac OS X
^^^^^^^^^^^^^^^^
No action needed.
================================================
FILE: docs/source/install.rst
================================================
Installation
============
Pwntools is best supported on 64-bit Ubuntu LTS releases (22.04 and 24.04). Most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).
Prerequisites
-------------
In order to get the most out of ``pwntools``, you should have the
following system libraries installed.
.. toctree::
:maxdepth: 3
:glob:
install/*
Note: For Mac OS X you will need to have cmake ``brew install cmake`` and pkg-config ``brew install pkg-config`` installed.
Released Version
-----------------
pwntools is available as a ``pip`` package for Python3. Version v5.0.0 supports Python3.10 or later. Use v4 if you use earlier versions of Python.
Python3
^^^^^^^
The Python version required for installing Pwntools is kept as low as possible on a best-effort basis. However, new features target Python3.10 and later.
.. code-block:: bash
$ sudo apt-get update
$ sudo apt-get install python3 python3-pip python3-dev git libssl-dev libffi-dev build-essential
$ python3 -m pip install --upgrade pip
$ python3 -m pip install --upgrade pwntools
Python2 (Deprecated)
^^^^^^^^^^^^^^^^^^^^
Python2 support has been removed in Pwntools v5.0.0. The last version to support Python2 was v4.15.0.
NOTE: Pwntools maintainers STRONGLY recommend using Python3 for all future Pwntools-based scripts and projects.
Additionally, due to `pip` dropping support for Python2, a specfic version of `pip` must be installed.
.. code-block:: bash
$ sudo apt-get update
$ sudo apt-get install python python-pip python-dev git libssl-dev libffi-dev build-essential
$ python2 -m pip install --upgrade pip==20.3.4
$ python2 -m pip install --upgrade pwntools
Command-Line Tools
------------------
When installed with ``sudo`` the above commands will install Pwntools' command-line tools to somewhere like ``/usr/bin``.
However, if you run as an unprivileged user, you may see a warning message that looks like this::
WARNING: The scripts asm, checksec, common, constgrep, cyclic, debug, disablenx, disasm,
elfdiff, elfpatch, errno, hex, main, phd, pwn, pwnstrip, scramble, shellcraft, template,
unhex, update and version are installed in '/home/user/.local/bin' which is not on PATH.
Follow the instructions listed and add ``~/.local/bin`` to your ``$PATH`` environment variable.
Development
--------------
If you are hacking on Pwntools locally, you'll want to do something like this:
.. code-block:: bash
$ git clone https://github.com/Gallopsled/pwntools
$ pip install --upgrade --editable ./pwntools
.. _Ubuntu: https://launchpad.net/~pwntools/+archive/ubuntu/binutils
================================================
FILE: docs/source/intro.rst
================================================
.. testsetup:: *
from pwn import *
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
Getting Started
========================
To get your feet wet with pwntools, let's first go through a few examples.
When writing exploits, pwntools generally follows the "kitchen sink" approach.
>>> from pwn import *
This imports a lot of functionality into the global namespace. You can now
assemble, disassemble, pack, unpack, and many other things with a single function.
A full list of everything that is imported is available on :doc:`globals`.
Tutorials
---------
A series of tutorials for Pwntools exists online, at
https://github.com/Gallopsled/pwntools-tutorial#readme
Making Connections
------------------
You need to talk to the challenge binary in order to pwn it, right?
pwntools makes this stupid simple with its :mod:`pwnlib.tubes` module.
This exposes a standard interface to talk to processes, sockets, serial ports,
and all manner of things, along with some nifty helpers for common tasks.
For example, remote connections via :mod:`pwnlib.tubes.remote`.
::
>>> conn = remote('ftp.ubuntu.com',21)
>>> conn.recvline() # doctest: +ELLIPSIS
b'220 ...'
>>> conn.send(b'USER anonymous\r\n')
>>> conn.recvuntil(b' ', drop=True)
b'331'
>>> conn.recvline()
b'Please specify the password.\r\n'
>>> conn.close()
It's also easy to spin up a listener
>>> l = listen()
>>> r = remote('localhost', l.lport)
>>> c = l.wait_for_connection()
>>> r.send(b'hello')
>>> c.recv()
b'hello'
Interacting with processes is easy thanks to :mod:`pwnlib.tubes.process`.
::
>>> sh = process('/bin/sh')
>>> sh.sendline(b'sleep 3; echo hello world;')
>>> sh.recvline(timeout=1)
b''
>>> sh.recvline(timeout=5)
b'hello world\n'
>>> sh.close()
Not only can you interact with processes programmatically, but you can
actually **interact** with processes.
>>> sh.interactive() # doctest: +SKIP
$ whoami
user
There's even an SSH module for when you've got to SSH into a box to perform
a local/setuid exploit with :mod:`pwnlib.tubes.ssh`. You can quickly spawn
processes and grab the output, or spawn a process and interact with it like
a ``process`` tube.
::
>>> shell = ssh('bandit0', 'bandit.labs.overthewire.org', password='bandit0', port=2220)
>>> shell['whoami']
b'bandit0'
>>> shell.download_file('/etc/motd')
>>> sh = shell.run('sh')
>>> sh.sendline(b'sleep 3; echo hello world;') # doctest: +SKIP
>>> sh.recvline(timeout=1)
b''
>>> sh.recvline(timeout=5)
b'hello world\n'
>>> shell.close()
Packing Integers
------------------
A common task for exploit-writing is converting between integers as Python
sees them, and their representation as a sequence of bytes.
Usually folks resort to the built-in ``struct`` module.
pwntools makes this easier with :mod:`pwnlib.util.packing`. No more remembering
unpacking codes, and littering your code with helper routines.
>>> import struct
>>> p32(0xdeadbeef) == struct.pack('I', 0xdeadbeef)
True
>>> leet = unhex('37130000')
>>> u32(b'abcd') == struct.unpack('I', b'abcd')[0]
True
The packing/unpacking operations are defined for many common bit-widths.
>>> u8(b'A') == 0x41
True
Setting the Target Architecture and OS
--------------------------------------
The target architecture can generally be specified as an argument to the routine that requires it.
>>> asm('nop')
b'\x90'
>>> asm('nop', arch='arm')
b'\x00\xf0 \xe3'
However, it can also be set once in the global ``context``. The operating system, word size, and endianness can also be set here.
>>> context.arch = 'i386'
>>> context.os = 'linux'
>>> context.endian = 'little'
>>> context.word_size = 32
Additionally, you can use a shorthand to set all of the values at once.
>>> asm('nop')
b'\x90'
>>> context(arch='arm', os='linux', endian='big', word_size=32)
>>> asm('nop')
b'\xe3 \xf0\x00'
.. doctest::
:hide:
>>> context.clear()
Setting Logging Verbosity
-------------------------
You can control the verbosity of the standard pwntools logging via ``context``.
For example, setting
>>> context.log_level = 'debug'
Will cause all of the data sent and received by a ``tube`` to be printed to the screen.
.. doctest::
:hide:
>>> context.clear()
Assembly and Disassembly
------------------------
Never again will you need to run some already-assembled pile of shellcode
from the internet! The :mod:`pwnlib.asm` module is full of awesome.
>>> enhex(asm('mov eax, 0'))
'b800000000'
But if you do, it's easy to suss out!
>>> print(disasm(unhex('6a0258cd80ebf9')))
0: 6a 02 push 0x2
2: 58 pop eax
3: cd 80 int 0x80
5: eb f9 jmp 0x0
However, you shouldn't even need to write your own shellcode most of the
time! pwntools comes with the :mod:`pwnlib.shellcraft` module, which is
loaded with useful time-saving shellcodes.
Let's say that we want to `setreuid(getuid(), getuid())` followed by `dup`ing
file descriptor 4 to `stdin`, `stdout`, and `stderr`, and then pop a shell!
>>> enhex(asm(shellcraft.setreuid() + shellcraft.dupsh(4))) # doctest: +ELLIPSIS
'6a3158cd80...'
Misc Tools
----------------------
Never write another hexdump, thanks to :mod:`pwnlib.util.fiddling`.
Find offsets in your buffer that cause a crash, thanks to :mod:`pwnlib.cyclic`.
>>> cyclic(20)
b'aaaabaaacaaadaaaeaaa'
>>> # Assume EIP = 0x62616166 (b'faab' which is pack(0x62616166)) at crash time
>>> cyclic_find(b'faab')
120
ELF Manipulation
----------------
Stop hard-coding things! Look them up at runtime with :mod:`pwnlib.elf`.
>>> e = ELF('/bin/cat')
>>> print(hex(e.address)) #doctest: +SKIP
0x400000
>>> print(hex(e.symbols['write'])) #doctest: +SKIP
0x401680
>>> print(hex(e.got['write'])) #doctest: +SKIP
0x60b070
>>> print(hex(e.plt['write'])) #doctest: +SKIP
0x401680
You can even patch and save the files.
>>> e = ELF('/bin/cat')
>>> e.read(e.address, 4)
b'\x7fELF'
>>> e.asm(e.address, 'ret')
>>> e.save('/tmp/quiet-cat')
>>> disasm(open('/tmp/quiet-cat','rb').read(1))
' 0: c3 ret'
================================================
FILE: docs/source/libc/glibc.rst
================================================
.. testsetup:: *
from pwn import *
:mod:`pwnlib.libc.glibc` --- Convenient Functions for Glibc
===========================================================
.. automodule:: pwnlib.libc.glibc
:members:
================================================
FILE: docs/source/libc.rst
================================================
:mod:`pwnlib.libc` --- Convenient Functions for Libc Implementations
====================================================================
Submodules
----------
.. toctree::
:glob:
libc/*
================================================
FILE: docs/source/libcdb.rst
================================================
.. testsetup:: *
from pwn import *
from pwnlib.libcdb import *
# TODO: Remove global POSIX flag
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
:mod:`pwnlib.libcdb` --- Libc Database
===========================================
.. automodule:: pwnlib.libcdb
:members:
================================================
FILE: docs/source/log.rst
================================================
:mod:`pwnlib.log` --- Logging stuff
===================================
.. automodule:: pwnlib.log
:members: getLogger, install_default_handler, rootlogger
.. autoclass:: pwnlib.log.Progress
:members:
:member-order: bysource
.. autoclass:: pwnlib.log.Logger
:members:
:member-order: bysource
.. autoclass:: pwnlib.log.Handler
:members:
:member-order: bysource
.. autoclass:: pwnlib.log.Formatter
:members:
:member-order: bysource
================================================
FILE: docs/source/memleak.rst
================================================
.. testsetup:: *
from pwn import *
:mod:`pwnlib.memleak` --- Helper class for leaking memory
=========================================================
.. automodule:: pwnlib.memleak
:members:
================================================
FILE: docs/source/protocols.rst
================================================
.. testsetup:: *
from pwn import *
:mod:`pwnlib.protocols.adb` --- Protocol implementations
========================================================
.. automodule:: pwnlib.protocols.adb
:members:
================================================
FILE: docs/source/qemu.rst
================================================
.. testsetup:: *
from pwn import *
# TODO: Remove global POSIX flag
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
:mod:`pwnlib.qemu` --- QEMU Utilities
==========================================
.. automodule:: pwnlib.qemu
:members:
================================================
FILE: docs/source/regsort.rst
================================================
.. testsetup:: *
from pwnlib.regsort import *
:mod:`pwnlib.regsort` --- Register sorting
===========================================================
.. automodule:: pwnlib.regsort
:members:
================================================
FILE: docs/source/replacements.rst
================================================
:mod:`pwnlib.replacements` --- Replacements for various functions
=================================================================
.. automodule:: pwnlib.replacements
:members:
================================================
FILE: docs/source/rop/ret2dlresolve.rst
================================================
.. testsetup:: *
from pwn import *
import tempfile
:mod:`pwnlib.rop.ret2dlresolve` --- Return to dl_resolve
========================================================
.. automodule:: pwnlib.rop.ret2dlresolve
:members:
================================================
FILE: docs/source/rop/rop.rst
================================================
.. testsetup:: *
import time
from glob import glob
from pwnlib.asm import asm
from pwnlib import constants
from pwnlib.context import context
from pwnlib.elf import ELF
from pwnlib.rop import ROP
from pwnlib.rop.call import Call, AppendedArgument
from pwnlib.elf.maps import CAT_PROC_MAPS_EXIT
from pwnlib.util.packing import *
from pwnlib.util.fiddling import *
from pwnlib.tubes.process import process
from pwnlib import shellcraft
from pwnlib.util.misc import which
import pwnlib.data
context.clear()
# TODO: Remove global LINUX flag
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['LINUX']
:mod:`pwnlib.rop.rop` --- Return Oriented Programming
==========================================================
.. automodule:: pwnlib.rop.rop
:members:
================================================
FILE: docs/source/rop/srop.rst
================================================
.. testsetup:: *
from pwnlib.rop.srop import *
from pwnlib import constants
from pwnlib import shellcraft
from pwnlib.elf import ELF
from pwnlib.tubes.process import process
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['LINUX']
:mod:`pwnlib.rop.srop` --- Sigreturn Oriented Programming
==========================================================
.. automodule:: pwnlib.rop.srop
:members:
================================================
FILE: docs/source/rop.rst
================================================
:mod:`pwnlib.rop` --- Return Oriented Programming
=================================================
Submodules
----------
.. toctree::
:glob:
rop/*
================================================
FILE: docs/source/runner.rst
================================================
.. testsetup:: *
from pwnlib.runner import *
from pwnlib.asm import asm
# TODO: Remove global POSIX flag
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
:mod:`pwnlib.runner` --- Running Shellcode
===========================================
.. automodule:: pwnlib.runner
:members:
================================================
FILE: docs/source/shellcraft/aarch64.rst
================================================
.. testsetup:: *
from pwn import *
context.clear(arch='aarch64')
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['LINUX']
:mod:`pwnlib.shellcraft.aarch64` --- Shellcode for AArch64
===========================================================
:mod:`pwnlib.shellcraft.aarch64`
--------------------------------
.. automodule:: pwnlib.shellcraft.aarch64
:members:
:mod:`pwnlib.shellcraft.aarch64.linux`
--------------------------------------
.. automodule:: pwnlib.shellcraft.aarch64.linux
:members:
================================================
FILE: docs/source/shellcraft/amd64.rst
================================================
.. testsetup:: *
from pwn import *
context.clear(arch='amd64')
# TODO: POSIX/WINDOWS shellcode test
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['LINUX']
:mod:`pwnlib.shellcraft.amd64` --- Shellcode for AMD64
===========================================================
:mod:`pwnlib.shellcraft.amd64`
---------------------------------------
.. automodule:: pwnlib.shellcraft.amd64
:members:
:mod:`pwnlib.shellcraft.amd64.linux`
---------------------------------------
.. automodule:: pwnlib.shellcraft.amd64.linux
:members:
:mod:`pwnlib.shellcraft.amd64.windows`
---------------------------------------
.. automodule:: pwnlib.shellcraft.amd64.windows
:members:
================================================
FILE: docs/source/shellcraft/arm.rst
================================================
.. testsetup:: *
from pwn import *
context.clear(arch='arm')
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['LINUX']
:mod:`pwnlib.shellcraft.arm` --- Shellcode for ARM
===========================================================
:mod:`pwnlib.shellcraft.arm`
-----------------------------
.. automodule:: pwnlib.shellcraft.arm
:members:
:mod:`pwnlib.shellcraft.arm.linux`
-----------------------------------
.. automodule:: pwnlib.shellcraft.arm.linux
:members:
================================================
FILE: docs/source/shellcraft/common.rst
================================================
:mod:`pwnlib.shellcraft.common` --- Shellcode common to all architecture
========================================================================
.. automodule:: pwnlib.shellcraft.common
:members:
================================================
FILE: docs/source/shellcraft/i386.rst
================================================
.. testsetup:: *
from pwn import *
context.clear(arch='i386')
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
:mod:`pwnlib.shellcraft.i386` --- Shellcode for Intel 80386
===========================================================
:mod:`pwnlib.shellcraft.i386`
-----------------------------
.. automodule:: pwnlib.shellcraft.i386
:members:
:mod:`pwnlib.shellcraft.i386.linux`
-----------------------------------
.. automodule:: pwnlib.shellcraft.i386.linux
:members:
:mod:`pwnlib.shellcraft.i386.freebsd`
-------------------------------------
.. automodule:: pwnlib.shellcraft.i386.freebsd
:members:
================================================
FILE: docs/source/shellcraft/loongarch64.rst
================================================
.. testsetup:: *
from pwn import *
context.clear(arch='loongarch64')
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['LINUX']
:mod:`pwnlib.shellcraft.loongarch64` --- Shellcode for LoongArch64
==================================================================
:mod:`pwnlib.shellcraft.loongarch64`
------------------------------------
.. automodule:: pwnlib.shellcraft.loongarch64
:members:
:mod:`pwnlib.shellcraft.loongarch64.linux`
------------------------------------------
.. automodule:: pwnlib.shellcraft.loongarch64.linux
:members:
================================================
FILE: docs/source/shellcraft/mips.rst
================================================
.. testsetup:: *
import tempfile
from pwnlib import shellcraft
from pwnlib.asm import asm
from pwnlib.context import context
from pwnlib.runner import run_assembly
from pwnlib.util.fiddling import enhex
from pwnlib.util.misc import write
context.clear(arch='mips')
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['LINUX']
:mod:`pwnlib.shellcraft.mips` --- Shellcode for MIPS
===========================================================
:mod:`pwnlib.shellcraft.mips`
-----------------------------
.. automodule:: pwnlib.shellcraft.mips
:members:
:mod:`pwnlib.shellcraft.mips.linux`
-----------------------------------
.. automodule:: pwnlib.shellcraft.mips.linux
:members:
================================================
FILE: docs/source/shellcraft/riscv64.rst
================================================
.. testsetup:: *
from pwn import *
context.clear(arch='riscv64')
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['LINUX']
:mod:`pwnlib.shellcraft.riscv64` --- Shellcode for RISCV64
==========================================================
:mod:`pwnlib.shellcraft.riscv64`
--------------------------------
.. automodule:: pwnlib.shellcraft.riscv64
:members:
:mod:`pwnlib.shellcraft.riscv64.linux`
--------------------------------------
.. automodule:: pwnlib.shellcraft.riscv64.linux
:members:
================================================
FILE: docs/source/shellcraft/thumb.rst
================================================
.. testsetup:: *
from pwn import *
context.clear(arch='thumb')
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['LINUX']
:mod:`pwnlib.shellcraft.thumb` --- Shellcode for Thumb Mode
===========================================================
:mod:`pwnlib.shellcraft.thumb`
-------------------------------
.. automodule:: pwnlib.shellcraft.thumb
:members:
:mod:`pwnlib.shellcraft.thumb.linux`
---------------------------------------
.. automodule:: pwnlib.shellcraft.thumb.linux
:members:
================================================
FILE: docs/source/shellcraft.rst
================================================
.. testsetup:: *
from pwnlib import shellcraft
# TODO: Remove global POSIX flag
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
:mod:`pwnlib.shellcraft` --- Shellcode generation
=================================================
.. automodule:: pwnlib.shellcraft
.. TODO:
Write a guide to adding more shellcode.
Submodules
----------
.. toctree::
:glob:
shellcraft/*
================================================
FILE: docs/source/term/readline.rst
================================================
.. testsetup:: *
from pwnlib.term.readline import *
import io
:mod:`pwnlib.term.readline` --- Terminal nice readline
======================================================
.. automodule:: pwnlib.term.readline
:members:
================================================
FILE: docs/source/term.rst
================================================
:mod:`pwnlib.term` --- Terminal handling
========================================
.. automodule:: pwnlib.term
:members:
Term Modules
-------------------
.. toctree::
term/readline
================================================
FILE: docs/source/testexample.rst
================================================
.. testsetup:: *
import os
from pwnlib.testexample import add
:mod:`pwnlib.testexample` --- Example Test Module
==================================================
.. automodule:: pwnlib.testexample
:members:
================================================
FILE: docs/source/timeout.rst
================================================
.. testsetup:: *
from pwnlib.context import context
from pwnlib.timeout import Timeout
import time
:mod:`pwnlib.timeout` --- Timeout handling
============================================
.. automodule:: pwnlib.timeout
:members:
================================================
FILE: docs/source/tubes/buffer.rst
================================================
.. testsetup:: *
from pwnlib.tubes.buffer import *
:mod:`pwnlib.tubes.buffer` --- buffer implementation for tubes
==============================================================
.. automodule:: pwnlib.tubes.buffer
:members:
================================================
FILE: docs/source/tubes/processes.rst
================================================
.. testsetup:: *
from pwn import *
# TODO: Remove global POSIX flag
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
:mod:`pwnlib.tubes.process` --- Processes
===========================================================
.. automodule:: pwnlib.tubes.process
.. autoclass:: pwnlib.tubes.process.process
:members:
:show-inheritance:
================================================
FILE: docs/source/tubes/serial.rst
================================================
.. testsetup:: *
from pwn import *
# TODO: Remove global POSIX flag
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
:mod:`pwnlib.tubes.serialtube` --- Serial Ports
===========================================================
.. automodule:: pwnlib.tubes.serialtube
.. autoclass:: pwnlib.tubes.serialtube.serialtube
:members:
================================================
FILE: docs/source/tubes/sockets.rst
================================================
.. testsetup:: *
from pwn import *
from pwnlib.tubes.server import server
:mod:`pwnlib.tubes.sock` --- Sockets
===========================================================
.. automodule:: pwnlib.tubes.sock
.. autoclass:: pwnlib.tubes.sock.sock()
:show-inheritance:
.. automodule:: pwnlib.tubes.remote
.. autoclass:: pwnlib.tubes.remote.remote
:members:
:show-inheritance:
.. automodule:: pwnlib.tubes.listen
.. autoclass:: pwnlib.tubes.listen.listen
:members:
:show-inheritance:
.. automodule:: pwnlib.tubes.server
.. autoclass:: pwnlib.tubes.server.server
:members:
:show-inheritance:
================================================
FILE: docs/source/tubes/ssh.rst
================================================
.. testsetup:: *
from pwn import *
# TODO: Remove global POSIX flag
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
:mod:`pwnlib.tubes.ssh` --- SSH
===========================================================
.. automodule:: pwnlib.tubes.ssh
.. autoclass:: pwnlib.tubes.ssh.ssh
:members:
.. autoclass:: pwnlib.tubes.ssh.ssh_channel()
:members: kill, poll, interactive
:show-inheritance:
.. autoclass:: pwnlib.tubes.ssh.ssh_process
:members:
:show-inheritance:
.. autoclass:: pwnlib.tubes.ssh.ssh_connecter()
:show-inheritance:
.. autoclass:: pwnlib.tubes.ssh.ssh_listener()
:show-inheritance:
================================================
FILE: docs/source/tubes.rst
================================================
.. testsetup:: *
from pwn import *
:mod:`pwnlib.tubes` --- Talking to the World!
=============================================
.. automodule:: pwnlib.tubes
Types of Tubes
-------------------
.. toctree::
:maxdepth: 3
:glob:
tubes/*
:mod:`pwnlib.tubes.tube` --- Common Functionality
-------------------------------------------------
.. automodule:: pwnlib.tubes.tube
.. autoclass:: pwnlib.tubes.tube.tube()
:members:
:exclude-members: recv_raw, send_raw, settimeout_raw,
can_recv_raw, shutdown_raw, connected_raw,
================================================
FILE: docs/source/ui.rst
================================================
.. testsetup:: *
from pwn import *
import io
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
:mod:`pwnlib.ui` --- Functions for user interaction
===================================================
.. automodule:: pwnlib.ui
:members:
================================================
FILE: docs/source/update.rst
================================================
.. testsetup:: *
from pwn import *
from pwnlib.update import *
:mod:`pwnlib.update` --- Updating Pwntools
===================================================
.. automodule:: pwnlib.update
:members:
================================================
FILE: docs/source/useragents.rst
================================================
.. testsetup:: *
from pwnlib.useragents import *
:mod:`pwnlib.useragents` --- A database of useragent strings
============================================================
.. automodule:: pwnlib.useragents
:members:
================================================
FILE: docs/source/util/crc.rst
================================================
.. testsetup:: *
from pwnlib.util.crc import *
:mod:`pwnlib.util.crc` --- Calculating CRC-sums
===============================================
.. automodule:: pwnlib.util.crc
:members:
================================================
FILE: docs/source/util/cyclic.rst
================================================
.. testsetup:: *
from pwn import *
from pwnlib.util.cyclic import *
:mod:`pwnlib.util.cyclic` --- Generation of unique sequences
============================================================
.. automodule:: pwnlib.util.cyclic
:members:
================================================
FILE: docs/source/util/fiddling.rst
================================================
.. testsetup:: *
from pwn import *
from pwnlib.util.fiddling import *
:mod:`pwnlib.util.fiddling` --- Utilities bit fiddling
======================================================
.. automodule:: pwnlib.util.fiddling
:members:
================================================
FILE: docs/source/util/getdents.rst
================================================
.. testsetup:: *
from pwnlib.util.getdents import *
from pwnlib.util.fiddling import unhex
:mod:`pwnlib.util.getdents` --- Linux binary directory listing
==============================================================
.. automodule:: pwnlib.util.getdents
:members:
================================================
FILE: docs/source/util/hashes.rst
================================================
:mod:`pwnlib.util.hashes` --- Hashing functions
===============================================
.. automodule:: pwnlib.util.hashes
:members:
================================================
FILE: docs/source/util/iters.rst
================================================
.. testsetup:: *
import string, operator
from pwnlib.util.iters import *
:mod:`pwnlib.util.iters` --- Extension of standard module :mod:`itertools`
==========================================================================
.. automodule:: pwnlib.util.iters
:members:
:exclude-members:
chain ,
combinations ,
combinations_with_replacement ,
compress ,
count ,
cycle ,
dropwhile ,
filter ,
filterfalse ,
groupby ,
islice ,
map ,
permutations ,
product ,
repeat ,
starmap ,
takewhile ,
tee ,
zip ,
zip_longest
.. function:: chain
Alias for :func:`itertools.chain`.
.. function:: combinations
Alias for :func:`itertools.combinations`
.. function:: combinations_with_replacement
Alias for :func:`itertools.combinations_with_replacement`
.. function:: compress
Alias for :func:`itertools.compress`
.. function:: count
Alias for :func:`itertools.count`
.. function:: cycle
Alias for :func:`itertools.cycle`
.. function:: dropwhile
Alias for :func:`itertools.dropwhile`
.. function:: groupby
Alias for :func:`itertools.groupby`
.. function:: filter
Alias for python3-style :func:`filter`
.. function:: filterfalse
Alias for :func:`itertools.filterfalse`
.. function:: map
Alias for python3-style :func:`map`
.. function:: islice
Alias for :func:`itertools.islice`
.. function:: zip
Alias for python3-style :func:`zip`
.. function:: zip_longest
Alias for :func:`itertools.zip_longest`
.. function:: permutations
Alias for :func:`itertools.permutations`
.. function:: product
Alias for :func:`itertools.product`
.. function:: repeat
Alias for :func:`itertools.repeat`
.. function:: starmap
Alias for :func:`itertools.starmap`
.. function:: takewhile
Alias for :func:`itertools.takewhile`
.. function:: tee
Alias for :func:`itertools.tee`
================================================
FILE: docs/source/util/lists.rst
================================================
.. testsetup:: *
from pwnlib.util.lists import *
:mod:`pwnlib.util.lists` --- Operations on lists
================================================
.. automodule:: pwnlib.util.lists
:members:
================================================
FILE: docs/source/util/misc.rst
================================================
.. testsetup:: *
from pprint import pprint
from pwnlib.util.misc import *
import os, subprocess
:mod:`pwnlib.util.misc` --- We could not fit it any other place
===============================================================
.. automodule:: pwnlib.util.misc
:members:
================================================
FILE: docs/source/util/net.rst
================================================
.. testsetup:: *
from pwnlib.util.net import *
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['LINUX']
:mod:`pwnlib.util.net` --- Networking interfaces
===================================================
.. automodule:: pwnlib.util.net
:members:
================================================
FILE: docs/source/util/packing.rst
================================================
.. testsetup:: *
from pwnlib.util.packing import *
:mod:`pwnlib.util.packing` --- Packing and unpacking of strings
===============================================================
.. automodule:: pwnlib.util.packing
:members:
================================================
FILE: docs/source/util/proc.rst
================================================
.. testsetup:: *
from pwnlib.util.proc import *
from pwnlib.tubes.process import process
import os, sys
import doctest
doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['LINUX']
:mod:`pwnlib.util.proc` --- Working with ``/proc/``
===================================================
.. automodule:: pwnlib.util.proc
:members:
================================================
FILE: docs/source/util/safeeval.rst
================================================
.. testsetup:: *
from pwnlib.util.safeeval import *
_get_opcodes = pwnlib.util.safeeval._get_opcodes
:mod:`pwnlib.util.safeeval` --- Safe evaluation of python code
==============================================================
.. automodule:: pwnlib.util.safeeval
:members:
================================================
FILE: docs/source/util/sh_string.rst
================================================
.. testsetup:: *
from pwn import *
test = pwnlib.util.sh_string.test
:mod:`pwnlib.util.sh_string` --- Shell Expansion is Hard
===============================================================
.. automodule:: pwnlib.util.sh_string
:members:
================================================
FILE: docs/source/util/web.rst
================================================
.. testsetup:: *
import tempfile
from pwnlib.context import context
from pwnlib.util.web import *
:mod:`pwnlib.util.web` --- Utilities for working with the WWW
=============================================================
.. automodule:: pwnlib.util.web
:members:
================================================
FILE: docs/source/windbg.rst
================================================
.. testsetup:: *
from pwn import *
:mod:`pwnlib.windbg` --- Working with WinDbg
============================================
.. automodule:: pwnlib.windbg
:members:
================================================
FILE: examples/README.md
================================================
# Examples
While these examples should all work, they are not very representative of
the pwntools project.
We have a plan to create a separate repository with examples, primarily
exploits. Until we do so, we recommend new users to look at
https://docs.pwntools.com, as this is a better overview of our features.
In no particular order the docstrings for each example:
* `args.py`
```
When not in lib-mode (import `pwn` rather than `pwnlib`) we parse the
commandline for variables definitions. A variable definition has the form::
<var>=<val>
where ``<var>`` contains only uppercase letters, digits and underscores and
doesn't start with a digit.
Try running this example with::
$ python args.py RHOST=localhost RPORT=1337
```
* `asm.py`
```
Example showing the interface to `pwnlib.asm.asm` and `pwnlib.shellcraft`.
```
* `attach.py`
```
Example showing `pwnlib.gdb.attach()`
```
* `clean_and_log.py`
```
Use case for `pwnlib.tubes.tube.clean_and_log`.
Sometimes you will have a solution to a challenge but you don't know what it
will look like when you get the flag. Sometimes that will leave you with a
top-level exception, no flag, and angry team members.
Solution:
1. Always run wireshark or tcpdump. Always.
2. Register <your socket>.clean or <your socket>.clean_and_log to run at exit.
```
* `indented.py`
```
When running in term-mode (import `pwn` rather than `pwnlib`, stdout is a TTY
and not running in a REPL), we can do proper indentation where lines too long to
fit on a screen are split into multiple individually indented lines.
Too see the difference try running with::
$ python indented.py
and
$ python -i indented.py
Also notice that `pause()` can react on any key when in `term_mode`.
```
* `listen_uroboros.py`
```
An example showing interconnection of sockets. This script will wait for three
connections on port 1337, then connect them like a three-way Uroboros.
```
* `options.py`
```
Example showing `pwnlib.ui.options()`
```
* `port_forward.py`
```
A very simple port forwarder using `pwnlib.tubes.tube.connect_both()`.
```
* `readline_completers.py`
```
Example showing pwnlib's readline implementation and a few completers. This
part of pwnlib will probably see some major changes soon, but we wanted to show
off some proof-of-concepts.
```
* `remote.py`
```
Example showing how to use the remote class.
```
* `remote_gdb_debugging.py`
```
Simple example showing how to use the remote
gdb debugging features available in pwntools.
```
* `spinners.py`
```
Just a lot of spinners!
```
* `splash.py`
```
"Easteregg"
```
* `ssh.py`
```
Example showing how to use the ssh class.
```
* `text.py`
```
Example showing how to use `pwnlib.term.text`.
Try running with::
$ TERM=xterm python text.py
and::
$ TE
gitextract_ig0lwdlw/
├── .gitattributes
├── .github/
│ ├── ISSUE_TEMPLATE/
│ │ ├── bug_report.md
│ │ ├── feature_request.md
│ │ └── question.md
│ ├── ISSUE_TEMPLATE.md
│ ├── PULL_REQUEST_TEMPLATE.md
│ ├── dependabot.yml
│ └── workflows/
│ ├── changelog.yml
│ ├── ci.yml
│ ├── docker.yml
│ ├── lint.yml
│ ├── merge-conflict.yml
│ └── pylint.yml
├── .gitignore
├── .isort.cfg
├── .readthedocs.yaml
├── .sublime-settings
├── CHANGELOG.md
├── CONTRIBUTING.md
├── DOCKER.md
├── LICENSE-pwntools.txt
├── MANIFEST.in
├── README.md
├── SECURITY.md
├── TESTING.md
├── docs/
│ ├── .gitignore
│ ├── Makefile
│ ├── requirements.txt
│ └── source/
│ ├── about.rst
│ ├── adb.rst
│ ├── args.rst
│ ├── asm.rst
│ ├── atexception.rst
│ ├── atexit.rst
│ ├── commandline.rst
│ ├── conf.py
│ ├── config.rst
│ ├── constants.rst
│ ├── context.rst
│ ├── dynelf.rst
│ ├── elf/
│ │ ├── config.rst
│ │ ├── corefile.rst
│ │ └── elf.rst
│ ├── elf.rst
│ ├── encoders.rst
│ ├── exception.rst
│ ├── filepointer.rst
│ ├── filesystem.rst
│ ├── flag.rst
│ ├── fmtstr.rst
│ ├── gdb.rst
│ ├── globals.rst
│ ├── index.rst
│ ├── install/
│ │ ├── binutils.rst
│ │ └── headers.rst
│ ├── install.rst
│ ├── intro.rst
│ ├── libc/
│ │ └── glibc.rst
│ ├── libc.rst
│ ├── libcdb.rst
│ ├── log.rst
│ ├── memleak.rst
│ ├── protocols.rst
│ ├── qemu.rst
│ ├── regsort.rst
│ ├── replacements.rst
│ ├── rop/
│ │ ├── ret2dlresolve.rst
│ │ ├── rop.rst
│ │ └── srop.rst
│ ├── rop.rst
│ ├── runner.rst
│ ├── shellcraft/
│ │ ├── aarch64.rst
│ │ ├── amd64.rst
│ │ ├── arm.rst
│ │ ├── common.rst
│ │ ├── i386.rst
│ │ ├── loongarch64.rst
│ │ ├── mips.rst
│ │ ├── riscv64.rst
│ │ └── thumb.rst
│ ├── shellcraft.rst
│ ├── term/
│ │ └── readline.rst
│ ├── term.rst
│ ├── testexample.rst
│ ├── timeout.rst
│ ├── tubes/
│ │ ├── buffer.rst
│ │ ├── processes.rst
│ │ ├── serial.rst
│ │ ├── sockets.rst
│ │ └── ssh.rst
│ ├── tubes.rst
│ ├── ui.rst
│ ├── update.rst
│ ├── useragents.rst
│ ├── util/
│ │ ├── crc.rst
│ │ ├── cyclic.rst
│ │ ├── fiddling.rst
│ │ ├── getdents.rst
│ │ ├── hashes.rst
│ │ ├── iters.rst
│ │ ├── lists.rst
│ │ ├── misc.rst
│ │ ├── net.rst
│ │ ├── packing.rst
│ │ ├── proc.rst
│ │ ├── safeeval.rst
│ │ ├── sh_string.rst
│ │ └── web.rst
│ └── windbg.rst
├── examples/
│ ├── README.md
│ ├── android.py
│ ├── args.py
│ ├── asm.py
│ ├── attach.py
│ ├── clean_and_log.py
│ ├── fmtstr/
│ │ ├── Makefile
│ │ ├── exploit.py
│ │ ├── exploit2.py
│ │ ├── printf-loop.c
│ │ ├── printf-loop.native
│ │ ├── printf-loop.native32
│ │ ├── printf.aarch64
│ │ ├── printf.arm
│ │ ├── printf.c
│ │ ├── printf.mips
│ │ ├── printf.mips64
│ │ ├── printf.mips64el
│ │ ├── printf.mipsel
│ │ ├── printf.native
│ │ ├── printf.native32
│ │ ├── printf.ppc
│ │ ├── printf.ppc64
│ │ └── printf.sparc64
│ ├── gdb_api.py
│ ├── gen-README.py
│ ├── indented.py
│ ├── listen_uroboros.py
│ ├── options.py
│ ├── port_forward.py
│ ├── readline_completers.py
│ ├── remote.py
│ ├── remote_gdb_debugging.py
│ ├── sigreturn_corefile_aarch64.py
│ ├── sigreturn_corefile_amd64.py
│ ├── sigreturn_corefile_arm.py
│ ├── sigreturn_corefile_i386.py
│ ├── spinners.py
│ ├── splash.py
│ ├── ssh.py
│ ├── text.py
│ └── yesno.py
├── extra/
│ ├── bash_completion.d/
│ │ ├── README.md
│ │ ├── install.sh
│ │ ├── pwn
│ │ └── shellcraft
│ ├── docker/
│ │ ├── Makefile
│ │ ├── README.md
│ │ ├── base/
│ │ │ └── Dockerfile
│ │ ├── beta/
│ │ │ └── Dockerfile
│ │ ├── dev/
│ │ │ └── Dockerfile
│ │ ├── develop/
│ │ │ ├── 10-import.py
│ │ │ ├── Dockerfile
│ │ │ └── ipython_config.py
│ │ └── stable/
│ │ └── Dockerfile
│ ├── textmate/
│ │ ├── README.md
│ │ ├── pwntools.YAML-tmLanguage
│ │ └── pwntools.tmLanguage
│ └── zsh_completion/
│ ├── README.md
│ ├── _pwn
│ └── install.zsh
├── pwn/
│ ├── __init__.py
│ └── toplevel.py
├── pwnlib/
│ ├── __init__.py
│ ├── abi.py
│ ├── adb/
│ │ ├── __init__.py
│ │ ├── adb.py
│ │ ├── bootimg.py
│ │ ├── bootloader.py
│ │ └── protocol.py
│ ├── args.py
│ ├── asm.py
│ ├── atexception.py
│ ├── atexit.py
│ ├── commandline/
│ │ ├── __init__.py
│ │ ├── asm.py
│ │ ├── checksec.py
│ │ ├── common.py
│ │ ├── constgrep.py
│ │ ├── cyclic.py
│ │ ├── debug.py
│ │ ├── disablenx.py
│ │ ├── disasm.py
│ │ ├── elfdiff.py
│ │ ├── elfpatch.py
│ │ ├── errno.py
│ │ ├── hex.py
│ │ ├── libcdb.py
│ │ ├── main.py
│ │ ├── phd.py
│ │ ├── pwnstrip.py
│ │ ├── scramble.py
│ │ ├── shellcraft.py
│ │ ├── template.py
│ │ ├── unhex.py
│ │ ├── update.py
│ │ └── version.py
│ ├── config.py
│ ├── constants/
│ │ ├── LICENSE.txt
│ │ ├── __init__.py
│ │ ├── cgc/
│ │ │ ├── __init__.py
│ │ │ └── thumb.py
│ │ ├── constant.py
│ │ ├── darwin/
│ │ │ ├── __init__.py
│ │ │ ├── aarch64.py
│ │ │ └── amd64.py
│ │ ├── freebsd.py
│ │ └── linux/
│ │ ├── __init__.py
│ │ ├── aarch64.py
│ │ ├── alpha.py
│ │ ├── amd64.py
│ │ ├── arm.py
│ │ ├── i386.py
│ │ ├── ia64.py
│ │ ├── loongarch64.py
│ │ ├── mips.py
│ │ ├── powerpc.py
│ │ ├── powerpc64.py
│ │ ├── riscv64.py
│ │ ├── s390.py
│ │ ├── s390x.py
│ │ ├── sparc.py
│ │ ├── sparc64.py
│ │ └── thumb.py
│ ├── context/
│ │ └── __init__.py
│ ├── data/
│ │ ├── __init__.py
│ │ ├── crcsums.txt
│ │ ├── elf/
│ │ │ ├── __init__.py
│ │ │ ├── fmtstr/
│ │ │ │ ├── Makefile
│ │ │ │ ├── __init__.py
│ │ │ │ ├── i386
│ │ │ │ └── vuln.c
│ │ │ ├── relro/
│ │ │ │ ├── __init__.py
│ │ │ │ ├── test-x86-full
│ │ │ │ ├── test-x86-full-nodt
│ │ │ │ ├── test-x86-none
│ │ │ │ ├── test-x86-none-now
│ │ │ │ ├── test-x86-none-now-nodt
│ │ │ │ └── test-x86-partial
│ │ │ ├── ret2dlresolve/
│ │ │ │ ├── Makefile
│ │ │ │ ├── __init__.py
│ │ │ │ ├── amd64
│ │ │ │ ├── i386
│ │ │ │ └── vuln.c
│ │ │ ├── test-aarch64
│ │ │ ├── test-aarch64-big
│ │ │ ├── test-aarch64-big-pie
│ │ │ ├── test-aarch64-big-relro
│ │ │ ├── test-aarch64-big-relro-pie
│ │ │ ├── test-aarch64-pie
│ │ │ ├── test-aarch64-relro
│ │ │ ├── test-aarch64-relro-pie
│ │ │ ├── test-arm
│ │ │ ├── test-arm-big
│ │ │ ├── test-arm-big-pie
│ │ │ ├── test-arm-big-relro
│ │ │ ├── test-arm-big-relro-pie
│ │ │ ├── test-arm-pie
│ │ │ ├── test-arm-relro
│ │ │ ├── test-arm-relro-pie
│ │ │ ├── test-mips-big
│ │ │ ├── test-mips-big-pie
│ │ │ ├── test-mips-big-pie-relro
│ │ │ ├── test-mips-big-relro
│ │ │ ├── test-riscv64
│ │ │ ├── test-riscv64-pie
│ │ │ ├── test-riscv64-relro
│ │ │ ├── test-riscv64-relro-pie
│ │ │ ├── test-thumb
│ │ │ ├── test-thumb-big
│ │ │ ├── test-thumb-big-pie
│ │ │ ├── test-thumb-big-relro
│ │ │ ├── test-thumb-big-relro-pie
│ │ │ ├── test-thumb-pie
│ │ │ ├── test-thumb-relro
│ │ │ ├── test-thumb-relro-pie
│ │ │ ├── test-x32
│ │ │ ├── test-x32-pie
│ │ │ ├── test-x32-relro
│ │ │ ├── test-x32-relro-pie
│ │ │ ├── test-x64
│ │ │ ├── test-x64-cfp
│ │ │ ├── test-x64-pie
│ │ │ ├── test-x64-relro
│ │ │ ├── test-x64-relro-pie
│ │ │ ├── test-x86
│ │ │ ├── test-x86-cfp
│ │ │ ├── test-x86-pie
│ │ │ ├── test-x86-relro
│ │ │ └── test-x86-relro-pie
│ │ ├── includes/
│ │ │ ├── LICENSE.txt
│ │ │ ├── cgc/
│ │ │ │ └── arm.h
│ │ │ ├── darwin/
│ │ │ │ ├── aarch64.h
│ │ │ │ └── amd64.h
│ │ │ ├── freebsd.h
│ │ │ ├── generator/
│ │ │ │ ├── freebsd/
│ │ │ │ │ ├── common.h
│ │ │ │ │ ├── machine/
│ │ │ │ │ │ ├── _align.h
│ │ │ │ │ │ ├── _limits.h
│ │ │ │ │ │ └── signal.h
│ │ │ │ │ ├── sys/
│ │ │ │ │ │ ├── _iovec.h
│ │ │ │ │ │ ├── _sigset.h
│ │ │ │ │ │ ├── _sockaddr_storage.h
│ │ │ │ │ │ ├── _timespec.h
│ │ │ │ │ │ ├── _types.h
│ │ │ │ │ │ ├── cdefs.h
│ │ │ │ │ │ ├── errno.h
│ │ │ │ │ │ ├── fcntl.h
│ │ │ │ │ │ ├── mman.h
│ │ │ │ │ │ ├── signal.h
│ │ │ │ │ │ ├── socket.h
│ │ │ │ │ │ ├── stat.h
│ │ │ │ │ │ ├── syscall.h
│ │ │ │ │ │ ├── time.h
│ │ │ │ │ │ └── unistd.h
│ │ │ │ │ └── vm/
│ │ │ │ │ └── vm.h
│ │ │ │ ├── generate_constants.sh
│ │ │ │ ├── linux/
│ │ │ │ │ ├── aarch64.h
│ │ │ │ │ ├── alpha.h
│ │ │ │ │ ├── amd64.h
│ │ │ │ │ ├── arm.h
│ │ │ │ │ ├── common.h
│ │ │ │ │ ├── diet/
│ │ │ │ │ │ ├── aarch64/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── alpha/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── arm/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── asm/
│ │ │ │ │ │ │ ├── aarch64-sigcontext.h
│ │ │ │ │ │ │ ├── alpha-sigcontext.h
│ │ │ │ │ │ │ ├── arm-sigcontext.h
│ │ │ │ │ │ │ ├── i386-sigcontext.h
│ │ │ │ │ │ │ ├── ia64-sigcontext.h
│ │ │ │ │ │ │ ├── mips-sigcontext.h
│ │ │ │ │ │ │ ├── parisc-sigcontext.h
│ │ │ │ │ │ │ ├── ppc-sigcontext.h
│ │ │ │ │ │ │ ├── s390-sigcontext.h
│ │ │ │ │ │ │ ├── sigcontext.h
│ │ │ │ │ │ │ ├── sparc-sigcontext.h
│ │ │ │ │ │ │ ├── types.h
│ │ │ │ │ │ │ └── x86_64-sigcontext.h
│ │ │ │ │ │ ├── endian.h
│ │ │ │ │ │ ├── errno.h
│ │ │ │ │ │ ├── fcntl.h
│ │ │ │ │ │ ├── i386/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── ia64/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── inttypes.h
│ │ │ │ │ │ ├── linuxnet.h
│ │ │ │ │ │ ├── loongarch64/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── mips/
│ │ │ │ │ │ │ ├── mips-asm.h
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── mips64/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── mipsel/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── parisc/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── ppc/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── ppc64/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── ppc64le/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── riscv64/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── s390/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── s390x/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── signal.h
│ │ │ │ │ │ ├── sparc/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── sparc64/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ ├── stddef.h
│ │ │ │ │ │ ├── stdint.h
│ │ │ │ │ │ ├── string.h
│ │ │ │ │ │ ├── sys/
│ │ │ │ │ │ │ ├── cdefs.h
│ │ │ │ │ │ │ ├── fsuid.h
│ │ │ │ │ │ │ ├── mman.h
│ │ │ │ │ │ │ ├── ptrace.h
│ │ │ │ │ │ │ ├── select.h
│ │ │ │ │ │ │ ├── socket.h
│ │ │ │ │ │ │ ├── stat.h
│ │ │ │ │ │ │ ├── time.h
│ │ │ │ │ │ │ ├── types.h
│ │ │ │ │ │ │ ├── ucontext.h
│ │ │ │ │ │ │ └── uio.h
│ │ │ │ │ │ ├── unistd.h
│ │ │ │ │ │ ├── x32/
│ │ │ │ │ │ │ └── syscalls.h
│ │ │ │ │ │ └── x86_64/
│ │ │ │ │ │ ├── syscalls.h
│ │ │ │ │ │ └── syscalls32.h
│ │ │ │ │ ├── i386.h
│ │ │ │ │ ├── ia64.h
│ │ │ │ │ ├── loongarch64.h
│ │ │ │ │ ├── mips.h
│ │ │ │ │ ├── powerpc.h
│ │ │ │ │ ├── powerpc64.h
│ │ │ │ │ ├── riscv64.h
│ │ │ │ │ ├── s390.h
│ │ │ │ │ ├── s390x.h
│ │ │ │ │ ├── sparc.h
│ │ │ │ │ ├── sparc64.h
│ │ │ │ │ ├── syscall_map.h
│ │ │ │ │ └── thumb.h
│ │ │ │ └── load_constants.py
│ │ │ └── linux/
│ │ │ ├── aarch64.h
│ │ │ ├── alpha.h
│ │ │ ├── amd64.h
│ │ │ ├── arm.h
│ │ │ ├── i386.h
│ │ │ ├── ia64.h
│ │ │ ├── loongarch64.h
│ │ │ ├── mips.h
│ │ │ ├── powerpc.h
│ │ │ ├── powerpc64.h
│ │ │ ├── riscv64.h
│ │ │ ├── s390.h
│ │ │ ├── s390x.h
│ │ │ ├── sparc.h
│ │ │ ├── sparc64.h
│ │ │ └── thumb.h
│ │ ├── syscalls/
│ │ │ ├── Makefile
│ │ │ ├── generate.py
│ │ │ └── generate_darwin.py
│ │ ├── templates/
│ │ │ └── pwnup.mako
│ │ └── useragents/
│ │ ├── LICENSE.txt
│ │ ├── download-useragents.py
│ │ └── useragents.txt
│ ├── device.py
│ ├── dynelf.py
│ ├── elf/
│ │ ├── __init__.py
│ │ ├── config.py
│ │ ├── corefile.py
│ │ ├── datatypes.py
│ │ ├── elf.py
│ │ ├── maps.py
│ │ └── plt.py
│ ├── encoders/
│ │ ├── __init__.py
│ │ ├── amd64/
│ │ │ ├── __init__.py
│ │ │ └── delta.py
│ │ ├── arm/
│ │ │ ├── __init__.py
│ │ │ ├── alphanumeric/
│ │ │ │ ├── ARM_Instructions.py
│ │ │ │ ├── __init__.py
│ │ │ │ ├── alphanum_byte.py
│ │ │ │ ├── alphanumeric.py
│ │ │ │ ├── builder.py
│ │ │ │ └── random_funcs.py
│ │ │ └── xor.py
│ │ ├── encoder.py
│ │ ├── i386/
│ │ │ ├── __init__.py
│ │ │ ├── ascii_shellcode.py
│ │ │ ├── delta.py
│ │ │ └── xor.py
│ │ └── mips/
│ │ ├── __init__.py
│ │ └── xor.py
│ ├── exception.py
│ ├── filepointer.py
│ ├── filesystem/
│ │ ├── __init__.py
│ │ ├── path.py
│ │ └── ssh.py
│ ├── flag/
│ │ ├── __init__.py
│ │ └── flag.py
│ ├── fmtstr.py
│ ├── gdb.py
│ ├── gdb_api_bridge.py
│ ├── gdb_faketerminal.py
│ ├── internal/
│ │ ├── __init__.py
│ │ └── dochelper.py
│ ├── lexer.py
│ ├── libc/
│ │ ├── __init__.py
│ │ └── glibc.py
│ ├── libcdb.py
│ ├── log.py
│ ├── memleak.py
│ ├── protocols/
│ │ ├── __init__.py
│ │ └── adb/
│ │ └── __init__.py
│ ├── py2compat.py
│ ├── qemu.py
│ ├── regsort.py
│ ├── replacements.py
│ ├── rop/
│ │ ├── __init__.py
│ │ ├── call.py
│ │ ├── gadgets.py
│ │ ├── ret2csu.py
│ │ ├── ret2dlresolve.py
│ │ ├── rop.py
│ │ └── srop.py
│ ├── runner.py
│ ├── shellcraft/
│ │ ├── __init__.py
│ │ ├── internal.py
│ │ ├── registers.py
│ │ └── templates/
│ │ ├── __doc__
│ │ ├── aarch64/
│ │ │ ├── __doc__
│ │ │ ├── breakpoint.asm
│ │ │ ├── crash.asm
│ │ │ ├── darwin/
│ │ │ │ ├── __doc__
│ │ │ │ ├── cat.asm
│ │ │ │ ├── cat2.asm
│ │ │ │ ├── open.asm
│ │ │ │ ├── syscall.asm
│ │ │ │ └── syscalls/
│ │ │ │ ├── __doc__
│ │ │ │ ├── execve.asm
│ │ │ │ ├── exit.asm
│ │ │ │ ├── getdirentries64.asm
│ │ │ │ ├── getxattr.asm
│ │ │ │ ├── lseek.asm
│ │ │ │ ├── read.asm
│ │ │ │ └── write.asm
│ │ │ ├── freebsd/
│ │ │ │ ├── __doc__
│ │ │ │ └── syscall.asm
│ │ │ ├── infloop.asm
│ │ │ ├── linux/
│ │ │ │ ├── __doc__
│ │ │ │ ├── cat.asm
│ │ │ │ ├── cat2.asm
│ │ │ │ ├── connect.asm
│ │ │ │ ├── dupio.asm
│ │ │ │ ├── dupsh.asm
│ │ │ │ ├── echo.asm
│ │ │ │ ├── forkexit.asm
│ │ │ │ ├── killparent.asm
│ │ │ │ ├── loader.asm
│ │ │ │ ├── loader_append.asm
│ │ │ │ ├── open.asm
│ │ │ │ ├── readn.asm
│ │ │ │ ├── setresuid.asm
│ │ │ │ ├── sh.asm
│ │ │ │ ├── socket.asm
│ │ │ │ ├── stage.asm
│ │ │ │ └── syscall.asm
│ │ │ ├── memcpy.asm
│ │ │ ├── mov.asm
│ │ │ ├── push.asm
│ │ │ ├── pushstr.asm
│ │ │ ├── pushstr_array.asm
│ │ │ ├── setregs.asm
│ │ │ └── xor.asm
│ │ ├── amd64/
│ │ │ ├── __doc__
│ │ │ ├── crash.asm
│ │ │ ├── darwin/
│ │ │ │ ├── __doc__
│ │ │ │ ├── cat.asm
│ │ │ │ ├── cat2.asm
│ │ │ │ ├── open.asm
│ │ │ │ ├── syscall.asm
│ │ │ │ └── syscalls/
│ │ │ │ ├── __doc__
│ │ │ │ ├── execve.asm
│ │ │ │ ├── exit.asm
│ │ │ │ ├── getdirentries64.asm
│ │ │ │ ├── getxattr.asm
│ │ │ │ ├── lseek.asm
│ │ │ │ ├── read.asm
│ │ │ │ └── write.asm
│ │ │ ├── freebsd/
│ │ │ │ ├── __doc__
│ │ │ │ ├── amd64_to_i386.asm
│ │ │ │ └── syscall.asm
│ │ │ ├── infloop.asm
│ │ │ ├── itoa.asm
│ │ │ ├── linux/
│ │ │ │ ├── __doc__
│ │ │ │ ├── amd64_to_i386.asm
│ │ │ │ ├── bindsh.asm
│ │ │ │ ├── cat.asm
│ │ │ │ ├── cat2.asm
│ │ │ │ ├── connect.asm
│ │ │ │ ├── connectstager.asm
│ │ │ │ ├── dupio.asm
│ │ │ │ ├── dupsh.asm
│ │ │ │ ├── echo.asm
│ │ │ │ ├── egghunter.asm
│ │ │ │ ├── findpeer.asm
│ │ │ │ ├── findpeersh.asm
│ │ │ │ ├── findpeerstager.asm
│ │ │ │ ├── forkbomb.asm
│ │ │ │ ├── forkexit.asm
│ │ │ │ ├── getpid.asm
│ │ │ │ ├── killparent.asm
│ │ │ │ ├── listen.asm
│ │ │ │ ├── loader.asm
│ │ │ │ ├── loader_append.asm
│ │ │ │ ├── membot.asm
│ │ │ │ ├── migrate_stack.asm
│ │ │ │ ├── mmap_rwx.asm
│ │ │ │ ├── read.asm
│ │ │ │ ├── read_upto.asm
│ │ │ │ ├── readfile.asm
│ │ │ │ ├── readinto.asm
│ │ │ │ ├── readloop.asm
│ │ │ │ ├── readn.asm
│ │ │ │ ├── readptr.asm
│ │ │ │ ├── recvsize.asm
│ │ │ │ ├── setregid.asm
│ │ │ │ ├── setresuid.asm
│ │ │ │ ├── setreuid.asm
│ │ │ │ ├── sh.asm
│ │ │ │ ├── socket.asm
│ │ │ │ ├── stage.asm
│ │ │ │ ├── stager.asm
│ │ │ │ ├── strace_dos.asm
│ │ │ │ ├── syscall.asm
│ │ │ │ └── writeloop.asm
│ │ │ ├── memcpy.asm
│ │ │ ├── mov.asm
│ │ │ ├── nop.asm
│ │ │ ├── popad.asm
│ │ │ ├── push.asm
│ │ │ ├── pushad.asm
│ │ │ ├── pushstr.asm
│ │ │ ├── pushstr_array.asm
│ │ │ ├── ret.asm
│ │ │ ├── setregs.asm
│ │ │ ├── strcpy.asm
│ │ │ ├── strlen.asm
│ │ │ ├── trap.asm
│ │ │ ├── windows/
│ │ │ │ ├── __doc__
│ │ │ │ ├── cmd.asm
│ │ │ │ ├── getexport.asm
│ │ │ │ ├── getprocaddress.asm
│ │ │ │ ├── kernel32base.asm
│ │ │ │ ├── ntdllbase.asm
│ │ │ │ ├── peb.asm
│ │ │ │ ├── teb.asm
│ │ │ │ └── winexec.asm
│ │ │ └── xor.asm
│ │ ├── arm/
│ │ │ ├── __doc__
│ │ │ ├── crash.asm
│ │ │ ├── freebsd/
│ │ │ │ ├── __doc__
│ │ │ │ └── syscall.asm
│ │ │ ├── infloop.asm
│ │ │ ├── itoa.asm
│ │ │ ├── linux/
│ │ │ │ ├── __doc__
│ │ │ │ ├── cacheflush.asm
│ │ │ │ ├── cat.asm
│ │ │ │ ├── cat2.asm
│ │ │ │ ├── connect.asm
│ │ │ │ ├── dir.asm
│ │ │ │ ├── dupio.asm
│ │ │ │ ├── dupsh.asm
│ │ │ │ ├── echo.asm
│ │ │ │ ├── egghunter.asm
│ │ │ │ ├── forkbomb.asm
│ │ │ │ ├── forkexit.asm
│ │ │ │ ├── killparent.asm
│ │ │ │ ├── open_file.asm
│ │ │ │ ├── setresuid.asm
│ │ │ │ ├── sh.asm
│ │ │ │ └── syscall.asm
│ │ │ ├── memcpy.asm
│ │ │ ├── mov.asm
│ │ │ ├── nop.asm
│ │ │ ├── push.asm
│ │ │ ├── pushstr.asm
│ │ │ ├── pushstr_array.asm
│ │ │ ├── ret.asm
│ │ │ ├── setregs.asm
│ │ │ ├── to_thumb.asm
│ │ │ ├── trap.asm
│ │ │ ├── udiv_10.asm
│ │ │ └── xor.asm
│ │ ├── common/
│ │ │ ├── __doc__
│ │ │ ├── freebsd/
│ │ │ │ └── __doc__
│ │ │ ├── label.asm
│ │ │ └── linux/
│ │ │ ├── __doc__
│ │ │ ├── kill.asm
│ │ │ ├── sleep.asm
│ │ │ └── syscalls/
│ │ │ ├── __doc__
│ │ │ ├── _llseek.asm
│ │ │ ├── _newselect.asm
│ │ │ ├── _sysctl.asm
│ │ │ ├── accept.asm
│ │ │ ├── accept4.asm
│ │ │ ├── access.asm
│ │ │ ├── acct.asm
│ │ │ ├── add_key.asm
│ │ │ ├── adjtimex.asm
│ │ │ ├── afs_syscall.asm
│ │ │ ├── alarm.asm
│ │ │ ├── arch_prctl.asm
│ │ │ ├── arch_specific_syscall.asm
│ │ │ ├── arm_fadvise64_64.asm
│ │ │ ├── arm_sync_file_range.asm
│ │ │ ├── bdflush.asm
│ │ │ ├── bind.asm
│ │ │ ├── bpf.asm
│ │ │ ├── break_.asm
│ │ │ ├── brk.asm
│ │ │ ├── cachectl.asm
│ │ │ ├── cacheflush.asm
│ │ │ ├── capget.asm
│ │ │ ├── capset.asm
│ │ │ ├── chdir.asm
│ │ │ ├── chmod.asm
│ │ │ ├── chown.asm
│ │ │ ├── chown32.asm
│ │ │ ├── chroot.asm
│ │ │ ├── clock_adjtime.asm
│ │ │ ├── clock_adjtime64.asm
│ │ │ ├── clock_getres.asm
│ │ │ ├── clock_getres_time64.asm
│ │ │ ├── clock_gettime.asm
│ │ │ ├── clock_gettime64.asm
│ │ │ ├── clock_nanosleep.asm
│ │ │ ├── clock_nanosleep_time64.asm
│ │ │ ├── clock_settime.asm
│ │ │ ├── clock_settime64.asm
│ │ │ ├── clone.asm
│ │ │ ├── clone3.asm
│ │ │ ├── close.asm
│ │ │ ├── close_range.asm
│ │ │ ├── connect.asm
│ │ │ ├── copy_file_range.asm
│ │ │ ├── creat.asm
│ │ │ ├── create_module.asm
│ │ │ ├── delete_module.asm
│ │ │ ├── dup.asm
│ │ │ ├── dup2.asm
│ │ │ ├── dup3.asm
│ │ │ ├── epoll_create.asm
│ │ │ ├── epoll_create1.asm
│ │ │ ├── epoll_ctl.asm
│ │ │ ├── epoll_ctl_old.asm
│ │ │ ├── epoll_pwait.asm
│ │ │ ├── epoll_pwait2.asm
│ │ │ ├── epoll_wait.asm
│ │ │ ├── epoll_wait_old.asm
│ │ │ ├── eventfd.asm
│ │ │ ├── eventfd2.asm
│ │ │ ├── execve.asm
│ │ │ ├── execveat.asm
│ │ │ ├── exit.asm
│ │ │ ├── exit_group.asm
│ │ │ ├── faccessat.asm
│ │ │ ├── faccessat2.asm
│ │ │ ├── fadvise64.asm
│ │ │ ├── fadvise64_64.asm
│ │ │ ├── fallocate.asm
│ │ │ ├── fanotify_init.asm
│ │ │ ├── fanotify_mark.asm
│ │ │ ├── fchdir.asm
│ │ │ ├── fchmod.asm
│ │ │ ├── fchmodat.asm
│ │ │ ├── fchown.asm
│ │ │ ├── fchown32.asm
│ │ │ ├── fchownat.asm
│ │ │ ├── fcntl.asm
│ │ │ ├── fcntl64.asm
│ │ │ ├── fdatasync.asm
│ │ │ ├── fgetxattr.asm
│ │ │ ├── finit_module.asm
│ │ │ ├── flistxattr.asm
│ │ │ ├── flock.asm
│ │ │ ├── fork.asm
│ │ │ ├── fremovexattr.asm
│ │ │ ├── fsconfig.asm
│ │ │ ├── fsetxattr.asm
│ │ │ ├── fsmount.asm
│ │ │ ├── fsopen.asm
│ │ │ ├── fspick.asm
│ │ │ ├── fstat.asm
│ │ │ ├── fstat64.asm
│ │ │ ├── fstatat.asm
│ │ │ ├── fstatat64.asm
│ │ │ ├── fstatfs.asm
│ │ │ ├── fstatfs64.asm
│ │ │ ├── fsync.asm
│ │ │ ├── ftime.asm
│ │ │ ├── ftruncate.asm
│ │ │ ├── ftruncate64.asm
│ │ │ ├── futex.asm
│ │ │ ├── futex_time64.asm
│ │ │ ├── futimesat.asm
│ │ │ ├── get_kernel_syms.asm
│ │ │ ├── get_mempolicy.asm
│ │ │ ├── get_robust_list.asm
│ │ │ ├── get_thread_area.asm
│ │ │ ├── getcpu.asm
│ │ │ ├── getcwd.asm
│ │ │ ├── getdents.asm
│ │ │ ├── getdents64.asm
│ │ │ ├── getegid.asm
│ │ │ ├── getegid32.asm
│ │ │ ├── geteuid.asm
│ │ │ ├── geteuid32.asm
│ │ │ ├── getgid.asm
│ │ │ ├── getgid32.asm
│ │ │ ├── getgroups.asm
│ │ │ ├── getgroups32.asm
│ │ │ ├── getitimer.asm
│ │ │ ├── getpeername.asm
│ │ │ ├── getpgid.asm
│ │ │ ├── getpgrp.asm
│ │ │ ├── getpid.asm
│ │ │ ├── getpmsg.asm
│ │ │ ├── getppid.asm
│ │ │ ├── getpriority.asm
│ │ │ ├── getrandom.asm
│ │ │ ├── getresgid.asm
│ │ │ ├── getresgid32.asm
│ │ │ ├── getresuid.asm
│ │ │ ├── getresuid32.asm
│ │ │ ├── getrlimit.asm
│ │ │ ├── getrusage.asm
│ │ │ ├── getsid.asm
│ │ │ ├── getsockname.asm
│ │ │ ├── getsockopt.asm
│ │ │ ├── gettid.asm
│ │ │ ├── gettimeofday.asm
│ │ │ ├── getuid.asm
│ │ │ ├── getuid32.asm
│ │ │ ├── getxattr.asm
│ │ │ ├── gtty.asm
│ │ │ ├── ia32_arch_prctl.asm
│ │ │ ├── ia32_io_pgetevents.asm
│ │ │ ├── ia32_rseq.asm
│ │ │ ├── ia32_statx.asm
│ │ │ ├── idle.asm
│ │ │ ├── init_module.asm
│ │ │ ├── inotify_add_watch.asm
│ │ │ ├── inotify_init.asm
│ │ │ ├── inotify_init1.asm
│ │ │ ├── inotify_rm_watch.asm
│ │ │ ├── io_cancel.asm
│ │ │ ├── io_destroy.asm
│ │ │ ├── io_getevents.asm
│ │ │ ├── io_pgetevents.asm
│ │ │ ├── io_pgetevents_time64.asm
│ │ │ ├── io_setup.asm
│ │ │ ├── io_submit.asm
│ │ │ ├── io_uring_enter.asm
│ │ │ ├── io_uring_register.asm
│ │ │ ├── io_uring_setup.asm
│ │ │ ├── ioctl.asm
│ │ │ ├── ioperm.asm
│ │ │ ├── iopl.asm
│ │ │ ├── ioprio_get.asm
│ │ │ ├── ioprio_set.asm
│ │ │ ├── ipc.asm
│ │ │ ├── kcmp.asm
│ │ │ ├── kexec_file_load.asm
│ │ │ ├── kexec_load.asm
│ │ │ ├── keyctl.asm
│ │ │ ├── kill.asm
│ │ │ ├── landlock_add_rule.asm
│ │ │ ├── landlock_create_ruleset.asm
│ │ │ ├── landlock_restrict_self.asm
│ │ │ ├── lchown.asm
│ │ │ ├── lchown32.asm
│ │ │ ├── lgetxattr.asm
│ │ │ ├── link.asm
│ │ │ ├── linkat.asm
│ │ │ ├── listen.asm
│ │ │ ├── listxattr.asm
│ │ │ ├── llistxattr.asm
│ │ │ ├── lock.asm
│ │ │ ├── lookup_dcookie.asm
│ │ │ ├── lremovexattr.asm
│ │ │ ├── lseek.asm
│ │ │ ├── lsetxattr.asm
│ │ │ ├── lstat.asm
│ │ │ ├── lstat64.asm
│ │ │ ├── madvise.asm
│ │ │ ├── madvise1.asm
│ │ │ ├── mbind.asm
│ │ │ ├── membarrier.asm
│ │ │ ├── memfd_create.asm
│ │ │ ├── migrate_pages.asm
│ │ │ ├── mincore.asm
│ │ │ ├── mkdir.asm
│ │ │ ├── mkdirat.asm
│ │ │ ├── mknod.asm
│ │ │ ├── mknodat.asm
│ │ │ ├── mlock.asm
│ │ │ ├── mlock2.asm
│ │ │ ├── mlockall.asm
│ │ │ ├── mmap.asm
│ │ │ ├── mmap2.asm
│ │ │ ├── modify_ldt.asm
│ │ │ ├── mount.asm
│ │ │ ├── mount_setattr.asm
│ │ │ ├── move_mount.asm
│ │ │ ├── move_pages.asm
│ │ │ ├── mprotect.asm
│ │ │ ├── mpx.asm
│ │ │ ├── mq_getsetattr.asm
│ │ │ ├── mq_notify.asm
│ │ │ ├── mq_open.asm
│ │ │ ├── mq_timedreceive.asm
│ │ │ ├── mq_timedreceive_time64.asm
│ │ │ ├── mq_timedsend.asm
│ │ │ ├── mq_timedsend_time64.asm
│ │ │ ├── mq_unlink.asm
│ │ │ ├── mremap.asm
│ │ │ ├── msgctl.asm
│ │ │ ├── msgget.asm
│ │ │ ├── msgrcv.asm
│ │ │ ├── msgsnd.asm
│ │ │ ├── msync.asm
│ │ │ ├── multiplexer.asm
│ │ │ ├── munlock.asm
│ │ │ ├── munlockall.asm
│ │ │ ├── munmap.asm
│ │ │ ├── name_to_handle_at.asm
│ │ │ ├── nanosleep.asm
│ │ │ ├── newfstatat.asm
│ │ │ ├── nfsservctl.asm
│ │ │ ├── nice.asm
│ │ │ ├── oldfstat.asm
│ │ │ ├── oldlstat.asm
│ │ │ ├── oldolduname.asm
│ │ │ ├── oldstat.asm
│ │ │ ├── olduname.asm
│ │ │ ├── open.asm
│ │ │ ├── open_by_handle_at.asm
│ │ │ ├── open_tree.asm
│ │ │ ├── openat.asm
│ │ │ ├── openat2.asm
│ │ │ ├── pause.asm
│ │ │ ├── pciconfig_iobase.asm
│ │ │ ├── pciconfig_read.asm
│ │ │ ├── pciconfig_write.asm
│ │ │ ├── perf_event_open.asm
│ │ │ ├── personality.asm
│ │ │ ├── pidfd_getfd.asm
│ │ │ ├── pidfd_open.asm
│ │ │ ├── pidfd_send_signal.asm
│ │ │ ├── pipe.asm
│ │ │ ├── pipe2.asm
│ │ │ ├── pivot_root.asm
│ │ │ ├── pkey_alloc.asm
│ │ │ ├── pkey_free.asm
│ │ │ ├── pkey_mprotect.asm
│ │ │ ├── poll.asm
│ │ │ ├── ppoll.asm
│ │ │ ├── ppoll_time64.asm
│ │ │ ├── prctl.asm
│ │ │ ├── pread.asm
│ │ │ ├── pread64.asm
│ │ │ ├── preadv.asm
│ │ │ ├── preadv2.asm
│ │ │ ├── prlimit64.asm
│ │ │ ├── process_madvise.asm
│ │ │ ├── process_vm_readv.asm
│ │ │ ├── process_vm_writev.asm
│ │ │ ├── prof.asm
│ │ │ ├── profil.asm
│ │ │ ├── pselect6.asm
│ │ │ ├── pselect6_time64.asm
│ │ │ ├── ptrace.asm
│ │ │ ├── putpmsg.asm
│ │ │ ├── pwrite.asm
│ │ │ ├── pwrite64.asm
│ │ │ ├── pwritev.asm
│ │ │ ├── pwritev2.asm
│ │ │ ├── query_module.asm
│ │ │ ├── quotactl.asm
│ │ │ ├── read.asm
│ │ │ ├── readahead.asm
│ │ │ ├── readdir.asm
│ │ │ ├── readlink.asm
│ │ │ ├── readlinkat.asm
│ │ │ ├── readv.asm
│ │ │ ├── reboot.asm
│ │ │ ├── recv.asm
│ │ │ ├── recvfrom.asm
│ │ │ ├── recvmmsg.asm
│ │ │ ├── recvmmsg_time64.asm
│ │ │ ├── recvmsg.asm
│ │ │ ├── remap_file_pages.asm
│ │ │ ├── removexattr.asm
│ │ │ ├── rename.asm
│ │ │ ├── renameat.asm
│ │ │ ├── renameat2.asm
│ │ │ ├── request_key.asm
│ │ │ ├── reserved221.asm
│ │ │ ├── reserved82.asm
│ │ │ ├── restart_syscall.asm
│ │ │ ├── riscv_flush_icache.asm
│ │ │ ├── rmdir.asm
│ │ │ ├── rseq.asm
│ │ │ ├── rtas.asm
│ │ │ ├── sched_get_priority_max.asm
│ │ │ ├── sched_get_priority_min.asm
│ │ │ ├── sched_getaffinity.asm
│ │ │ ├── sched_getattr.asm
│ │ │ ├── sched_getparam.asm
│ │ │ ├── sched_getscheduler.asm
│ │ │ ├── sched_rr_get_interval.asm
│ │ │ ├── sched_rr_get_interval_time64.asm
│ │ │ ├── sched_setaffinity.asm
│ │ │ ├── sched_setattr.asm
│ │ │ ├── sched_setparam.asm
│ │ │ ├── sched_setscheduler.asm
│ │ │ ├── sched_yield.asm
│ │ │ ├── seccomp.asm
│ │ │ ├── security.asm
│ │ │ ├── select.asm
│ │ │ ├── semctl.asm
│ │ │ ├── semget.asm
│ │ │ ├── semop.asm
│ │ │ ├── semtimedop.asm
│ │ │ ├── semtimedop_time64.asm
│ │ │ ├── send.asm
│ │ │ ├── sendfile.asm
│ │ │ ├── sendfile64.asm
│ │ │ ├── sendmmsg.asm
│ │ │ ├── sendmsg.asm
│ │ │ ├── sendto.asm
│ │ │ ├── set_mempolicy.asm
│ │ │ ├── set_robust_list.asm
│ │ │ ├── set_thread_area.asm
│ │ │ ├── set_tid_address.asm
│ │ │ ├── setdomainname.asm
│ │ │ ├── setfsgid.asm
│ │ │ ├── setfsgid32.asm
│ │ │ ├── setfsuid.asm
│ │ │ ├── setfsuid32.asm
│ │ │ ├── setgid.asm
│ │ │ ├── setgid32.asm
│ │ │ ├── setgroups.asm
│ │ │ ├── setgroups32.asm
│ │ │ ├── sethostname.asm
│ │ │ ├── setitimer.asm
│ │ │ ├── setns.asm
│ │ │ ├── setpgid.asm
│ │ │ ├── setpriority.asm
│ │ │ ├── setregid.asm
│ │ │ ├── setregid32.asm
│ │ │ ├── setresgid.asm
│ │ │ ├── setresgid32.asm
│ │ │ ├── setresuid.asm
│ │ │ ├── setresuid32.asm
│ │ │ ├── setreuid.asm
│ │ │ ├── setreuid32.asm
│ │ │ ├── setrlimit.asm
│ │ │ ├── setsid.asm
│ │ │ ├── setsockopt.asm
│ │ │ ├── settimeofday.asm
│ │ │ ├── setuid.asm
│ │ │ ├── setuid32.asm
│ │ │ ├── setxattr.asm
│ │ │ ├── sgetmask.asm
│ │ │ ├── shmat.asm
│ │ │ ├── shmctl.asm
│ │ │ ├── shmdt.asm
│ │ │ ├── shmget.asm
│ │ │ ├── shutdown.asm
│ │ │ ├── sigaction.asm
│ │ │ ├── sigaltstack.asm
│ │ │ ├── signal.asm
│ │ │ ├── signalfd.asm
│ │ │ ├── signalfd4.asm
│ │ │ ├── sigpending.asm
│ │ │ ├── sigprocmask.asm
│ │ │ ├── sigqueueinfo.asm
│ │ │ ├── sigreturn.asm
│ │ │ ├── sigsuspend.asm
│ │ │ ├── sigtimedwait.asm
│ │ │ ├── sigtimedwait_time64.asm
│ │ │ ├── socket.asm
│ │ │ ├── socketcall.asm
│ │ │ ├── socketcall_accept.asm
│ │ │ ├── socketcall_bind.asm
│ │ │ ├── socketcall_connect.asm
│ │ │ ├── socketcall_getpeername.asm
│ │ │ ├── socketcall_getsockname.asm
│ │ │ ├── socketcall_getsockopt.asm
│ │ │ ├── socketcall_listen.asm
│ │ │ ├── socketcall_recv.asm
│ │ │ ├── socketcall_recvfrom.asm
│ │ │ ├── socketcall_recvmsg.asm
│ │ │ ├── socketcall_send.asm
│ │ │ ├── socketcall_sendmsg.asm
│ │ │ ├── socketcall_sendto.asm
│ │ │ ├── socketcall_setsockopt.asm
│ │ │ ├── socketcall_shutdown.asm
│ │ │ ├── socketcall_socket.asm
│ │ │ ├── socketcall_socketpair.asm
│ │ │ ├── socketpair.asm
│ │ │ ├── splice.asm
│ │ │ ├── spu_create.asm
│ │ │ ├── spu_run.asm
│ │ │ ├── ssetmask.asm
│ │ │ ├── stat.asm
│ │ │ ├── stat64.asm
│ │ │ ├── statfs.asm
│ │ │ ├── statfs64.asm
│ │ │ ├── statx.asm
│ │ │ ├── stime.asm
│ │ │ ├── stty.asm
│ │ │ ├── subpage_prot.asm
│ │ │ ├── swapcontext.asm
│ │ │ ├── swapoff.asm
│ │ │ ├── swapon.asm
│ │ │ ├── switch_endian.asm
│ │ │ ├── symlink.asm
│ │ │ ├── symlinkat.asm
│ │ │ ├── sync.asm
│ │ │ ├── sync_file_range.asm
│ │ │ ├── sync_file_range2.asm
│ │ │ ├── syncfs.asm
│ │ │ ├── sys_kexec_load.asm
│ │ │ ├── syscall.asm
│ │ │ ├── sysfs.asm
│ │ │ ├── sysinfo.asm
│ │ │ ├── syslog.asm
│ │ │ ├── sysmips.asm
│ │ │ ├── sysriscv.asm
│ │ │ ├── tee.asm
│ │ │ ├── tgkill.asm
│ │ │ ├── tgsigqueueinfo.asm
│ │ │ ├── time.asm
│ │ │ ├── timer_create.asm
│ │ │ ├── timer_delete.asm
│ │ │ ├── timer_getoverrun.asm
│ │ │ ├── timer_gettime.asm
│ │ │ ├── timer_gettime64.asm
│ │ │ ├── timer_settime.asm
│ │ │ ├── timer_settime64.asm
│ │ │ ├── timerfd.asm
│ │ │ ├── timerfd_create.asm
│ │ │ ├── timerfd_gettime.asm
│ │ │ ├── timerfd_gettime64.asm
│ │ │ ├── timerfd_settime.asm
│ │ │ ├── timerfd_settime64.asm
│ │ │ ├── times.asm
│ │ │ ├── tkill.asm
│ │ │ ├── truncate.asm
│ │ │ ├── truncate64.asm
│ │ │ ├── tuxcall.asm
│ │ │ ├── ugetrlimit.asm
│ │ │ ├── ulimit.asm
│ │ │ ├── umask.asm
│ │ │ ├── umount.asm
│ │ │ ├── umount2.asm
│ │ │ ├── uname.asm
│ │ │ ├── unlink.asm
│ │ │ ├── unlinkat.asm
│ │ │ ├── unshare.asm
│ │ │ ├── uselib.asm
│ │ │ ├── userfaultfd.asm
│ │ │ ├── ustat.asm
│ │ │ ├── utime.asm
│ │ │ ├── utimensat.asm
│ │ │ ├── utimensat_time64.asm
│ │ │ ├── utimes.asm
│ │ │ ├── vfork.asm
│ │ │ ├── vhangup.asm
│ │ │ ├── vm86.asm
│ │ │ ├── vm86old.asm
│ │ │ ├── vmsplice.asm
│ │ │ ├── vserver.asm
│ │ │ ├── wait4.asm
│ │ │ ├── waitid.asm
│ │ │ ├── waitpid.asm
│ │ │ ├── write.asm
│ │ │ └── writev.asm
│ │ ├── i386/
│ │ │ ├── __doc__
│ │ │ ├── breakpoint.asm
│ │ │ ├── cgc/
│ │ │ │ ├── __doc__
│ │ │ │ ├── allocate.asm
│ │ │ │ ├── cat.asm
│ │ │ │ ├── deallocate.asm
│ │ │ │ ├── fdwait.asm
│ │ │ │ ├── random.asm
│ │ │ │ ├── receive.asm
│ │ │ │ ├── sendfile.asm
│ │ │ │ ├── syscall.asm
│ │ │ │ ├── terminate.asm
│ │ │ │ └── transmit.asm
│ │ │ ├── crash.asm
│ │ │ ├── epilog.asm
│ │ │ ├── freebsd/
│ │ │ │ ├── __doc__
│ │ │ │ ├── acceptloop_ipv4.asm
│ │ │ │ ├── i386_to_amd64.asm
│ │ │ │ ├── sh.asm
│ │ │ │ └── syscall.asm
│ │ │ ├── function.asm
│ │ │ ├── getpc.asm
│ │ │ ├── infloop.asm
│ │ │ ├── itoa.asm
│ │ │ ├── linux/
│ │ │ │ ├── __doc__
│ │ │ │ ├── acceptloop_ipv4.asm
│ │ │ │ ├── cat.asm
│ │ │ │ ├── cat2.asm
│ │ │ │ ├── connect.asm
│ │ │ │ ├── connectstager.asm
│ │ │ │ ├── dir.asm
│ │ │ │ ├── dupio.asm
│ │ │ │ ├── dupsh.asm
│ │ │ │ ├── echo.asm
│ │ │ │ ├── egghunter.asm
│ │ │ │ ├── findpeer.asm
│ │ │ │ ├── findpeersh.asm
│ │ │ │ ├── findpeerstager.asm
│ │ │ │ ├── forkbomb.asm
│ │ │ │ ├── forkexit.asm
│ │ │ │ ├── i386_to_amd64.asm
│ │ │ │ ├── killparent.asm
│ │ │ │ ├── loader.asm
│ │ │ │ ├── loader_append.asm
│ │ │ │ ├── mprotect_all.asm
│ │ │ │ ├── pidmax.asm
│ │ │ │ ├── readfile.asm
│ │ │ │ ├── readn.asm
│ │ │ │ ├── recvsize.asm
│ │ │ │ ├── setregid.asm
│ │ │ │ ├── setresuid.asm
│ │ │ │ ├── setreuid.asm
│ │ │ │ ├── sh.asm
│ │ │ │ ├── socket.asm
│ │ │ │ ├── socketcall.asm
│ │ │ │ ├── stage.asm
│ │ │ │ ├── stager.asm
│ │ │ │ └── syscall.asm
│ │ │ ├── memcpy.asm
│ │ │ ├── mov.asm
│ │ │ ├── nop.asm
│ │ │ ├── prolog.asm
│ │ │ ├── push.asm
│ │ │ ├── pushstr.asm
│ │ │ ├── pushstr_array.asm
│ │ │ ├── ret.asm
│ │ │ ├── setregs.asm
│ │ │ ├── stackarg.asm
│ │ │ ├── stackhunter.asm
│ │ │ ├── stackhunter_helper.asm
│ │ │ ├── strcpy.asm
│ │ │ ├── strlen.asm
│ │ │ ├── trap.asm
│ │ │ └── xor.asm
│ │ ├── loongarch64/
│ │ │ ├── __doc__
│ │ │ ├── linux/
│ │ │ │ ├── __doc__
│ │ │ │ └── syscall.asm
│ │ │ ├── mov.asm
│ │ │ ├── nop.asm
│ │ │ ├── push.asm
│ │ │ ├── pushstr.asm
│ │ │ ├── pushstr_array.asm
│ │ │ ├── setregs.asm
│ │ │ ├── trap.asm
│ │ │ └── xor.asm
│ │ ├── mips/
│ │ │ ├── __doc__
│ │ │ ├── freebsd/
│ │ │ │ ├── __doc__
│ │ │ │ └── syscall.asm
│ │ │ ├── linux/
│ │ │ │ ├── __doc__
│ │ │ │ ├── bindsh.asm
│ │ │ │ ├── cat.asm
│ │ │ │ ├── cat2.asm
│ │ │ │ ├── connect.asm
│ │ │ │ ├── dupio.asm
│ │ │ │ ├── dupsh.asm
│ │ │ │ ├── echo.asm
│ │ │ │ ├── findpeer.asm
│ │ │ │ ├── findpeersh.asm
│ │ │ │ ├── forkbomb.asm
│ │ │ │ ├── forkexit.asm
│ │ │ │ ├── killparent.asm
│ │ │ │ ├── listen.asm
│ │ │ │ ├── readfile.asm
│ │ │ │ ├── setresuid.asm
│ │ │ │ ├── sh.asm
│ │ │ │ ├── stager.asm
│ │ │ │ └── syscall.asm
│ │ │ ├── mov.asm
│ │ │ ├── nop.asm
│ │ │ ├── push.asm
│ │ │ ├── pushstr.asm
│ │ │ ├── pushstr_array.asm
│ │ │ ├── setregs.asm
│ │ │ └── trap.asm
│ │ ├── powerpc/
│ │ │ ├── __doc__
│ │ │ └── linux/
│ │ │ └── __doc__
│ │ ├── riscv64/
│ │ │ ├── __doc__
│ │ │ ├── linux/
│ │ │ │ ├── __doc__
│ │ │ │ ├── cat2.asm
│ │ │ │ ├── open.asm
│ │ │ │ └── syscall.asm
│ │ │ ├── mov.asm
│ │ │ ├── nop.asm
│ │ │ ├── push.asm
│ │ │ ├── pushstr.asm
│ │ │ ├── pushstr_array.asm
│ │ │ ├── setregs.asm
│ │ │ ├── trap.asm
│ │ │ └── xor.asm
│ │ └── thumb/
│ │ ├── __doc__
│ │ ├── crash.asm
│ │ ├── freebsd/
│ │ │ ├── __doc__
│ │ │ └── syscall.asm
│ │ ├── infloop.asm
│ │ ├── itoa.asm
│ │ ├── linux/
│ │ │ ├── __doc__
│ │ │ ├── bindsh.asm
│ │ │ ├── cat.asm
│ │ │ ├── cat2.asm
│ │ │ ├── connect.asm
│ │ │ ├── connectstager.asm
│ │ │ ├── dupio.asm
│ │ │ ├── dupsh.asm
│ │ │ ├── echo.asm
│ │ │ ├── findpeer.asm
│ │ │ ├── findpeersh.asm
│ │ │ ├── findpeerstager.asm
│ │ │ ├── forkbomb.asm
│ │ │ ├── forkexit.asm
│ │ │ ├── killparent.asm
│ │ │ ├── listen.asm
│ │ │ ├── loader.asm
│ │ │ ├── loader_append.asm
│ │ │ ├── readfile.asm
│ │ │ ├── readn.asm
│ │ │ ├── recvsize.asm
│ │ │ ├── setresuid.asm
│ │ │ ├── sh.asm
│ │ │ ├── stage.asm
│ │ │ ├── stager.asm
│ │ │ └── syscall.asm
│ │ ├── memcpy.asm
│ │ ├── mov.asm
│ │ ├── nop.asm
│ │ ├── popad.asm
│ │ ├── push.asm
│ │ ├── pushad.asm
│ │ ├── pushstr.asm
│ │ ├── pushstr_array.asm
│ │ ├── ret.asm
│ │ ├── setregs.asm
│ │ ├── to_arm.asm
│ │ ├── trap.asm
│ │ └── udiv_10.asm
│ ├── term/
│ │ ├── __init__.py
│ │ ├── completer.py
│ │ ├── key.py
│ │ ├── keyconsts.py
│ │ ├── keymap.py
│ │ ├── readline.py
│ │ ├── spinners.py
│ │ ├── term.py
│ │ ├── termcap.py
│ │ ├── text.py
│ │ ├── unix_termcap.py
│ │ └── windows_termcap.py
│ ├── testexample.py
│ ├── timeout.py
│ ├── tubes/
│ │ ├── __init__.py
│ │ ├── buffer.py
│ │ ├── listen.py
│ │ ├── process.py
│ │ ├── remote.py
│ │ ├── serialtube.py
│ │ ├── server.py
│ │ ├── sock.py
│ │ ├── ssh.py
│ │ └── tube.py
│ ├── ui.py
│ ├── update.py
│ ├── useragents.py
│ ├── util/
│ │ ├── __init__.py
│ │ ├── crc/
│ │ │ ├── __init__.py
│ │ │ └── known.py
│ │ ├── cyclic.py
│ │ ├── fiddling.py
│ │ ├── getdents.py
│ │ ├── hashes.py
│ │ ├── iters.py
│ │ ├── lists.py
│ │ ├── misc.py
│ │ ├── net.py
│ │ ├── packing.py
│ │ ├── proc.py
│ │ ├── safeeval.py
│ │ ├── sh_string.py
│ │ ├── splash.py
│ │ └── web.py
│ ├── version.py
│ └── windbg.py
├── pyproject.toml
├── setup.py
└── travis/
├── coverage_chdir.py
├── docker/
│ ├── .gitignore
│ ├── 10-import.py
│ ├── Dockerfile
│ ├── Dockerfile.travis
│ ├── Makefile
│ ├── README.md
│ ├── doctest3
│ ├── ipython_config.py
│ ├── run.sh
│ └── tmux.sh
├── install.sh
├── libcdb_nginx_cache.conf
├── setup_avd.sh
├── setup_avd_fast.sh
└── ssh_setup.sh
SYMBOL INDEX (2326 symbols across 172 files)
FILE: docs/source/conf.py
class SphinxPwnlibFilter (line 50) | class SphinxPwnlibFilter(logging.Filter):
method filter (line 51) | def filter(self, record):
function linkcode_resolve (line 335) | def linkcode_resolve(domain, info):
function dont_skip_any_doctests (line 389) | def dont_skip_any_doctests(app, what, name, obj, skip, options):
class PlatformDocTestRunner (line 405) | class PlatformDocTestRunner(sphinx.ext.doctest.SphinxDocTestRunner):
method run (line 406) | def run(self, test, compileflags=None, out=None, clear_globs=True):
class PlatformDocTestBuilder (line 429) | class PlatformDocTestBuilder(sphinx.ext.doctest.DocTestBuilder):
method __init__ (line 431) | def __init__(self, *args, **kwargs):
method test_runner (line 437) | def test_runner(self):
method test_runner (line 441) | def test_runner(self, value):
method test_doc (line 444) | def test_doc(self, docname, doctree):
method test_group (line 458) | def test_group(self, group):
function setup (line 464) | def setup(app):
class EndlessLoop (line 473) | class EndlessLoop(Exception): pass
function alrm_handler (line 475) | def alrm_handler(sig, frame):
function sigabrt_handler (line 481) | def sigabrt_handler(signum, frame):
function alrm_handler (line 486) | def alrm_handler():
FILE: examples/clean_and_log.py
function submit_data (line 16) | def submit_data():
FILE: examples/fmtstr/exploit.py
function exec_fmt (line 5) | def exec_fmt(payload):
function exploit (line 10) | def exploit(binary):
FILE: examples/fmtstr/exploit2.py
function exploit (line 8) | def exploit(e):
FILE: examples/fmtstr/printf-loop.c
function main (line 4) | int main() {
FILE: examples/fmtstr/printf.c
function main (line 11) | int main(int argc, char const *argv[])
FILE: examples/gdb_api.py
function check_write (line 6) | def check_write(gdb, exp_buf):
function demo_sync_breakpoint (line 16) | def demo_sync_breakpoint(cat, gdb, txt):
function demo_async_breakpoint (line 40) | def demo_async_breakpoint(cat, gdb, txt):
function main (line 75) | def main():
FILE: examples/gen-README.py
function append_example (line 20) | def append_example(_arg, top, names):
FILE: extra/docker/develop/ipython_config.py
class ClassicPrompts (line 45) | class ClassicPrompts(Prompts):
method in_prompt_tokens (line 46) | def in_prompt_tokens(self, cli=None):
method continuation_prompt_tokens (line 51) | def continuation_prompt_tokens(self, cli=None, width=None):
method rewrite_prompt_tokens (line 56) | def rewrite_prompt_tokens(self):
method out_prompt_tokens (line 59) | def out_prompt_tokens(self):
FILE: pwnlib/abi.py
class ABI (line 5) | class ABI(object):
method __init__ (line 26) | def __init__(self, stack, arg_regs, align, minimum):
method default (line 34) | def default():
method syscall (line 66) | def syscall():
method sigreturn (line 98) | def sigreturn():
class SyscallABI (line 121) | class SyscallABI(ABI):
method __init__ (line 126) | def __init__(self, *a, **kw):
class SigreturnABI (line 131) | class SigreturnABI(SyscallABI):
FILE: pwnlib/adb/adb.py
function adb (line 74) | def adb(argv, *a, **kw):
function devices (line 97) | def devices(serial=None):
function current_device (line 114) | def current_device(any=False):
function with_device (line 132) | def with_device(f):
function root (line 147) | def root():
function no_emulator (line 171) | def no_emulator(f):
function reboot (line 182) | def reboot(wait=True):
function reboot_bootloader (line 195) | def reboot_bootloader():
function uptime (line 204) | def uptime():
function boot_time (line 222) | def boot_time():
class AdbDevice (line 243) | class AdbDevice(Device):
method __init__ (line 263) | def __init__(self, serial, type, port=None, product='unknown', model='...
method arch (line 283) | def arch(self):
method avd (line 288) | def avd(self):
method bits (line 293) | def bits(self):
method endian (line 298) | def endian(self):
method __do_deferred_initialization (line 303) | def __do_deferred_initialization(self):
method __str__ (line 329) | def __str__(self):
method __repr__ (line 332) | def __repr__(self):
method from_adb_output (line 338) | def from_adb_output(line):
method __wrapped (line 365) | def __wrapped(self, function):
method __getattr__ (line 373) | def __getattr__(self, name):
function wait_for_device (line 401) | def wait_for_device(kick=False):
function disable_verity (line 453) | def disable_verity():
function remount (line 471) | def remount():
function unroot (line 484) | def unroot():
function _create_adb_push_pull_callback (line 497) | def _create_adb_push_pull_callback(w):
function pull (line 512) | def pull(remote_path, local_path=None):
function push (line 547) | def push(local_path, remote_path):
function read (line 607) | def read(path, target=None, callback=None):
function write (line 642) | def write(path, data=b''):
function mkdir (line 663) | def mkdir(path):
function makedirs (line 709) | def makedirs(path):
function exists (line 731) | def exists(path):
function isdir (line 751) | def isdir(path):
function unlink (line 772) | def unlink(path, recursive=False):
function process (line 821) | def process(argv, *a, **kw):
function interactive (line 850) | def interactive(**kw):
function shell (line 855) | def shell(**kw):
function which (line 860) | def which(name, all = False, *a, **kw):
function whoami (line 922) | def whoami():
function forward (line 936) | def forward(port):
function logcat (line 944) | def logcat(stream=False):
function pidof (line 964) | def pidof(name):
function proc_exe (line 979) | def proc_exe(pid):
function getprop (line 996) | def getprop(name=None):
function setprop (line 1040) | def setprop(name, value):
function listdir (line 1045) | def listdir(directory='/'):
function fastboot (line 1059) | def fastboot(args, *a, **kw):
function fingerprint (line 1069) | def fingerprint():
function product (line 1074) | def product():
function build (line 1079) | def build():
function unlock_bootloader (line 1085) | def unlock_bootloader():
class Kernel (line 1119) | class Kernel(object):
method address (line 1123) | def address(self):
method symbols (line 1137) | def symbols(self):
method kallsyms (line 1149) | def kallsyms(self):
method version (line 1160) | def version(self):
method cmdline (line 1167) | def cmdline(self):
method lastmsg (line 1173) | def lastmsg(self):
method enable_uart (line 1181) | def enable_uart(self):
class Property (line 1229) | class Property(object):
method __init__ (line 1230) | def __init__(self, name=None):
method __str__ (line 1234) | def __str__(self):
method __getattr__ (line 1237) | def __getattr__(self, attr):
method __setattr__ (line 1244) | def __setattr__(self, attr, value):
method __eq__ (line 1252) | def __eq__(self, other):
method __hash__ (line 1267) | def __hash__(self, other):
function _build_date (line 1273) | def _build_date():
function find_ndk_project_root (line 1279) | def find_ndk_project_root(source):
function _generate_ndk_project (line 1312) | def _generate_ndk_project(file_list, abi='arm-v7a', platform_version=21):
function compile (line 1344) | def compile(source):
class Partition (line 1424) | class Partition(object):
method __init__ (line 1425) | def __init__(self, path, name, blocks=0):
method data (line 1432) | def data(self):
function walk (line 1437) | def walk(top, topdown=True):
function find (line 1460) | def find(top, name):
function readlink (line 1466) | def readlink(path):
class Partitions (line 1476) | class Partitions(object):
method by_name_dir (line 1489) | def by_name_dir(self):
method __dir__ (line 1497) | def __dir__(self):
method iter_proc_partitions (line 1501) | def iter_proc_partitions(self):
method __iter__ (line 1510) | def __iter__(self):
method __getattr__ (line 1521) | def __getattr__(self, attr):
function install (line 1549) | def install(apk, *arguments):
function uninstall (line 1577) | def uninstall(package, *arguments):
function packages (line 1591) | def packages():
function version (line 1600) | def version():
FILE: pwnlib/adb/bootimg.py
class boot_img_hdr (line 10) | class boot_img_hdr(ctypes.Structure):
class BootImage (line 36) | class BootImage(object):
method __init__ (line 37) | def __init__(self, data):
method __getattr__ (line 46) | def __getattr__(self, name):
FILE: pwnlib/adb/bootloader.py
class img_info (line 10) | class img_info(ctypes.Structure):
class bootloader_images_header (line 16) | class bootloader_images_header(ctypes.Structure):
class BootloaderImage (line 26) | class BootloaderImage(object):
method __init__ (line 27) | def __init__(self, data):
method extract (line 53) | def extract(self, index_or_name):
method extract_all (line 84) | def extract_all(self, path):
method __str__ (line 99) | def __str__(self):
method __getattr__ (line 112) | def __getattr__(self, name):
FILE: pwnlib/args.py
class PwnlibArgs (line 60) | class PwnlibArgs(collections.defaultdict):
method __getattr__ (line 61) | def __getattr__(self, attr):
function isident (line 81) | def isident(s):
function asbool (line 96) | def asbool(s):
function LOG_LEVEL (line 109) | def LOG_LEVEL(x):
function LOG_FILE (line 116) | def LOG_FILE(x):
function SILENT (line 121) | def SILENT(x):
function DEBUG (line 126) | def DEBUG(x):
function NOTERM (line 131) | def NOTERM(v):
function TIMEOUT (line 137) | def TIMEOUT(v):
function RANDOMIZE (line 142) | def RANDOMIZE(v):
function NOASLR (line 146) | def NOASLR(v):
function NOPTRACE (line 150) | def NOPTRACE(v):
function STDERR (line 155) | def STDERR(v):
function LOCAL_LIBCDB (line 159) | def LOCAL_LIBCDB(v):
function initialize (line 178) | def initialize():
FILE: pwnlib/asm.py
function dpkg_search_for_binutils (line 69) | def dpkg_search_for_binutils(arch, util):
function print_binutils_instructions (line 102) | def print_binutils_instructions(util, context):
function check_binutils_version (line 139) | def check_binutils_version(util):
function which_binutils (line 154) | def which_binutils(util, check_version=False):
function _assembler (line 258) | def _assembler():
function _linker (line 304) | def _linker():
function _execstack (line 320) | def _execstack(linker):
function _objcopy (line 328) | def _objcopy():
function _objdump (line 331) | def _objdump():
function _include_header (line 339) | def _include_header():
function _arch_header (line 351) | def _arch_header():
function _bfdname (line 377) | def _bfdname():
function _bfdarch (line 412) | def _bfdarch():
function _run (line 432) | def _run(cmd, stdin = None):
function cpp (line 464) | def cpp(shellcode):
function make_elf_from_assembly (line 507) | def make_elf_from_assembly(assembly,
function make_elf (line 596) | def make_elf(data,
function make_macho_from_assembly (line 690) | def make_macho_from_assembly(shellcode):
function make_macho (line 695) | def make_macho(data, is_shellcode=False):
function asm (line 751) | def asm(shellcode, vma = 0, extract = True, shared = False):
function disasm (line 907) | def disasm(data, vma = 0, byte = True, offset = True, instructions = True):
FILE: pwnlib/atexception.py
function register (line 17) | def register(func, *args, **kwargs):
function unregister (line 55) | def unregister(func):
function _run_handlers (line 64) | def _run_handlers():
function _newhook (line 91) | def _newhook(typ, val, tb):
FILE: pwnlib/atexit.py
function register (line 23) | def register(func, *args, **kwargs):
function unregister (line 59) | def unregister(ident):
function _run_handlers (line 68) | def _run_handlers():
FILE: pwnlib/commandline/asm.py
function main (line 97) | def main(args):
FILE: pwnlib/commandline/checksec.py
function main (line 25) | def main(args):
FILE: pwnlib/commandline/common.py
function context_arg (line 13) | def context_arg(arg):
function main (line 28) | def main(file=sys.argv[0], command_main=None):
function deprecated_main (line 36) | def deprecated_main():
function entrypoint (line 43) | def entrypoint(commands):
FILE: pwnlib/commandline/constgrep.py
function main (line 58) | def main(args):
FILE: pwnlib/commandline/cyclic.py
function main (line 59) | def main(args):
FILE: pwnlib/commandline/debug.py
function main (line 51) | def main(args):
FILE: pwnlib/commandline/disablenx.py
function main (line 17) | def main(args):
FILE: pwnlib/commandline/disasm.py
function main (line 59) | def main(args):
FILE: pwnlib/commandline/elfdiff.py
function dump (line 14) | def dump(objdump, path):
function diff (line 21) | def diff(a,b):
function main (line 35) | def main(a):
FILE: pwnlib/commandline/elfpatch.py
function main (line 20) | def main(a):
FILE: pwnlib/commandline/errno.py
function main (line 17) | def main(args):
FILE: pwnlib/commandline/hex.py
function format_hex (line 32) | def format_hex(hex_string, prefix, separator):
function main (line 35) | def main(args):
FILE: pwnlib/commandline/libcdb.py
function print_libc_info (line 158) | def print_libc_info(libc):
function print_libc_elf (line 168) | def print_libc_elf(exe):
function get_libc_version (line 196) | def get_libc_version(exe):
function translate_offset (line 202) | def translate_offset(offs, args, exe):
function collect_synthetic_symbols (line 210) | def collect_synthetic_symbols(exe):
function main (line 225) | def main(args):
FILE: pwnlib/commandline/main.py
function main (line 47) | def main():
FILE: pwnlib/commandline/phd.py
function asint (line 66) | def asint(s):
function main (line 74) | def main(args):
FILE: pwnlib/commandline/pwnstrip.py
function main (line 21) | def main(args):
FILE: pwnlib/commandline/scramble.py
function main (line 74) | def main(args):
FILE: pwnlib/commandline/shellcraft.py
function _string (line 19) | def _string(s):
function get_template (line 169) | def get_template(shellcodes):
function is_not_a_syscall_template (line 182) | def is_not_a_syscall_template(name):
function main (line 186) | def main(args):
FILE: pwnlib/commandline/template.py
function get_docker_image_libraries (line 34) | def get_docker_image_libraries():
function detect_missing_binaries (line 114) | def detect_missing_binaries(args):
function main (line 171) | def main(args):
FILE: pwnlib/commandline/unhex.py
function main (line 17) | def main(args):
FILE: pwnlib/commandline/update.py
function main (line 24) | def main(a):
FILE: pwnlib/commandline/version.py
function main (line 17) | def main(a):
FILE: pwnlib/config.py
function register_config (line 39) | def register_config(section, function):
function initialize (line 49) | def initialize():
FILE: pwnlib/constants/__init__.py
class ConstantsModule (line 62) | class ConstantsModule(ModuleType):
method __init__ (line 72) | def __init__(self, name, module):
method guess (line 77) | def guess(self):
method __dir__ (line 86) | def __dir__(self):
method __getattr__ (line 89) | def __getattr__(self, key):
method eval (line 117) | def eval(self, string):
FILE: pwnlib/constants/constant.py
class Constant (line 1) | class Constant(int):
method __new__ (line 2) | def __new__(cls, s, i):
method __str__ (line 6) | def __str__(self):
method __repr__ (line 8) | def __repr__(self):
FILE: pwnlib/context/__init__.py
class _devnull (line 36) | class _devnull(object):
method write (line 38) | def write(self, *a, **kw): pass
method read (line 39) | def read(self, *a, **kw): return ''
method flush (line 40) | def flush(self, *a, **kw): pass
method close (line 41) | def close(self, *a, **kw): pass
class _defaultdict (line 43) | class _defaultdict(dict):
method __init__ (line 72) | def __init__(self, default=None):
method __missing__ (line 80) | def __missing__(self, key):
class _DictStack (line 83) | class _DictStack(object):
method __init__ (line 107) | def __init__(self, default):
method push (line 111) | def push(self):
method pop (line 114) | def pop(self):
method copy (line 118) | def copy(self):
method __len__ (line 122) | def __len__(self): return self._current.__len__()
method __delitem__ (line 123) | def __delitem__(self, k): return self._current.__delitem__(k)
method __getitem__ (line 124) | def __getitem__(self, k): return self._current.__getitem__(k)
method __setitem__ (line 125) | def __setitem__(self, k, v): return self._current.__setitem__(k, v)
method __contains__ (line 126) | def __contains__(self, k): return self._current.__contains__(k)
method __iter__ (line 127) | def __iter__(self): return self._current.__iter__()
method __repr__ (line 128) | def __repr__(self): return self._current.__repr__()
method __eq__ (line 129) | def __eq__(self, other): return self._current.__eq__(other)
method keys (line 132) | def keys(self): return self._current.keys()
method values (line 133) | def values(self): return self._current.values()
method items (line 134) | def items(self): return self._current.items()
class _Tls_DictStack (line 137) | class _Tls_DictStack(threading.local, _DictStack):
function _validator (line 155) | def _validator(validator):
class Thread (line 178) | class Thread(threading.Thread):
method __init__ (line 233) | def __init__(self, *args, **kwargs):
method __bootstrap (line 237) | def __bootstrap(self):
function _longest (line 253) | def _longest(d):
class ContextType (line 272) | class ContextType(object):
method __init__ (line 452) | def __init__(self, **kwargs):
method copy (line 462) | def copy(self):
method __dict__ (line 477) | def __dict__(self):
method update (line 480) | def update(self, *args, **kwargs):
method __repr__ (line 515) | def __repr__(self):
method local (line 519) | def local(self, function=None, **kwargs):
method silent (line 568) | def silent(self, function=None):
method quiet (line 574) | def quiet(self, function=None):
method quietfunc (line 608) | def quietfunc(self, function):
method verbose (line 647) | def verbose(self):
method clear (line 674) | def clear(self, *a, **kw):
method native (line 703) | def native(self):
method arch (line 717) | def arch(self, arch):
method aslr (line 816) | def aslr(self, aslr):
method kernel (line 829) | def kernel(self, arch):
method bits (line 843) | def bits(self, bits):
method binary (line 870) | def binary(self, binary):
method bytes (line 904) | def bytes(self):
method bytes (line 923) | def bytes(self, value):
method encoding (line 927) | def encoding(self, charset):
method endian (line 938) | def endian(self, endianness):
method log_level (line 975) | def log_level(self, value):
method log_file (line 1015) | def log_file(self, value):
method log_console (line 1079) | def log_console(self, stream):
method local_libcdb (line 1097) | def local_libcdb(self, path):
method mask (line 1123) | def mask(self):
method os (line 1127) | def os(self, os):
method randomize (line 1199) | def randomize(self, r):
method signed (line 1206) | def signed(self, signed):
method timeout (line 1241) | def timeout(self, value=Timeout.default):
method terminal (line 1254) | def terminal(self, value):
method abi (line 1265) | def abi(self):
method proxy (line 1269) | def proxy(self, proxy):
method noptrace (line 1303) | def noptrace(self, value):
method adb_host (line 1315) | def adb_host(self, value):
method adb_port (line 1327) | def adb_port(self, value):
method device (line 1338) | def device(self, device):
method adb (line 1354) | def adb(self):
method buffer_size (line 1375) | def buffer_size(self, size):
method cache_dir_base (line 1384) | def cache_dir_base(self, new_base):
method cache_dir (line 1399) | def cache_dir(self):
method cache_dir (line 1469) | def cache_dir(self, v):
method delete_corefiles (line 1477) | def delete_corefiles(self, v):
method disable_corefiles (line 1486) | def disable_corefiles(self, v):
method rename_corefiles (line 1498) | def rename_corefiles(self, v):
method newline (line 1515) | def newline(self, v):
method throw_eof_on_incomplete_line (line 1526) | def throw_eof_on_incomplete_line(self, v):
method gdbinit (line 1546) | def gdbinit(self, value):
method gdb_binary (line 1562) | def gdb_binary(self, value):
method cyclic_alphabet (line 1576) | def cyclic_alphabet(self, alphabet):
method cyclic_size (line 1589) | def cyclic_size(self, size):
method ssh_session (line 1602) | def ssh_session(self, shell):
method __call__ (line 1619) | def __call__(self, **kwargs):
method reset_local (line 1625) | def reset_local(self):
method endianness (line 1632) | def endianness(self):
method endianness (line 1643) | def endianness(self, value):
method sign (line 1648) | def sign(self):
method sign (line 1655) | def sign(self, value):
method signedness (line 1659) | def signedness(self):
method signedness (line 1666) | def signedness(self, value):
method word_size (line 1671) | def word_size(self):
method word_size (line 1678) | def word_size(self, value):
function LocalContext (line 1703) | def LocalContext(function):
function LocalNoarchContext (line 1737) | def LocalNoarchContext(function):
function update_context_defaults (line 1757) | def update_context_defaults(section):
FILE: pwnlib/data/elf/__init__.py
function get (line 8) | def get(x):
FILE: pwnlib/data/elf/fmtstr/__init__.py
function get (line 4) | def get(x):
FILE: pwnlib/data/elf/fmtstr/vuln.c
function main (line 8) | int main(int argc, char const *argv[])
FILE: pwnlib/data/elf/relro/__init__.py
function get (line 4) | def get(x):
FILE: pwnlib/data/elf/ret2dlresolve/__init__.py
function get (line 4) | def get(x):
FILE: pwnlib/data/elf/ret2dlresolve/vuln.c
function vuln (line 2) | void vuln(void){
function main (line 6) | int main(int argc, char** argv){
FILE: pwnlib/data/includes/generator/freebsd/sys/fcntl.h
type __mode_t (line 51) | typedef __mode_t mode_t;
type __off_t (line 56) | typedef __off_t off_t;
type __pid_t (line 61) | typedef __pid_t pid_t;
type flock (line 262) | struct flock {
type __oflock (line 276) | struct __oflock {
FILE: pwnlib/data/includes/generator/freebsd/sys/mman.h
type __mode_t (line 167) | typedef __mode_t mode_t;
type __off_t (line 172) | typedef __off_t off_t;
type __size_t (line 177) | typedef __size_t size_t;
type file (line 184) | struct file
type shmfd (line 186) | struct shmfd {
type shmfd (line 210) | struct shmfd
type file (line 212) | struct file
type file (line 213) | struct file
type shmfd (line 214) | struct shmfd
FILE: pwnlib/data/includes/generator/freebsd/sys/signal.h
type __sigset_t (line 146) | typedef __sigset_t sigset_t;
type sigevent (line 162) | struct sigevent {
type siginfo_t (line 195) | typedef struct __siginfo {
type __siginfo (line 294) | struct __siginfo
type sigaction (line 299) | struct sigaction {
type __sighandler_t (line 351) | typedef __sighandler_t *sig_t;
type __siginfo (line 352) | struct __siginfo
type stack_t (line 360) | typedef struct sigaltstack {
type sigvec (line 380) | struct sigvec {
type osigcontext (line 398) | struct osigcontext {
type sigstack (line 407) | struct sigstack {
FILE: pwnlib/data/includes/generator/freebsd/sys/socket.h
type __gid_t (line 50) | typedef __gid_t gid_t;
type __off_t (line 55) | typedef __off_t off_t;
type __pid_t (line 60) | typedef __pid_t pid_t;
type __sa_family_t (line 66) | typedef __sa_family_t sa_family_t;
type __socklen_t (line 71) | typedef __socklen_t socklen_t;
type __ssize_t (line 76) | typedef __ssize_t ssize_t;
type __uid_t (line 82) | typedef __uid_t uid_t;
type linger (line 157) | struct linger {
type accept_filter_arg (line 163) | struct accept_filter_arg {
type sockaddr (line 285) | struct sockaddr {
type sockproto (line 297) | struct sockproto {
type msghdr (line 433) | struct msghdr {
type cmsghdr (line 470) | struct cmsghdr {
type cmsgcred (line 492) | struct cmsgcred {
type sockcred (line 504) | struct sockcred {
type osockaddr (line 566) | struct osockaddr {
type omsghdr (line 574) | struct omsghdr {
type sf_hdtr (line 601) | struct sf_hdtr {
type sockaddr (line 621) | struct sockaddr
type sockaddr (line 622) | struct sockaddr
type sockaddr (line 623) | struct sockaddr
type sockaddr (line 624) | struct sockaddr
type sockaddr (line 625) | struct sockaddr
type sockaddr (line 629) | struct sockaddr
type msghdr (line 630) | struct msghdr
type sockaddr (line 633) | struct sockaddr
type msghdr (line 634) | struct msghdr
type sf_hdtr (line 636) | struct sf_hdtr
type socket (line 649) | struct socket
type tcpcb (line 651) | struct tcpcb
type socket (line 651) | struct socket
type inpcb (line 652) | struct inpcb
type socket (line 652) | struct socket
type sockbuf (line 653) | struct sockbuf
type socket (line 653) | struct socket
type sockbuf (line 654) | struct sockbuf
type socket (line 654) | struct socket
type socket (line 656) | struct socket
type socket (line 657) | struct socket
type socket (line 659) | struct socket
type socket (line 660) | struct socket
type socket (line 662) | struct socket
type socket (line 663) | struct socket
type socket (line 665) | struct socket
type socket (line 666) | struct socket
type protosw (line 668) | struct protosw
type socket (line 668) | struct socket
type socket (line 669) | struct socket
type protosw (line 669) | struct protosw
type socket (line 671) | struct socket
type socket (line 672) | struct socket
type socket (line 674) | struct socket
type socket (line 675) | struct socket
type socket (line 677) | struct socket
type socket (line 678) | struct socket
type socket (line 680) | struct socket
type socket (line 680) | struct socket
FILE: pwnlib/data/includes/generator/freebsd/sys/stat.h
type __blksize_t (line 46) | typedef __blksize_t blksize_t;
type __blkcnt_t (line 51) | typedef __blkcnt_t blkcnt_t;
type __dev_t (line 56) | typedef __dev_t dev_t;
type __fflags_t (line 61) | typedef __fflags_t fflags_t;
type __gid_t (line 66) | typedef __gid_t gid_t;
type __ino_t (line 71) | typedef __ino_t ino_t;
type __mode_t (line 76) | typedef __mode_t mode_t;
type __nlink_t (line 81) | typedef __nlink_t nlink_t;
type __off_t (line 86) | typedef __off_t off_t;
type __uid_t (line 91) | typedef __uid_t uid_t;
type ostat (line 103) | struct ostat {
type stat (line 122) | struct stat {
type nstat (line 153) | struct nstat {
type stat (line 307) | struct stat
type stat (line 313) | struct stat
type stat (line 321) | struct stat
type stat (line 324) | struct stat
FILE: pwnlib/data/includes/generator/linux/diet/asm/aarch64-sigcontext.h
type sigcontext (line 1) | struct sigcontext {
FILE: pwnlib/data/includes/generator/linux/diet/asm/alpha-sigcontext.h
type sigcontext (line 1) | struct sigcontext {
FILE: pwnlib/data/includes/generator/linux/diet/asm/arm-sigcontext.h
type sigcontext (line 9) | struct sigcontext {
FILE: pwnlib/data/includes/generator/linux/diet/asm/i386-sigcontext.h
type _fpreg (line 3) | struct _fpreg {
type _fpxreg (line 8) | struct _fpxreg {
type _xmmreg (line 14) | struct _xmmreg {
type _fpstate (line 18) | struct _fpstate {
type sigcontext (line 43) | struct sigcontext {
FILE: pwnlib/data/includes/generator/linux/diet/asm/ia64-sigcontext.h
type sigcontext (line 7) | struct sigcontext {
FILE: pwnlib/data/includes/generator/linux/diet/asm/mips-sigcontext.h
type sigcontext (line 7) | struct sigcontext {
type sigcontext (line 26) | struct sigcontext {
FILE: pwnlib/data/includes/generator/linux/diet/asm/parisc-sigcontext.h
type sigcontext (line 7) | struct sigcontext {
FILE: pwnlib/data/includes/generator/linux/diet/asm/ppc-sigcontext.h
type pt_regs (line 5) | struct pt_regs {
type sigcontext (line 73) | struct sigcontext {
FILE: pwnlib/data/includes/generator/linux/diet/asm/s390-sigcontext.h
type _psw_t (line 14) | typedef struct
type _s390_regs_common (line 20) | typedef struct
type _s390_fp_regs (line 27) | typedef struct
type _sigregs (line 33) | typedef struct
type sigcontext (line 39) | struct sigcontext
FILE: pwnlib/data/includes/generator/linux/diet/asm/sparc-sigcontext.h
type sigcontext (line 5) | struct sigcontext {
type __siginfo_t (line 30) | typedef struct {
type __siginfo_fpu_t (line 41) | typedef struct {
FILE: pwnlib/data/includes/generator/linux/diet/asm/types.h
type umode_t (line 10) | typedef uint32_t umode_t;
type umode_t (line 12) | typedef uint16_t umode_t;
type __u8 (line 15) | typedef uint8_t __u8;
type __u16 (line 16) | typedef uint16_t __u16;
type __u32 (line 17) | typedef uint32_t __u32;
type __u64 (line 19) | typedef uint64_t __u64;
type __s8 (line 22) | typedef int8_t __s8;
type __s16 (line 23) | typedef int16_t __s16;
type __s32 (line 24) | typedef int32_t __s32;
type __s64 (line 26) | typedef int64_t __s64;
type __kernel_size_t (line 30) | typedef unsigned long __kernel_size_t;
type __kernel_size_t (line 32) | typedef uint32_t __kernel_size_t;
type __le16 (line 36) | typedef uint16_t __le16;
type __be16 (line 37) | typedef uint16_t __be16;
type __le32 (line 38) | typedef uint32_t __le32;
type __be32 (line 39) | typedef uint32_t __be32;
type __le64 (line 40) | typedef uint64_t __le64;
type __be64 (line 41) | typedef uint64_t __be64;
type __sum16 (line 43) | typedef uint16_t __sum16;
type __wsum (line 44) | typedef uint32_t __wsum;
type __kernel_sa_family_t (line 46) | typedef uint16_t __kernel_sa_family_t;
FILE: pwnlib/data/includes/generator/linux/diet/asm/x86_64-sigcontext.h
type _fpstate (line 6) | struct _fpstate {
type sigcontext (line 20) | struct sigcontext { // ofs ofs-x32
FILE: pwnlib/data/includes/generator/linux/diet/fcntl.h
type flock (line 84) | struct flock {
type flock64 (line 92) | struct flock64 {
type flock (line 165) | struct flock {
type flock (line 251) | struct flock {
type flock64 (line 260) | struct flock64 {
type flock (line 268) | struct flock {
type flock (line 347) | struct flock {
type flock64 (line 359) | struct flock64 {
type flock (line 439) | struct flock {
type flock64 (line 447) | struct flock64 {
type flock (line 535) | struct flock {
type flock64 (line 543) | struct flock64 {
type flock (line 626) | struct flock
type flock64 (line 635) | struct flock64
type stat64 (line 693) | struct stat64
type iovec (line 725) | struct iovec
type f_owner_ex (line 758) | struct f_owner_ex {
type timeval (line 774) | struct timeval
FILE: pwnlib/data/includes/generator/linux/diet/inttypes.h
type intmax_t (line 258) | typedef signed long intmax_t;
type uintmax_t (line 259) | typedef unsigned long uintmax_t;
type intmax_t (line 263) | __extension__ typedef signed long long int intmax_t;
type uintmax_t (line 264) | __extension__ typedef unsigned long long int uintmax_t;
type __INTPTR_TYPE__ (line 268) | typedef __INTPTR_TYPE__ intptr_t;
type __UINTPTR_TYPE__ (line 269) | typedef __UINTPTR_TYPE__ uintptr_t;
type __SIZE_TYPE__ (line 271) | typedef __SIZE_TYPE__ uintptr_t;
type __PTRDIFF_TYPE__ (line 272) | typedef __PTRDIFF_TYPE__ intptr_t;
type imaxdiv_t (line 279) | typedef struct { intmax_t quot,rem; } imaxdiv_t;
FILE: pwnlib/data/includes/generator/linux/diet/signal.h
type sig_atomic_t (line 217) | typedef int sig_atomic_t;
type sighandler_t (line 222) | typedef sighandler_t sig_t;
type sighandler_t (line 226) | typedef sighandler_t __sighandler_t;
type sigval_t (line 233) | typedef union sigval {
type __band_t (line 246) | typedef int32_t __band_t;
type __band_t (line 248) | typedef long __band_t;
type siginfo_t (line 251) | typedef struct siginfo {
type sigset_t (line 430) | typedef struct {
type sigaction (line 434) | struct sigaction {
type sigevent_t (line 476) | typedef struct sigevent {
type stack_t (line 495) | typedef struct sigaltstack {
type sigaltstack (line 507) | struct sigaltstack
type sigaltstack (line 507) | struct sigaltstack
type sigaction (line 529) | struct sigaction
type sigaction (line 529) | struct sigaction
type timespec (line 533) | struct timespec
FILE: pwnlib/data/includes/generator/linux/diet/stddef.h
type __PTRDIFF_TYPE__ (line 11) | typedef __PTRDIFF_TYPE__ ptrdiff_t;
type __SIZE_TYPE__ (line 12) | typedef __SIZE_TYPE__ size_t;
type __WCHAR_TYPE__ (line 14) | typedef __WCHAR_TYPE__ wchar_t;
type wchar_t (line 19) | typedef int wchar_t;
FILE: pwnlib/data/includes/generator/linux/diet/stdint.h
type int_least16_t (line 10) | typedef int16_t int_least16_t;
type int_least32_t (line 11) | typedef int32_t int_least32_t;
type int_least64_t (line 12) | typedef int64_t int_least64_t;
type uint_least8_t (line 14) | typedef uint8_t uint_least8_t;
type uint_least16_t (line 15) | typedef uint16_t uint_least16_t;
type uint_least32_t (line 16) | typedef uint32_t uint_least32_t;
type uint_least64_t (line 17) | typedef uint64_t uint_least64_t;
type int_fast8_t (line 19) | typedef signed char int_fast8_t;
type int_fast16_t (line 20) | typedef signed long int int_fast16_t;
type int_fast32_t (line 21) | typedef signed long int int_fast32_t;
type int_fast64_t (line 22) | typedef int64_t int_fast64_t;
type uint_fast8_t (line 24) | typedef unsigned char uint_fast8_t;
type uint_fast16_t (line 25) | typedef unsigned long int uint_fast16_t;
type uint_fast32_t (line 26) | typedef unsigned long int uint_fast32_t;
type uint_fast64_t (line 27) | typedef uint64_t uint_fast64_t;
type __WINT_TYPE__ (line 149) | typedef __WINT_TYPE__ wint_t;
type wint_t (line 151) | typedef unsigned int wint_t;
FILE: pwnlib/data/includes/generator/linux/diet/sys/ptrace.h
type pt_regs (line 92) | struct pt_regs {
type pt_regs (line 125) | struct pt_regs {
type psw_t (line 244) | typedef struct {
type freg_t (line 249) | typedef union
type s390_fp_regs (line 261) | typedef struct
type s390_regs (line 273) | typedef struct
type pt_regs (line 281) | struct pt_regs
type per_cr_words (line 291) | typedef struct
type addr_t (line 298) | typedef uint32_t addr_t;
type per_cr_bits (line 300) | typedef struct
type per_lowcore_words (line 320) | typedef struct
type per_lowcore_bits (line 327) | typedef struct
type per_struct (line 346) | typedef struct
type ptrace_area (line 372) | typedef struct
type ptprot_flags (line 395) | typedef enum
type ptprot_area (line 402) | typedef struct
type user_regs_struct (line 419) | struct user_regs_struct
type pt_regs (line 460) | struct pt_regs {
type pt_regs (line 519) | struct pt_regs {
type fpsimd_state (line 526) | struct fpsimd_state {
type hwdebug_state (line 532) | struct hwdebug_state {
type pt_regs (line 544) | struct pt_regs {
type switch_stack (line 578) | struct switch_stack {
type pt_regs (line 605) | struct pt_regs {
type pt_regs (line 631) | struct pt_regs {
type pt_regs (line 648) | struct pt_regs {
type reg_window (line 678) | struct reg_window {
type sparc_stackf (line 684) | struct sparc_stackf {
type pt_regs (line 790) | struct pt_regs {
type ia64_fpreg (line 814) | struct ia64_fpreg {
type pt_regs (line 820) | struct pt_regs {
type switch_stack (line 869) | struct switch_stack {
FILE: pwnlib/data/includes/generator/linux/diet/sys/select.h
type fd_set (line 17) | typedef struct {
type timeval (line 27) | struct timeval
type timespec (line 30) | struct timespec
FILE: pwnlib/data/includes/generator/linux/diet/sys/socket.h
type sockaddr (line 388) | struct sockaddr {
type linger (line 393) | struct linger {
type msghdr (line 398) | struct msghdr {
type cmsghdr (line 408) | struct cmsghdr {
type ucred (line 423) | struct ucred {
type cmsghdr (line 610) | struct cmsghdr
type cmsghdr (line 610) | struct cmsghdr
type cmsghdr (line 612) | struct cmsghdr
type cmsghdr (line 613) | struct cmsghdr
type cmsghdr (line 615) | struct cmsghdr
type cmsghdr (line 619) | struct cmsghdr
type msghdr (line 619) | struct msghdr
type cmsghdr (line 619) | struct cmsghdr
type sockaddr_storage (line 633) | struct sockaddr_storage {
type sockaddr (line 640) | struct sockaddr
type sockaddr (line 641) | struct sockaddr
type sockaddr (line 642) | struct sockaddr
type sockaddr (line 646) | struct sockaddr
type msghdr (line 648) | struct msghdr
type sockaddr (line 652) | struct sockaddr
type msghdr (line 654) | struct msghdr
type sockaddr (line 656) | struct sockaddr
type sockaddr (line 657) | struct sockaddr
type mmsghdr (line 672) | struct mmsghdr {
type mmsghdr (line 677) | struct mmsghdr
type timespec (line 678) | struct timespec
type mmsghdr (line 679) | struct mmsghdr
type addrinfo (line 691) | struct addrinfo {
type sockaddr (line 703) | struct sockaddr
type addrinfo (line 705) | struct
type addrinfo (line 706) | struct addrinfo
type addrinfo (line 707) | struct addrinfo
FILE: pwnlib/data/includes/generator/linux/diet/sys/stat.h
type stat (line 12) | struct stat {
type stat64 (line 33) | struct stat64 {
type stat (line 67) | struct stat {
type stat64 (line 84) | struct stat64 {
type stat (line 95) | struct stat {
type stat64 (line 115) | struct stat64 {
type stat (line 142) | struct stat {
type stat64 (line 160) | struct stat64 {
type stat (line 186) | struct stat {
type stat64 (line 210) | struct stat64 {
type stat (line 234) | struct stat {
type stat64 (line 262) | struct stat64 {
type stat (line 290) | struct stat {
type stat (line 311) | struct stat {
type stat64 (line 336) | struct stat64 {
type stat (line 359) | struct stat {
type stat64 (line 383) | struct stat64 {
type stat (line 416) | struct stat {
type stat64 (line 439) | struct stat64 {
type stat (line 464) | struct stat {
type stat (line 485) | struct stat {
type stat64 (line 508) | struct stat64 {
type stat (line 535) | struct stat {
type stat64 (line 566) | struct stat64 {
type stat (line 592) | struct stat {
type stat (line 617) | struct stat {
type stat (line 633) | struct stat {
type stat (line 691) | struct stat
type stat (line 692) | struct stat
type stat (line 693) | struct stat
type stat64 (line 698) | struct stat64
type stat64 (line 699) | struct stat64
type stat64 (line 700) | struct stat64
type stat (line 730) | struct stat
type timespec (line 734) | struct timespec
FILE: pwnlib/data/includes/generator/linux/diet/sys/time.h
function __BEGIN_DECLS (line 7) | __BEGIN_DECLS
type timeval (line 14) | struct timeval {
type timezone (line 19) | struct timezone {
type itimerspec (line 30) | struct itimerspec {
type itimerval (line 35) | struct itimerval {
type timezone (line 41) | struct timezone
type itimerval (line 46) | struct itimerval
type itimerval (line 47) | struct itimerval
type itimerval (line 47) | struct itimerval
type timeval (line 49) | struct timeval
type timezone (line 49) | struct timezone
type timeval (line 50) | struct timeval
type timezone (line 50) | struct timezone
function adjtime (line 52) | extern int adjtime (const struct timeval *delta, struct timeval *olddelt...
type timeval (line 78) | struct timeval
FILE: pwnlib/data/includes/generator/linux/diet/sys/types.h
type blksize_t (line 10) | typedef unsigned long int blksize_t;
type clock_t (line 11) | typedef unsigned long int clock_t;
type fsblkcnt_t (line 15) | typedef uint64_t fsblkcnt_t;
type fsfilcnt_t (line 16) | typedef uint64_t fsfilcnt_t;
type dev_t (line 42) | typedef uint32_t dev_t;
type gid_t (line 43) | typedef uint32_t gid_t;
type mode_t (line 44) | typedef uint32_t mode_t;
type nlink_t (line 45) | typedef uint32_t nlink_t;
type uid_t (line 46) | typedef uint32_t uid_t;
type dev_t (line 48) | typedef uint32_t dev_t;
type gid_t (line 49) | typedef uint16_t gid_t;
type mode_t (line 50) | typedef uint16_t mode_t;
type nlink_t (line 51) | typedef uint16_t nlink_t;
type uid_t (line 52) | typedef uint16_t uid_t;
type dev_t (line 54) | typedef uint32_t dev_t;
type gid_t (line 55) | typedef uint32_t gid_t;
type mode_t (line 56) | typedef uint16_t mode_t;
type nlink_t (line 57) | typedef uint16_t nlink_t;
type uid_t (line 58) | typedef uint32_t uid_t;
type dev_t (line 60) | typedef uint32_t dev_t;
type gid_t (line 61) | typedef int32_t gid_t;
type mode_t (line 62) | typedef uint32_t mode_t;
type nlink_t (line 63) | typedef int32_t nlink_t;
type uid_t (line 64) | typedef int32_t uid_t;
type dev_t (line 66) | typedef uint32_t dev_t;
type gid_t (line 67) | typedef uint32_t gid_t;
type mode_t (line 68) | typedef uint32_t mode_t;
type nlink_t (line 69) | typedef uint16_t nlink_t;
type uid_t (line 70) | typedef uint32_t uid_t;
type dev_t (line 72) | typedef unsigned long dev_t;
type gid_t (line 73) | typedef uint32_t gid_t;
type mode_t (line 74) | typedef uint32_t mode_t;
type nlink_t (line 75) | typedef unsigned long nlink_t;
type uid_t (line 76) | typedef uint32_t uid_t;
type id_t (line 79) | typedef int32_t id_t;
type ino_t (line 82) | typedef unsigned long ino_t;
type key_t (line 83) | typedef int32_t key_t;
type pid_t (line 84) | typedef int32_t pid_t;
type __SIZE_TYPE__ (line 88) | typedef __SIZE_TYPE__ ssize_t;
type suseconds_t (line 96) | typedef signed int suseconds_t;
type useconds_t (line 97) | typedef signed int useconds_t;
type suseconds_t (line 99) | typedef signed long suseconds_t;
type useconds_t (line 100) | typedef signed long useconds_t;
type time_t (line 103) | typedef signed long long time_t;
type time_t (line 105) | typedef signed long time_t;
type loff_t (line 109) | __extension__ typedef signed long long loff_t;
type off64_t (line 111) | __extension__ typedef signed long long off64_t;
type off64_t (line 113) | typedef off64_t off_t;
type off64_t (line 117) | typedef off64_t off_t;
type off_t (line 119) | typedef signed long off_t;
type ino64_t (line 123) | __extension__ typedef unsigned long long ino64_t;
type blkcnt64_t (line 124) | __extension__ typedef signed long long blkcnt64_t;
type uid32_t (line 126) | typedef uint32_t uid32_t;
type gid32_t (line 127) | typedef uint32_t gid32_t;
type clockid_t (line 129) | typedef int32_t clockid_t;
type timer_t (line 130) | typedef int32_t timer_t;
type fpos_t (line 132) | typedef long int fpos_t;
type socklen_t (line 135) | typedef uint32_t socklen_t;
type sa_family_t (line 136) | typedef uint16_t sa_family_t;
type __attribute_dontuse__ (line 142) | typedef unsigned char u_char __attribute_dontuse__;
type __attribute_dontuse__ (line 143) | typedef unsigned short u_short __attribute_dontuse__;
type __attribute_dontuse__ (line 144) | typedef unsigned int u_int __attribute_dontuse__;
type __attribute_dontuse__ (line 145) | typedef unsigned char uchar __attribute_dontuse__;
type __attribute_dontuse__ (line 146) | typedef unsigned short ushort __attribute_dontuse__;
type __attribute_dontuse__ (line 147) | typedef unsigned int uint __attribute_dontuse__;
type __attribute_dontuse__ (line 148) | typedef unsigned long u_long __attribute_dontuse__;
type __attribute_dontuse__ (line 149) | typedef uint32_t n_long __attribute_dontuse__;
type __attribute_dontuse__ (line 150) | typedef uint32_t n_time __attribute_dontuse__;
type __attribute_dontuse__ (line 151) | typedef uint16_t n_short __attribute_dontuse__;
type __attribute_dontuse__ (line 152) | typedef unsigned long ulong __attribute_dontuse__;
type __attribute_dontuse__ (line 153) | typedef uint32_t nlong __attribute_dontuse__;
type __attribute_dontuse__ (line 154) | typedef uint32_t ntime __attribute_dontuse__;
type __attribute_dontuse__ (line 155) | typedef uint16_t nshort __attribute_dontuse__;
type __attribute_dontuse__ (line 159) | typedef int64_t quad_t __attribute_dontuse__;
type __attribute_dontuse__ (line 160) | typedef uint64_t u_quad_t __attribute_dontuse__;
type __attribute_dontuse__ (line 162) | typedef long daddr_t __attribute_dontuse__;
type daddr_t (line 164) | typedef daddr_t __daddr_t __attribute_dontuse__;
type __attribute_dontuse__ (line 168) | typedef uint8_t u_int8_t __attribute_dontuse__;
type __attribute_dontuse__ (line 169) | typedef uint16_t u_int16_t __attribute_dontuse__;
type __attribute_dontuse__ (line 170) | typedef uint32_t u_int32_t __attribute_dontuse__;
type __attribute_dontuse__ (line 172) | typedef uint64_t u_int64_t __attribute_dontuse__;
FILE: pwnlib/data/includes/generator/linux/diet/sys/ucontext.h
type mcontext_t (line 10) | typedef struct sigcontext mcontext_t;
type ucontext (line 14) | struct ucontext {
type ucontext (line 25) | struct ucontext {
type mc_greg_t (line 56) | typedef unsigned long mc_greg_t;
type mc_greg_t (line 57) | typedef mc_greg_t mc_gregset_t[MC_NGREG];
type mc_fq (line 60) | struct mc_fq {
type mc_fpu_t (line 65) | typedef struct mc_fpu {
type mcontext_t (line 80) | typedef struct {
type ucontext (line 87) | struct ucontext {
type ucontext (line 96) | struct ucontext {
type ucontext (line 104) | struct ucontext {
type ucontext (line 114) | struct ucontext {
type ucontext_t (line 126) | typedef struct ucontext ucontext_t;
FILE: pwnlib/data/includes/generator/linux/diet/sys/uio.h
function __BEGIN_DECLS (line 6) | __BEGIN_DECLS
type iovec (line 14) | struct iovec
type iovec (line 15) | struct iovec
type iovec (line 17) | struct iovec
type iovec (line 18) | struct iovec
FILE: pwnlib/data/includes/generator/linux/diet/unistd.h
type dirent (line 156) | struct dirent
type dirent64 (line 157) | struct dirent64
type dirent (line 160) | struct dirent
type dirent64 (line 163) | struct dirent64
type __sysctl_args (line 322) | struct __sysctl_args
type __sysctl_args (line 323) | struct __sysctl_args
FILE: pwnlib/data/syscalls/generate.py
function can_be_constant (line 128) | def can_be_constant(arg):
function can_be_string (line 133) | def can_be_string(arg):
function can_be_array (line 140) | def can_be_array(arg):
function fix_bad_arg_names (line 147) | def fix_bad_arg_names(func, arg):
function get_arg_default (line 160) | def get_arg_default(arg):
function fix_rt_syscall_name (line 164) | def fix_rt_syscall_name(name):
function fix_syscall_names (line 170) | def fix_syscall_names(name):
function main (line 180) | def main(target):
function generate_one (line 186) | def generate_one(target):
FILE: pwnlib/data/useragents/download-useragents.py
function getxml (line 16) | def getxml(url):
function loop (line 27) | def loop(xml):
FILE: pwnlib/device.py
class Device (line 1) | class Device(object):
method __init__ (line 8) | def __init__(self, serial=None):
method __str__ (line 11) | def __str__(self):
method __eq__ (line 14) | def __eq__(self, other):
FILE: pwnlib/dynelf.py
function sysv_hash (line 67) | def sysv_hash(symbol):
function gnu_hash (line 81) | def gnu_hash(s):
class DynELF (line 92) | class DynELF(object):
method __init__ (line 146) | def __init__(self, leak, pointer=None, elf=None, libcdb=True):
method for_one_lib_only (line 200) | def for_one_lib_only(cls, leak, ptr):
method from_lib_ptr (line 204) | def from_lib_ptr(cls, leak, ptr):
method find_base (line 208) | def find_base(leak, ptr):
method elfclass (line 215) | def elfclass(self):
method elftype (line 224) | def elftype(self):
method link_map (line 240) | def link_map(self):
method dynamic (line 247) | def dynamic(self):
method _find_base (line 256) | def _find_base(self, ptr):
method _find_base_optimized (line 289) | def _find_base_optimized(self, ptr):
method _find_dynamic_phdr (line 317) | def _find_dynamic_phdr(self):
method _find_dt_optimized (line 352) | def _find_dt_optimized(self, name):
method _find_dt (line 373) | def _find_dt(self, tag):
method _find_linkmap (line 413) | def _find_linkmap(self, pltgot=None, debug=None):
method waitfor (line 457) | def waitfor(self, msg):
method failure (line 464) | def failure(self, msg):
method success (line 471) | def success(self, msg):
method status (line 478) | def status(self, msg):
method libc (line 485) | def libc(self):
method lookup (line 515) | def lookup (self, symb = None, lib = None):
method bases (line 591) | def bases(self):
method _dynamic_load_dynelf (line 622) | def _dynamic_load_dynelf(self, libname):
method _rel_lookup (line 668) | def _rel_lookup(self, symb, strtab=None, symtab=None, jmprel=None):
method _lookup (line 724) | def _lookup(self, symb):
method _resolve_symbol_sysv (line 790) | def _resolve_symbol_sysv(self, libbase, symb, hshtab, strtab, symtab):
method _resolve_symbol_gnu (line 850) | def _resolve_symbol_gnu(self, libbase, symb, hshtab, strtab, symtab):
method _lookup_build_id (line 931) | def _lookup_build_id(self, lib = None):
method _make_absolute_ptr (line 953) | def _make_absolute_ptr(self, ptr_or_offset):
method stack (line 976) | def stack(self):
method heap (line 996) | def heap(self):
method _find_mapped_pages (line 1007) | def _find_mapped_pages(self, readonly = False, page_size = 0x1000):
method dump (line 1035) | def dump(self, libs = False, readonly = False):
FILE: pwnlib/elf/config.py
class KernelConfig (line 4) | class KernelConfig(object):
method __init__ (line 5) | def __init__(self, name, title, requires=[], excludes=[], minver=0, ma...
method relevant (line 25) | def relevant(self, config):
method check (line 53) | def check(self, value):
method __call__ (line 56) | def __call__(self, config):
class Enabled (line 73) | class Enabled(KernelConfig):
method __init__ (line 74) | def __init__(self, name, **kw):
method check (line 76) | def check(self, config):
class EnabledIfPresent (line 79) | class EnabledIfPresent(Enabled):
method check (line 80) | def check(self, config):
class Disabled (line 85) | class Disabled(KernelConfig):
method __init__ (line 86) | def __init__(self, name, **kw):
method check (line 88) | def check(self, config):
class Minimum (line 91) | class Minimum(KernelConfig):
method __init__ (line 92) | def __init__(self, name, minimum, **kw):
method check (line 95) | def check(self, value):
function parse_kconfig (line 196) | def parse_kconfig(data):
FILE: pwnlib/elf/corefile.py
class Mapping (line 111) | class Mapping(object):
method __init__ (line 114) | def __init__(self, core, name, start, stop, flags, page_offset):
method path (line 136) | def path(self):
method address (line 141) | def address(self):
method permstr (line 146) | def permstr(self):
method __str__ (line 153) | def __str__(self):
method __repr__ (line 156) | def __repr__(self):
method __int__ (line 166) | def __int__(self):
method data (line 170) | def data(self):
method __getitem__ (line 174) | def __getitem__(self, item):
method __contains__ (line 197) | def __contains__(self, item):
method find (line 202) | def find(self, sub, start=None, end=None):
method rfind (line 216) | def rfind(self, sub, start=None, end=None):
class Corefile (line 230) | class Corefile(ELF):
method __init__ (line 523) | def __init__(self, *a, **kw):
method _parse_nt_file (line 660) | def _parse_nt_file(self, note):
method vvar (line 698) | def vvar(self):
method vdso (line 705) | def vdso(self):
method vsyscall (line 712) | def vsyscall(self):
method libc (line 719) | def libc(self):
method exe (line 733) | def exe(self):
method pid (line 761) | def pid(self):
method ppid (line 767) | def ppid(self):
method signal (line 773) | def signal(self):
method fault_addr (line 796) | def fault_addr(self):
method _pc_register (line 845) | def _pc_register(self):
method pc (line 853) | def pc(self):
method _sp_register (line 861) | def _sp_register(self):
method sp (line 869) | def sp(self):
method _describe (line 876) | def _describe(self):
method _describe_core (line 879) | def _describe_core(self):
method _load_mappings (line 901) | def _load_mappings(self):
method _parse_auxv (line 914) | def _parse_auxv(self, note):
method _parse_stack (line 947) | def _parse_stack(self):
method maps (line 1062) | def maps(self):
method getenv (line 1086) | def getenv(self, name):
method registers (line 1113) | def registers(self):
method debug (line 1140) | def debug(self):
method __getattr__ (line 1145) | def __getattr__(self, attribute):
method _populate_got (line 1155) | def _populate_got(*a): pass
method _populate_plt (line 1156) | def _populate_plt(*a): pass
class Core (line 1158) | class Core(Corefile):
class Coredump (line 1161) | class Coredump(Corefile):
class CorefileFinder (line 1164) | class CorefileFinder(object):
method __init__ (line 1165) | def __init__(self, proc):
method load_core_check_pid (line 1242) | def load_core_check_pid(self):
method apport_corefile (line 1266) | def apport_corefile(self):
method apport_crash_extract_corefile (line 1282) | def apport_crash_extract_corefile(self, crashfile_data):
method apport_read_crash_data (line 1327) | def apport_read_crash_data(self):
method systemd_coredump_corefile (line 1356) | def systemd_coredump_corefile(self):
method wsl_capture_crash_corefile (line 1383) | def wsl_capture_crash_corefile(self):
method native_corefile (line 1415) | def native_corefile(self):
method native_corefile_pipe (line 1431) | def native_corefile_pipe(self):
method native_corefile_pattern (line 1470) | def native_corefile_pattern(self):
method qemu_corefile (line 1521) | def qemu_corefile(self):
method apport_coredump (line 1549) | def apport_coredump(self):
method binfmt_lookup (line 1596) | def binfmt_lookup(self):
FILE: pwnlib/elf/datatypes.py
class constants (line 84) | class constants:
class Elf32_Ehdr (line 288) | class Elf32_Ehdr(ctypes.Structure):
class Elf64_Ehdr (line 304) | class Elf64_Ehdr(ctypes.Structure):
class Elf32_Phdr (line 320) | class Elf32_Phdr(ctypes.Structure):
class Elf64_Phdr (line 330) | class Elf64_Phdr(ctypes.Structure):
class Elf32_Shdr (line 340) | class Elf32_Shdr(ctypes.Structure):
class Elf64_Shdr (line 352) | class Elf64_Shdr(ctypes.Structure):
class _U__Elf32_Dyn (line 364) | class _U__Elf32_Dyn(ctypes.Union):
class Elf32_Dyn (line 368) | class Elf32_Dyn(ctypes.Structure):
class _U__Elf64_Dyn (line 373) | class _U__Elf64_Dyn(ctypes.Union):
class Elf64_Dyn (line 377) | class Elf64_Dyn(ctypes.Structure):
class Elf32_Sym (line 382) | class Elf32_Sym(ctypes.Structure):
class Elf64_Sym (line 390) | class Elf64_Sym(ctypes.Structure):
class Elf64_Rel (line 398) | class Elf64_Rel(ctypes.Structure):
class Elf32_Rel (line 403) | class Elf32_Rel(ctypes.Structure):
class Elf32_Link_Map (line 407) | class Elf32_Link_Map(ctypes.Structure):
class Elf64_Link_Map (line 414) | class Elf64_Link_Map(ctypes.Structure):
class Elf_eident (line 438) | class Elf_eident(ctypes.Structure):
class Elf_i386_GOT (line 447) | class Elf_i386_GOT(ctypes.Structure):
class Elf_x86_64_GOT (line 451) | class Elf_x86_64_GOT(ctypes.Structure):
class Elf_HashTable (line 456) | class Elf_HashTable(ctypes.Structure):
class GNU_HASH (line 463) | class GNU_HASH(ctypes.Structure):
class Elf32_r_debug (line 469) | class Elf32_r_debug(ctypes.Structure):
class Elf64_r_debug (line 473) | class Elf64_r_debug(ctypes.Structure):
class elf_siginfo (line 482) | class elf_siginfo(ctypes.Structure):
class timeval32 (line 487) | class timeval32(ctypes.Structure):
class timeval64 (line 491) | class timeval64(ctypes.Structure):
function generate_prstatus_common (line 496) | def generate_prstatus_common(size, regtype):
class user_regs_struct_i386 (line 517) | class user_regs_struct_i386(ctypes.Structure):
class user_regs_struct_amd64 (line 543) | class user_regs_struct_amd64(ctypes.Structure):
class user_regs_struct_arm (line 576) | class user_regs_struct_arm(ctypes.Structure):
method cpsr (line 580) | def cpsr(self):
method pc (line 583) | def pc(self):
method lr (line 586) | def lr(self):
method sp (line 589) | def sp(self):
method ip (line 592) | def ip(self):
method fp (line 595) | def fp(self):
class user_regs_struct_aarch64 (line 599) | class user_regs_struct_aarch64(ctypes.Structure):
method lr (line 606) | def lr(self):
method __getattr__ (line 609) | def __getattr__(self, name):
class elf_prstatus_i386 (line 615) | class elf_prstatus_i386(ctypes.Structure):
class elf_prstatus_amd64 (line 620) | class elf_prstatus_amd64(ctypes.Structure):
class elf_prstatus_arm (line 626) | class elf_prstatus_arm(ctypes.Structure):
class elf_prstatus_aarch64 (line 629) | class elf_prstatus_aarch64(ctypes.Structure):
class Elf32_auxv_t (line 632) | class Elf32_auxv_t(ctypes.Structure):
class Elf64_auxv_t (line 635) | class Elf64_auxv_t(ctypes.Structure):
function generate_siginfo (line 639) | def generate_siginfo(int_t, long_t):
class elf_siginfo_32 (line 648) | class elf_siginfo_32(generate_siginfo(ctypes.c_uint32, ctypes.c_uint32)):
class elf_siginfo_64 (line 651) | class elf_siginfo_64(generate_siginfo(ctypes.c_uint32, ctypes.c_uint64)):
FILE: pwnlib/elf/elf.py
function _iter_symbols (line 101) | def _iter_symbols(sec):
class Function (line 107) | class Function(object):
method __init__ (line 116) | def __init__(self, name, address, size, elf=None):
method __repr__ (line 129) | def __repr__(self):
method __flat__ (line 138) | def __flat__(self):
method disasm (line 141) | def disasm(self):
function load (line 144) | def load(*args, **kwargs):
class dotdict (line 148) | class dotdict(dict):
method __missing__ (line 168) | def __missing__(self, name):
method __getattr__ (line 174) | def __getattr__(self, name):
class ELF (line 186) | class ELF(ELFFile):
method __init__ (line 222) | def __init__(self, path_or_bytes, checksec=True):
method close (line 381) | def close(self):
method from_assembly (line 391) | def from_assembly(assembly, *a, **kw):
method from_bytes (line 415) | def from_bytes(bytes, *a, **kw):
method process (line 435) | def process(self, argv=[], *a, **kw):
method debug (line 455) | def debug(self, argv=[], *a, **kw):
method _describe (line 471) | def _describe(self, *a, **kw):
method get_machine_arch (line 482) | def get_machine_arch(self):
method entry (line 503) | def entry(self):
method elftype (line 510) | def elftype(self):
method iter_segments (line 514) | def iter_segments(self):
method segments (line 522) | def segments(self):
method iter_segments_by_type (line 529) | def iter_segments_by_type(self, t):
method iter_notes (line 538) | def iter_notes(self):
method iter_properties (line 549) | def iter_properties(self):
method get_segment_for_address (line 561) | def get_segment_for_address(self, address, size=1):
method iter_sections (line 596) | def iter_sections(self):
method sections (line 604) | def sections(self):
method dwarf (line 612) | def dwarf(self):
method sym (line 617) | def sym(self):
method address (line 622) | def address(self):
method address (line 651) | def address(self, new):
method section (line 673) | def section(self, name):
method rwx_segments (line 687) | def rwx_segments(self):
method executable_segments (line 700) | def executable_segments(self):
method writable_segments (line 712) | def writable_segments(self):
method non_writable_segments (line 721) | def non_writable_segments(self):
method libs (line 730) | def libs(self):
method maps (line 751) | def maps(self):
method libc (line 765) | def libc(self):
method _populate_libraries (line 783) | def _populate_libraries(self):
method _patch_elf_and_read_maps (line 818) | def _patch_elf_and_read_maps(self):
method _populate_functions (line 935) | def _populate_functions(self):
method _populate_symbols (line 956) | def _populate_symbols(self):
method _populate_synthetic_symbols (line 973) | def _populate_synthetic_symbols(self):
method _populate_got (line 1001) | def _populate_got(self):
method _populate_mips_got (line 1055) | def _populate_mips_got(self):
method _populate_plt (line 1094) | def _populate_plt(self):
method _populate_kernel_version (line 1147) | def _populate_kernel_version(self):
method libc_start_main_return (line 1168) | def libc_start_main_return(self):
method search (line 1241) | def search(self, needle, writable = False, executable = False):
method offset_to_vaddr (line 1358) | def offset_to_vaddr(self, offset):
method _populate_memory (line 1394) | def _populate_memory(self):
method vaddr_to_offset (line 1442) | def vaddr_to_offset(self, address):
method read (line 1478) | def read(self, address, count):
method write (line 1594) | def write(self, address, data):
method save (line 1622) | def save(self, path=None):
method get_data (line 1636) | def get_data(self):
method data (line 1649) | def data(self):
method disasm (line 1657) | def disasm(self, address, n_bytes):
method asm (line 1669) | def asm(self, address, assembly):
method bss (line 1681) | def bss(self, offset=0):
method __repr__ (line 1691) | def __repr__(self):
method dynamic_by_tag (line 1694) | def dynamic_by_tag(self, tag):
method dynamic_value_by_tag (line 1716) | def dynamic_value_by_tag(self, tag):
method dynamic_string (line 1728) | def dynamic_string(self, offset):
method relro (line 1754) | def relro(self):
method nx (line 1822) | def nx(self):
method execstack (line 2051) | def execstack(self):
method canary (line 2106) | def canary(self):
method packed (line 2114) | def packed(self):
method stripped (line 2119) | def stripped(self):
method debuginfo (line 2124) | def debuginfo(self):
method pie (line 2129) | def pie(self):
method rpath (line 2135) | def rpath(self):
method runpath (line 2145) | def runpath(self):
method checksec (line 2154) | def checksec(self, banner=True, color=True):
method buildid (line 2264) | def buildid(self):
method fortify (line 2272) | def fortify(self):
method asan (line 2280) | def asan(self):
method msan (line 2286) | def msan(self):
method ubsan (line 2292) | def ubsan(self):
method shadowstack (line 2298) | def shadowstack(self):
method ibt (line 2310) | def ibt(self):
method _update_args (line 2322) | def _update_args(self, kw):
method p64 (line 2327) | def p64(self, address, data, *a, **kw):
method p56 (line 2332) | def p56(self, address, data, *a, **kw):
method p48 (line 2337) | def p48(self, address, data, *a, **kw):
method p40 (line 2342) | def p40(self, address, data, *a, **kw):
method p32 (line 2347) | def p32(self, address, data, *a, **kw):
method p16 (line 2352) | def p16(self, address, data, *a, **kw):
method p8 (line 2357) | def p8(self, address, data, *a, **kw):
method pack (line 2362) | def pack(self, address, data, *a, **kw):
method u64 (line 2367) | def u64(self, address, *a, **kw):
method u56 (line 2372) | def u56(self, address, *a, **kw):
method u48 (line 2377) | def u48(self, address, *a, **kw):
method u40 (line 2382) | def u40(self, address, *a, **kw):
method u32 (line 2387) | def u32(self, address, *a, **kw):
method u16 (line 2392) | def u16(self, address, *a, **kw):
method u8 (line 2397) | def u8(self, address, *a, **kw):
method unpack (line 2402) | def unpack(self, address, *a, **kw):
method string (line 2407) | def string(self, address):
method flat (line 2436) | def flat(self, address, *a, **kw):
method fit (line 2443) | def fit(self, address, *a, **kw):
method parse_kconfig (line 2450) | def parse_kconfig(self, data):
method disable_nx (line 2453) | def disable_nx(self):
method set_runpath (line 2483) | def set_runpath(exepath, runpath):
method set_interpreter (line 2518) | def set_interpreter(exepath, interpreter_path):
method patch_custom_libraries (line 2552) | def patch_custom_libraries(exe_path, custom_library_path, create_copy=...
FILE: pwnlib/elf/plt.py
function emulate_plt_instructions (line 13) | def emulate_plt_instructions(elf, got, address, data, targets):
function __ensure_memory_to_run_unicorn (line 56) | def __ensure_memory_to_run_unicorn():
function prepare_unicorn_and_context (line 77) | def prepare_unicorn_and_context(elf, got, address, data):
function emulate_plt_instructions_inner (line 152) | def emulate_plt_instructions_inner(uc, elf, got, pc, data):
FILE: pwnlib/encoders/amd64/delta.py
class amd64DeltaEncoder (line 4) | class amd64DeltaEncoder(i386DeltaEncoder):
FILE: pwnlib/encoders/arm/alphanumeric/ARM_Instructions.py
function dpimm (line 22) | def dpimm(op, cond, s, d, n, imm):
function dpshiftimm (line 48) | def dpshiftimm(op, s, d, n, a, imm):
function dpshiftreg (line 67) | def dpshiftreg(op, s, d, n, a, shift, b):
function lsbyte (line 90) | def lsbyte(op, cond, d, n, imm):
function smul (line 109) | def smul(d, reglH, reglL):
function lmul (line 114) | def lmul(n, reglH, reglL):
function swi (line 119) | def swi(cond):
function bmi (line 129) | def bmi():
function sbyteposti (line 134) | def sbyteposti(d, n, m, imm):
FILE: pwnlib/encoders/arm/alphanumeric/__init__.py
class ArmEncoder (line 13) | class ArmEncoder(Encoder):
method __call__ (line 19) | def __call__(self, input, avoid, pcreg=None):
class ThumbEncoder (line 45) | class ThumbEncoder(ArmEncoder):
method __call__ (line 50) | def __call__(self, input, avoid, pcreg=None):
FILE: pwnlib/encoders/arm/alphanumeric/alphanum_byte.py
function alphanumeric_check (line 13) | def alphanumeric_check(c):
function alphanumeric_get_byte (line 21) | def alphanumeric_get_byte():
function alphanumeric_get_byte_ltmax (line 27) | def alphanumeric_get_byte_ltmax(max):
function off_gen (line 35) | def off_gen(c):
function alphanumeric_get_complement (line 46) | def alphanumeric_get_complement(c):
FILE: pwnlib/encoders/arm/alphanumeric/builder.py
class builder (line 23) | class builder:
method __init__ (line 25) | def __init__(self):
method enc_data_builder (line 35) | def enc_data_builder(self, input):
method DecoderLoopBuilder (line 57) | def DecoderLoopBuilder(self, icache_flush):
method encDecoderLoopBuilder (line 135) | def encDecoderLoopBuilder(self, input):
method DecoderBuilder (line 146) | def DecoderBuilder(self, input, icache_flush):
method algo1 (line 242) | def algo1(self, input, begin_inp, iter):
method gap_traverse (line 333) | def gap_traverse(self, gap):
method buildInit (line 352) | def buildInit(self, input):
method algo2 (line 415) | def algo2(self):
FILE: pwnlib/encoders/arm/alphanumeric/random_funcs.py
function random_get_int (line 14) | def random_get_int(maxv):
function randel (line 18) | def randel(arr):
function enc_data_msn (line 21) | def enc_data_msn(c, i):
FILE: pwnlib/encoders/arm/xor.py
class ArmXorEncoder (line 10) | class ArmXorEncoder(Encoder):
method __call__ (line 47) | def __call__(self, raw_bytes, avoid, pcreg=''):
FILE: pwnlib/encoders/encoder.py
class Encoder (line 13) | class Encoder(object):
method __init__ (line 22) | def __init__(self):
method __call__ (line 29) | def __call__(self, raw_bytes, avoid, pcreg):
function encode (line 45) | def encode(raw_bytes, avoid=None, expr=None, force=0, pcreg=''):
function null (line 111) | def null(raw_bytes, *a, **kw):
function line (line 122) | def line(raw_bytes, *a, **kw):
function alphanumeric (line 133) | def alphanumeric(raw_bytes, *a, **kw):
function printable (line 144) | def printable(raw_bytes, *a, **kw):
function scramble (line 155) | def scramble(raw_bytes, *a, **kw):
FILE: pwnlib/encoders/i386/ascii_shellcode.py
class AsciiShellcodeEncoder (line 15) | class AsciiShellcodeEncoder(Encoder):
method __init__ (line 26) | def __init__(self, slop=20, max_subs=4):
method __call__ (line 47) | def __call__(self, raw_bytes, avoid=None, pcreg=None):
method _get_allocator (line 113) | def _get_allocator(self, size, vocab):
method _find_negatives (line 154) | def _find_negatives(self, vocab):
method _get_subtractions (line 192) | def _get_subtractions(self, shellcode, vocab):
method _calc_subtractions (line 229) | def _calc_subtractions(self, last, target, vocab):
FILE: pwnlib/encoders/i386/delta.py
class i386DeltaEncoder (line 33) | class i386DeltaEncoder(Encoder):
method __call__ (line 54) | def __call__(self, raw_bytes, avoid, pcreg=''):
FILE: pwnlib/encoders/i386/xor.py
class i386XorEncoder (line 22) | class i386XorEncoder(Encoder):
method __call__ (line 65) | def __call__(self, raw_bytes, avoid, pcreg=''):
FILE: pwnlib/encoders/mips/xor.py
class MipsXorEncoder (line 98) | class MipsXorEncoder(Encoder):
method __call__ (line 115) | def __call__(self, raw_bytes, avoid, pcreg=''):
FILE: pwnlib/exception.py
class PwnlibException (line 6) | class PwnlibException(Exception):
method __init__ (line 11) | def __init__(self, msg, reason = None, exit_code = None):
method __repr__ (line 18) | def __repr__(self):
FILE: pwnlib/filepointer.py
function _update_var (line 72) | def _update_var(l):
class IO_flags (line 100) | class IO_flags:
class IO_flags2 (line 119) | class IO_flags2:
class _FlagsUnionBase (line 127) | class _FlagsUnionBase(ctypes.Union):
method __getattr__ (line 128) | def __getattr__(self, name):
method __setattr__ (line 133) | def __setattr__(self, name, value):
method __int__ (line 138) | def __int__(self):
method __str__ (line 141) | def __str__(self):
class _IOFileFlags_bits (line 145) | class _IOFileFlags_bits(ctypes.LittleEndianStructure):
method __str__ (line 167) | def __str__(self):
class _IOFileFlags (line 170) | class _IOFileFlags(_FlagsUnionBase):
class _IOFileFlags2_bits (line 178) | class _IOFileFlags2_bits(ctypes.LittleEndianStructure):
method __str__ (line 189) | def __str__(self):
class _IOFileFlags2 (line 192) | class _IOFileFlags2(_FlagsUnionBase):
class FileStructure (line 199) | class FileStructure(object):
method __init__ (line 268) | def __init__(self, null=0):
method __setattr__ (line 274) | def __setattr__(self,item,value):
method __repr__ (line 286) | def __repr__(self):
method __len__ (line 296) | def __len__(self):
method __bytes__ (line 299) | def __bytes__(self):
method struntil (line 309) | def struntil(self,v):
method setdefault (line 339) | def setdefault(self,null):
method write (line 372) | def write(self,addr=0,size=0):
method read (line 400) | def read(self,addr=0,size=0):
method orange (line 428) | def orange(self,io_list_all,vtable):
FILE: pwnlib/filesystem/path.py
function mktemp (line 6) | def mktemp(cls):
function mkdtemp (line 10) | def mkdtemp(cls):
FILE: pwnlib/filesystem/ssh.py
class SSHPath (line 17) | class SSHPath(PosixPath):
method __init__ (line 67) | def __init__(self, path, ssh=None):
method _s (line 74) | def _s(self, other):
method _new (line 82) | def _new(self, path, *a, **kw):
method _run (line 87) | def _run(self, *a, **kw):
method __str__ (line 92) | def __str__(self):
method __fspath__ (line 95) | def __fspath__(self):
method as_posix (line 98) | def as_posix(self):
method __bytes__ (line 101) | def __bytes__(self):
method __repr__ (line 104) | def __repr__(self):
method as_uri (line 107) | def as_uri(self):
method __eq__ (line 110) | def __eq__(self, other):
method __hash__ (line 122) | def __hash__(*a, **kw): ""; raise NotImplementedError
method __lt__ (line 123) | def __lt__(*a, **kw): ""; raise NotImplementedError
method __le__ (line 124) | def __le__(*a, **kw): ""; raise NotImplementedError
method __gt__ (line 125) | def __gt__(*a, **kw): ""; raise NotImplementedError
method __ge__ (line 126) | def __ge__(*a, **kw): ""; raise NotImplementedError
method anchor (line 129) | def anchor(self):
method name (line 133) | def name(self):
method suffix (line 143) | def suffix(self):
method suffixes (line 155) | def suffixes(self):
method stem (line 169) | def stem(self):
method with_name (line 180) | def with_name(self, name):
method with_stem (line 196) | def with_stem(self, name):
method with_suffix (line 205) | def with_suffix(self, suffix):
method relative_to (line 214) | def relative_to(self, *other):
method is_relative_to (line 217) | def is_relative_to(self, *other):
method parts (line 221) | def parts(self):
method joinpath (line 230) | def joinpath(self, *args):
method parent (line 244) | def parent(self):
method parents (line 257) | def parents(self):
method is_absolute (line 269) | def is_absolute(self):
method is_reserved (line 282) | def is_reserved(self):
method match (line 285) | def match(self, path_pattern):
method cwd (line 291) | def cwd(self):
method home (line 295) | def home(self):
method samefile (line 305) | def samefile(self, other_path):
method iterdir (line 322) | def iterdir(self):
method glob (line 339) | def glob(self, pattern):
method rglob (line 342) | def rglob(self, pattern):
method absolute (line 345) | def absolute(self):
method resolve (line 363) | def resolve(self, strict=False):
method stat (line 397) | def stat(self):
method owner (line 410) | def owner(self):
method group (line 413) | def group(self):
method open (line 416) | def open(self, *a, **kw):
method read_bytes (line 431) | def read_bytes(self):
method read_text (line 440) | def read_text(self):
method write_bytes (line 449) | def write_bytes(self, data):
method write_text (line 459) | def write_text(self, data):
method readlink (line 472) | def readlink(self):
method touch (line 478) | def touch(self):
method mkdir (line 491) | def mkdir(self, mode=0o777, parents=False, exist_ok=True):
method chmod (line 531) | def chmod(self, mode):
method lchmod (line 544) | def lchmod(*a, **kw):
method unlink (line 547) | def unlink(self, missing_ok=False):
method rmdir (line 583) | def rmdir(self):
method link_to (line 604) | def link_to(self, target):
method symlink_to (line 607) | def symlink_to(self, target):
method rename (line 629) | def rename(self, target):
method replace (line 648) | def replace(self, target):
method exists (line 667) | def exists(self):
method is_dir (line 688) | def is_dir(self):
method is_file (line 712) | def is_file(self):
method is_symlink (line 736) | def is_symlink(self):
method is_block_device (line 739) | def is_block_device(self):
method is_char_device (line 742) | def is_char_device(self):
method is_fifo (line 745) | def is_fifo(self):
method is_socket (line 748) | def is_socket(self):
method expanduser (line 751) | def expanduser(self):
method mktemp (line 771) | def mktemp(cls):
method mkdtemp (line 776) | def mkdtemp(self):
FILE: pwnlib/flag/flag.py
function submit_flag (line 18) | def submit_flag(flag,
FILE: pwnlib/fmtstr.py
function normalize_writes (line 127) | def normalize_writes(writes):
class AtomWrite (line 163) | class AtomWrite(object):
method __init__ (line 178) | def __init__(self, start, size, integer, mask=None):
method __len__ (line 186) | def __len__(self):
method __key (line 189) | def __key(self):
method __eq__ (line 192) | def __eq__(self, other):
method __ne__ (line 197) | def __ne__(self, other):
method __hash__ (line 200) | def __hash__(self):
method __repr__ (line 203) | def __repr__(self):
method bitsize (line 207) | def bitsize(self):
method end (line 211) | def end(self):
method compute_padding (line 214) | def compute_padding(self, counter):
method replace (line 237) | def replace(self, start=None, size=None, integer=None, mask=None):
method union (line 247) | def union(self, other):
method __getslice__ (line 266) | def __getslice__(self, i, j):
method __getitem__ (line 269) | def __getitem__(self, i):
function make_atoms_simple (line 285) | def make_atoms_simple(address, data, badbytes=frozenset()):
function merge_atoms_writesize (line 328) | def merge_atoms_writesize(atoms, maxsize):
function find_min_hamming_in_range_step (line 358) | def find_min_hamming_in_range_step(prev, step, carry, strict):
function find_min_hamming_in_range (line 416) | def find_min_hamming_in_range(maxbytes, lower, upper, target):
function merge_atoms_overlapping (line 468) | def merge_atoms_overlapping(atoms, sz, szmax, numbwritten, overflows):
function overlapping_atoms (line 565) | def overlapping_atoms(atoms):
class AtomQueue (line 595) | class AtomQueue(object):
method __init__ (line 596) | def __init__(self, numbwritten):
method add (line 601) | def add(self, atom):
method pop (line 606) | def pop(self):
function sort_atoms (line 629) | def sort_atoms(atoms, numbwritten):
function make_payload_dollar (line 694) | def make_payload_dollar(data_offset, atoms, numbwritten=0, countersize=4...
function make_atoms (line 787) | def make_atoms(writes, sz, szmax, numbwritten, overflows, strategy, badb...
function fmtstr_split (line 819) | def fmtstr_split(offset, writes, numbwritten=0, write_size='byte', write...
function fmtstr_payload (line 835) | def fmtstr_payload(offset, writes, numbwritten=0, write_size='byte', wri...
class FmtStr (line 912) | class FmtStr(object):
method __init__ (line 933) | def __init__(self, execute_fmt, offset=None, padlen=0, numbwritten=0, ...
method leak_stack (line 948) | def leak_stack(self, offset, prefix=b""):
method find_offset (line 964) | def find_offset(self):
method _leaker (line 977) | def _leaker(self, addr):
method execute_writes (line 1015) | def execute_writes(self):
method write (line 1029) | def write(self, addr, data):
FILE: pwnlib/gdb.py
function debug_assembly (line 169) | def debug_assembly(asm, gdbscript=None, vma=None, api=False):
function debug_shellcode (line 208) | def debug_shellcode(data, gdbscript=None, vma=None, api=False):
function _execve_script (line 244) | def _execve_script(argv, executable, env, ssh, preexec_fn, preexec_args):
function _gdbserver_args (line 283) | def _gdbserver_args(pid=None, path=None, port=0, gdbserver_args=None, ar...
function _gdbserver_port (line 359) | def _gdbserver_port(gdbserver, ssh):
function _get_which (line 408) | def _get_which(ssh=None):
function _get_runner (line 413) | def _get_runner(ssh=None):
function debug (line 419) | def debug(args, gdbscript=None, gdb_args=None, exe=None, ssh=None, env=N...
function get_gdb_arch (line 740) | def get_gdb_arch():
function binary (line 753) | def binary():
class Breakpoint (line 786) | class Breakpoint:
method __init__ (line 793) | def __init__(self, conn, *args, **kwargs):
method _server_set_breakpoint (line 802) | def _server_set_breakpoint(self, *args, **kwargs):
method __getattr__ (line 806) | def __getattr__(self, item):
method __setattr__ (line 821) | def __setattr__(self, name, value):
method exposed_stop (line 836) | def exposed_stop(self):
class FinishBreakpoint (line 840) | class FinishBreakpoint(Breakpoint):
method __init__ (line 847) | def __init__(self, *args, **kwargs):
method _server_set_breakpoint (line 856) | def _server_set_breakpoint(self, *args, **kwargs):
method __getattr__ (line 861) | def __getattr__(self, item):
method exposed_out_of_scope (line 877) | def exposed_out_of_scope(self):
class Gdb (line 881) | class Gdb:
method __init__ (line 888) | def __init__(self, conn):
method __getattr__ (line 911) | def __getattr__(self, item):
method wait (line 915) | def wait(self):
method interrupt_and_wait (line 920) | def interrupt_and_wait(self):
method continue_nowait (line 925) | def continue_nowait(self):
method continue_and_wait (line 929) | def continue_and_wait(self):
method quit (line 934) | def quit(self):
function attach (line 939) | def attach(target, gdbscript = '', exe = None, gdb_args = None, ssh = No...
function ssh_gdb (line 1367) | def ssh_gdb(ssh, argv, gdbscript = None, arch = None, **kwargs):
function find_module_addresses (line 1395) | def find_module_addresses(binary, ssh=None, ulimit=False):
function corefile (line 1519) | def corefile(process):
function version (line 1578) | def version(program='gdb'):
FILE: pwnlib/gdb_api_bridge.py
class ServeResult (line 15) | class ServeResult:
method __init__ (line 17) | def __init__(self):
method set (line 22) | def set(self, exc):
method wait (line 28) | def wait(self):
class GdbConnection (line 36) | class GdbConnection(Connection):
method serve_gdb_thread (line 45) | def serve_gdb_thread(self, serve_result):
method serve_all (line 59) | def serve_all(self):
class GdbService (line 76) | class GdbService(Service):
method exposed_set_breakpoint (line 82) | def exposed_set_breakpoint(self, client, has_stop, *args, **kwargs):
method exposed_set_finish_breakpoint (line 92) | def exposed_set_finish_breakpoint(self, client, has_stop, has_out_of_s...
method exposed_quit (line 103) | def exposed_quit(self):
FILE: pwnlib/internal/dochelper.py
class ExecDirective (line 17) | class ExecDirective(Directive):
method run (line 21) | def run(self):
function setup (line 38) | def setup(app):
FILE: pwnlib/lexer.py
class PwntoolsLexer (line 14) | class PwntoolsLexer(RegexLexer):
method analyse_text (line 92) | def analyse_text(text):
FILE: pwnlib/libc/glibc.py
function ptr_mangle (line 7) | def ptr_mangle(guard: int, value: int) -> int:
function ptr_demangle (line 32) | def ptr_demangle(guard: int, mangled: int) -> int:
function protect_ptr (line 57) | def protect_ptr(word_addr: int, value: int) -> int:
FILE: pwnlib/libcdb.py
function _turbofast_extract_build_id (line 24) | def _turbofast_extract_build_id(path):
function provider_libcdb (line 82) | def provider_libcdb(hex_encoded_id, search_type):
function query_libc_rip (line 112) | def query_libc_rip(params):
function provider_libc_rip (line 129) | def provider_libc_rip(search_target, search_type):
function provider_local_system (line 157) | def provider_local_system(hex_encoded_id, search_type):
function provider_local_database (line 173) | def provider_local_database(search_target, search_type):
function query_local_database (line 195) | def query_local_database(params):
function search_by_hash (line 237) | def search_by_hash(search_target, search_type='build_id', unstrip=True, ...
function _check_elf_cache (line 294) | def _check_elf_cache(cache_type, search_target, search_type):
function unstrip_libc (line 332) | def unstrip_libc(filename):
function _extract_tarfile (line 426) | def _extract_tarfile(cache_dir, data_filename, tarball):
function _extract_debfile (line 470) | def _extract_debfile(cache_dir, package_filename, package):
function _extract_pkgfile (line 482) | def _extract_pkgfile(cache_dir, package_filename, package):
function _find_libc_package_lib_url (line 486) | def _find_libc_package_lib_url(libc):
function download_libraries (line 503) | def download_libraries(libc_path, unstrip=True):
function _handle_multiple_matching_libcs (line 593) | def _handle_multiple_matching_libcs(matching_libcs):
function search_by_symbol_offsets (line 610) | def search_by_symbol_offsets(symbols, select_index=None, unstrip=True, o...
function search_by_libs_id (line 715) | def search_by_libs_id(libs_id, unstrip=True, offline_only=False):
function search_by_build_id (line 741) | def search_by_build_id(hex_encoded_id, unstrip=True, offline_only=False):
function search_by_md5 (line 770) | def search_by_md5(hex_encoded_id, unstrip=True, offline_only=False):
function search_by_sha1 (line 799) | def search_by_sha1(hex_encoded_id, unstrip=True, offline_only=False):
function search_by_sha256 (line 828) | def search_by_sha256(hex_encoded_id, unstrip=True, offline_only=False):
function _parse_libc_symbol (line 857) | def _parse_libc_symbol(path):
function _pack_libs_info (line 871) | def _pack_libs_info(path, libs_id, libs_url, syms):
function get_build_id_offsets (line 905) | def get_build_id_offsets():
FILE: pwnlib/log.py
function read_log_config (line 134) | def read_log_config(settings):
class Progress (line 159) | class Progress(object):
method __init__ (line 170) | def __init__(self, logger, msg, status, level, args, kwargs):
method _log (line 183) | def _log(self, status, args, kwargs, msgtype):
method status (line 196) | def status(self, status, *args, **kwargs):
method success (line 211) | def success(self, status = 'Done', *args, **kwargs):
method failure (line 222) | def failure(self, status = 'Failed', *args, **kwargs):
method __enter__ (line 233) | def __enter__(self):
method __exit__ (line 236) | def __exit__(self, exc_typ, exc_val, exc_tb):
class Logger (line 243) | class Logger(object):
method __init__ (line 266) | def __init__(self, logger=None):
method _getlevel (line 282) | def _getlevel(self, levelString):
method _log (line 287) | def _log(self, level, msg, args, kwargs, msgtype, progress = None):
method progress (line 297) | def progress(self, message, status = '', *args, **kwargs):
method waitfor (line 322) | def waitfor(self, *args, **kwargs):
method indented (line 326) | def indented(self, message, *args, **kwargs):
method success (line 338) | def success(self, message, *args, **kwargs):
method failure (line 345) | def failure(self, message, *args, **kwargs):
method info_once (line 352) | def info_once(self, message, *args, **kwargs):
method warning_once (line 363) | def warning_once(self, message, *args, **kwargs):
method warn_once (line 374) | def warn_once(self, *args, **kwargs):
method debug (line 380) | def debug(self, message, *args, **kwargs):
method info (line 387) | def info(self, message, *args, **kwargs):
method hexdump (line 394) | def hexdump(self, message, *args, **kwargs):
method maybe_hexdump (line 401) | def maybe_hexdump(self, message, *args, **kwargs):
method warning (line 416) | def warning(self, message, *args, **kwargs):
method warn (line 423) | def warn(self, *args, **kwargs):
method error (line 427) | def error(self, message, *args, **kwargs):
method exception (line 437) | def exception(self, message, *args, **kwargs):
method critical (line 448) | def critical(self, message, *args, **kwargs):
method log (line 455) | def log(self, level, message, *args, **kwargs):
method isEnabledFor (line 463) | def isEnabledFor(self, level):
method setLevel (line 474) | def setLevel(self, level):
method addHandler (line 482) | def addHandler(self, handler):
method removeHandler (line 489) | def removeHandler(self, handler):
method level (line 497) | def level(self):
method level (line 500) | def level(self, value):
class Handler (line 505) | class Handler(logging.StreamHandler):
method stream (line 517) | def stream(self):
method stream (line 520) | def stream(self, value):
method emit (line 522) | def emit(self, record):
class Formatter (line 592) | class Formatter(logging.Formatter):
method format (line 615) | def format(self, record):
function _need_text (line 645) | def _need_text(s):
function getLogger (line 653) | def getLogger(name):
class LogfileHandler (line 656) | class LogfileHandler(logging.FileHandler):
method __init__ (line 657) | def __init__(self):
method stream (line 660) | def stream(self):
method stream (line 663) | def stream(self, value):
method handle (line 665) | def handle(self, *a, **kw):
function install_default_handler (line 691) | def install_default_handler():
FILE: pwnlib/memleak.py
class MemLeak (line 14) | class MemLeak(object):
method __init__ (line 80) | def __init__(self, f, search_range = 20, reraise = True, relative = Fa...
method __repr__ (line 91) | def __repr__(self):
method __call__ (line 100) | def __call__(self, *a, **kw):
method struct (line 103) | def struct(self, address, struct):
method field (line 127) | def field(self, address, obj):
method field_compare (line 147) | def field_compare(self, address, obj, expected):
method _leak (line 172) | def _leak(self, addr, n, recurse=True):
method raw (line 219) | def raw(self, addr, numb):
method _b (line 226) | def _b(self, addr, ndx, size):
method b (line 235) | def b(self, addr, ndx = 0):
method w (line 254) | def w(self, addr, ndx = 0):
method d (line 273) | def d(self, addr, ndx = 0):
method q (line 292) | def q(self, addr, ndx = 0):
method p (line 311) | def p(self, addr, ndx = 0):
method s (line 318) | def s(self, addr):
method n (line 349) | def n(self, addr, numb):
method _clear (line 374) | def _clear(self, addr, ndx, size):
method clearb (line 383) | def clearb(self, addr, ndx = 0):
method clearw (line 404) | def clearw(self, addr, ndx = 0):
method cleard (line 423) | def cleard(self, addr, ndx = 0):
method clearq (line 442) | def clearq(self, addr, ndx = 0):
method _set (line 460) | def _set(self, addr, val, ndx, size):
method setb (line 465) | def setb(self, addr, val, ndx = 0):
method setw (line 479) | def setw(self, addr, val, ndx = 0):
method setd (line 493) | def setd(self, addr, val, ndx = 0):
method setq (line 501) | def setq(self, addr, val, ndx = 0):
method sets (line 509) | def sets(self, addr, val, null_terminate = True):
method __getitem__ (line 530) | def __getitem__(self, item):
method compare (line 543) | def compare(self, address, bts):
method NoNulls (line 550) | def NoNulls(function):
method NoWhitespace (line 568) | def NoWhitespace(function):
method NoNewlines (line 586) | def NoNewlines(function):
method String (line 604) | def String(function):
class RelativeMemLeak (line 634) | class RelativeMemLeak(MemLeak):
method __init__ (line 635) | def __init__(self, *a, **kw):
FILE: pwnlib/protocols/adb/__init__.py
function pack (line 27) | def pack(val):
function unpack (line 30) | def unpack(val):
class Message (line 36) | class Message(object):
method __init__ (line 38) | def __init__(self, string):
method __bytes__ (line 40) | def __bytes__(self):
method __str__ (line 42) | def __str__(self):
method __flat__ (line 44) | def __flat__(self):
class Connection (line 47) | class Connection(remote):
method __init__ (line 49) | def __init__(self, host, port, level=None, *a, **kw):
method close (line 58) | def close(self):
method adb_send (line 62) | def adb_send(self, message):
method adb_unpack (line 66) | def adb_unpack(self):
method flat32 (line 69) | def flat32(self, *a, **kw):
class Process (line 73) | class Process(Connection):
class AdbClient (line 76) | class AdbClient(Logger):
method __init__ (line 78) | def __init__(self, level=None):
method c (line 89) | def c(self):
method _autoclose (line 116) | def _autoclose(fn):
method _with_transport (line 128) | def _with_transport(fn):
method send (line 141) | def send(self, *a, **kw):
method unpack (line 147) | def unpack(self, *a, **kw):
method recvl (line 151) | def recvl(self):
method kill (line 157) | def kill(self):
method version (line 182) | def version(self):
method devices (line 201) | def devices(self, long=False):
method track_devices (line 220) | def track_devices(self):
method transport (line 233) | def transport(self, serial=None, try_again=True):
method execute (line 268) | def execute(self, argv):
method _basic_wrapper (line 291) | def _basic_wrapper(string):
method remount (line 301) | def remount(self):
method root (line 307) | def root(self):
method unroot (line 315) | def unroot(self):
method disable_verity (line 321) | def disable_verity(self):
method enable_verity (line 327) | def enable_verity(self):
method reconnect (line 333) | def reconnect(self):
method reboot (line 339) | def reboot(self):
method reboot_bootloader (line 345) | def reboot_bootloader(self):
method wait_for_device (line 350) | def wait_for_device(self, serial=''):
method _sync (line 369) | def _sync(fn):
method list (line 379) | def list(self, path):
method _list (line 430) | def _list(self, path):
method stat (line 464) | def stat(self, path):
method write (line 500) | def write(self, path, data, mode=0o755, timestamp=None, callback=None):
method _write (line 528) | def _write(self, path, data, mode=0o755, timestamp=None, callback=None):
method read (line 557) | def read(self, path, filesize=0, callback=lambda *a: True):
method forward (line 619) | def forward(self, device, host_proto, host_port, device_proto, device_...
method __enter__ (line 623) | def __enter__(self, *a, **kw):
method __exit__ (line 627) | def __exit__(self, *a, **kw): pass
function proxy (line 629) | def proxy(port=9999):
FILE: pwnlib/py2compat.py
function py2_monkey_patch (line 18) | def py2_monkey_patch(module):
function get_terminal_size (line 27) | def get_terminal_size(fallback=(80, 24)):
class terminal_size (line 73) | class terminal_size(tuple):
method columns (line 75) | def columns(self):
method lines (line 79) | def lines(self):
method __repr__ (line 82) | def __repr__(self):
function get_terminal_size (line 90) | def get_terminal_size(fd): # pylint: disable=function-redefined
FILE: pwnlib/qemu.py
function archname (line 85) | def archname():
function user_path (line 109) | def user_path():
function ld_prefix (line 137) | def ld_prefix(path=None, env=None):
FILE: pwnlib/regsort.py
function check_cycle (line 14) | def check_cycle(reg, assignments, mapping=None):
function check_cycle_ (line 40) | def check_cycle_(reg, assignments, path, mapping):
function extract_dependencies (line 67) | def extract_dependencies(reg, assignments, mapping=None):
function resolve_order (line 88) | def resolve_order(reg, deps):
function depends_on_cycle (line 111) | def depends_on_cycle(reg, assignments, in_cycles):
function regsort (line 118) | def regsort(in_out, all_regs, mapping = None, tmp = None, xchg = True, r...
FILE: pwnlib/replacements.py
function sleep (line 7) | def sleep(n):
FILE: pwnlib/rop/call.py
class Unresolved (line 10) | class Unresolved(object):
class CurrentStackPointer (line 23) | class CurrentStackPointer(Unresolved):
class NextGadgetAddress (line 30) | class NextGadgetAddress(Unresolved):
class StackAdjustment (line 42) | class StackAdjustment(Unresolved):
class AppendedArgument (line 56) | class AppendedArgument(Unresolved):
method __init__ (line 103) | def __init__(self, value, address = 0):
method address (line 127) | def address(self):
method address (line 131) | def address(self, value):
method local (line 142) | def local(self, address):
method resolve (line 155) | def resolve(self, addr=None):
method __len__ (line 187) | def __len__(self):
method __bytes__ (line 190) | def __bytes__(self):
method __repr__ (line 193) | def __repr__(self):
class Call (line 200) | class Call(object):
method __init__ (line 223) | def __init__(self, name, target, args, abi=None, before=()):
method __repr__ (line 235) | def __repr__(self):
method is_flat (line 242) | def is_flat(self):
method register_arguments (line 250) | def register_arguments(self):
method stack_arguments (line 254) | def stack_arguments(self):
method _special_repr (line 258) | def _special_repr(cls, x):
method __str__ (line 266) | def __str__(self):
FILE: pwnlib/rop/gadgets.py
class Gadget (line 1) | class Gadget(object):
method __init__ (line 38) | def __init__(self, address, insns, regs, move):
method __repr__ (line 46) | def __repr__(self):
method __getitem__ (line 53) | def __getitem__(self, key):
method __setitem__ (line 59) | def __setitem__(self, key, value):
FILE: pwnlib/rop/ret2csu.py
function ret2csu (line 12) | def ret2csu(rop, elf, edi, rsi, rdx, rbx, rbp, r12, r13, r14, r15, call=...
FILE: pwnlib/rop/ret2dlresolve.py
class Elf32_Rel (line 81) | class Elf32_Rel(object):
method __init__ (line 92) | def __init__(self, r_offset=0, r_info=0):
method __flat__ (line 96) | def __flat__(self):
method __bytes__ (line 99) | def __bytes__(self):
class Elf64_Rel (line 103) | class Elf64_Rel(object):
method __init__ (line 114) | def __init__(self, r_offset=0, r_info=0):
method __flat__ (line 118) | def __flat__(self):
method __bytes__ (line 121) | def __bytes__(self):
class Elf32_Sym (line 125) | class Elf32_Sym(object):
method __init__ (line 140) | def __init__(self, st_name=0, st_value=0, st_size=0, st_info=0, st_oth...
method __flat__ (line 148) | def __flat__(self):
method __bytes__ (line 156) | def __bytes__(self):
class Elf64_Sym (line 160) | class Elf64_Sym(object):
method __init__ (line 175) | def __init__(self, st_name=0, st_value=0, st_size=0, st_info=0, st_oth...
method __flat__ (line 183) | def __flat__(self):
method __bytes__ (line 191) | def __bytes__(self):
class Queue (line 195) | class Queue(list):
method size (line 197) | def size(self):
class MarkedBytes (line 209) | class MarkedBytes(bytes):
class Ret2dlresolvePayload (line 214) | class Ret2dlresolvePayload(object):
method __init__ (line 238) | def __init__(self, elf, symbol, args, data_addr=None, resolution_addr=...
method _format_args (line 263) | def _format_args(self):
method _get_recommended_address (line 276) | def _get_recommended_address(self):
method _build_structures (line 283) | def _build_structures(self):
method _build_args (line 349) | def _build_args(self):
method _build (line 385) | def _build(self):
FILE: pwnlib/rop/rop.py
class Padding (line 404) | class Padding(object):
method __init__ (line 408) | def __init__(self, name='<pad>'):
function _slot_len (line 411) | def _slot_len(x):
class DescriptiveStack (line 417) | class DescriptiveStack(list):
method __init__ (line 429) | def __init__(self, address):
method next (line 436) | def next(self):
method describe (line 442) | def describe(self, text, address = None):
method dump (line 447) | def dump(self):
class ROP (line 472) | class ROP(object):
method __init__ (line 589) | def __init__(self, elfs, base = None, badchars = b'', **kwargs):
method from_blob (line 625) | def from_blob(blob, *a, **kw):
method setRegisters (line 628) | def setRegisters(self, registers):
method __call__ (line 732) | def __call__(self, *args, **kwargs):
method resolve (line 772) | def resolve(self, resolvable):
method unresolve (line 789) | def unresolve(self, value):
method generatePadding (line 810) | def generatePadding(self, offset, count):
method describe (line 833) | def describe(self, object):
method build (line 846) | def build(self, base = None, description = None):
method chain (line 1040) | def chain(self, base=None):
method dump (line 1053) | def dump(self, base=None):
method regs (line 1063) | def regs(self, registers=None, **kw):
method call (line 1070) | def call(self, resolvable, arguments = (), abi = None, **kwargs):
method _srop_call (line 1102) | def _srop_call(self, resolvable, arguments):
method find_gadget (line 1156) | def find_gadget(self, instructions):
method _flatten (line 1166) | def _flatten(self, initial_list):
method raw (line 1176) | def raw(self, value):
method migrate (line 1212) | def migrate(self, next_base):
method __bytes__ (line 1230) | def __bytes__(self):
method __flat__ (line 1234) | def __flat__(self):
method __flat_at__ (line 1237) | def __flat_at__(self, address):
method __get_cachefile_name (line 1240) | def __get_cachefile_name(self, files):
method clear_cache (line 1258) | def clear_cache():
method __cache_load (line 1265) | def __cache_load(self, elf):
method __cache_save (line 1274) | def __cache_save(self, elf, data):
method __load (line 1281) | def __load(self):
method __repr__ (line 1398) | def __repr__(self):
method search_iter (line 1401) | def search_iter(self, move=None, regs=None):
method search (line 1418) | def search(self, move = 0, regs = None, order = 'size'):
method ret2csu (line 1463) | def ret2csu(self, edi=Padding('edi'), rsi=Padding('rsi'),
method ret2dlresolve (line 1537) | def ret2dlresolve(self, dlresolve):
method __getattr__ (line 1550) | def __getattr__(self, attr):
method __setattr__ (line 1629) | def __setattr__(self, attr, value):
FILE: pwnlib/rop/srop.py
class SigreturnFrame (line 252) | class SigreturnFrame(dict):
method __init__ (line 360) | def __init__(self):
method __setitem__ (line 374) | def __setitem__(self, item, value):
method __setattr__ (line 383) | def __setattr__(self, attr, value):
method __getattr__ (line 389) | def __getattr__(self, attr):
method __bytes__ (line 394) | def __bytes__(self):
method __str__ (line 403) | def __str__(self):
method __len__ (line 406) | def __len__(self):
method __flat__ (line 409) | def __flat__(self):
method registers (line 413) | def registers(self):
method register_offsets (line 419) | def register_offsets(self):
method arguments (line 425) | def arguments(self):
method arguments (line 430) | def arguments(self, a):
method sp (line 435) | def sp(self):
method sp (line 439) | def sp(self, v):
method pc (line 443) | def pc(self):
method pc (line 447) | def pc(self, v):
method syscall (line 451) | def syscall(self):
method syscall (line 455) | def syscall(self, v):
method syscall_register (line 459) | def syscall_register(self):
method set_regvalue (line 462) | def set_regvalue(self, reg, val):
method get_spindex (line 468) | def get_spindex(self):
FILE: pwnlib/runner.py
function run_assembly (line 12) | def run_assembly(assembly):
function run_shellcode (line 43) | def run_shellcode(bytes, **kw):
function run_assembly_exitcode (line 71) | def run_assembly_exitcode(assembly):
function run_shellcode_exitcode (line 90) | def run_shellcode_exitcode(bytes):
FILE: pwnlib/shellcraft/__init__.py
class module (line 13) | class module(ModuleType):
method __init__ (line 16) | def __init__(self, name, directory):
method _get_source (line 39) | def _get_source(self, template):
method __lazyinit__ (line 43) | def __lazyinit__(self):
method __getattr__ (line 67) | def __getattr__(self, key):
method __dir__ (line 88) | def __dir__(self):
method _context_modules (line 101) | def _context_modules(self):
method __shellcodes__ (line 107) | def __shellcodes__(self):
method templates (line 115) | def templates(self):
method eval (line 135) | def eval(self, item):
method pretty (line 140) | def pretty(self, n, comment=True):
method okay (line 156) | def okay(self, s, *a, **kw):
class LazyImporter (line 169) | class LazyImporter:
method find_module (line 170) | def find_module(self, fullname, path=None):
method load_module (line 183) | def load_module(self, fullname):
FILE: pwnlib/shellcraft/internal.py
function init_mako (line 10) | def init_mako():
function lookup_template (line 76) | def lookup_template(filename):
function get_context_from_dirpath (line 84) | def get_context_from_dirpath(directory):
function make_function (line 109) | def make_function(funcname, filename, directory):
FILE: pwnlib/shellcraft/registers.py
class Register (line 171) | class Register(object):
method __init__ (line 207) | def __init__(self, name, size):
method bits (line 233) | def bits(self):
method bytes (line 237) | def bytes(self):
method fits (line 240) | def fits(self, value):
method __str__ (line 243) | def __str__(self):
method __repr__ (line 246) | def __repr__(self):
function get_register (line 255) | def get_register(name):
function is_register (line 262) | def is_register(obj):
function bits_required (line 268) | def bits_required(value):
function current (line 279) | def current():
function register_size (line 310) | def register_size(reg):
function fits_in_register (line 313) | def fits_in_register(reg, value):
FILE: pwnlib/term/__init__.py
function can_init (line 22) | def can_init():
function init (line 60) | def init():
FILE: pwnlib/term/completer.py
class Completer (line 7) | class Completer:
method complete (line 8) | def complete(self, _left, _right):
method suggest (line 10) | def suggest(self, _left, _right):
method __enter__ (line 12) | def __enter__(self):
method __exit__ (line 16) | def __exit__(self, *args):
class WordCompleter (line 20) | class WordCompleter(Completer):
method __init__ (line 21) | def __init__(self, delims = None):
method _get_word (line 26) | def _get_word(self, left):
method _update (line 35) | def _update(self, w):
method complete (line 41) | def complete(self, buffer_left, buffer_right):
method suggest (line 49) | def suggest(self, buffer_left, _buffer_right):
method complete_word (line 54) | def complete_word(self, word):
class LongestPrefixCompleter (line 57) | class LongestPrefixCompleter(WordCompleter):
method __init__ (line 58) | def __init__(self, words = None, delims = None):
method complete_word (line 63) | def complete_word(self, word):
class PathCompleter (line 82) | class PathCompleter(Completer):
method __init__ (line 83) | def __init__(self, mask = '*', only_dirs = False):
method _update (line 92) | def _update(self, prefix):
method complete (line 121) | def complete(self, buffer_left, buffer_right):
method suggest (line 141) | def suggest(self, buffer_left, buffer_right):
FILE: pwnlib/term/key.py
function getch (line 20) | def getch(timeout = 0):
function getraw (line 38) | def getraw(timeout = None):
class Matcher (line 49) | class Matcher:
method __init__ (line 50) | def __init__(self, desc):
method __call__ (line 83) | def __call__(self, k):
method __eq__ (line 90) | def __eq__(self, other):
method __neq__ (line 101) | def __neq__(self, other):
method __hash__ (line 104) | def __hash__(self):
method __str__ (line 107) | def __str__(self):
class Key (line 110) | class Key:
method __init__ (line 111) | def __init__(self, type, code = None, mods = kc.MOD_NONE):
method __str__ (line 117) | def __str__(self):
method __repr__ (line 144) | def __repr__(self):
method __eq__ (line 147) | def __eq__(self, other):
function _read (line 163) | def _read(timeout = 0):
function _peek (line 166) | def _peek():
function get (line 170) | def get(timeout = None):
function unget (line 179) | def unget(k):
function _name_to_key (line 183) | def _name_to_key(fname):
function _peek_ti (line 198) | def _peek_ti():
function _init_ti_table (line 208) | def _init_ti_table():
function _parse_csi (line 220) | def _parse_csi(offset):
function _csi_func (line 260) | def _csi_func(cmd, args):
function _csi_ss3 (line 275) | def _csi_ss3(cmd, args):
function _csi_u (line 282) | def _csi_u(cmd, args):
function _csi_R (line 288) | def _csi_R(cmd, args):
function _peekkey_csi (line 369) | def _peekkey_csi(offset):
function _peekkey_ss3 (line 391) | def _peekkey_ss3(offset):
function _peek_csi (line 410) | def _peek_csi():
function _peek_simple (line 425) | def _peek_simple():
FILE: pwnlib/term/keymap.py
class Keymap (line 7) | class Keymap:
method __init__ (line 8) | def __init__(self, bindings, on_match = None, on_nomatch = None,
method handle_input (line 18) | def handle_input(self):
method stop (line 23) | def stop(self):
method currently_entered (line 27) | def currently_entered(self):
method reset (line 30) | def reset(self):
method send (line 34) | def send(self, k):
method register (line 58) | def register(self, desc, cb = None):
method unregister (line 80) | def unregister(self, desc, cb = None):
method on_match (line 106) | def on_match(self, cb):
method on_nomatch (line 109) | def on_nomatch(self, cb):
method on_key (line 112) | def on_key(self, cb):
FILE: pwnlib/term/readline.py
function force_to_bytes (line 35) | def force_to_bytes(data):
function set_completer (line 43) | def set_completer(completer):
function fmt_suggestions (line 52) | def fmt_suggestions(suggestions):
function auto_complete (line 69) | def auto_complete(*_):
function handle_keypress (line 84) | def handle_keypress(trace):
function clear (line 92) | def clear():
function redisplay (line 99) | def redisplay():
function self_insert (line 133) | def self_insert(trace):
function set_buffer (line 140) | def set_buffer(left, right):
function cancel_search (line 146) | def cancel_search(*_):
function commit_search (line 152) | def commit_search():
function update_search_results (line 159) | def update_search_results():
function search_history (line 180) | def search_history(*_):
function history_prev (line 191) | def history_prev(*_):
function history_next (line 203) | def history_next(*_):
function backward_char (line 216) | def backward_char(*_):
function forward_char (line 224) | def forward_char(*_):
function insert_text (line 232) | def insert_text(s):
function submit (line 241) | def submit(*_):
function control_c (line 247) | def control_c(*_):
function control_d (line 260) | def control_d(*_):
function kill_to_end (line 267) | def kill_to_end(*_):
function delete_char_forward (line 273) | def delete_char_forward(*_):
function delete_char_backward (line 280) | def delete_char_backward(*_):
function kill_word_backward (line 287) | def kill_word_backward(*_):
function backward_word (line 301) | def backward_word(*_):
function forward_word (line 316) | def forward_word(*_):
function go_beginning (line 331) | def go_beginning(*_):
function go_end (line 335) | def go_end(*_):
function readline (line 367) | def readline(_size=-1, prompt='', float=True, priority=10):
function raw_input (line 424) | def raw_input(prompt='', float=True):
function str_input (line 437) | def str_input(prompt='', float=True):
function eval_input (line 450) | def eval_input(prompt='', float=True):
function init (line 476) | def init():
FILE: pwnlib/term/spinners.py
function billboard (line 3) | def billboard(msg, window):
FILE: pwnlib/term/term.py
class WinchLock (line 38) | class WinchLock(object):
method __init__ (line 39) | def __init__(self):
method acquire (line 44) | def acquire(self):
method release (line 48) | def release(self):
method __enter__ (line 51) | def __enter__(self):
method __exit__ (line 54) | def __exit__(self, tp, val, tb):
function show_cursor (line 64) | def show_cursor():
function hide_cursor (line 67) | def hide_cursor():
function update_geometry (line 70) | def update_geometry():
function handler_sigwinch (line 74) | def handler_sigwinch(signum, stack):
function handler_sigstop (line 90) | def handler_sigstop(signum, stack):
function handler_sigcont (line 94) | def handler_sigcont(signum, stack):
function setupterm (line 100) | def setupterm():
function resetterm (line 119) | def resetterm():
function init (line 130) | def init():
function put (line 165) | def put(s):
function do (line 206) | def do(c, *args):
function goto (line 211) | def goto(rc):
class Cell (line 234) | class Cell(object):
method __init__ (line 235) | def __init__(self, value, float):
method draw (line 239) | def draw(self):
method update (line 245) | def update(self, value):
method prepare_redraw (line 262) | def prepare_redraw(self):
method update_locked (line 273) | def update_locked(self, erase_line=False):
method __repr__ (line 326) | def __repr__(self):
class WeakCellList (line 330) | class WeakCellList(object):
method __init__ (line 331) | def __init__(self):
method cells (line 337) | def cells(self):
method floats (line 341) | def floats(self):
method iter_field (line 344) | def iter_field(self, *Ls):
method __iter__ (line 353) | def __iter__(self):
method iter_after (line 356) | def iter_after(self, v):
method clear (line 363) | def clear(self):
method insert (line 369) | def insert(self, v, before):
method append (line 377) | def append(self, v):
function get_position (line 385) | def get_position():
function output (line 392) | def output(s='', float=False, priority=10, frozen=False, indent=0, befor...
FILE: pwnlib/term/text.py
function eval_when (line 9) | def eval_when(when):
class Module (line 23) | class Module(types.ModuleType):
method __init__ (line 24) | def __init__(self):
method when (line 52) | def when(self):
method when (line 56) | def when(self, val):
method has_bright (line 60) | def has_bright(self):
method has_gray (line 64) | def has_gray(self):
method _fg_color (line 67) | def _fg_color(self, c):
method _bg_color (line 73) | def _bg_color(self, c):
method _decorator (line 79) | def _decorator(self, desc, init):
method __getattr__ (line 94) | def __getattr__(self, desc):
method get (line 129) | def get(self, desc):
FILE: pwnlib/term/unix_termcap.py
function get (line 8) | def get(cap, *args, **kwargs):
function init (line 42) | def init():
FILE: pwnlib/term/windows_termcap.py
function get (line 11) | def get(cap, *args, **kwargs):
function init (line 30) | def init():
function _check_bool (line 58) | def _check_bool(result, func, args):
function set_conout_mode (line 69) | def set_conout_mode(new_mode, mask=0xffffffff):
function enable_vt_mode (line 83) | def enable_vt_mode():
FILE: pwnlib/testexample.py
function add (line 45) | def add(a, b):
FILE: pwnlib/timeout.py
class _DummyContextClass (line 9) | class _DummyContextClass(object):
method __enter__ (line 10) | def __enter__(self): pass
method __exit__ (line 11) | def __exit__(self,*a): pass
class _countdown_handler (line 15) | class _countdown_handler(object):
method __init__ (line 16) | def __init__(self, obj, timeout):
method __enter__ (line 20) | def __enter__(self):
method __exit__ (line 31) | def __exit__(self, *a):
class _local_handler (line 36) | class _local_handler(object):
method __init__ (line 37) | def __init__(self, obj, timeout):
method __enter__ (line 40) | def __enter__(self):
method __exit__ (line 48) | def __exit__(self, *a):
class TimeoutDefault (line 53) | class TimeoutDefault(object):
method __repr__ (line 54) | def __repr__(self): return "pwnlib.timeout.Timeout.default"
method __str__ (line 55) | def __str__(self): return "<default timeout>"
class Maximum (line 57) | class Maximum(float):
method __repr__ (line 58) | def __repr__(self):
class Timeout (line 62) | class Timeout(object):
method __init__ (line 126) | def __init__(self, timeout=default):
method timeout (line 131) | def timeout(self):
method timeout (line 144) | def timeout(self, value):
method _get_timeout_seconds (line 149) | def _get_timeout_seconds(self, value):
method countdown_active (line 166) | def countdown_active(self):
method timeout_change (line 169) | def timeout_change(self):
method countdown (line 175) | def countdown(self, timeout = default):
method local (line 200) | def local(self, timeout):
FILE: pwnlib/tubes/buffer.py
class Buffer (line 4) | class Buffer(object):
method __init__ (line 32) | def __init__(self, buffer_fill_size = None):
method __len__ (line 37) | def __len__(self):
method __nonzero__ (line 49) | def __nonzero__(self):
method __contains__ (line 52) | def __contains__(self, x):
method index (line 67) | def index(self, x):
method add (line 82) | def add(self, data):
method unget (line 99) | def unget(self, data):
method get (line 124) | def get(self, want=float('inf')):
method get_fill_size (line 174) | def get_fill_size(self, size=None):
FILE: pwnlib/tubes/listen.py
class listen (line 11) | class listen(sock):
method __init__ (line 79) | def __init__(self, port=0, bindaddr='::',
method spawn_process (line 149) | def spawn_process(self, *args, **kwargs):
method wait_for_connection (line 160) | def wait_for_connection(self):
method sock (line 166) | def sock(self):
method sock (line 175) | def sock(self, s):
method close (line 178) | def close(self):
FILE: pwnlib/tubes/process.py
class PTY (line 37) | class PTY(object): pass
class process (line 44) | class process(tube):
method __init__ (line 234) | def __init__(self, argv = None,
method __preexec_fn (line 425) | def __preexec_fn(self):
method __on_enoexec (line 482) | def __on_enoexec(self, exception):
method program (line 522) | def program(self):
method cwd (line 537) | def cwd(self):
method _validate (line 561) | def _validate(self, cwd, executable, argv, env):
method _handles (line 633) | def _handles(self, stdin, stdout, stderr):
method __getattr__ (line 664) | def __getattr__(self, attr):
method kill (line 672) | def kill(self):
method terminate (line 679) | def terminate(self):
method poll (line 713) | def poll(self, block = False):
method communicate (line 745) | def communicate(self, stdin = None):
method recv_raw (line 754) | def recv_raw(self, numb):
method send_raw (line 792) | def send_raw(self, data):
method settimeout_raw (line 806) | def settimeout_raw(self, timeout):
method can_recv_raw (line 809) | def can_recv_raw(self, timeout):
method connected_raw (line 840) | def connected_raw(self, direction):
method close (line 848) | def close(self):
method fileno (line 874) | def fileno(self):
method shutdown_raw (line 880) | def shutdown_raw(self, direction):
method __pty_make_controlling_tty (line 890) | def __pty_make_controlling_tty(self, tty_fd):
method maps (line 936) | def maps(self):
method get_mapping (line 1014) | def get_mapping(self, path_value, single=True):
method stack_mapping (line 1059) | def stack_mapping(self, single=True):
method heap_mapping (line 1088) | def heap_mapping(self, single=True):
method vdso_mapping (line 1120) | def vdso_mapping(self, single=True):
method vvar_mapping (line 1149) | def vvar_mapping(self, single=True):
method libc_mapping (line 1178) | def libc_mapping(self, single=True):
method musl_mapping (line 1232) | def musl_mapping(self, single=True):
method elf_mapping (line 1259) | def elf_mapping(self, single=True):
method lib_size (line 1297) | def lib_size(self, path_value):
method address_mapping (line 1342) | def address_mapping(self, address):
method libs (line 1373) | def libs(self):
method libc (line 1400) | def libc(self):
method elf (line 1430) | def elf(self):
method corefile (line 1439) | def corefile(self):
method leak (line 1487) | def leak(self, address, count=1):
method writemem (line 1521) | def writemem(self, address, data):
method stdin (line 1566) | def stdin(self):
method stdout (line 1573) | def stdout(self):
method stderr (line 1580) | def stderr(self):
function _read_in_thread (line 1589) | def _read_in_thread(recv_queue, proc_stdout):
FILE: pwnlib/tubes/remote.py
class remote (line 10) | class remote(sock):
method __init__ (line 62) | def __init__(self, host, port,
method _connect (line 105) | def _connect(self, fam, typ):
method fromsocket (line 136) | def fromsocket(cls, socket):
class tcp (line 151) | class tcp(remote):
method __init__ (line 153) | def __init__(self, host, port, *a, **kw):
class udp (line 156) | class udp(remote):
method __init__ (line 158) | def __init__(self, host, port, *a, **kw):
class connect (line 161) | class connect(remote):
FILE: pwnlib/tubes/serialtube.py
class serialtube (line 13) | class serialtube(tube.tube):
method __init__ (line 14) | def __init__(
method recv_raw (line 52) | def recv_raw(self, numb):
method send_raw (line 67) | def send_raw(self, data):
method settimeout_raw (line 79) | def settimeout_raw(self, timeout):
method can_recv_raw (line 82) | def can_recv_raw(self, timeout):
method connected_raw (line 90) | def connected_raw(self, direction):
method close (line 93) | def close(self):
method fileno (line 98) | def fileno(self):
method shutdown_raw (line 104) | def shutdown_raw(self, direction):
FILE: pwnlib/tubes/server.py
class server (line 13) | class server(sock):
method __init__ (line 68) | def __init__(self, port=0, bindaddr = "::", fam = "any", typ = "tcp",
method next_connection (line 143) | def next_connection(self):
method close (line 146) | def close(self):
FILE: pwnlib/tubes/sock.py
class sock (line 10) | class sock(tube):
method __init__ (line 13) | def __init__(self, *args, **kwargs):
method recvall (line 18) | def recvall(self, timeout = tube.forever):
method recv_raw (line 29) | def recv_raw(self, numb, *a):
method send_raw (line 56) | def send_raw(self, data):
method settimeout_raw (line 70) | def settimeout_raw(self, timeout):
method can_recv_raw (line 75) | def can_recv_raw(self, timeout):
method connected_raw (line 113) | def connected_raw(self, direction):
method close (line 160) | def close(self):
method _close_msg (line 173) | def _close_msg(self):
method fileno (line 176) | def fileno(self):
method shutdown_raw (line 182) | def shutdown_raw(self, direction):
method _get_family (line 210) | def _get_family(cls, fam):
method _get_type (line 227) | def _get_type(cls, typ):
FILE: pwnlib/tubes/ssh.py
class ssh_channel (line 33) | class ssh_channel(sock):
method __init__ (line 55) | def __init__(self, parent, process = None, tty = False, cwd = None, en...
method kill (line 138) | def kill(self):
method recvall (line 146) | def recvall(self, timeout = sock.forever):
method wait (line 169) | def wait(self, timeout=sock.default):
method poll (line 173) | def poll(self, block=False):
method can_recv_raw (line 188) | def can_recv_raw(self, timeout):
method interactive (line 196) | def interactive(self, prompt = term.text.bold_red('$') + ' '):
method close (line 277) | def close(self):
method spawn_process (line 283) | def spawn_process(self, *args, **kwargs):
method _close_msg (line 286) | def _close_msg(self):
class ssh_process (line 289) | class ssh_process(ssh_channel):
method libs (line 305) | def libs(self):
method libc (line 331) | def libc(self):
method elf (line 354) | def elf(self):
method corefile (line 370) | def corefile(self):
method getenv (line 379) | def getenv(self, variable, **kwargs):
method _close_msg (line 422) | def _close_msg(self):
class ssh_connecter (line 433) | class ssh_connecter(sock):
method __init__ (line 434) | def __init__(self, parent, host, port, *a, **kw):
method spawn_process (line 492) | def spawn_process(self, *args, **kwargs):
method _close_msg (line 495) | def _close_msg(self):
class ssh_listener (line 499) | class ssh_listener(sock):
method __init__ (line 500) | def __init__(self, parent, bind_address, port, *a, **kw):
method _close_msg (line 534) | def _close_msg(self):
method spawn_process (line 537) | def spawn_process(self, *args, **kwargs):
method wait_for_connection (line 540) | def wait_for_connection(self):
method sock (line 546) | def sock(self):
method sock (line 556) | def sock(self, s):
class ssh (line 560) | class ssh(Timeout, Logger):
method __init__ (line 595) | def __init__(self, user=None, host=None, port=22, password=None, key=N...
method __repr__ (line 750) | def __repr__(self):
method cwd (line 754) | def cwd(self):
method cwd (line 758) | def cwd(self, cwd):
method sftp (line 764) | def sftp(self):
method sftp (line 778) | def sftp(self, value):
method __enter__ (line 782) | def __enter__(self, *a):
method __exit__ (line 785) | def __exit__(self, *a, **kw):
method shell (line 788) | def shell(self, shell = None, tty = True, timeout = Timeout.default):
method process (line 811) | def process(self, argv=None, executable=None, tty=True, cwd=None, env=...
method which (line 1062) | def which(self, program):
method system (line 1081) | def system(self, process, tty = True, cwd = None, env = None, timeout ...
method getenv (line 1124) | def getenv(self, variable, **kwargs):
method run_to_end (line 1155) | def run_to_end(self, process, tty = False, cwd = None, env = None, wd ...
method connect_remote (line 1181) | def connect_remote(self, host, port, timeout = Timeout.default):
method listen_remote (line 1205) | def listen_remote(self, port = 0, bind_address = '', timeout = Timeout...
method __getitem__ (line 1229) | def __getitem__(self, attr):
method __call__ (line 1240) | def __call__(self, attr):
method __getattr__ (line 1251) | def __getattr__(self, attr):
method connected (line 1290) | def connected(self):
method close (line 1304) | def close(self):
method _libs_remote (line 1311) | def _libs_remote(self, remote):
method _get_fingerprint (line 1331) | def _get_fingerprint(self, remote):
method _get_cachefile (line 1346) | def _get_cachefile(self, fingerprint):
method _verify_local_fingerprint (line 1349) | def _verify_local_fingerprint(self, fingerprint):
method _download_raw (line 1365) | def _download_raw(self, remote, local, h):
method _download_to_cache (line 1409) | def _download_to_cache(self, remote, p, fingerprint=True):
method download_data (line 1438) | def download_data(self, remote, fingerprint=True):
method download_file (line 1463) | def download_file(self, remote, local = None):
method download_dir (line 1497) | def download_dir(self, remote=None, local=None, ignore_failed_read=Fal...
method upload_data (line 1544) | def upload_data(self, data, remote):
method upload_file (line 1589) | def upload_file(self, filename, remote = None):
method upload_dir (line 1610) | def upload_dir(self, local, remote=None):
method upload (line 1645) | def upload(self, file_or_directory, remote=None):
method download (line 1667) | def download(self, file_or_directory, local=None):
method unlink (line 1702) | def unlink(self, file):
method libs (line 1715) | def libs(self, remote, directory = None, flatten = False):
method interactive (line 1776) | def interactive(self, shell=None):
method set_working_directory (line 1792) | def set_working_directory(self, wd = None, symlink = False):
method write (line 1889) | def write(self, path, data):
method read (line 1894) | def read(self, path):
method _init_remote_platform_info (line 1898) | def _init_remote_platform_info(self):
method os (line 1944) | def os(self):
method arch (line 1955) | def arch(self):
method bits (line 1965) | def bits(self):
method version (line 1976) | def version(self):
method distro (line 1992) | def distro(self):
method aslr (line 2001) | def aslr(self):
method aslr_ulimit (line 2024) | def aslr_ulimit(self):
method _cpuinfo (line 2083) | def _cpuinfo(self):
method user_shstk (line 2093) | def user_shstk(self):
method ibt (line 2114) | def ibt(self):
method _checksec_cache (line 2134) | def _checksec_cache(self, value=None):
method checksec (line 2144) | def checksec(self, banner=True):
FILE: pwnlib/tubes/tube.py
class tube (line 23) | class tube(Timeout, Logger):
method __init__ (line 31) | def __init__(self, timeout = default, level = None, *a, **kw):
method _normalize_keepends_drop (line 42) | def _normalize_keepends_drop(self, keepends, drop, drop_default):
method newline (line 81) | def newline(self):
method newline (line 103) | def newline(self, newline):
method recv (line 107) | def recv(self, numb = None, timeout = default):
method unrecv (line 141) | def unrecv(self, data):
method _fillbuffer (line 164) | def _fillbuffer(self, timeout = default):
method _recv (line 199) | def _recv(self, numb = None, timeout = default):
method recvpred (line 214) | def recvpred(self, pred, timeout = default):
method recvn (line 268) | def recvn(self, numb, timeout = default):
method recvuntil (line 314) | def recvuntil(self, delims, drop=False, timeout=default):
method recvlines (line 404) | def recvlines(self, numlines=2**20, keepends=None, drop=None, timeout=...
method recvlinesS (line 466) | def recvlinesS(self, numlines=2**20, keepends=None, drop=None, timeout...
method recvlinesb (line 485) | def recvlinesb(self, numlines=2**20, keepends=None, drop=None, timeout...
method recvline (line 502) | def recvline(self, keepends=None, drop=None, timeout=default):
method recvline_pred (line 576) | def recvline_pred(self, pred, keepends=None, drop=None, timeout=default):
method recvline_contains (line 629) | def recvline_contains(self, items, keepends=None, drop=None, timeout=d...
method recvline_startswith (line 665) | def recvline_startswith(self, delims, keepends=None, drop=None, timeou...
method recvline_endswith (line 703) | def recvline_endswith(self, delims, keepends=None, drop=None, timeout=...
method recvregex (line 736) | def recvregex(self, regex, exact=False, timeout=default, capture=False):
method recvline_regex (line 776) | def recvline_regex(self, regex, exact=False, keepends=None, drop=None,...
method recvrepeat (line 800) | def recvrepeat(self, timeout=default):
method recvall (line 832) | def recvall(self, timeout=Timeout.forever):
method send (line 854) | def send(self, data):
method sendline (line 882) | def sendline(self, line=b''):
method sendlines (line 903) | def sendlines(self, lines=[]):
method sendafter (line 908) | def sendafter(self, delim, data, timeout = default):
method sendlineafter (line 919) | def sendlineafter(self, delim, data, timeout = default):
method sendthen (line 929) | def sendthen(self, delim, data, timeout = default):
method sendlinethen (line 938) | def sendlinethen(self, delim, data, timeout = default):
method interactive (line 947) | def interactive(self, prompt = term.text.bold_red('$') + ' '):
method stream (line 1034) | def stream(self, line_mode=True):
method clean (line 1066) | def clean(self, timeout = 0.05):
method clean_and_log (line 1095) | def clean_and_log(self, timeout = 0.05):
method upload_manually (line 1129) | def upload_manually(self, data, target_path = './payload', prompt = b'...
method connect_input (line 1255) | def connect_input(self, other):
method connect_output (line 1312) | def connect_output(self, other):
method connect_both (line 1337) | def connect_both(self, other):
method spawn_process (line 1345) | def spawn_process(self, *args, **kwargs):
method __lshift__ (line 1358) | def __lshift__(self, other):
method __rshift__ (line 1380) | def __rshift__(self, other):
method __ne__ (line 1389) | def __ne__(self, other):
method wait_for_close (line 1402) | def wait_for_close(self, timeout=default):
method can_recv (line 1413) | def can_recv(self, timeout = 0):
method settimeout (line 1435) | def settimeout(self, timeout):
method shutdown (line 1466) | def shutdown(self, direction = "send"):
method connected (line 1503) | def connected(self, direction = 'any'):
method __enter__ (line 1537) | def __enter__(self):
method __exit__ (line 1550) | def __exit__(self, type, value, traceback):
method recv_raw (line 1559) | def recv_raw(self, numb):
method send_raw (line 1573) | def send_raw(self, data):
method settimeout_raw (line 1584) | def settimeout_raw(self, timeout):
method timeout_change (line 1593) | def timeout_change(self):
method can_recv_raw (line 1605) | def can_recv_raw(self, timeout):
method connected_raw (line 1615) | def connected_raw(self, direction):
method close (line 1624) | def close(self):
method fileno (line 1634) | def fileno(self):
method shutdown_raw (line 1642) | def shutdown_raw(self, direction):
method p64 (line 1652) | def p64(self, *a, **kw): return self.send(packing.p64(*a, **kw))
method p56 (line 1653) | def p56(self, *a, **kw): return self.send(packing.p56(*a, **kw))
method p48 (line 1654) | def p48(self, *a, **kw): return self.send(packing.p48(*a, **kw))
method p40 (line 1655) | def p40(self, *a, **kw): return self.send(packing.p40(*a, **kw))
method p32 (line 1656) | def p32(self, *a, **kw): return self.send(packing.p32(*a, **kw))
method p16 (line 1657) | def p16(self, *a, **kw): return self.send(packing.p16(*a, **kw))
method p8 (line 1658) | def p8(self, *a, **kw): return self.send(packing.p8(*a, **kw))
method pack (line 1659) | def pack(self, *a, **kw): return self.send(packing.pack(*a, **kw))
method u64 (line 1661) | def u64(self, *a, **kw): return packing.u64(self.recvn(8), *a, ...
method u56 (line 1662) | def u56(self, *a, **kw): return packing.u56(self.recvn(7), *a, ...
method u48 (line 1663) | def u48(self, *a, **kw): return packing.u48(self.recvn(6), *a, ...
method u40 (line 1664) | def u40(self, *a, **kw): return packing.u40(self.recvn(5), *a, ...
method u32 (line 1665) | def u32(self, *a, **kw): return packing.u32(self.recvn(4), *a, ...
method u16 (line 1666) | def u16(self, *a, **kw): return packing.u16(self.recvn(2), *a, ...
method u8 (line 1667) | def u8(self, *a, **kw): return packing.u8(self.recvn(1), *a, *...
method unpack (line 1668) | def unpack(self, *a, **kw): return packing.unpack(self.recvn(conte...
method flat (line 1670) | def flat(self, *a, **kw): return self.send(packing.flat(*a,**kw))
method fit (line 1671) | def fit(self, *a, **kw): return self.send(packing.fit(*a, **kw))
method make_wrapper (line 1675) | def make_wrapper(func):
method make_wrapper (line 1703) | def make_wrapper(func, alias):
FILE: pwnlib/ui.py
function testpwnproc (line 16) | def testpwnproc(cmd):
function yesno (line 47) | def yesno(prompt, default=None):
function options (line 127) | def options(prompt, opts, default = None):
function pause (line 254) | def pause(n=None):
function more (line 302) | def more(text):
FILE: pwnlib/update.py
function read_update_config (line 46) | def read_update_config(settings):
function available_on_pypi (line 65) | def available_on_pypi(prerelease=current_version.is_prerelease):
function cache_file (line 92) | def cache_file():
function last_check (line 109) | def last_check():
function should_check (line 118) | def should_check():
function perform_check (line 130) | def perform_check(prerelease=current_version.is_prerelease):
function check_automatically (line 194) | def check_automatically():
FILE: pwnlib/useragents.py
function _load (line 11) | def _load():
function getall (line 23) | def getall():
function random (line 43) | def random():
FILE: pwnlib/util/crc/__init__.py
class BitPolynom (line 29) | class BitPolynom(object):
method __init__ (line 71) | def __init__(self, n):
method __int__ (line 94) | def __int__(self):
method __add__ (line 97) | def __add__(self, other):
method __radd__ (line 100) | def __radd__(self, other):
method __sub__ (line 103) | def __sub__(self, other):
method __rsub__ (line 106) | def __rsub__(self, other):
method __xor__ (line 109) | def __xor__(self, other):
method __rxor__ (line 112) | def __rxor__(self, other):
method __or__ (line 115) | def __or__(self, other):
method __ror__ (line 118) | def __ror__(self, other):
method __and__ (line 121) | def __and__(self, other):
method __rand__ (line 124) | def __rand__(self, other):
method __mul__ (line 127) | def __mul__(self, other):
method __rmul__ (line 138) | def __rmul__(self, other):
method __divmod__ (line 141) | def __divmod__(self, other):
method __rdivmod__ (line 156) | def __rdivmod__(self, other):
method __div__ (line 159) | def __div__(self, other):
method __rdiv__ (line 163) | def __rdiv__(self, other):
method __mod__ (line 170) | def __mod__(self, other):
method __rmod__ (line 173) | def __rmod__(self, other):
method __eq__ (line 176) | def __eq__(self, other):
method __hash__ (line 179) | def __hash__(self):
method __cmp__ (line 182) | def __cmp__(self, other):
method __lshift__ (line 185) | def __lshift__(self, other):
method __rlshift__ (line 188) | def __rlshift__(self, other):
method __rshift__ (line 191) | def __rshift__(self, other):
method __rrshift__ (line 194) | def __rrshift__(self, other):
method __pow__ (line 197) | def __pow__(self, other):
method degree (line 203) | def degree(self):
method __repr__ (line 223) | def __repr__(self):
class Module (line 237) | class Module(types.ModuleType):
method __init__ (line 238) | def __init__(self):
method __getattr__ (line 247) | def __getattr__(self, attr):
method __dir__ (line 263) | def __dir__(self):
method generic_crc (line 267) | def generic_crc(data, polynom, width, init, refin, refout, xorout):
method _make_crc (line 314) | def _make_crc(name, polynom, width, init, refin, refout, xorout, check...
method cksum (line 348) | def cksum(data):
method find_crc_function (line 367) | def find_crc_function(data, checksum):
FILE: pwnlib/util/crc/known.py
function generate (line 5) | def generate():
FILE: pwnlib/util/cyclic.py
function de_bruijn (line 10) | def de_bruijn(alphabet = None, n = None):
function cyclic (line 47) | def cyclic(length = None, alphabet = None, n = None):
function cyclic_find (line 134) | def cyclic_find(subseq, alphabet = None, n = None):
function metasploit_pattern (line 256) | def metasploit_pattern(sets = None):
function cyclic_metasploit (line 286) | def cyclic_metasploit(length = None, sets = None):
function cyclic_metasploit_find (line 318) | def cyclic_metasploit_find(subseq, sets = None):
function _gen_find (line 343) | def _gen_find(subseq, generator):
function _join_sequence (line 360) | def _join_sequence(seq, alphabet):
class cyclic_gen (line 368) | class cyclic_gen(object):
method __init__ (line 409) | def __init__(self, alphabet = None, n = None):
method get (line 422) | def get(self, length = None):
method find (line 456) | def find(self, subseq):
FILE: pwnlib/util/fiddling.py
function unhex (line 23) | def unhex(s):
function enhex (line 45) | def enhex(x):
function urlencode (line 60) | def urlencode(s):
function urldecode (line 72) | def urldecode(s, ignore_invalid = False):
function bits (line 106) | def bits(s, endian = 'big', zero = 0, one = 1):
function bits_str (line 163) | def bits_str(s, endian = 'big', zero = '0', one = '1'):
function unbits (line 177) | def unbits(s, endian = 'big'):
function bitswap (line 225) | def bitswap(s):
function bitswap_int (line 243) | def bitswap_int(n, width):
function b64e (line 273) | def b64e(s):
function b64d (line 288) | def b64d(s):
function xor (line 301) | def xor(*args, **kwargs):
function xor_pair (line 360) | def xor_pair(data, avoid = b'\x00\n'):
function xor_key (line 405) | def xor_key(data, avoid=b'\x00\n', size=None):
function randoms (line 454) | def randoms(count, alphabet = string.ascii_lowercase):
function rol (line 475) | def rol(n, k, word_size = None):
function ror (line 518) | def ror(n, k, word_size = None):
function naf (line 523) | def naf(n):
function isprint (line 549) | def isprint(c):
function hexii (line 559) | def hexii(s, width = 16, skip = True):
function _hexiichar (line 575) | def _hexiichar(c):
function sequential_lines (line 597) | def sequential_lines(a,b):
function update_cyclic_pregenerated (line 600) | def update_cyclic_pregenerated(size):
function hexdump_iter (line 605) | def hexdump_iter(fd, width=16, skip=True, hexii=False, begin=0, style=None,
function hexdump (line 769) | def hexdump(s, width=16, skip=True, hexii=False, begin=0, style=None,
function negate (line 966) | def negate(value, width = None):
function bnot (line 975) | def bnot(value, width=None):
function js_escape (line 985) | def js_escape(data, padding=context.cyclic_alphabet[0:1], **kwargs):
function js_unescape (line 1027) | def js_unescape(s, **kwargs):
function tty_escape (line 1095) | def tty_escape(s, lnext=b'\x16', dangerous=bytes(bytearray(range(0x20)))):
FILE: pwnlib/util/getdents.py
class Dtype (line 8) | class Dtype(IntEnum):
class linux_dirent (line 20) | class linux_dirent:
method __init__ (line 68) | def __init__(self, buf: bytes, is_dirent64: bool):
method __len__ (line 85) | def __len__(self):
method __str__ (line 88) | def __str__(self):
method __repr__ (line 91) | def __repr__(self):
function dirents (line 95) | def dirents(buf: bytes) -> list[linux_dirent]:
function dirents64 (line 128) | def dirents64(buf: bytes) -> list[linux_dirent]:
FILE: pwnlib/util/hashes.py
function _closure (line 7) | def _closure():
FILE: pwnlib/util/iters.py
function take (line 66) | def take(n, iterable):
function tabulate (line 94) | def tabulate(func, start = 0):
function consume (line 113) | def consume(n, iterator):
function nth (line 152) | def nth(n, iterable, default = None):
function quantify (line 181) | def quantify(iterable, pred = bool):
function pad (line 204) | def pad(iterable, value = None):
function cyclen (line 232) | def cyclen(n, iterable):
function dotproduct (line 254) | def dotproduct(x, y):
function flatten (line 274) | def flatten(xss):
function repeat_func (line 297) | def repeat_func(func, *args, **kwargs):
function pairwise (line 342) | def pairwise(iterable):
function group (line 364) | def group(n, iterable, fill_value = None):
function roundrobin (line 391) | def roundrobin(*iterables):
function powerset (line 421) | def powerset(iterable, include_empty = True):
function unique_everseen (line 446) | def unique_everseen(iterable, key = None):
function unique_justseen (line 482) | def unique_justseen(iterable, key = None):
function unique_window (line 507) | def unique_window(iterable, window, key = None):
function iter_except (line 547) | def iter_except(func, exception):
function random_product (line 584) | def random_product(*args, **kwargs):
function random_permutation (line 611) | def random_permutation(iterable, r = None):
function random_combination (line 633) | def random_combination(iterable, r):
function random_combination_with_replacement (line 655) | def random_combination_with_replacement(iterable, r):
function lexicographic (line 681) | def lexicographic(alphabet):
function chained (line 703) | def chained(func):
function bruteforce (line 736) | def bruteforce(func, alphabet, length, method = 'upto', start = None, da...
function _mbruteforcewrap (line 835) | def _mbruteforcewrap(func, alphabet, length, method, start, databag):
class CustomPickler (line 843) | class CustomPickler:
method __init__ (line 844) | def __init__(self, *reduction):
method __reduce__ (line 847) | def __reduce__(self):
method __repr__ (line 850) | def __repr__(self):
function construct_func (line 854) | def construct_func(*args):
class PicklableFunc (line 858) | class PicklableFunc:
method __init__ (line 859) | def __init__(self, f):
method __call__ (line 862) | def __call__(self, *a, **kw):
method __getattr__ (line 865) | def __getattr__(self, a):
method __reduce__ (line 868) | def __reduce__(self):
function mbruteforce (line 891) | def mbruteforce(func, alphabet, length, method = 'upto', start = None, t...
FILE: pwnlib/util/lists.py
function partition (line 4) | def partition(lst, f, save_keys = False):
function group (line 37) | def group(n, lst, underfull_action = 'ignore', fill_value = None):
function concat (line 95) | def concat(l):
function concat_all (line 113) | def concat_all(*args):
function ordlist (line 134) | def ordlist(s):
function unordlist (line 146) | def unordlist(cs):
function findall (line 158) | def findall(haystack, needle):
FILE: pwnlib/util/misc.py
function align (line 27) | def align(alignment, x):
function align_down (line 40) | def align_down(alignment, x):
function binary_ip (line 53) | def binary_ip(host):
function size (line 66) | def size(n, abbrev = 'B', si = False):
function read (line 117) | def read(path, count=-1, skip=0):
function write (line 134) | def write(path, data = b'', create_dir = False, mode = 'w'):
function which (line 144) | def which(name, all = False, path=None):
function normalize_argv_env (line 206) | def normalize_argv_env(argv, env, log, level=2):
function run_in_new_terminal (line 266) | def run_in_new_terminal(command, terminal=None, args=None, kill_at_exit=...
function parse_ldd_output (line 562) | def parse_ldd_output(output):
function mkdir_p (line 594) | def mkdir_p(path):
function dealarm_shell (line 605) | def dealarm_shell(tube):
function register_sizes (line 622) | def register_sizes(regs, in_sizes):
function _create_execve_script (line 739) | def _create_execve_script(argv=None, executable=None, cwd=None, env=None...
FILE: pwnlib/util/net.py
class struct_sockaddr (line 15) | class struct_sockaddr(ctypes.Structure):
class struct_sockaddr_in (line 23) | class struct_sockaddr_in(ctypes.Structure):
class struct_sockaddr_in6 (line 32) | class struct_sockaddr_in6(ctypes.Structure):
class union_ifa_ifu (line 42) | class union_ifa_ifu(ctypes.Union):
class struct_ifaddrs (line 47) | class struct_ifaddrs(ctypes.Structure):
function sockaddr_fixup (line 61) | def sockaddr_fixup(saptr):
function getifaddrs (line 76) | def getifaddrs():
function interfaces (line 125) | def interfaces(all = False):
function interfaces4 (line 151) | def interfaces4(all = False):
function interfaces6 (line 177) | def interfaces6(all = False):
function sockaddr (line 203) | def sockaddr(host, port, network = 'ipv4'):
function sock_match (line 240) | def sock_match(local, remote, fam=socket.AF_UNSPEC, typ=0):
FILE: pwnlib/util/packing.py
function pack (line 46) | def pack(number, word_size = None, endianness = None, sign = None, **kwa...
function unpack (line 162) | def unpack(data, word_size = None):
function unpack_many (line 236) | def unpack_many(data, word_size = None):
function make_single (line 298) | def make_single(op,size,end,sign):
function _do_packing (line 342) | def _do_packing(op, size, number, endianness=None):
function p8 (line 360) | def p8(number, endianness = None, **kwargs):
function p16 (line 378) | def p16(number, endianness = None, **kwargs):
function p32 (line 403) | def p32(number, endianness = None, **kwargs):
function p40 (line 428) | def p40(number, endianness = None, **kwargs):
function p48 (line 453) | def p48(number, endianness = None, **kwargs):
function p56 (line 478) | def p56(number, endianness = None, **kwargs):
function p64 (line 503) | def p64(number, endianness = None, **kwargs):
function u8 (line 528) | def u8(data, endianness = None, **kwargs):
function u16 (line 546) | def u16(data, endianness = None, **kwargs):
function u32 (line 564) | def u32(data, endianness = None, **kwargs):
function u40 (line 582) | def u40(data, endianness = None, **kwargs):
function u48 (line 600) | def u48(data, endianness = None, **kwargs):
function u56 (line 618) | def u56(data, endianness = None, **kwargs):
function u64 (line 636) | def u64(data, endianness = None, **kwargs):
function make_packer (line 653) | def make_packer(word_size = None, sign = None, **kwargs):
function make_unpacker (line 717) | def make_unpacker(word_size = None, endianness = None, sign = None, **kw...
function _fit (line 778) | def _fit(pieces, preprocessor, packer, filler, stacklevel=1):
function _flat (line 853) | def _flat(args, preprocessor, packer, filler, stacklevel=1):
function flat (line 889) | def flat(*args, **kwargs):
function fit (line 1061) | def fit(*args, **kwargs):
function signed (line 1103) | def signed(integer):
function unsigned (line 1106) | def unsigned(integer):
function dd (line 1109) | def dd(dst, src, count = 0, skip = 0, seek = 0, truncate = False):
function _need_bytes (line 1294) | def _need_bytes(s, level=1, min_wrong=0):
function _need_text (line 1316) | def _need_text(s, level=1):
function _encode (line 1338) | def _encode(s):
function _decode (line 1349) | def _decode(b):
function overlap (line 1362) | def overlap(*structs: bytes | tuple[bytes, int]) -> bytes:
FILE: pwnlib/util/proc.py
function pidof (line 17) | def pidof(target):
function pid_by_name (line 65) | def pid_by_name(name):
function name (line 99) | def name(pid):
function parent (line 116) | def parent(pid):
function children (line 131) | def children(ppid):
function ancestors (line 142) | def ancestors(pid):
function descendants (line 162) | def descendants(pid):
function exe (line 190) | def exe(pid):
function cwd (line 206) | def cwd(pid):
function cmdline (line 223) | def cmdline(pid):
function memory_maps (line 239) | def memory_maps(pid):
function stat (line 257) | def stat(pid):
function starttime (line 279) | def starttime(pid):
function status (line 295) | def status(pid):
function _tracer_windows (line 323) | def _tracer_windows(pid):
function tracer (line 359) | def tracer(pid):
function state (line 379) | def state(pid):
function wait_for_debugger (line 395) | def wait_for_debugger(pid, debugger_pid=None):
FILE: pwnlib/util/safeeval.py
function _get_opcodes (line 22) | def _get_opcodes(codeobj):
function test_expr (line 34) | def test_expr(expr, allowed_codes):
function const (line 53) | def const(expr):
function expr (line 77) | def expr(expr):
function values (line 101) | def values(expr, env):
FILE: pwnlib/util/sh_string.py
function test_all (line 251) | def test_all():
function test (line 275) | def test(original):
function sh_string (line 361) | def sh_string(s):
function sh_prepare (line 440) | def sh_prepare(variables, export = False):
function sh_command_with (line 491) | def sh_command_with(f, *args):
FILE: pwnlib/util/splash.py
function splash (line 26) | def splash():
FILE: pwnlib/util/web.py
function wget (line 10) | def wget(url, save=None, timeout=5, **kwargs):
FILE: pwnlib/windbg.py
function debug (line 77) | def debug(args, windbgscript=None, exe=None, env=None, creationflags=0, ...
function binary (line 125) | def binary():
function attach (line 139) | def attach(target, windbgscript=None, windbg_args=[]):
FILE: travis/docker/ipython_config.py
class ClassicPrompts (line 45) | class ClassicPrompts(Prompts):
method in_prompt_tokens (line 46) | def in_prompt_tokens(self, cli=None):
method continuation_prompt_tokens (line 51) | def continuation_prompt_tokens(self, cli=None, width=None):
method rewrite_prompt_tokens (line 56) | def rewrite_prompt_tokens(self):
method out_prompt_tokens (line 59) | def out_prompt_tokens(self):
Condensed preview — 1386 files, each showing path, character count, and a content snippet. Download the .json file or copy for the full structured content (9,583K chars).
[
{
"path": ".gitattributes",
"chars": 32,
"preview": "pwnlib/data/* linguist-vendored\n"
},
{
"path": ".github/ISSUE_TEMPLATE/bug_report.md",
"chars": 1415,
"preview": "---\nname: Bug report\nabout: Create a report to help us improve\ntitle: ''\nlabels: backport-required, bug\nassignees: ''\n\n-"
},
{
"path": ".github/ISSUE_TEMPLATE/feature_request.md",
"chars": 501,
"preview": "---\nname: Feature request\nabout: Suggest an idea for this project\ntitle: ''\nlabels: feature\nassignees: ''\n\n---\n\nThanks f"
},
{
"path": ".github/ISSUE_TEMPLATE/question.md",
"chars": 621,
"preview": "---\nname: Question\nabout: Ask us a question about Pwntools\ntitle: ''\nlabels: question\nassignees: ''\n\n---\n\nThanks for usi"
},
{
"path": ".github/ISSUE_TEMPLATE.md",
"chars": 645,
"preview": "# Pwntools Issue Template\n\nThanks for contributing to Pwntools!\n\nWhen reporting an issue, be sure that you are running t"
},
{
"path": ".github/PULL_REQUEST_TEMPLATE.md",
"chars": 1482,
"preview": "# Pwntools Pull Request\n\nThanks for contributing to Pwntools! Take a moment to look at [`CONTRIBUTING.md`][contributing"
},
{
"path": ".github/dependabot.yml",
"chars": 248,
"preview": "version: 2\nupdates:\n\n - package-ecosystem: \"github-actions\"\n directory: \"/\"\n schedule:\n # Check for updates "
},
{
"path": ".github/workflows/changelog.yml",
"chars": 804,
"preview": "name: Changelog\non:\n pull_request:\n paths:\n - pwnlib/**\n - pwn/**\nenv:\n GITHUB_BASE: origin/${{ github.event."
},
{
"path": ".github/workflows/ci.yml",
"chars": 13704,
"preview": "name: Continuous Integration\non: [push, pull_request]\n\njobs:\n test:\n strategy:\n matrix:\n python_version:"
},
{
"path": ".github/workflows/docker.yml",
"chars": 2200,
"preview": "name: Publish Docker images\non:\n push:\n branches:\n - dev\n - beta\n - stable\n workflow_dispatch:\njobs:"
},
{
"path": ".github/workflows/lint.yml",
"chars": 1233,
"preview": "name: Lint\non: [push, pull_request]\n\njobs:\n lint:\n strategy:\n matrix:\n python-version: ['3.10']\n "
},
{
"path": ".github/workflows/merge-conflict.yml",
"chars": 916,
"preview": "name: Check for merge markers\non:\n pull_request:\n types: [synchronize]\nenv:\n GITHUB_BASE: origin/${{ github.event.p"
},
{
"path": ".github/workflows/pylint.yml",
"chars": 966,
"preview": "name: PyLint\non: [pull_request]\n\njobs:\n build:\n strategy:\n matrix:\n python-version: ['3.10']\n os:"
},
{
"path": ".gitignore",
"chars": 187,
"preview": "*.o\n*.hi\n*.pyc\n*~\n*.swp\n.ropeproject\n*.pdf\n*/auto/*\n*/bin/*\ndocs/build\nbuild\nMANIFEST\ndist\nvenv\n.vscode\n.idea\n*.egg-info"
},
{
"path": ".isort.cfg",
"chars": 69,
"preview": "[settings]\nindent=' '\nnot_skip = __init__.py\nforce_single_line = 1"
},
{
"path": ".readthedocs.yaml",
"chars": 233,
"preview": "# https://docs.readthedocs.io/en/stable/config-file/v2.html\n\nversion: 2\n\nbuild:\n os: ubuntu-22.04\n tools:\n python: "
},
{
"path": ".sublime-settings",
"chars": 183,
"preview": "{\n \"default_encoding\": \"UTF-8\",\n \"ensure_newline_at_eof_on_save\": true,\n \"tab_size\": 4,\n \"translate_tabs_to_"
},
{
"path": "CHANGELOG.md",
"chars": 71214,
"preview": "# Changelog\n\nThis changelog only includes added major features and changes. Bugfixes and\nminor changes are omitted.\n\n## "
},
{
"path": "CONTRIBUTING.md",
"chars": 1975,
"preview": "# Contributing\n\nGithub has a great guide for contributing to open source projects:\n\n- [Contributing to a project](https:"
},
{
"path": "DOCKER.md",
"chars": 2354,
"preview": "# Using Pwntools with Docker\n\nSometimes it's annoying to set up Pwntools on your workstation, and you want something tha"
},
{
"path": "LICENSE-pwntools.txt",
"chars": 1645,
"preview": "TL;DR version:\n Everything in pwntools is open source. Most is under an MIT license, but a\n few pieces are under GPL"
},
{
"path": "MANIFEST.in",
"chars": 303,
"preview": "graft build\ngraft examples\ngraft extra\ngraft travis\ninclude *.md *.txt *.sh *.yml MANIFEST.in\nrecursive-include docs *"
},
{
"path": "README.md",
"chars": 3042,
"preview": "# pwntools - CTF toolkit\n![pwntools logo](https://github.com/Gallopsled/pwntools/blob/stable/docs/source/logo.png?raw=tr"
},
{
"path": "SECURITY.md",
"chars": 1732,
"preview": "# Security Policy\n\n## Supported Versions\n\n| Version | Supported |\n| ------------- | ------------------ |\n"
},
{
"path": "TESTING.md",
"chars": 1986,
"preview": "# Testing\n\nPwntools makes extensive use of unit tests and integration tests to ensure everything is in working order, an"
},
{
"path": "docs/.gitignore",
"chars": 17,
"preview": "build\nrobots.txt\n"
},
{
"path": "docs/Makefile",
"chars": 5997,
"preview": "# Makefile for Sphinx documentation\n#\n\n# You can set these variables from the command line.\nSPHINXOPTS =\nSPHINXBUILD "
},
{
"path": "docs/requirements.txt",
"chars": 280,
"preview": "capstone\ncoverage[toml]\npython-dateutil\ndoc2dash\ndocutils>=0.18\nintervaltree\nisort\nmako>=1.0.0\nparamiko>=1.15.2\npyelftoo"
},
{
"path": "docs/source/about.rst",
"chars": 2245,
"preview": "About pwntools\n========================\n\nWhether you're using it to write exploits, or as part\nof another software proje"
},
{
"path": "docs/source/adb.rst",
"chars": 367,
"preview": ".. testsetup:: *\n\n from pprint import pprint\n from pwn import *\n adb = pwnlib.adb\n\n import doctest\n doctest_ad"
},
{
"path": "docs/source/args.rst",
"chars": 188,
"preview": ".. testsetup:: *\n\n from pwn import *\n\n:mod:`pwnlib.args` --- Magic Command-Line Arguments\n============================"
},
{
"path": "docs/source/asm.rst",
"chars": 585,
"preview": ".. testsetup:: *\n\n import tempfile\n import subprocess\n from pwn import *\n\n # TODO: Remove global POSIX flag\n i"
},
{
"path": "docs/source/atexception.rst",
"chars": 175,
"preview": ":mod:`pwnlib.atexception` --- Callbacks on unhandled exception\n========================================================="
},
{
"path": "docs/source/atexit.rst",
"chars": 140,
"preview": ":mod:`pwnlib.atexit` --- Replacement for atexit\n===============================================\n\n.. automodule:: pwnlib."
},
{
"path": "docs/source/commandline.rst",
"chars": 509,
"preview": ".. testsetup:: *\n\n from pwn import *\n old = context.defaults.copy()\n\n.. testcleanup:: *\n\n context.defaults.copy ="
},
{
"path": "docs/source/conf.py",
"chars": 16949,
"preview": "# pwntools documentation build configuration file, created by\n# sphinx-quickstart on Wed May 28 15:00:52 2014.\n#\n# This "
},
{
"path": "docs/source/config.rst",
"chars": 137,
"preview": ":mod:`pwnlib.config` --- Pwntools Configuration File\n====================================================\n\n.. automodule"
},
{
"path": "docs/source/constants.rst",
"chars": 253,
"preview": ".. testsetup:: *\n\n from pwnlib import constants\n from pwnlib.context import context\n\n:mod:`pwnlib.constants` --- Eas"
},
{
"path": "docs/source/context.rst",
"chars": 910,
"preview": ".. testsetup:: *\n\n from pwn import *\n import logging\n log = pwnlib.log.getLogger('pwnlib.context')\n context.clea"
},
{
"path": "docs/source/dynelf.rst",
"chars": 172,
"preview": ":mod:`pwnlib.dynelf` --- Resolving remote functions using leaks\n========================================================"
},
{
"path": "docs/source/elf/config.rst",
"chars": 245,
"preview": ".. testsetup:: *\n\n from pwn import *\n from pwnlib.elf.config import parse_kconfig\n\n:mod:`pwnlib.elf.config` --- Kern"
},
{
"path": "docs/source/elf/corefile.rst",
"chars": 1202,
"preview": ".. testsetup:: *\n\n from glob import glob\n from pwn import *\n\n # The Linux kernel won't overwrite an existing coref"
},
{
"path": "docs/source/elf/elf.rst",
"chars": 894,
"preview": ".. testsetup:: *\n\n from pwn import *\n from glob import glob\n from pwnlib.elf.maps import CAT_PROC_MAPS_EXIT\n imp"
},
{
"path": "docs/source/elf.rst",
"chars": 309,
"preview": ".. testsetup:: *\n\n from pwnlib.elf import *\n from pwnlib.util.misc import which\n\n:mod:`pwnlib.elf` --- ELF Executabl"
},
{
"path": "docs/source/encoders.rst",
"chars": 710,
"preview": ".. testsetup:: *\n\n from pwn import *\n\n # TODO: Remove global POSIX flag\n import doctest\n doctest_additional_flag"
},
{
"path": "docs/source/exception.rst",
"chars": 146,
"preview": ":mod:`pwnlib.exception` --- Pwnlib exceptions\n====================================================\n\n.. automodule:: pwnl"
},
{
"path": "docs/source/filepointer.rst",
"chars": 272,
"preview": ".. testsetup:: *\n\n from pwnlib.filepointer import *\n from pwnlib.filepointer import _update_var\n\n:mod:`pwnlib.filepo"
},
{
"path": "docs/source/filesystem.rst",
"chars": 616,
"preview": ".. testsetup:: *\n\n import time\n from pwnlib.context import context\n from pwnlib.tubes.ssh import ssh\n from p"
},
{
"path": "docs/source/flag.rst",
"chars": 169,
"preview": ".. testsetup:: *\n\n from pwn import *\n\n\n:mod:`pwnlib.flag` --- CTF Flag Management\n===================================="
},
{
"path": "docs/source/fmtstr.rst",
"chars": 223,
"preview": ".. testsetup:: *\n\n\tfrom pwn import *\n\timport tempfile\n\n:mod:`pwnlib.fmtstr` --- Format string bug exploitation tools\n==="
},
{
"path": "docs/source/gdb.rst",
"chars": 401,
"preview": ".. testsetup:: *\n\n from pwn import *\n context.arch = 'amd64'\n context.terminal = [os.path.join(os.path.dirname("
},
{
"path": "docs/source/globals.rst",
"chars": 4716,
"preview": ".. testsetup:: *\n\n from pwn import *\n\n``from pwn import *``\n========================\n\nThe most common way that you'll "
},
{
"path": "docs/source/index.rst",
"chars": 1742,
"preview": "pwntools\n====================================\n\n``pwntools`` is a CTF framework and exploit development library.\nWritten "
},
{
"path": "docs/source/install/binutils.rst",
"chars": 2812,
"preview": "Binutils\n-------------\n\nAssembly of foreign architectures (e.g. assembling Sparc shellcode on\nMac OS X) requires cross-c"
},
{
"path": "docs/source/install/headers.rst",
"chars": 394,
"preview": "Python Development Headers\n-----------------------------\n\nSome of pwntools' Python dependencies require native extension"
},
{
"path": "docs/source/install.rst",
"chars": 2672,
"preview": "Installation\n============\n\nPwntools is best supported on 64-bit Ubuntu LTS releases (22.04 and 24.04). Most functionali"
},
{
"path": "docs/source/intro.rst",
"chars": 6470,
"preview": ".. testsetup:: *\n\n from pwn import *\n\n import doctest\n doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POS"
},
{
"path": "docs/source/libc/glibc.rst",
"chars": 208,
"preview": ".. testsetup:: *\n\n from pwn import *\n\n:mod:`pwnlib.libc.glibc` --- Convenient Functions for Glibc\n===================="
},
{
"path": "docs/source/libc.rst",
"chars": 196,
"preview": ":mod:`pwnlib.libc` --- Convenient Functions for Libc Implementations\n==================================================="
},
{
"path": "docs/source/libcdb.rst",
"chars": 320,
"preview": ".. testsetup:: *\n\n from pwn import *\n from pwnlib.libcdb import *\n\n # TODO: Remove global POSIX flag\n import doc"
},
{
"path": "docs/source/log.rst",
"chars": 462,
"preview": ":mod:`pwnlib.log` --- Logging stuff\n===================================\n\n.. automodule:: pwnlib.log\n :members: getLogg"
},
{
"path": "docs/source/memleak.rst",
"chars": 203,
"preview": ".. testsetup:: *\n\n from pwn import *\n\n:mod:`pwnlib.memleak` --- Helper class for leaking memory\n====================="
},
{
"path": "docs/source/protocols.rst",
"chars": 205,
"preview": ".. testsetup:: *\n\n from pwn import *\n\n\n:mod:`pwnlib.protocols.adb` --- Protocol implementations\n======================"
},
{
"path": "docs/source/qemu.rst",
"chars": 286,
"preview": ".. testsetup:: *\n\n from pwn import *\n\n # TODO: Remove global POSIX flag\n import doctest\n doctest_additional_flag"
},
{
"path": "docs/source/regsort.rst",
"chars": 200,
"preview": ".. testsetup:: *\n\n from pwnlib.regsort import *\n\n:mod:`pwnlib.regsort` --- Register sorting\n========================="
},
{
"path": "docs/source/replacements.rst",
"chars": 182,
"preview": ":mod:`pwnlib.replacements` --- Replacements for various functions\n======================================================"
},
{
"path": "docs/source/rop/ret2dlresolve.rst",
"chars": 228,
"preview": ".. testsetup:: *\n\n from pwn import *\n import tempfile\n\n:mod:`pwnlib.rop.ret2dlresolve` --- Return to dl_resolve\n===="
},
{
"path": "docs/source/rop/rop.rst",
"chars": 837,
"preview": ".. testsetup:: *\n\n import time\n from glob import glob\n\n from pwnlib.asm import asm\n from pwnlib import constants"
},
{
"path": "docs/source/rop/srop.rst",
"chars": 441,
"preview": ".. testsetup:: *\n\n from pwnlib.rop.srop import *\n\n from pwnlib import constants\n from pwnlib import shellcraft\n "
},
{
"path": "docs/source/rop.rst",
"chars": 157,
"preview": ":mod:`pwnlib.rop` --- Return Oriented Programming\n=================================================\n\nSubmodules\n--------"
},
{
"path": "docs/source/runner.rst",
"chars": 333,
"preview": ".. testsetup:: *\n\n from pwnlib.runner import *\n from pwnlib.asm import asm\n\n # TODO: Remove global POSIX flag\n i"
},
{
"path": "docs/source/shellcraft/aarch64.rst",
"chars": 542,
"preview": ".. testsetup:: *\n\n from pwn import *\n context.clear(arch='aarch64')\n\n import doctest\n doctest_additional_flags ="
},
{
"path": "docs/source/shellcraft/amd64.rst",
"chars": 718,
"preview": ".. testsetup:: *\n\n from pwn import *\n context.clear(arch='amd64')\n\n # TODO: POSIX/WINDOWS shellcode test\n import"
},
{
"path": "docs/source/shellcraft/arm.rst",
"chars": 508,
"preview": ".. testsetup:: *\n\n from pwn import *\n context.clear(arch='arm')\n\n import doctest\n doctest_additional_flags = doc"
},
{
"path": "docs/source/shellcraft/common.rst",
"chars": 201,
"preview": ":mod:`pwnlib.shellcraft.common` --- Shellcode common to all architecture\n==============================================="
},
{
"path": "docs/source/shellcraft/i386.rst",
"chars": 660,
"preview": ".. testsetup:: *\n\n from pwn import *\n context.clear(arch='i386')\n\n import doctest\n doctest_additional_flags = do"
},
{
"path": "docs/source/shellcraft/loongarch64.rst",
"chars": 585,
"preview": ".. testsetup:: *\n\n from pwn import *\n context.clear(arch='loongarch64')\n\n import doctest\n doctest_additional_fla"
},
{
"path": "docs/source/shellcraft/mips.rst",
"chars": 739,
"preview": ".. testsetup:: *\n\n import tempfile\n\n from pwnlib import shellcraft\n\n from pwnlib.asm import asm\n from pwnlib.con"
},
{
"path": "docs/source/shellcraft/riscv64.rst",
"chars": 541,
"preview": ".. testsetup:: *\n\n from pwn import *\n context.clear(arch='riscv64')\n\n import doctest\n doctest_additional_flags ="
},
{
"path": "docs/source/shellcraft/thumb.rst",
"chars": 533,
"preview": ".. testsetup:: *\n\n from pwn import *\n context.clear(arch='thumb')\n\n import doctest\n doctest_additional_flags = d"
},
{
"path": "docs/source/shellcraft.rst",
"chars": 427,
"preview": ".. testsetup:: *\n\n from pwnlib import shellcraft\n\n # TODO: Remove global POSIX flag\n import doctest\n doctest_add"
},
{
"path": "docs/source/term/readline.rst",
"chars": 231,
"preview": ".. testsetup:: *\n\n from pwnlib.term.readline import *\n import io\n\n:mod:`pwnlib.term.readline` --- Terminal nice read"
},
{
"path": "docs/source/term.rst",
"chars": 190,
"preview": ":mod:`pwnlib.term` --- Terminal handling\n========================================\n\n.. automodule:: pwnlib.term\n :membe"
},
{
"path": "docs/source/testexample.rst",
"chars": 220,
"preview": ".. testsetup:: *\n\n import os\n from pwnlib.testexample import add\n\n:mod:`pwnlib.testexample` --- Example Test Module\n"
},
{
"path": "docs/source/timeout.rst",
"chars": 243,
"preview": ".. testsetup:: *\n\n from pwnlib.context import context\n from pwnlib.timeout import Timeout\n import time\n\n:mod:`pwnl"
},
{
"path": "docs/source/tubes/buffer.rst",
"chars": 232,
"preview": ".. testsetup:: *\n\n from pwnlib.tubes.buffer import *\n\n:mod:`pwnlib.tubes.buffer` --- buffer implementation for tubes\n="
},
{
"path": "docs/source/tubes/processes.rst",
"chars": 388,
"preview": ".. testsetup:: *\n\n from pwn import *\n\n # TODO: Remove global POSIX flag\n import doctest\n doctest_additional_flag"
},
{
"path": "docs/source/tubes/serial.rst",
"chars": 381,
"preview": ".. testsetup:: *\n\n from pwn import *\n\n # TODO: Remove global POSIX flag\n import doctest\n doctest_additional_flag"
},
{
"path": "docs/source/tubes/sockets.rst",
"chars": 657,
"preview": ".. testsetup:: *\n\n from pwn import *\n from pwnlib.tubes.server import server\n\n:mod:`pwnlib.tubes.sock` --- Sockets\n="
},
{
"path": "docs/source/tubes/ssh.rst",
"chars": 701,
"preview": ".. testsetup:: *\n\n from pwn import *\n\n # TODO: Remove global POSIX flag\n import doctest\n doctest_additional_flag"
},
{
"path": "docs/source/tubes.rst",
"chars": 575,
"preview": ".. testsetup:: *\n\n from pwn import *\n\n:mod:`pwnlib.tubes` --- Talking to the World!\n=================================="
},
{
"path": "docs/source/ui.rst",
"chars": 283,
"preview": ".. testsetup:: *\n\n from pwn import *\n import io\n\n import doctest\n doctest_additional_flags = doctest.OPTIONFLAGS"
},
{
"path": "docs/source/update.rst",
"chars": 210,
"preview": ".. testsetup:: *\n\n from pwn import *\n from pwnlib.update import *\n\n:mod:`pwnlib.update` --- Updating Pwntools\n======"
},
{
"path": "docs/source/useragents.rst",
"chars": 224,
"preview": ".. testsetup:: *\n\n from pwnlib.useragents import *\n\n:mod:`pwnlib.useragents` --- A database of useragent strings\n====="
},
{
"path": "docs/source/util/crc.rst",
"chars": 195,
"preview": ".. testsetup:: *\n\n from pwnlib.util.crc import *\n\n\n:mod:`pwnlib.util.crc` --- Calculating CRC-sums\n==================="
},
{
"path": "docs/source/util/cyclic.rst",
"chars": 248,
"preview": ".. testsetup:: *\n\n from pwn import *\n from pwnlib.util.cyclic import *\n\n\n:mod:`pwnlib.util.cyclic` --- Generation of"
},
{
"path": "docs/source/util/fiddling.rst",
"chars": 242,
"preview": ".. testsetup:: *\n\n from pwn import *\n from pwnlib.util.fiddling import *\n\n\n:mod:`pwnlib.util.fiddling` --- Utiliti"
},
{
"path": "docs/source/util/getdents.rst",
"chars": 277,
"preview": ".. testsetup:: *\n\n from pwnlib.util.getdents import *\n from pwnlib.util.fiddling import unhex\n\n\n:mod:`pwnlib.util.ge"
},
{
"path": "docs/source/util/hashes.rst",
"chars": 145,
"preview": ":mod:`pwnlib.util.hashes` --- Hashing functions\n===============================================\n\n.. automodule:: pwnlib."
},
{
"path": "docs/source/util/iters.rst",
"chars": 2514,
"preview": ".. testsetup:: *\n\n import string, operator\n from pwnlib.util.iters import *\n\n\n:mod:`pwnlib.util.iters` --- Extension"
},
{
"path": "docs/source/util/lists.rst",
"chars": 200,
"preview": ".. testsetup:: *\n\n from pwnlib.util.lists import *\n\n:mod:`pwnlib.util.lists` --- Operations on lists\n================="
},
{
"path": "docs/source/util/misc.rst",
"chars": 282,
"preview": ".. testsetup:: *\n\n from pprint import pprint\n from pwnlib.util.misc import *\n import os, subprocess\n\n:mod:`pwnlib."
},
{
"path": "docs/source/util/net.rst",
"chars": 285,
"preview": ".. testsetup:: *\n\n from pwnlib.util.net import *\n\n import doctest\n doctest_additional_flags = doctest.OPTIONFLAGS_"
},
{
"path": "docs/source/util/packing.rst",
"chars": 235,
"preview": ".. testsetup:: *\n\n from pwnlib.util.packing import *\n\n\n:mod:`pwnlib.util.packing` --- Packing and unpacking of strings"
},
{
"path": "docs/source/util/proc.rst",
"chars": 353,
"preview": ".. testsetup:: *\n\n from pwnlib.util.proc import *\n from pwnlib.tubes.process import process\n import os, sys\n\n im"
},
{
"path": "docs/source/util/safeeval.rst",
"chars": 287,
"preview": ".. testsetup:: *\n\n from pwnlib.util.safeeval import *\n _get_opcodes = pwnlib.util.safeeval._get_opcodes\n\n\n:mod:`pwnl"
},
{
"path": "docs/source/util/sh_string.rst",
"chars": 250,
"preview": ".. testsetup:: *\n\n from pwn import *\n test = pwnlib.util.sh_string.test\n\n:mod:`pwnlib.util.sh_string` --- Shell Expa"
},
{
"path": "docs/source/util/web.rst",
"chars": 280,
"preview": ".. testsetup:: *\n\n import tempfile\n\n from pwnlib.context import context\n from pwnlib.util.web import *\n\n:mod:`pwnl"
},
{
"path": "docs/source/windbg.rst",
"chars": 182,
"preview": ".. testsetup:: *\r\n\r\n from pwn import *\r\n\r\n:mod:`pwnlib.windbg` --- Working with WinDbg\r\n============================="
},
{
"path": "examples/README.md",
"chars": 2856,
"preview": "# Examples\nWhile these examples should all work, they are not very representative of\nthe pwntools project.\n\nWe have a pl"
},
{
"path": "examples/android.py",
"chars": 577,
"preview": "from __future__ import print_function\n\nimport gdb\nfrom pwn import adb, context\n\n# Tell pwntools that the target is an An"
},
{
"path": "examples/args.py",
"chars": 461,
"preview": "\"\"\"\nWhen not in lib-mode (import `pwn` rather than `pwnlib`) we parse the\ncommandline for variables definitions. A vari"
},
{
"path": "examples/asm.py",
"chars": 265,
"preview": "\"\"\"\nExample showing the interface to `pwnlib.asm.asm` and `pwnlib.shellcraft`.\n\"\"\"\n\nfrom pwn import *\n\ncontext(arch='i38"
},
{
"path": "examples/attach.py",
"chars": 175,
"preview": "\"\"\"\nExample showing `pwnlib.gdb.attach()`\n\"\"\"\n\nfrom pwn import *\n\nbash = process('/bin/bash')\ngdb.attach(bash, gdbscript"
},
{
"path": "examples/clean_and_log.py",
"chars": 1009,
"preview": "\"\"\"\nUse case for `pwnlib.tubes.tube.clean_and_log`.\n\nSometimes you will have a solution to a challenge but you don't kno"
},
{
"path": "examples/fmtstr/Makefile",
"chars": 1550,
"preview": "CFLAGS := -Wno-unused-result -Wno-format-security\nTARGETS := printf.mips printf.mips64 printf.mipsel printf.mips64el pri"
},
{
"path": "examples/fmtstr/exploit.py",
"chars": 856,
"preview": "#!/usr/bin/env python\nfrom pwn import *\n\n@context.quiet\ndef exec_fmt(payload):\n p = context.binary.process()\n p.se"
},
{
"path": "examples/fmtstr/exploit2.py",
"chars": 1939,
"preview": "#!/usr/bin/env python\n\"\"\"\nAn example combining fmtstr and dynelf to automatically exploit a PIE binary.\n\"\"\"\n\nfrom pwn im"
},
{
"path": "examples/fmtstr/printf-loop.c",
"chars": 245,
"preview": "#include <stdio.h>\n#include <unistd.h>\n\nint main() {\n while (1) {\n char str[256];\n int n = read(STDIN_FILENO, str"
},
{
"path": "examples/fmtstr/printf.c",
"chars": 794,
"preview": "#ifdef _FORTIFY_SOURCE\n#undef _FORTIFY_SOURCE\n#endif\n#include <stdio.h>\n#include <stdlib.h>\n#include <unistd.h>\n#include"
},
{
"path": "examples/gdb_api.py",
"chars": 2811,
"preview": "#!/usr/bin/env python3\n\"\"\"An example of using GDB Python API with Pwntools.\"\"\"\nfrom pwn import *\n\n\ndef check_write(gdb, "
},
{
"path": "examples/gen-README.py",
"chars": 1235,
"preview": "\"\"\"\nScript to generate README.md\n\"\"\"\n\nfrom pwn import *\n\n\nout = '''# Examples\nWhile these examples should all work, they"
},
{
"path": "examples/indented.py",
"chars": 534,
"preview": "\"\"\"\nWhen running in term-mode (import `pwn` rather than `pwnlib`, stdout is a TTY\nand not running in a REPL), we can do "
},
{
"path": "examples/listen_uroboros.py",
"chars": 343,
"preview": "\"\"\"\nAn example showing interconnection of sockets. This script will wait for three\nconnections on port 1337, then conne"
},
{
"path": "examples/options.py",
"chars": 178,
"preview": "\"\"\"\nExample showing `pwnlib.ui.options()`\n\"\"\"\n\nfrom pwn import *\n\nopts = [string.ascii_letters[x] for x in range(12)]\npr"
},
{
"path": "examples/port_forward.py",
"chars": 253,
"preview": "\"\"\"\nA very simple port forwarder using `pwnlib.tubes.tube.connect_both()`.\n\"\"\"\n\nfrom pwn import *\n\nwhile True:\n liste"
},
{
"path": "examples/readline_completers.py",
"chars": 769,
"preview": "\"\"\"\nExample showing pwnlib's readline implementation and a few completers. This\npart of pwnlib will probably see some m"
},
{
"path": "examples/remote.py",
"chars": 166,
"preview": "\"\"\"\nExample showing how to use the remote class.\n\"\"\"\n\nfrom pwn import *\n\nsock = remote('127.0.0.1', 9001)\n\nprint(sock.re"
},
{
"path": "examples/remote_gdb_debugging.py",
"chars": 333,
"preview": "\"\"\"\nSimple example showing how to use the remote\ngdb debugging features available in pwntools.\n\"\"\"\n\nimport getpass\n\nfrom"
},
{
"path": "examples/sigreturn_corefile_aarch64.py",
"chars": 751,
"preview": "from pwn import *\ncontext.arch='aarch64'\nframe = SigreturnFrame()\n\nregisters = ['x%i' % i for i in range(0, 31)]\nregiste"
},
{
"path": "examples/sigreturn_corefile_amd64.py",
"chars": 795,
"preview": "from pwn import *\ncontext.arch='amd64'\nframe = SigreturnFrame()\n\nregisters = ['rax', 'rbx', 'rcx', 'rdx',\n '"
},
{
"path": "examples/sigreturn_corefile_arm.py",
"chars": 775,
"preview": "from pwn import *\n\ncontext.arch='arm'\nframe = SigreturnFrame()\n\nregisters = ['r0', 'r1', 'r2', 'r3', 'r4', 'r5', 'r6', '"
},
{
"path": "examples/sigreturn_corefile_i386.py",
"chars": 730,
"preview": "from pwn import *\ncontext.kernel='amd64'\nframe = SigreturnFrame()\n\nregisters = ['eax', 'ebx', 'ecx', 'edx',\n "
},
{
"path": "examples/spinners.py",
"chars": 369,
"preview": "\"\"\"\nJust a lot of spinners!\n\"\"\"\n\nfrom pwn import *\n\ncontext.log_level = 0\n\nn = 1\nh = log.waitfor('spinners running', sta"
},
{
"path": "examples/splash.py",
"chars": 163,
"preview": "\"\"\"\n\"Easteregg\"\n\"\"\"\n\nfrom pwn import *\n\nsplash()\n\nh = log.waitfor(\"You wrote\", status = \"--\")\n\nwhile True:\n l = str_i"
},
{
"path": "examples/ssh.py",
"chars": 1380,
"preview": "\"\"\"\nExample showing how to use the ssh class.\n\"\"\"\n\nfrom pwn import *\n\nshell = ssh(host='bandit.labs.overthewire.org',use"
},
{
"path": "examples/text.py",
"chars": 367,
"preview": "'''\nExample showing how to use `pwnlib.term.text`.\n\nTry running with::\n\n $ TERM=xterm python text.py\n\nand::\n\n $ TERM=x"
},
{
"path": "examples/yesno.py",
"chars": 140,
"preview": "\"\"\"\nExample showing `pwnlib.ui.yesno()`\n\"\"\"\n\nfrom pwn import *\n\nif ui.yesno('Do you like Pwntools?'):\n print(':D')\nel"
},
{
"path": "extra/bash_completion.d/README.md",
"chars": 389,
"preview": "# Bash Completion\n\nTo install the completion, add `. /path/to/bash_completion.d/pwn`to your e.g. `~/.bash_profile`.\n\nThe"
},
{
"path": "extra/bash_completion.d/install.sh",
"chars": 297,
"preview": "#!/usr/bin/env bash\n\nBASH_COMPLETION_DIR=$(cd \"$(dirname \"${BASH_SOURCE[0]}\")\" && pwd)\n\nif grep \"$BASH_COMPLETION_DIR\" ~"
},
{
"path": "extra/bash_completion.d/pwn",
"chars": 3888,
"preview": "#!/usr/bin/env bash\n# AUTOMATCALLY GENERATED by `shtab`\n\n_shtab_pwnlib_options_='-h --help'\n_shtab_pwnlib_commands_='asm"
},
{
"path": "extra/bash_completion.d/shellcraft",
"chars": 1249,
"preview": "#!/usr/bin/env bash\n# cache list of shellcodes\n_shellcraft_shellcodes=$(pwn shellcraft -l)\n\n_shellcraft()\n{\n COMPREPL"
},
{
"path": "extra/docker/Makefile",
"chars": 823,
"preview": "subdirs=$(shell find . -mindepth 1 -maxdepth 1 -type d | xargs -n1 basename)\ntags=base stable beta dev\nROOT=$(shell git "
},
{
"path": "extra/docker/README.md",
"chars": 1600,
"preview": "# Pwntools Docker Images\n\nThis directory contains some Docker images with various versions of Pwntools pre-installed.\n\n#"
},
{
"path": "extra/docker/base/Dockerfile",
"chars": 1471,
"preview": "############################################################\n# Dockerfile to build Pwntools container\n# Based on Ubuntu\n"
},
{
"path": "extra/docker/beta/Dockerfile",
"chars": 277,
"preview": "FROM pwntools/pwntools:stable\n\nUSER root\nRUN python3 -m pip uninstall --break-system-packages -q -y pwntools && python3 "
},
{
"path": "extra/docker/dev/Dockerfile",
"chars": 276,
"preview": "FROM pwntools/pwntools:stable\n\nUSER root\nRUN python3 -m pip uninstall --break-system-packages -q -y pwntools && python3 "
},
{
"path": "extra/docker/develop/10-import.py",
"chars": 175,
"preview": "try:\n from pwn import *\nexcept Exception:\n print(\"Could not import pwntools\")\nimport os, re, sys, time, random, ur"
},
{
"path": "extra/docker/develop/Dockerfile",
"chars": 2358,
"preview": "FROM pwntools/pwntools:base\n\n# Support sharing history with the develop Dockerfile\nENV HISTFILE=/home/pwntools/.history\n"
},
{
"path": "extra/docker/develop/ipython_config.py",
"chars": 20510,
"preview": "# Configuration file for ipython.\n\nc = get_config()\n\n#------------------------------------------------------------------"
},
{
"path": "extra/docker/stable/Dockerfile",
"chars": 277,
"preview": "FROM pwntools/pwntools:base\n\nUSER root\nRUN python3 -m pip uninstall --break-system-packages -q -y pwntools && python3 -m"
},
{
"path": "extra/textmate/README.md",
"chars": 606,
"preview": "# Pwntools Mako Assembly Syntax Highlighting\n\nThis should work for TextMate and anything that's compatible (e.g. Sublime"
},
{
"path": "extra/textmate/pwntools.YAML-tmLanguage",
"chars": 11432,
"preview": "# [PackageDev] target_format: plist, ext: tmLanguage\n---\nname: Pwntools Mako ASM\nscopeName: source.pwntools\nfileTypes: ["
},
{
"path": "extra/textmate/pwntools.tmLanguage",
"chars": 13414,
"preview": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/P"
},
{
"path": "extra/zsh_completion/README.md",
"chars": 198,
"preview": "# ZSH Completion\n\nTo install the completion, copy `_pwn` to somewhere in your `$fpath`.\n\nThe `./install.sh` script attem"
},
{
"path": "extra/zsh_completion/_pwn",
"chars": 14592,
"preview": "#compdef pwn\n# ----------------------------------------------------------------------------------------\n# Zsh completion"
},
{
"path": "extra/zsh_completion/install.zsh",
"chars": 570,
"preview": "#!/usr/bin/env zsh\n\n# Try to find a writable directory first, in reverse order\nfor dir in \"${(Oa)fpath[@]}\"; do\n if ["
},
{
"path": "pwn/__init__.py",
"chars": 536,
"preview": "# Promote useful stuff to toplevel\nfrom pwn.toplevel import *\n\npwnlib.args.initialize()\npwnlib.log.install_default_handl"
},
{
"path": "pwn/toplevel.py",
"chars": 3112,
"preview": "# Get all the modules from pwnlib\nimport collections\nimport logging\nimport math\nimport operator\nimport os\nimport platfor"
},
{
"path": "pwnlib/__init__.py",
"chars": 570,
"preview": "from __future__ import absolute_import\n\nfrom .version import __version__\n\nversion = __version__\n\n__all__ = [\n 'adb',\n"
},
{
"path": "pwnlib/abi.py",
"chars": 9697,
"preview": "from pwnlib.context import LocalContext\nfrom pwnlib.context import context\n\n\nclass ABI(object):\n \"\"\"\n Encapsulates"
},
{
"path": "pwnlib/adb/__init__.py",
"chars": 159,
"preview": "from pwnlib.adb.adb import *\nfrom pwnlib.adb.protocol import Client\nfrom pwnlib.adb.bootimg import BootImage\nfrom pwnlib"
},
{
"path": "pwnlib/adb/adb.py",
"chars": 44084,
"preview": "\"\"\"Provides utilities for interacting with Android devices via the Android Debug Bridge.\n\nUsing Android Devices with Pwn"
},
{
"path": "pwnlib/adb/bootimg.py",
"chars": 1311,
"preview": "import ctypes\n\nBOOT_MAGIC = b\"ANDROID!\"\nBOOT_MAGIC_SIZE = 8\nBOOT_NAME_SIZE = 16\nBOOT_ARGS_SIZE = 512\nBOOT_EXTRA_ARGS_SIZ"
},
{
"path": "pwnlib/adb/bootloader.py",
"chars": 3754,
"preview": "import ctypes\nimport io\nimport os\nimport sys\n\nfrom pwnlib.log import getLogger\n\nlog = getLogger(__name__)\n\nclass img_inf"
},
{
"path": "pwnlib/adb/protocol.py",
"chars": 119,
"preview": "\"\"\"\nThis file exists only for backward compatibility\n\"\"\"\nfrom pwnlib.protocols.adb import AdbClient\nClient = AdbClient\n"
},
{
"path": "pwnlib/args.py",
"chars": 5688,
"preview": "\"\"\"\nPwntools exposes several magic command-line arguments and environment\nvariables when operating in `from pwn import *"
},
{
"path": "pwnlib/asm.py",
"chars": 32859,
"preview": "r\"\"\"\nUtilities for assembling and disassembling code.\n\nArchitecture Selection\n------------------------\n\n Architecture"
},
{
"path": "pwnlib/atexception.py",
"chars": 2887,
"preview": "\"\"\"\nAnalogous to atexit, this module allows the programmer to register functions to\nbe run if an unhandled exception occ"
},
{
"path": "pwnlib/atexit.py",
"chars": 2937,
"preview": "\"\"\"\nReplacement for the Python standard library's atexit.py.\n\nWhereas the standard :mod:`atexit` module only defines :fu"
},
{
"path": "pwnlib/commandline/__init__.py",
"chars": 299,
"preview": "__all__ = [\n 'asm',\n 'checksec',\n 'common',\n 'constgrep',\n 'cyclic',\n 'debug',\n 'disasm',\n 'disa"
},
{
"path": "pwnlib/commandline/asm.py",
"chars": 3111,
"preview": "import argparse\nimport sys\n\nimport pwnlib.args\npwnlib.args.free_form = False\n\nfrom pwn import *\nfrom pwnlib.commandline "
},
{
"path": "pwnlib/commandline/checksec.py",
"chars": 798,
"preview": "import argparse\nimport sys\n\nfrom pwn import *\nfrom pwnlib.commandline import common\n\nparser = common.parser_commands.add"
},
{
"path": "pwnlib/commandline/common.py",
"chars": 1508,
"preview": "import argparse\nimport os\nimport sys\n\nimport pwnlib\nfrom pwnlib.context import context\n\nchoices = list(map(str, [16,32,6"
},
{
"path": "pwnlib/commandline/constgrep.py",
"chars": 3931,
"preview": "import argparse\nimport functools\nimport re\n\nimport pwnlib.args\npwnlib.args.free_form = False\n\nfrom pwn import *\nfrom pwn"
},
{
"path": "pwnlib/commandline/cyclic.py",
"chars": 2663,
"preview": "import argparse\nimport string\nimport sys\n\nimport pwnlib.args\npwnlib.args.free_form = False\n\nfrom pwn import *\nfrom pwnli"
},
{
"path": "pwnlib/commandline/debug.py",
"chars": 2947,
"preview": "import argparse\nimport sys\n\nfrom pwn import *\nfrom pwnlib.commandline import common\n\nparser = common.parser_commands.add"
},
{
"path": "pwnlib/commandline/disablenx.py",
"chars": 523,
"preview": "import argparse\nfrom pwn import *\nfrom pwnlib.commandline import common\n\nparser = common.parser_commands.add_parser(\n "
},
{
"path": "pwnlib/commandline/disasm.py",
"chars": 2908,
"preview": "import argparse\nimport re\nimport string\nimport sys\n\nimport pwnlib.args\npwnlib.args.free_form = False\n\nfrom pwn import *\n"
},
{
"path": "pwnlib/commandline/elfdiff.py",
"chars": 1301,
"preview": "import shutil\nfrom argparse import ArgumentParser\nfrom subprocess import CalledProcessError\nfrom subprocess import check"
},
{
"path": "pwnlib/commandline/elfpatch.py",
"chars": 810,
"preview": "import sys\n\nimport pwnlib.args\npwnlib.args.free_form = False\n\nfrom pwn import *\nfrom pwnlib.commandline import common\n\np"
},
{
"path": "pwnlib/commandline/errno.py",
"chars": 885,
"preview": "import argparse\nimport os\nimport errno\n\nfrom pwnlib.commandline import common\n\nparser = common.parser_commands.add_parse"
},
{
"path": "pwnlib/commandline/hex.py",
"chars": 1317,
"preview": "import argparse\nimport sys\n\nfrom pwnlib.commandline import common\nfrom pwnlib.util.fiddling import enhex\nfrom pwnlib.uti"
},
{
"path": "pwnlib/commandline/libcdb.py",
"chars": 9320,
"preview": "#!/usr/bin/env python3\nimport re\nimport shutil\nimport sys\n\nimport pwnlib.args\npwnlib.args.free_form = False\n\nfrom pwn im"
},
{
"path": "pwnlib/commandline/main.py",
"chars": 1523,
"preview": "from pwnlib.commandline import asm\nfrom pwnlib.commandline import checksec\nfrom pwnlib.commandline import common\nfrom pw"
},
{
"path": "pwnlib/commandline/phd.py",
"chars": 2341,
"preview": "import argparse\nimport os\nimport signal\nimport sys\nimport io\n\nimport pwnlib.args\npwnlib.args.free_form = False\n\nfrom pwn"
},
{
"path": "pwnlib/commandline/pwnstrip.py",
"chars": 1615,
"preview": "import argparse\n\nimport pwnlib.args\npwnlib.args.free_form = False\n\nfrom pwn import *\nfrom pwnlib.commandline import comm"
},
{
"path": "pwnlib/commandline/scramble.py",
"chars": 2588,
"preview": "import argparse\nimport sys\n\nimport pwnlib.args\npwnlib.args.free_form = False\n\nfrom pwn import *\nfrom pwnlib.commandline "
},
{
"path": "pwnlib/commandline/shellcraft.py",
"chars": 10240,
"preview": "import argparse\nimport os\nimport sys\nimport types\n\nimport pwnlib.args\npwnlib.args.free_form = False\n\nfrom pwn import *\nf"
},
{
"path": "pwnlib/commandline/template.py",
"chars": 10068,
"preview": "from pwn import *\nfrom pwnlib.commandline import common\nfrom pwnlib.util.misc import which, parse_ldd_output, write\n\nfro"
},
{
"path": "pwnlib/commandline/unhex.py",
"chars": 879,
"preview": "import argparse\nimport sys\nfrom string import whitespace\n\nfrom pwnlib.commandline import common\nfrom pwnlib.util.fiddlin"
},
{
"path": "pwnlib/commandline/update.py",
"chars": 714,
"preview": "#!/usr/bin/env python3\nimport subprocess\n\nimport pwnlib.args\npwnlib.args.free_form = False\n\nfrom pwn import *\nfrom pwnli"
},
{
"path": "pwnlib/commandline/version.py",
"chars": 837,
"preview": "#!/usr/bin/env python3\nimport os\nimport subprocess\n\nimport pwnlib.args\npwnlib.args.free_form = False\n\nfrom pwn import *\n"
},
{
"path": "pwnlib/config.py",
"chars": 2011,
"preview": "\"\"\"Allows per-user and per-host configuration of Pwntools settings.\n\nThe list of configurable options includes all of th"
},
{
"path": "pwnlib/constants/LICENSE.txt",
"chars": 252,
"preview": "The file __init__.py is covered by the same license as the majority of this\nproject, that is an MIT license.\n\nThe remain"
},
{
"path": "pwnlib/constants/__init__.py",
"chars": 5077,
"preview": "\"\"\"Module containing constants extracted from header files.\n\nThe purpose of this module is to provide quick access to co"
},
{
"path": "pwnlib/constants/cgc/__init__.py",
"chars": 0,
"preview": ""
},
{
"path": "pwnlib/constants/cgc/thumb.py",
"chars": 903,
"preview": "from pwnlib.constants.constant import Constant\n\nterminate = Constant('terminate', 1)\nSYS_terminate = Constant('SYS_termi"
},
{
"path": "pwnlib/constants/constant.py",
"chars": 262,
"preview": "class Constant(int):\n def __new__(cls, s, i):\n obj = super(Constant, cls).__new__(cls, i)\n obj.s = s\n "
},
{
"path": "pwnlib/constants/darwin/__init__.py",
"chars": 0,
"preview": ""
}
]
// ... and 1186 more files (download for full content)
About this extraction
This page contains the full source code of the Gallopsled/pwntools GitHub repository, extracted and formatted as plain text for AI agents and large language models (LLMs). The extraction includes 1386 files (8.8 MB), approximately 2.4M tokens, and a symbol index with 2326 extracted functions, classes, methods, constants, and types. Use this with OpenClaw, Claude, ChatGPT, Cursor, Windsurf, or any other AI tool that accepts text input. You can copy the full output to your clipboard or download it as a .txt file.
Extracted by GitExtract — free GitHub repo to text converter for AI. Built by Nikandr Surkov.