* Fix some global type hint errors
Errors in global scope should be fixed before we're enabling strict mode in mypy and tackle the local problems.
* Remove pwnlib.util.pairwise since it's in itertools now
pairwise was added to itertools itself in 3.10.
https://docs.python.org/3/library/itertools.html#itertools.pairwise
* refactor: optimize completion script
And deprecate an interface
* chore: update changelog
* refactor: full patch of zsh comp script
* fix: add missing message in output
* fix: a typo and a missing help
* feat: allow -l to match multiple arguments
* feat: optimize completion logic
1. move all complicated functions in front of pwn()
2. add file completion for libcdb subcommands
3. add completion for pwn errno
* Add automatic detection of statically linked binaries in `detect_missing_binaries` function.
* Add entry for PR #2570 to CHANGELOG.md: fix `pwn template` for statically linked binaries.
* Remove partial test implementation
The commands should be tested end-to-end instead of using doctests (later).
---------
Co-authored-by: Peace-Maker <[email protected]>
I often use `checksec *` to lazily avoid typing filenames in a directory.
If the directory contains any other sub-dirs, the command fails.
With this patch, checksec will silently skip dir paths. There's still
TOCTOU issue but I don't think checksec do anything important enough
to explicitly use try/catch to account for that.
Co-authored-by: peace-maker <[email protected]>
This reverts #2346 which apparently didn't do what was expected. The logger has to be initialized for the checksec output to show up, so some other file imported * from pwn before too.
With the double registration of subparsers removed in f28d3ebb6c this didn't happen anymore making checksec print nothing.
* Bump tested python version to >= 3.10
Some workflows were using 3.8 still. Start testing on 3.12 too.
* Fix installing rpyc in CI on ubuntu 24.04
`ubuntu-latest` now points to 24.04 which requires the --break-system-packages dance.
* Test Python 2 on Ubuntu 22.04
Ubuntu 24.04 dropped the python2.7 packages.
* Test on android-34
* Fix ARM binutils disassembly output test expectation
It used to print "; 0x4" but changed to "@ 0x4" in some version.
* Skip QEMU LD_PREFIX path test
Ubuntu 24.04 seemed to have switched the qemu-user --help output to show `/usr/gnemul/qemu-$ARCH` instead of `/etc/qemu-binfmt`. Ignore the actual path in the test.
* Fix x86 ascii shellcode encoder test
The alphabet was using `\` escape sequences badly.
<stdin>:1: SyntaxWarning: invalid escape sequence '\]'
* Fix mips xor encoder unaligned memory access
qemu throws a SIGBUS error when the shellcode tries to access unaligned memory since some version. Align the "stack" properly.
* Fix util.lists.partition test output on Python 3.12
The __repr__ output of OrderedDict was changed to look like ordinary {} dicts.
* Fix safeeval test on Python 3.12
There is a 151 RESUME opcode in Python 3.12 now.
* Fix registering commandline subparsers multiple times for Python 3.11
Python 3.11 added a sanity check to argparse to prevent registering the same subparser multiple times.
argparse.ArgumentError: argument command: conflicting subparser: cyclic
Avoid importing the command twice.
`python -m pwnlib.commandline.cyclic` failed on Python 3.11 triggered in CI when running the commandline tools while collecting coverage.
* Fix pip cache in CI
* Fix pwn constgrep when it matches a non-constant type
This commit fixes the following issue:
```
root@pwndbg:~# pwn constgrep a
Traceback (most recent call last):
File "/usr/local/bin/pwn", line 8, in <module>
sys.exit(main())
File "/usr/local/lib/python3.10/dist-packages/pwnlib/commandline/main.py", line 58, in main
commands[args.command](args)
File "/usr/local/lib/python3.10/dist-packages/pwnlib/commandline/constgrep.py", line 110, in main
for _, k in sorted(out):
TypeError: '<' not supported between instances of 'Constant' and 'type'
```
Note that it was caused because of the following type object being matched and fetched from the module object:
```
ipdb> out[25:27]
[(Constant('CS', 0xd), 'CS'), (<class 'pwnlib.constants.constant.Constant'>, 'Constant')]
ipdb> sorted(out[24:27])
*** TypeError: '<' not supported between instances of 'type' and 'Constant'
```
* Add test for `pwn constgrep C` to the CI
* Add changelog entry
* Detect challenge binary and libc in `pwn template`
When the `args.exe` or `args.libc` arguments are missing, look for the
files in the current working directory.
This allows to quickly get a template by just running `pwn template`
(and maybe --host --port for remote instances).
This is inspired by https://github.com/io12/pwninit
* Update CHANGELOG
* Add --no-auto argument to disable automatic detection
Allow to keep the old static template behavior.
* Add logging about detection outcome
Inform the user that we're looking for the binaries and if we found one.
* Be more strict about libc filename detection
Check about common name patterns instead of plainly the presence of "libc" in the name.
Co-authored-by: Arusekk <[email protected]>
* Change --no-auto argument to reduce double negation
Co-authored-by: Arusekk <[email protected]>
---------
Co-authored-by: Arusekk <[email protected]>
* next fails if string is not found in binary
fixes#2306
* Only display "str_bin_sh" symbol if it's available
* Update CHANGELOG
---------
Co-authored-by: Peace-Maker <[email protected]>
* libcdb.py - python 3.12
Python 3.12 would complain if the \d atom is not escaped in the binary string.
/usr/lib/python3.12/site-packages/pwnlib/commandline/libcdb.py:224: SyntaxWarning: invalid escape sequence '\d'
libc_version = re.search(b'libc[ -](\d+\.\d+)', exe.data)
* Use raw string
---------
Co-authored-by: peace-maker <[email protected]>
* Add ELF.set_runpath()
Shells out to the `patchelf` tool to patch the ELF's RUNPATH. This lets the dynamic loader look for needed shared libraries in the given path first before the system libraries when running the binary.
* Add ELF.set_interpreter()
Shells out to the `patchelf` tool to patch the ELF's PT_INTERP segment. This allows to change the ld.so used when running the binary.
* Add convenience wrapper to set runpath & interpreter
A helper function to patch the ELF such that it uses the dynamic loader and other libraries in the given folder.
* Add method to download libraries matching a libc
Download the matching libraries for the given libc binary and cache them in a local directory using `libcdb.download_libraries()`. The libraries are looked up using libc.rip and fetched from the official package repositories if available.
Only .deb and .pkg.tar.* packages are currently supported (Debian/Ubuntu, Arch).
* Add --libc argument to pwnup template
This generates code into the template which allows you to run the binary using the given libc.
The foreign libc is used by default, but you can choose to run the binary against your system's local libc using the `LOCAL_LIBC` command line argument when executing the exploit script.
* Work around Python 2 tarfile not supporting xz
* Fix crash when libc wasn't found on libc.rip
* Update README
* Use subprocess.check_output instead of pwnlib.process
* Special case Python 2 instead of 3
* Only catch Exceptions instead of everything
Co-authored-by: Arusekk <[email protected]>
* Check launchpad.net for Ubuntu libcs
This mimics the way io12/pwninit obtains the ld.so.
If the download from libc.rip fails, try launchpad.net.
* Hide comment in template when --quiet
* Please confused pylint in PY2 context
Co-authored-by: Arusekk <[email protected]>
---------
Co-authored-by: Arusekk <[email protected]>
"1001" would highlight the "00" even though it's not a null byte in the
input. Group the bytes correctly to look for real null bytes and
newlines only ignoring accidental matches of adjacent bytes.
Co-authored-by: Arusekk <[email protected]>
* make pwn cyclic -l work with entry larger than 4 bytes
* Do not assume py3, do not assume little-endian
* Update changelog
* pack all bytes instead
Co-authored-by: Arusekk <[email protected]>
* Add libcdb commandline tool
Allows to dump information about a local libc binary or lookup matching libc versions based on a build hash or symbol offsets (querying https://libc.rip).
It's possible to download and unstrip a matching libc binary from the command line.
* Fix Python 2 compatibility
* Remove main_arena heuristic
* Update CHANGELOG
Co-authored-by: Arusekk <[email protected]>
Ubuntu, why are you doing this to us?
I seriously mean that Ubuntu is the most silly distro.
Like, they probably updated their docker (or VM) images last week,
then Github got it, and we started getting failures.
They totally changed the behaviour of that 'apport' thing,
and it now drops core files in /var/lib/apport/coredump
instead of the current working directory.
Why is that even... ugh. Nevermind. It works now, at least.
But for how long?
* Cleanup unconditional imports
This may aid #1725
* Import explicitly
* Add good ol' SIGALRM-based debugs for tests
* Fix py2 GDB tests somehow
XXX: see why this matters
* Update CHANGELOG.md
* Try to catch more errors by using python -bb
* Apply changes to travis dockerfiles as well
* Introduce context._need_bytes and context._need_text
...and resolve many issues
peace-maker