485 Commits
Author SHA1 Message Date
Carlos Luna-Pena 57de79f0e3 fix #2737: pwnlib.shellcraft submodule imports on python 3.12+ (#2739)
* shellcraft: migrate lazy importer to find_spec for py3.12+

* shellcraft: changelog entry + mypy baseline sync for #2739
2026-05-31 00:03:11 +02:00
peace-maker fb35a123b4 Fix some global type hint errors (#2736)
* Fix some global type hint errors

Errors in global scope should be fixed before we're enabling strict mode in mypy and tackle the local problems.

* Remove pwnlib.util.pairwise since it's in itertools now

pairwise was added to itertools itself in 3.10.
https://docs.python.org/3/library/itertools.html#itertools.pairwise
2026-05-28 17:16:27 +02:00
xtex b0e224b02c loongarch64: prefer assembler macros (#2733)
It turned out that the generator I wrote previously
was incorrect. The assembler pseudo-instruction
should work.
2026-05-26 10:14:26 +02:00
peace-makerandCopilot 79ca9a962c Add type hints to timeout, term.text, hashes, and more (#2723)
* Add typehints to timeout module

Co-authored-by: Copilot <[email protected]>

* Add typehints to device class

* Add typehints to PwnlibException

* Add general typehints for term.text module

Since the available module attributes are handled dynamically like `text.green()` or `text.green_on_white()` or `text.underline_red()`, it's not feasible to type out all possible combinations.

Just tell the type checker that all module attibutes have the same type and thus avoid the `error: Module has no attribute "bold_blue"  [attr-defined]` errors.

* Add typehints for config module

* Add typehints for hashes module

The guaranteed algorithms in hashlib are pretty stable and we can generate the list out proper type checking and auto complete.

Still add a check in CI that notifies us if there are changes in the future.

* Add atexception and atexit types

atexception.unregister was not documented correctly since the function expects an identifier returned by `atexception.register` instead of the handler function.

* Fix toplevel type hints in shellcraft.internal

* Fix toplevel type hints in term.key

---------

Co-authored-by: Copilot <[email protected]>
2026-05-07 14:37:29 +02:00
peace-maker e88054fe49 Start to check type hints gradually (#2714)
* Start to gradually add type hints

Use mypy-baseline to ignore all existing errors for now while avoiding adding new ones in new code.

* Remove Python 2 fallback imports

* Remove py2compat layer

* Avoid redefining a tube helper function

* Remove explicit new-style class (object) syntax

old-style classes were removed in Python 3 so there is no distinction anymore.

* Ignore type error in shellcraft helper script

* Fix repeatedly changing `linux_dirent.d_name`

* Avoid typechecking windows_termcap on Linux

We run mypy on Linux in CI, ignore Windows related import errors

* Run mypy-baseline in CI

* Add type hint plan to CONTRIBUTING

* Sort the mypy baseline

Run with `--sort-baseline` for better diffs.

`mypy | mypy-baseline sync --sort-baseline`

* Switch dev dependencies to dependency-groups

The dependency groups aren't baked into build metadata and won't appear on Pypi.
2026-04-27 17:09:15 +02:00
Arusekk a58534382a Use format strings and raw strings (#2554) 2026-03-21 11:09:46 +01:00
RocketDev 5161b5ef23 Cleanup Python 2 legacy (#2680)
* Cleanup Python 2 legacy

* chore: update changelog
2026-02-20 10:48:42 +01:00
Peace-Maker 3677514a71 Merge branch 'beta' into dev 2025-08-06 14:49:12 +02:00
peace-maker da9797c1c2 Support longer function names in Windows getexport shellcode (#2587)
* Support longer function names in Windows getexport shellcode

Previously, an arbitrary name length limit of 8 characters was in place due to the lack of a proper strcmp loop. Implement a cheap strcmp for longer function names.
This trashes a bunch of registers and we might be able to optimize it further to reduce the damage.

Use a unique label too to avoid redefinition when using the shellcraft template twice in the same shellcode. Use the mov shellcraft template for the destination register to avoid an instruction if the result is already in the desired register.

* Update CHANGELOG
2025-08-05 14:55:35 +00:00
Arusekk 76078a3967 Merge branch 'beta' into dev 2025-04-02 18:01:07 +02:00
Arusekk 1205b1aaa3 regsort: respect register aliases (#2576)
Closes #2481
2025-04-02 15:57:59 +00:00
Arusekk a251f87b16 riscv: avoid compressed instructions (#2419)
... and do not throw errors if there are relocs (might be benign)
2025-04-02 13:24:36 +02:00
Arusekk 96e22ac169 Merge branch 'beta' into dev 2025-03-24 12:19:19 +01:00
Maxime Meignan 92aa64ce01 Fixed bound on memcpy loop in thumb,arm,aarch64 (#2552) 2025-03-24 10:30:14 +00:00
ArusekkandPeace-Maker 328b2cd447 Drop six (#2547)
Co-authored-by: Peace-Maker <[email protected]>
2025-02-28 12:15:04 +01:00
xtex 3eb690bd38 Initial LoongArch64 support (#2529)
Signed-off-by: Bingwu Zhang <[email protected]>
2025-01-29 14:02:10 +01:00
Dvorhack d5fffb6769 Shellcode socket IPV6 (#2415) 2024-06-15 18:56:45 +02:00
peace-makerandLevitatingLion cb540857cc Add basic RISCV64 shellcraft support (#2322)
* Add basic RISCV64 shellcraft support

The `mov` template isn't 100% null-byte and newline free
for all inputs. Certain larger values are just emitted using
the `li` pseudo-instruction by the assembler which might
contain null-bytes.

Co-authored-by: LevitatingLion <[email protected]>

* Generate RISCV syscall constants from musl-libc

diet-libc doesn't support RISCV, so borrow from musl.
Need to consider their license.

* Update CHANGELOG

* Fix CHANGELOG

---------

Co-authored-by: LevitatingLion <[email protected]>
2024-03-29 17:28:50 +01:00
peace-maker 2b7ec5e77a Fix gdb and other doctests (#2355)
* Fix gdb.debug doctests

* Accept bytes in ssh.which

But still return a `str` return for backwards-compatibility.

* CI: Make rpyc visible in gdb's python

* Fix not running all doctests

They appear to have to be a free standing block of `>>>` with an empty line above.

* Remove unnecessary text type check in ssh.which
2024-02-22 18:30:23 +01:00
Arusekk f6bee59b46 elf.maps: Less nullbytes + update hardcoded shellcodes 2024-01-22 13:06:10 +01:00
Arusekk b5253fa510 shellcraft.amd64.mov: fix logic once again 2024-01-21 05:19:41 +01:00
Arusekk ea22cc8cef shellcraft.amd64.mov: fix logic 2024-01-20 22:39:34 +01:00
Arusekk ad6ef0e372 Update pwnlib/shellcraft/templates/aarch64/mov.asm 2024-01-03 21:25:42 +01:00
psondej a814be2604 refactor aarch64 pushstr_array, use "xzr" reg 2024-01-03 19:40:05 +01:00
psondej 15748d082d fix aarch64: mov, pushstr, pushstr_array
fixes:
- https://github.com/Gallopsled/pwntools/issues/2160
- https://github.com/Gallopsled/pwntools/issues/2284
2024-01-03 18:34:26 +01:00
psondej 5d32b24998 add darwin shellcrafter templates 2024-01-03 18:27:33 +01:00
c7649c95e2 Make sure winexec shellcode is 16 byte aligned and add nCmdShow option (#2308)
* Make sure winexec is 16 byte aligned and add nCmdShow option

* fix typo and add changelog

* Update pwnlib/shellcraft/templates/amd64/windows/winexec.asm

Co-authored-by: peace-maker <[email protected]>

* tidied up winexec 16-byte alignment

* fix stack alignment on return

* Use stable alignment

* Avoid null-bytes in `add` instruction for long commands

---------

Co-authored-by: peace-maker <[email protected]>
Co-authored-by: Arusekk <[email protected]>
2023-12-14 16:39:36 +01:00
Arusekk 2f58fe7ae5 Merge branch 'stable' into beta 2023-11-01 23:44:00 +01:00
Arusekk 64d52b09f3 shellcraft.aarch64: Fix atexit SEGV in loader (#2294)
Fixes #2289
2023-11-01 22:26:43 +00:00
Arusekk 0696c5cb4f shellcraft/*/freebsd: match linux in switching cs (#2232)
* shellcraft/*/freebsd: match linux in switching cs

* shellcraft: note trashed registers in switching cs
2023-07-24 19:34:12 +02:00
Arusekk ac855ab179 shellcraft/i386: optimize stackhunter (#2231)
* shellcraft/i386: optimize stackhunter

* shellcraft/i386: add+opt long-gone stackhunter_helper

* shellcraft/i386: concise doctests
2023-07-24 19:33:26 +02:00
Arusekk d69e294d54 py2: fix long hex in shellcraft etc. (#2230) 2023-07-17 17:10:15 +02:00
Disconnect3d dd1edaa6c9 shellcraft: more explicit sleep.asm docstring (#2226)
This commit adds information that the sleep shellcraft function does not check if it returned as part of an interrupt and it does not retry the syscall if this occured.
2023-07-12 00:24:54 +02:00
ArusekkandPeace-Maker 1399c7a969 Shellcraft stackargs (#2219)
From: Peace-Maker <[email protected]>

* Shellcraft: Fix spilling syscall args to the stack

There was a typo in the generated syscall template causing only the last
stack argument to be generated.

$ shellcraft -f asm mips.linux.sendto 3 0x123456 0x100 0 0xabcdefff 0x10
The 0xabcdefff argument was missing.

* Shellcraft: Generate 6 syscall arguments for unknown functions

There are syscalls with 6 arguments like mmap and sendto which couldn't
be called with all 6 arguments set.

$ shellcraft -f asm mips.linux.mmap2 0 0x1000
'PROT_READ | PROT_WRITE | PROT_EXEC' 'MAP_PRIVATE | MAP_ANONYMOUS' -1 0

* Shellcraft: Fix typo in error message

The `syscalls` variable is only present in the generate.py, not the
generated template.

* Regenerate syscall templates

* MIPS shellcraft: Push last two syscall arguments to the stack

The mips.linux.syscall template was only handling 4 syscall arguments
and silently discarded the remaining ones. Push the arguments to the stack
instead.

$ shellcraft -f asm mips.linux.syscall SYS_sendto 3 0x123456 0x100 0 0xabcdefff 0x10

Fixes #2153

* Fix mips syscall doctest

* Update CHANGELOG

Co-authored-by: Peace-Maker <[email protected]>
2023-07-09 22:00:54 +02:00
peace-makerandArusekk 8d104851ad Add shellcraft.sleep template wrapping SYS_nanosleep (#2221)
* Add shellcraft.sleep template wrapping SYS_nanosleep

Accepts the time in seconds as a float argument and calls SYS_nanosleep.

Fixes #1428

* Update CHANGELOG

* Use nanosleep wrapper

Co-authored-by: Arusekk <[email protected]>
2023-07-09 21:27:53 +02:00
Arusekk cb5b8af5f3 Merge branch 'beta' into dev 2023-05-21 15:18:06 +02:00
Arusekk 78196db658 Merge branch 'stable' into beta 2023-05-21 15:07:18 +02:00
peace-maker d76c9fc704 Fix typo in mips mov shellcraft template (#2195) 2023-05-21 13:01:48 +00:00
peace-maker 44d514119e Add basic shellcode for Win64 to shellcraft (#2154)
* Add initial set of shellcode to run WinExec("cmd.exe")

* Remove nullbyte from getexport

* Generate docs for windows shellcode
2023-01-08 22:51:58 +01:00
Arusekk 21131bd5e8 Merge branch 'beta' into dev 2022-12-28 22:34:59 +01:00
Arusekk 8f42bef2b1 Use modern inspect.signature
While at it, drop the hard-to-maintain code.
We lose the signature in py2, but its support is second-class anyway.

Fixes #2145
Closes #2148
2022-12-28 22:13:55 +01:00
Arusekk 87e37ee121 setresuid: generic implementation for all arches (#2093)
* setresuid: generic implementation for all arches

Closes #1324

* Update changelog
2022-08-15 12:41:25 +02:00
Arusekk e53c7f7350 shellcraft: consistently name dupio and optimize (#2092)
* shellcraft: consistently name dupio and optimize

* Update changelog
2022-08-08 23:10:10 +02:00
Arusekk b825e977f3 shellcraft: fix and optimize itoa
Fixes #2073
2022-08-07 10:56:17 +02:00
Arusekk 0533ba01c8 Make setRegisters more robust
Closes #1683
2022-08-07 10:31:33 +02:00
Arusekk 038e50fa0c Replace reserved argument names in syscalls (#1998)
Just stick to the replaced names everywhere.
This actually only broke linkat(2) and symlinkat(2),
but it touches many len -> length renames as well
for the sake of consistency.
Fixes #1964
2022-01-04 11:05:08 +01:00
Arusekk 3dd0b24cc3 Add cat2 to shellcraft (#1995)
* Introduce shellcraft.linux.cat2 to avoid sendfile

Fixes #1871

* Switch CAT_PROC_MAPS_EXIT to shellcraft.linux.cat2
2021-11-14 15:20:43 +01:00
Arusekk 90930e2bb8 Unified args (#1896)
* Introduce _need_bytes(min_wrong=0x80) for ASCII-ok contexts

* Unify argv and env preparation

Fixes #1804

* Switch sh_prepare to bytes

Fixes #1808

* Python 2 again

* Actually fix py2
2021-06-19 11:14:11 +02:00
Arusekk 2d1e0616a7 Update dietlibc headers and all that jazz (#1733)
* Update dietlibc headers

Closes #691

* Generated files

* Enable easy updating of syscall numbers

* Generated files

* Generate new syscalls

* Update CHANGELOG.md

* Workaround for py2

* Revert CGC deletion
2021-05-07 17:17:46 +02:00
Arusekk 835bc6ad56 Address code review from #1861 (#1866)
* Address code review from #1861

Review by @heapcrash

* Fix regression
2021-04-19 09:06:46 +02:00