Release 3.0.2

The backport only includes the changes in pwnlib/update.py, not the
stuff in pwnlib/commandline/

.coveragerc

@@ -0,0 +1,8 @@
+[run]
+branch = True
+omit =
+    */constants/*
+source =
+    pwn
+    pwnlib
+    ~/.pwntools-cache/

.gitignore

@@ -2,6 +2,8 @@
 *.hi
 *.pyc
 *~
+*.swp
+.ropeproject
 *.pdf
 */auto/*
 */bin/*
@@ -9,4 +11,6 @@ docs/build
 build
 MANIFEST
 dist
-pwntools.egg-info
+*.egg-info
+*.core
+.coverage

.isort.cfg

@@ -0,0 +1,4 @@
+[settings]
+indent='    '
+not_skip = __init__.py
+force_single_line = 1

.sublime-settings

@@ -0,0 +1,7 @@
+{
+    "default_encoding": "UTF-8",
+    "ensure_newline_at_eof_on_save": true,
+    "tab_size": 4,
+    "translate_tabs_to_spaces": true,
+    "trim_trailing_white_space_on_save": true
+}

.travis.yml

@@ -1,15 +1,30 @@
+sudo: false
 language: python
+addons:
+  apt:
+    packages:
+    - gcc-multilib
+    - gcc-4.6-arm-linux-gnueabihf
+cache:
+    - pip
+    - directories:
+        - usr
+        - /home/travis/virtualenv/python2.7.9/lib/python2.7/site-packages/
+        - /home/travis/virtualenv/python2.7.9/bin/
 python:
   - "2.7"
-branches:
-  only:
-    - master
-install:
+after_success:
+  - coveralls
+before_install:
   - source .travis_install.sh
   - source .travis_ssh_setup.sh
-  - python -c 'from pwn import *; print pwnlib.term.term_mode' NOTERM
-  - python -c 'from pwn import *; print pwnlib.term.term_mode' NOTERM
-  - python -c 'from pwn import *; print pwnlib.term.term_mode' NOTERM
-  - python -c 'from pwn import *; print pwnlib.term.term_mode' NOTERM
-
-script: make -C docs doctest
+install:
+  - pip install -e .
+  - pip install -r docs/requirements.txt
+before_script:
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
+script:
+  - PWNLIB_NOTERM=1 coverage run -m sphinx -b doctest docs/source docs/build/doctest

.travis_install.sh

@@ -1,15 +1,68 @@
-#!/usr/bin/env bash
+#!/usr/bin/env bash -e
+local_deb_extract()
+{
+    wget $1
+    ar vx *.deb
+    tar xvf data.tar.*
+    rm -f *.tar.* *deb*
+}
+
+get_binutils()
+{
+    BINUTILS_PREFIX='https://launchpad.net/~pwntools/+archive/ubuntu/binutils/+files/binutils-'
+    BINUTILS_SUFFIX='-linux-gnu_2.22-6ubuntu1.1cross0.11pwntools12~precise_amd64.deb'
+    local_deb_extract "${BINUTILS_PREFIX}${1}${BINUTILS_SUFFIX}"
+}
+
+get_qemu()
+{
+    echo "Installing qemu"
+    QEMU_URL='https://mirrors.kernel.org/ubuntu/pool/universe/q/qemu/qemu-user-static_2.6%2bdfsg-3ubuntu1_amd64.deb'
+    local_deb_extract "$QEMU_URL"
+}
+
+setup_travis()
+{
+    export PATH=$PWD/usr/bin:$PATH
+    export LD_LIBRARY_PATH=$PWD/usr/lib
+
+    if [ ! -d usr/bin ];
+    then
+        # Install our custom binutils
+        which arm-linux-as     || get_binutils arm
+        which mips-linux-as    || get_binutils mips
+        which powerpc-linux-as || get_binutils powerpc
+        which aarch64-linux-as || get_binutils aarch64
+
+        # Install the multiarch binutils
+        local_deb_extract http://mirrors.mit.edu/ubuntu/ubuntu/pool/universe/b/binutils/binutils-multiarch_2.22-6ubuntu1_amd64.deb
+    fi
+
+    if ! (which qemu-arm-static && qemu-arm-static -version | grep 2.6.0); then
+        get_qemu
+    fi
+
+    # Get rid of files we don't want cached
+    rm -rf usr/share
+
+    pushd usr/lib
+    ln -sf libbfd-2.22-multiarch.so libbfd-2.22.so
+    ln -sf libopcodes-2.22-multiarch.so libopcodes-2.22.so
+    popd
+
+    which arm-linux-gnu-as
+    which mips-linux-gnu-as
+    which powerpc-linux-gnu-as
+    which aarch64-linux-gnu-as
+    which qemu-arm-static
+}
 
 setup_linux()
 {
-    sudo apt-get update
-    sudo apt-get install software-properties-common pwgen
+    sudo apt-get install -y software-properties-common openssh-server libncurses5-dev libncursesw5-dev
     sudo apt-add-repository --yes ppa:pwntools/binutils
     sudo apt-get update
     sudo apt-get install binutils-arm-linux-gnu binutils-mips-linux-gnu binutils-powerpc-linux-gnu
-    wget -nc http://www.capstone-engine.org/download/2.1.2/capstone-2.1.2_amd64.deb
-    (echo "a30bcb58fd82d32b135eec978eaa22230c44e722 *capstone-2.1.2_amd64.deb" | sha1sum -c) || exit
-    sudo dpkg -i *.deb
 }
 
 setup_osx()
@@ -19,11 +72,17 @@ setup_osx()
     brew install capstone
 }
 
-case $(uname) in
-Darwin) setup_osx   ;;
-Linux)  setup_linux ;;
-esac
+if [[ "$USER" == "travis" ]]; then
+    setup_travis
+elif [[ "$USER" == "shippable" ]]; then
+    sudo apt-get update
+    sudo apt-get install openssh-server gcc-multilib
+    sudo /usr/sbin/sshd -f /etc/ssh/sshd_config &
+    setup_travis
+elif [[ "$(uname)" == "Darwin" ]]; then
+    setup_osx
+elif [[ "$(uname)" == "Linux" ]]; then
+    setup_linux
+fi
 
-pip install -r requirements.txt
-pip install -r docs/requirements.txt
-pip install .
+dpkg -l

.travis_ssh_setup.sh

@@ -2,17 +2,53 @@
 #
 # Install a demo user for SSH purposes
 #
-U=demouser
+# All of the "conditional sudo" is to do container-based builds on
+# Travis which are much, much faster.
+U=travis
 H=/home/$U
 
-sudo useradd -m $U
-ssh-keygen -t rsa -f /tmp/$U -N ''
+USUDO()
+{
+if [[ "$USER" == "travis" ]];
+then
+    $*
+else
+    sudo -u $U $*
+fi
+}
 
-eval $(ssh-agent -s)
-ssh-add    /tmp/$U
 
-sudo -u $U mkdir $H/.ssh
-sudo -u $U cp    /tmp/$U.pub $H/.ssh/authorized_keys
-sudo chmod -R 700 $H
+if [[ "$USER" == "travis" ]];
+then
+    rm -f ~/.ssh/*
+else
+    # Create the new user account
+    # Disable password login for the user, and ensure the account is not locked
+    sudo useradd -m $U
+    sudo passwd --delete --unlock $U
+fi
 
-(echo -n "$U:"; pwgen 100 1) | sudo chpasswd
+# Generate a new key so that we can log into it
+ssh-keygen -t rsa -f ~/.ssh/$U -N ''
+
+# Load the public key into a memory for below
+pubkey=$(cat ~/.ssh/$U.pub)
+
+# Set the authorized_keys entry to only permit login from localhost,
+# and only with
+USUDO mkdir $H/.ssh
+USUDO tee -a $H/.ssh/authorized_keys <<EOF
+from="127.0.0.1" $pubkey
+EOF
+
+# In the pwntools examples, we ssh to 'example.pwnme'
+# Set up an SSH config entry to make this actually work
+cat >> ~/.ssh/config <<EOF
+
+Host example.pwnme
+    User $U
+    HostName 127.0.0.1
+    IdentityFile ~/.ssh/$U
+EOF
+
+ssh -o "StrictHostKeyChecking no" -vvvv [email protected] id

CHANGELOG.md

@@ -3,7 +3,116 @@
 This changelog only includes added major features and changes. Bugfixes and
 minor changes are omitted.
 
-## 2.2.0 - 2014-08-28 (pre)
+## 3.0.2 (September 6 2016)
+
+- Cherry-pick #695, as this was a regression-fix.
+- Added a fix for the update checker, as it would suggest prereleases as updates to stable releases.
+- Various documentation fixes.
+
+## 3.0.1 (August 20 2016)
+
+A small bugfix release. There were a lot of references to the `master`-branch, however after 3.0.0 we use the names `stable`, `beta` and `dev` for our branches.
+
+## 3.0.0 (August 20 2016)
+
+This was a large release (1305 commits since 2.2.0) with a lot of bugfixes and changes.  The Binjitsu project, a fork of Pwntools, was merged back into Pwntools.  As such, its features are now available here.
+
+As always, the best source of information on specific features is the comprehensive docs at https://pwntools.readthedocs.org.
+
+This list of changes is non-complete, but covers all of the significant changes which were appropriately documented.
+
+#### Android
+
+Android support via a new `adb` module, `context.device`, `context.adb_host`, and `context.adb_port`.
+
+#### Assembly and Shellcode
+
+- Assembly module enhancements for making ELF modules from assembly or pre-assembled shellcode.  See `asm.make_elf` and `asm.make_elf_from_assembly`.
+- `asm` and `shellcraft` command-line tools support flags for the new shellcode encoders
+- `asm` and `shellcraft` command-line tools support `--debug` flag for automatically launching GDB on the result
+- Added MIPS, PowerPC, and AArch64 support to the `shellcraft` module
+- Added Cyber Grand Challenge (CGC) support to the `shellcraft` module
+- Added syscall wrappers for every Linux syscall for all supported architectures to the `shellcraft` module
+    + e.g. `shellcraft.<arch>.gettimeofday`
+- (e.g. `shellcraft.i386.linux.`)
+- Added in-memory ELF loaders for most supported architectures
+    + Only supports statically-linked binaries
+    + `shellcraft.<arch>.linux.loader`
+
+#### Context Module
+
+- Added `context.aslr` which controls ASLR on launched processes.  This works with both `process()` and `ssh.process()`, and can be specified per-process with the `aslr=` keyword argument.
+- Added `context.binary` which automatically sets all `context` variables from an ELF file.
+- Added `context.device`, `context.adb`, `context.adb_port`, and `context.adb_host` for connecting to Android devices.
+- Added `context.kernel` setting for SigReturn-Oriented-Programming (SROP).
+- Added `context.log_file` setting for sending logs to a file.  This can be set with the `LOG_FILE` magic command-line option.
+- Added `context.noptrace` setting for disabling actions which require `ptrace` support.  This is useful for turning all `gdb.debug` and `gdb.attach` options into no-ops, and can be set via the `NOPTRACE` magic command-line option.
+- Added `context.proxy` which hooks all connections and sends them to a SOCKS4/SOCKS5.  This can be set via the `PROXY` magic command-line option.
+- Added `context.randomize` to control randommization of settings like XOR keys and register ordering (default off).
+- Added `context.termianl` for setting how to launch commands in a new terminal.
+
+#### DynELF and MemLeak Module
+
+- Added a `DynELF().libc` property which attempt to find the remote libc and download the ELF from LibcDB.
+- Added a `DynELF().stack` property which leaks the `__environ` pointer from libc, making it easy to leak stack addresses.
+- Added `MemLeak.String` and `MemLeak.NoNewlines` and other related helpers for handling special leakers which cannot e.g. handle newlines in the leaked addresses and which leak a C string (e.g. auto-append a `'\x00'`).
+- Enhancements for leaking speed via `MemLeak.compare` to avoid leaking an entire field if we can tell from a partial leak that it does not match what we are searching for.
+
+#### Encoders Module
+
+- Added a `pwnlib.encoders` module for assembled-shellcode encoders/decoders
+- Includes position-indepentent basic XOR encoders
+- Includes position-independent delta encoders
+- Includes non-position-independent alphanumeric encoders for Intel
+- Includes position-independent alphanumeric encoders for ARM/Thumb
+
+#### ELF Module
+
+- Added a `Core` object which can parse core-files, in order to extract / search for memory contents, and extract register states (e.g. `Core('./corefile').eax`).
+
+#### Format Strings
+
+- Added a basic `fmtstr` module for assisting with Format String exploitation
+
+#### GDB Module
+
+- Added support for debugging Android devices when `context.os=='android'`
+- Added helpers for debugging shellcode snippets with `gdb.debug_assembly()` and `gdb.debug_shellcode()`
+
+#### ROP Module
+
+- Added support for SigReturn via `pwnlib.rop.srop`
+    + Occurs automatically when syscalls are invoked and a function cannot be found
+    + SigReturn frames can be constructed manually with `SigreturnFrame()` objects
+- Added functional doctests for ROP and SROP
+
+#### Tubes Process Module
+
+- `process()` has many new options, check out the documentation
+    + `aslr` controls ASLR
+    + `setuid` can disable the effect of setuid, allowing core dumps (useful for extracting crash state via the new `Core()` object)
+    + TTY echo and control characters can be enabled via `raw` argument
+- `stdout` and `stderr` are now PTYs by default
+    + `stdin` can be set to a PTY also via setting `stdin=process.PTY`
+
+#### Tubes SSH Module
+
+- Massive enhancements all over
+- `ssh` objects now have a `ssh.process()` method which avoids the need to handle shell expansion via the old `ssh.run()` method
+- Files are downloaded via SFTP if available
+- New `download` and `upload` methods auto-detect whether the target is a file or directory and acts accordingly
+- Added `listen()` method alias for `listen_remote()`
+- Added `remote()` method alias for `connect_remote()`
+
+#### Utilities
+
+- Added `fit()` method to combine the functionality of `flat()` with the functionality of `cyclic()`
+- Added `negative()` method to negate the value of an integer via two's complement, with respect to the current integer size (`context.bytes`).
+- Added `xor_key()` method to generate an XOR key which avoids undesirable bytes over a given input.
+- Added a multi-threaded `bruteforce()` implementation, `mbruteforce()`.
+- Added `dealarm_shell()` helper to remove the effects of `alarm()` after you've popped a shell.
+
+## 2.2.0
 
 This was a large release with a lot of bugfixes and changes. Only the most significant
 are mentioned here.
@@ -16,3 +125,11 @@ are mentioned here.
 - Added a serial tube
 - Huge performance gains in the buffering for tubes
 - Re-added user agents
+- Begun using Travis CI with lots of test
+- Removed bundled binutils in favor of documenting how to build them yourselves
+- Added support for port forwarding though our SSH module
+- Added dependency for capstone and ropgadget
+- Added a lots of shellcodes
+- Stuff we forgot
+- Lots of documentation fixes
+- Lots of bugfixes

CONTRIBUTING.md

@@ -1,7 +1,5 @@
 # Contributing
 
-We love pull requests!
-
 Github has a great guide for contributing to open source projects:
 
 - [Contributing to a project](https://guides.github.com/activities/forking/)
@@ -11,7 +9,7 @@ Github has a great guide for contributing to open source projects:
 - [Making a Pull Request](https://guides.github.com/activities/forking/#making-a-pull-request)
 - [Huzzah!](https://guides.github.com/activities/forking/#huzzah)
 
-## Pwntools Specifics
+## pwntools Specifics
 
 In general, we like to keep things documented.  You should add documentation to any new functionality, and update it for any changed functionality.  Our docstrings use the [Google Style Python Docstrings](https://sphinxcontrib-napoleon.readthedocs.org/en/latest/example_google.html#example-google).
 
@@ -21,18 +19,17 @@ Finally, it is probably a good idea to run the test suite locally before doing
 the pull-request to make sure everything works, however this is not a
 requirement.
 
+Once you are ready to do a pull-request, you should figure out if your changes
+constitutes a new feature or a bugfix in stable or beta. If it is a bugfix in
+stable or beta, you should do the pull-request against the branch in question,
+and otherwise your pull-request should be against the dev branch.
+
 Once you do the pull-request Travis CI will run the test-suite on it. Once it
 passes one of the core developers will look at your pull request, possibly
-comment on it and then hopefully merge it into master.
+comment on it and then hopefully merge it into the branch in question.
 
-## Test Suite
+## Automated Testing
 
-To run the test suite, you should be running Ubuntu 12.04 or 14.04, and run the following commands.  **Be aware** that this will add a user to your machine, and create a public key for SSH login!
+Pull requests against Pwntools require at a minimum that no tests have been broken, and ideally each pull request will include new tests to ensure that all of the functionality works as intended.
 
-```sh
-bash .travis_install.sh
-bash .travis_ssh_setup.sh
-cd docs
-pip install -r requirements.txt
-make doctest
-```
+You can find more information on testing in [TESTING.md](TESTING.md).

LICENSE-pwntools.txt

@@ -13,7 +13,7 @@ directories:
 - pwnlib/data/
 
 
-Copyright (c) 2013 Gallopsled
+Copyright (c) 2015 Gallopsled et al.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -1,11 +1,14 @@
 # pwntools - CTF toolkit
-[![Docs latest](https://readthedocs.org/projects/pwntools/badge/)](https://pwntools.readthedocs.org/en/latest)
-[![Docs 2.1.3](https://readthedocs.org/projects/pwntools/badge/?version=2.1.3)](https://pwntools.readthedocs.org/en/2.1.3)
-[![PyPI](https://img.shields.io/pypi/v/pwntools.svg)](https://pypi.python.org/pypi/pwntools/)
-[![Gittip](https://img.shields.io/gittip/gallopsled.svg)](https://www.gittip.com/gallopsled/)
-[![Travis](https://travis-ci.org/Gallopsled/pwntools.svg)](https://travis-ci.org/Gallopsled/pwntools)
+![pwntools logo](https://github.com/Gallopsled/pwntools/blob/stable/docs/source/logo.png?raw=true)
 
-This is the CTF framework used by Gallopsled in every CTF.
+[![Docs](https://readthedocs.org/projects/pwntools/badge/?version=stable)](https://docs.pwntools.com/)
+[![PyPI](https://img.shields.io/pypi/v/pwntools.svg?style=flat)](https://pypi.python.org/pypi/pwntools/)
+[![Travis](https://travis-ci.org/Gallopsled/pwntools.svg)](https://travis-ci.org/Gallopsled/pwntools)
+[![Coveralls](https://img.shields.io/coveralls/Gallopsled/pwntools/dev.svg)](https://coveralls.io/github/Gallopsled/pwntools?branch=dev)
+[![Twitter](https://img.shields.io/badge/twitter-pwntools-4099FF.svg?style=flat)](https://twitter.com/pwntools)
+[![MIT License](https://img.shields.io/badge/license-MIT-blue.svg?style=flat)](http://choosealicense.com/licenses/mit/)
+
+pwntools is a CTF framework and exploit development library. Written in Python, it is designed for rapid prototyping and development, and intended to make exploit writing as simple as possible.
 
 ```python
 from pwn import *
@@ -17,32 +20,35 @@ r.send(asm(shellcraft.sh()))
 r.interactive()
 ```
 
-However we have made command-line frontends for some of the functionality
-in `pwnlib`. These are:
+# Try It Now!
 
-* `asm`/`disasm`: Small wrapper for various assemblers.
-* `constgrep`: Tool for finding constants defined in header files.
-* `cyclic`: De Bruijn sequence generator and lookup tool.
-* `hex`/`unhex`: Command line tools for doing common hexing/unhexing operations.
-* `shellcraft`: Frontend to our shellcode.
-* `phd`: Replacement for `hexdump` with colors.
+You can now do a live demo of Pwntools, [right in your browser](http://demo.pwntools.com).  Alternately, you can SSH to the same host, and log in as user `zerocool` with [this private key][key] (password `i_promise_not_to_be_evil`).
+
+It will drop you into a clean, Docker-ized container.  There is nothing of value on the VPS, so please don't be evil.
+
+[key]: https://gist.githubusercontent.com/zachriggle/efa2e0080ae6de2e8344/raw/4b503e9db54f009d97477d03d4ba5678471f8ff0/id_rsa
 
 # Documentation
-Our documentation is available at [pwntools.readthedocs.org](https://pwntools.readthedocs.org/en/latest/)
+Our documentation is available at [docs.pwntools.com](https://docs.pwntools.com/)
 
 To get you started, we've provided some example solutions for past CTF challenges in our [write-ups repository](https://github.com/Gallopsled/pwntools-write-ups).
 
 # Installation
 
-pwntools is best supported on Ubuntu 12.04 and 14.04, but most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).
+pwntools is best supported on 64-bit Ubuntu 12.04 and 14.04, but most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).  Python 2.7 is required.
 
 Most of the functionality of pwntools is self-contained and Python-only.  You should be able to get running quickly with
 
 ```sh
-pip install pwntools
+apt-get update
+apt-get install python2.7 python-pip python-dev git libssl-dev
+pip install --upgrade pwntools
 ```
 
-However, some of the features (ROP generation and assembling/disassembling foreign architectures) require non-Python dependencies.  For more information, see the [complete installation instructions here](https://pwntools.readthedocs.org/en/latest/install.html).
+If you'd like to be an early tester of the the current beta release, add
+`--pre` to the command-line.
+
+However, some of the features (assembling/disassembling foreign architectures) require non-Python dependencies.  For more information, see the [complete installation instructions here](https://docs.pwntools.com/en/stable/install.html).
 
 
 # Contribution
@@ -50,7 +56,7 @@ However, some of the features (ROP generation and assembling/disassembling forei
 See [CONTRIBUTING.md](CONTRIBUTING.md)
 
 # Contact
-If you have any questions not worthy of a [bug report](https://github.com/Gallopsled/pwntools/issues), feel free to join us
-at [`#gallopsled` on Freenode](irc://irc.freenode.net/gallopsled) and ask away.
-Click [here](https://kiwiirc.com/client/irc.freenode.net/gallopsled) to connect.
-
+If you have any questions not worthy of a [bug report](https://github.com/Gallopsled/pwntools/issues), feel free to ping us
+at [`#pwntools` on Freenode](irc://irc.freenode.net/pwntools) and ask away.
+Click [here](https://kiwiirc.com/client/irc.freenode.net/pwntools) to connect.
+There is also a [mailing list](https://groups.google.com/forum/#!forum/pwntools-users) for higher latency discussion.

TESTING.md

@@ -0,0 +1,41 @@
+# Testing
+
+Pwntools makes extensive use of unit tests and integration tests to ensure everything is in working order, and no regressions occur.
+
+## Test Suite
+
+
+To run the test suite, it is beste to use Ubuntu 12.04 or 14.04, and run the following commands.  **Be aware** that this will add a user to the machine, and create a public key for SSH login!
+
+```sh
+bash .travis_install.sh
+bash .travis_ssh_setup.sh
+pip install -e .
+pip install -r docs/requirements.txt
+cd docs
+PWNLIB_NOTERM=1 make clean doctest
+```
+
+## New Tests
+
+To add a new test to an existing module, just add an inline doctest.  If the test needs access to an external module, add the import statement to the `testsetup` block in the corresponding file in `docs/source/<module>.rst`.
+
+To add an entirely new module, create a new `module.rst` and add it to the list in `index.rst`.  The best way to see if your tests are actually being run is to add an intentionally-failing test like:
+
+```py
+>>> assert False
+```
+
+## Example Test Module
+
+The module `pwnlib.testexample` exists to demonstrate how everything is tied together.  The only files which were modified to add this example module and run its tests automatically are:
+
+- `pwnlib/testexample.py`
+- `docs/source/testexample.rst`
+- `docs/source/index.rst`
+
+## Shellcode and ROP
+
+These are both less easy to test, as they require actually executing code, or loading real binaries.  In order to make the process simpler, the `runner` library was created to wrap common tasks.  For an example of testing shellcode with these helpers, see [exit.asm](pwnlib/shellcraft/templates/i386/linux/exit.asm).
+
+Additionally, for loading ELF files on-the-fly, the helpers `ELF.from_bytes` and `ELF.from_assembly` are available.

docs/Makefile

@@ -6,6 +6,8 @@ SPHINXOPTS    =
 SPHINXBUILD   = sphinx-build
 PAPER         =
 BUILDDIR      = build
+DASHBUILD     = ./dashbuild.py
+TAR           = tar
 
 # Internal variables.
 PAPEROPT_a4     = -D latex_paper_size=a4
@@ -14,7 +16,8 @@ ALLSPHINXOPTS   = -d $(BUILDDIR)/doctrees $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) sou
 # the i18n builder cannot share the environment and doctrees with the others
 I18NSPHINXOPTS  = $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) source
 
-.PHONY: help clean html dirhtml singlehtml pickle json htmlhelp qthelp devhelp epub latex latexpdf text man changes linkcheck doctest gettext
+
+.PHONY: help clean html dirhtml singlehtml pickle json htmlhelp qthelp devhelp epub latex latexpdf text man changes linkcheck doctest gettext dash
 
 help:
 	@echo "Please use \`make <target>' where <target> is one of"
@@ -34,12 +37,17 @@ help:
 	@echo "  texinfo    to make Texinfo files"
 	@echo "  info       to make Texinfo files and run them through makeinfo"
 	@echo "  gettext    to make PO message catalogs"
+	@echo "  dash       to make a Dash docset"
 	@echo "  changes    to make an overview of all changed/added/deprecated items"
 	@echo "  linkcheck  to check all external links for integrity"
 	@echo "  doctest    to run all doctests embedded in the documentation (if enabled)"
 
 clean:
 	-rm -rf $(BUILDDIR)/*
+	-rm -rf /tmp/user/pwn*
+	-rm -rf $(HOME)/.pwntools-cache
+	-rm -rf /tmp/pwn* 2>/dev/null || true
+	-rm -rf build
 
 html:
 	$(SPHINXBUILD) -b html $(ALLSPHINXOPTS) $(BUILDDIR)/html
@@ -136,6 +144,11 @@ gettext:
 	@echo
 	@echo "Build finished. The message catalogs are in $(BUILDDIR)/locale."
 
+dash:
+	$(DASHBUILD) source $(BUILDDIR)/dash
+	$(TAR) --exclude='.DS_Store' -cvzf $(BUILDDIR)/dash/pwntools.tgz -C $(BUILDDIR)/dash pwntools.docset
+	@echo "Build finished. The Dash docset is in $(BUILDDIR)/dash."
+
 changes:
 	$(SPHINXBUILD) -b changes $(ALLSPHINXOPTS) $(BUILDDIR)/changes
 	@echo

docs/dashbuild.py

@@ -0,0 +1,99 @@
+#!/usr/bin/env python
+
+# -*- coding: utf-8 -*-
+
+#
+# Helper to build Dash docset from sphinx source files.
+#
+# Dash docsets can be read by various applications:
+#
+# Dash         OS X, iOS         https://kapeli.com
+# Zeal         Linux, Windows    https://zealdocs.org
+# Velocity     Windows           http://velocity.silverlakesoftware.com
+# LovelyDocs   Android           http://lovelydocs.io
+# dasht        POSIX             https://github.com/sunaku/dasht
+# Helm Dash    emacs             https://github.com/areina/helm-dash
+#
+
+import argparse
+import doc2dash.__main__
+import os, os.path
+import sphinx
+import sqlite3
+import sys
+
+sys.path.append(os.path.abspath(os.path.join('..', 'pwnlib')))
+import version
+
+def main(args):
+	"""Generate a Dash docset from Sphinx source files."""
+
+	srcdir = args.srcdir
+	dstdir = args.dstdir
+	name = args.name
+
+	if not os.path.exists(dstdir):
+		os.makedirs(dstdir)
+
+	# Generate HTML without indices.
+	sphinx.build_main([ "sphinx-build", "-b", "html", "-d", os.path.join(dstdir, "doctrees"), \
+		"-t", "dash", srcdir, os.path.join(dstdir, "html") ])
+
+	# Convert to docset.
+	try:
+		doc2dash.__main__.main.main( \
+			[ os.path.join(dstdir, "html"), "-d", dstdir, "-n", name, \
+					"-f", "-I", "index.html"], "doc2dash", False)
+	except SystemExit,e:
+		pass
+
+	# Insert a link to the online version.
+	online = args.online
+	if online is not None and online != "":
+		url = online.replace("@VERSION", args.version)
+		with open(os.path.join(dstdir, name+".docset", "Contents", "Info.plist"), "r+") as f_info:
+			pl = f_info.read()
+			pl = pl.replace("</dict>", \
+				"\t<key>DashDocSetFallbackURL</key>\n\t<string>%s</string>\n</dict>" % url)
+			f_info.seek(0)
+			f_info.write(pl)
+			f_info.truncate()
+
+	# Modify the CSS to hide the menu included in the HTML.
+	with open(os.path.join(dstdir, name+".docset", "Contents", "Resources", "Documents", "_static", "css", "theme.css"), "r+") as f_css:
+		css = f_css.read()
+		css = css.replace( \
+			'@media screen and (max-width: 768px){.wy-body-for-nav{background:#fcfcfc}.wy-nav-top{display:block}',\
+			'@media screen {.wy-body-for-nav{background:#fcfcfc}' )
+		css = css.replace( \
+			'@media screen and (max-width: 480px)', \
+			'@media screen ')
+		f_css.seek(0)
+		f_css.write(css)
+		f_css.truncate()
+
+	# Modify the index
+	db_conn = sqlite3.connect(os.path.join(dstdir, name+".docset", "Contents", "Resources", "docSet.dsidx"))
+	try:
+		db_conn.execute('INSERT INTO "searchIndex" ("name","type","path") VALUES ' \
+			'("1 Contents", "Guide", "index.html"), ' \
+			'("2 About pwntools", "Guide", "about.html"), ' \
+			'("3 Installation", "Guide", "install.html"), ' \
+			'("4 Getting Started", "Guide", "intro.html"), ' \
+			'("5 Globals (pwn)", "Guide", "globals.html"), ' \
+			'("6 Command Line Tools", "Guide", "commandline.html")')
+		db_conn.execute('DELETE FROM "searchIndex" WHERE "type" = "Module" AND ("name" = "pwn" OR "name" = "pwnlib")')
+		db_conn.commit()
+	finally:
+		db_conn.close()
+
+	return 0
+
+parser = argparse.ArgumentParser()
+parser.add_argument("--name", help="docset name", default="pwntools")
+parser.add_argument("--online", help="URL for online docs", default="https://pwntools.readthedocs.org/en/@VERSION/")
+parser.add_argument("--version", help="pwntools version", default=version.__version__)
+parser.add_argument("srcdir", help="Source directory containing .rst files")
+parser.add_argument("dstdir", help="Destination and working directory")
+
+main(parser.parse_args())

docs/requirements.txt

@@ -1,6 +1,16 @@
-paramiko
-argparse
-mako
-pyelftools
 sphinxcontrib-napoleon
-sphinxcontrib-autoprogram
+sphinxcontrib-autoprogram
+isort
+paramiko>=1.15.2
+mako>=1.0.0
+pyelftools>=0.2.3
+capstone
+ropgadget>=5.3
+pyserial>=2.7
+requests>=2.5.1
+pip>=6.0.8
+tox>=1.8.1
+pygments>=2.0
+sphinx_rtd_theme
+doc2dash
+coveralls

docs/source/about.rst

@@ -11,7 +11,7 @@ nice side-effects.
 When redesigning pwntools for 2.0, we noticed two contrary goals:
 
 * We would like to have a "normal" python module structure, to allow other
-  people to faster get familiar with how pwntools works.
+  people to familiarize themselves with pwntools quickly.
 * We would like to have even more side-effects, especially by putting the
   terminal in raw-mode.
 
@@ -30,10 +30,10 @@ the following:
 
 * Imports everything from the toplevel :mod:`pwnlib` along with
   functions from a lot of submodules. This means that if you do
-  ``import pwn`` or ``from pwn import *``, you will access to
+  ``import pwn`` or ``from pwn import *``, you will have access to
   everything you need to write an exploit.
 * Calls :func:`pwnlib.term.init` to put your terminal in raw mode
-  and implementing functionality to make it look like it is not.
+  and implements functionality to make it appear like it isn't.
 * Setting the :data:`pwnlib.context.log_level` to `"info"`.
 * Tries to parse some of the values in :data:`sys.argv` and every
   value it succeeds in parsing it removes.

docs/source/adb.rst

@@ -0,0 +1,9 @@
+.. testsetup:: *
+
+   from pwn import *
+
+:mod:`pwnlib.adb` --- Android Debug Bridge
+=====================================================
+
+.. automodule:: pwnlib.adb
+   :members:

docs/source/asm.rst

@@ -1,7 +1,12 @@
 .. testsetup:: *
 
+   import tempfile
+   import subprocess
+   from pwnlib.context import context
    from pwnlib.asm import *
    from pwnlib import shellcraft
+   from pwnlib.tubes.process import process
+
 
 :mod:`pwnlib.asm` --- Assembler functions
 =========================================

docs/source/commandline.rst

@@ -17,6 +17,9 @@ pwntools comes with a handful of useful command-line utilities which serve as wr
 .. autoprogram:: pwnlib.commandline.asm:parser
    :prog: asm
 
+.. autoprogram:: pwnlib.commandline.checksec:parser
+   :prog: checksec
+
 .. autoprogram:: pwnlib.commandline.constgrep:p
    :prog: constgrep
 
@@ -32,12 +35,21 @@ pwntools comes with a handful of useful command-line utilities which serve as wr
 .. autoprogram:: pwnlib.commandline.elfpatch:p
    :prog: elfpatch
 
+.. autoprogram:: pwnlib.commandline.errno:parser
+   :prog: errno
+
 .. autoprogram:: pwnlib.commandline.hex:parser
    :prog: hex
 
 .. autoprogram:: pwnlib.commandline.phd:parser
    :prog: phd
 
+.. autoprogram:: pwnlib.commandline.pwnstrip:p
+   :prog: pwnstrip
+
+.. autoprogram:: pwnlib.commandline.scramble:parser
+   :prog: scramble
+
 .. autoprogram:: pwnlib.commandline.shellcraft:p
    :prog: shellcraft
 

docs/source/conf.py

@@ -11,13 +11,19 @@
 # All configuration values have a default; values that are commented out
 # serve to show the default.
 
-import sys, os, subprocess
+import os
+import subprocess
+import sys
+
+build_dash = tags.has('dash')
 
 # If extensions (or modules to document with autodoc) are in another directory,
 # add these directories to sys.path here. If the directory is relative to the
 # documentation root, use os.path.abspath to make it absolute, like shown here.
 sys.path.insert(0, os.path.abspath('../..'))
 
+import pwnlib
+
 # -- General configuration -----------------------------------------------------
 
 # If your documentation needs a minimal Sphinx version, state it here.
@@ -39,11 +45,16 @@ extensions = [
 ]
 
 doctest_global_setup = '''
+import sys, os
+os.environ['PWNLIB_NOTERM'] = '1'
+os.environ['PWNLIB_RANDOMIZE'] = '0'
 import pwnlib
 pwnlib.context.context.reset_local()
 pwnlib.context.ContextType.defaults['log_level'] = 'ERROR'
+pwnlib.context.ContextType.defaults['randomize'] = False
 pwnlib.term.text.when = 'never'
-
+pwnlib.log.install_default_handler()
+pwnlib.log.rootlogger.setLevel(1)
 '''
 
 autodoc_member_order = 'alphabetical'
@@ -64,14 +75,13 @@ master_doc = 'index'
 
 # General information about the project.
 project = u'pwntools'
-copyright = u'2014, Gallopsled et al'
+copyright = u'2016, Gallopsled et al.'
 
 # The version info for the project you're documenting, acts as replacement for
 # |version| and |release|, also used in various other places throughout the
 # built documents.
 #
 # The short X.Y version.
-import pwnlib
 release = pwnlib.__version__
 version = release.rsplit('.', 1)[0]
 
@@ -161,10 +171,10 @@ html_static_path = []
 #html_additional_pages = {}
 
 # If false, no module index is generated.
-#html_domain_indices = True
+html_domain_indices = not build_dash
 
 # If false, no index is generated.
-#html_use_index = True
+html_use_index = not build_dash
 
 # If true, the index is split into individual pages for each letter.
 #html_split_index = False
@@ -207,7 +217,7 @@ latex_elements = {
 # (source start file, target name, title, author, documentclass [howto/manual]).
 latex_documents = [
   ('index', 'pwntools.tex', u'pwntools Documentation',
-   u'Gallopsled et al', 'manual'),
+   u'2016, Gallopsled et al.', 'manual'),
 ]
 
 intersphinx_mapping = {'python': ('https://docs.python.org/2.7', None),
@@ -240,7 +250,7 @@ intersphinx_mapping = {'python': ('https://docs.python.org/2.7', None),
 # (source start file, name, description, authors, manual section).
 man_pages = [
     ('index', 'pwntools', u'pwntools Documentation',
-     [u'Gallopsled et al'], 1)
+     [u'2016, Gallopsled et al.'], 1)
 ]
 
 # If true, show URL addresses after external links.
@@ -254,7 +264,7 @@ man_pages = [
 #  dir menu entry, description, category)
 texinfo_documents = [
   ('index', 'pwntools', u'pwntools Documentation',
-   u'Gallopsled et al', 'pwntools', 'One line description of project.',
+   u'', 'pwntools', 'CTF exploit writing toolkit.',
    'Miscellaneous'),
 ]
 
@@ -312,3 +322,18 @@ def linkcode_resolve(domain, info):
                 pass
 
     return "https://github.com/Gallopsled/pwntools/blob/%s/%s" % (branch, filename)
+
+
+# The readthedocs theme is used by the Dash generator. (Can be used for HTML too.)
+
+if build_dash:
+
+    # on_rtd is whether we are on readthedocs.org
+    on_rtd = os.environ.get('READTHEDOCS', None) == 'True'
+
+    if not on_rtd:  # only import and set the theme if we're building docs locally
+        import sphinx_rtd_theme
+        html_theme = 'sphinx_rtd_theme'
+        html_theme_path = [sphinx_rtd_theme.get_html_theme_path()]
+
+    # otherwise, readthedocs.org uses their theme by default, so no need to specify it

docs/source/context.rst

@@ -1,9 +1,8 @@
 .. testsetup:: *
 
-   import pwnlib
-   from   pwnlib.context import context
-   import threading, logging
-
+   from pwn import *
+   import logging
+   log = pwnlib.log.getLogger('pwnlib.context')
 
 :mod:`pwnlib.context` --- Setting runtime variables
 =====================================================

docs/source/encoders.rst

@@ -0,0 +1,25 @@
+.. testsetup:: *
+
+   from pwn import *
+
+:mod:`pwnlib.encoders` --- Encoding Shellcode
+===============================================
+
+.. automodule:: pwnlib.encoders
+   :members:
+
+.. automodule:: pwnlib.encoders.encoder
+   :members:
+
+
+.. automodule:: pwnlib.encoders.amd64
+   :members:
+
+.. automodule:: pwnlib.encoders.arm
+   :members:
+
+.. automodule:: pwnlib.encoders.i386
+   :members:
+
+.. automodule:: pwnlib.encoders.i386.xor
+   :members:

docs/source/fmtstr.rst

@@ -0,0 +1,10 @@
+.. testsetup:: *
+
+	from pwn import *
+	import tempfile
+
+:mod:`pwnlib.fmtstr` --- Format string bug exploitation tools
+=============================================================
+
+.. automodule:: pwnlib.fmtstr
+   :members:

docs/source/index.rst

@@ -5,6 +5,20 @@ pwntools
 Written in Python, it is designed for rapid prototyping and development,
 and intended to make exploit writing as simple as possible.
 
+The primary location for this documentation is at docs.pwntools.com_, which uses
+readthedocs_. It comes in three primary flavors:
+
+- Stable_
+- Beta_
+- Dev_
+
+.. _readthedocs: https://readthedocs.org
+.. _docs.pwntools.com: https://docs.pwntools.com
+.. _Stable: https://docs.pwntools.com/en/stable
+.. _Beta: https://docs.pwntools.com/en/beta
+.. _Dev: https://docs.pwntools.com/en/dev
+
+
 Getting Started
 ---------------
 
@@ -28,30 +42,44 @@ Each of the ``pwntools`` modules is documented here.
    :maxdepth: 1
    :glob:
 
+   adb
    asm
    atexception
    atexit
    constants
    context
    dynelf
+   encoders
    elf
    exception
+   fmtstr
    gdb
    log
    memleak
    replacements
    rop
+   rop/*
+   runner
    shellcraft
+   shellcraft/*
    term
    timeout
    tubes
+   tubes/*
    ui
    useragents
    util/*
 
-Indices and tables
-==================
+.. toctree::
+   :hidden:
 
-* :ref:`genindex`
-* :ref:`modindex`
-* :ref:`search`
+   testexample
+
+.. only:: not dash
+
+   Indices and tables
+   ==================
+
+   * :ref:`genindex`
+   * :ref:`modindex`
+   * :ref:`search`

docs/source/install.rst

@@ -20,18 +20,25 @@ following system libraries installed.
 Released Version
 -----------------
 
-Pwntools is available as a ``pip`` package.
+pwntools is available as a ``pip`` package.
 
 .. code-block:: bash
 
     $ apt-get install python2.7 python2.7-dev python-pip
-    $ pip install pwntools
+    $ pip install --upgrade pwntools
 
-Latest Version
+Alternatively you can get early access to the beta release if you want to help
+file bugs or simple get newer features:
+
+.. code-block:: bash
+
+    $ pip install --upgrade --pre pwntools
+
+
+Development
 --------------
 
-Alternatively if you prefer to use the latest version from the
-repository:
+If you are hacking on Pwntools locally, you'll want to do something like this:
 
 .. code-block:: bash
 
@@ -40,7 +47,3 @@ repository:
     $ pip install -e .
 
 .. _Ubuntu: https://launchpad.net/~pwntools/+archive/ubuntu/binutils
-.. _libcapstone 2.1: http://www.capstone-engine.org
-.. _i386: http://www.capstone-engine.org/download/2.1.2/capstone-2.1.2_i386.deb
-.. _amd64: http://www.capstone-engine.org/download/2.1.2/capstone-2.1.2_amd64.deb
-

docs/source/install/binutils.rst

@@ -7,6 +7,8 @@ installed. We've made this process as smooth as we can.
 
 In these examples, replace ``$ARCH`` with your target architecture (e.g., arm, mips64, vax, etc.).
 
+Building `binutils` from source takes about 60 seconds on a modern 8-core machine.
+
 Ubuntu
 ^^^^^^^^^^^^^^^^
 First, add our `Personal Package Archive repository <http://binutils.pwntools.com>`__.
@@ -15,7 +17,7 @@ First, add our `Personal Package Archive repository <http://binutils.pwntools.co
 
     $ apt-get install software-properties-common
     $ apt-add-repository ppa:pwntools/binutils
-    $ apt-get updatez
+    $ apt-get update
 
 Then, install the binutils for your architecture.
 
@@ -56,8 +58,6 @@ OSes, ``binutils`` is simple to build by hand.
     gpg --keyserver keys.gnupg.net --recv-keys 4AE55E93
     gpg --verify binutils-$V.tar.gz.sig
 
-    rm -rf binutils-*
-
     tar xf binutils-$V.tar.gz
 
     mkdir binutils-build
@@ -77,6 +77,6 @@ OSes, ``binutils`` is simple to build by hand.
     MAKE=gmake
     hash gmake || MAKE=make
 
-    $MAKE -j
+    $MAKE -j clean all
     sudo $MAKE install
 

docs/source/install/capstone.rst

@@ -1,27 +0,0 @@
-Capstone
--------------
-
-Capstone is a disassembly library required for gathering ROP gadgets
-and ROP chain generation.
-
-It's a separate requirement from ``binutils`` because it's used by
-Jon Salwan's ``ROPgadget`` tool which we use under the covers.
-
-In particular, version ``2.1.2`` should be used.  Capstone can be downloaded here_, or installed with the steps below.
-
-Ubuntu
-^^^^^^^^^^^^^^^^
-
-.. code-block:: bash
-
-    $ wget -nc http://www.capstone-engine.org/download/2.1.2/capstone-2.1.2_amd64.deb
-    $ apt-get install capstone-2.1.2_amd64.deb
-
-Mac OS X
-^^^^^^^^^^^^^^^^
-
-.. code-block:: bash
-
-    $ brew install capstone
-
-.. _here:  http://www.capstone-engine.org/download.html

docs/source/install/headers.rst

@@ -1,5 +1,5 @@
 Python Development Headers
--------------
+-----------------------------
 
 Some of pwntools' Python dependencies require native extensions (for example, Paramiko requires PyCrypto).
 

docs/source/intro.rst

@@ -67,7 +67,7 @@ actually **interact** with processes.
 
 There's even an SSH module for when you've got to SSH into a box to perform
 a local/setuid exploit with :mod:`pwnlib.tubes.ssh`.  You can quickly spawn
-processes and grab the output, or spawn a process and interact iwth it like
+processes and grab the output, or spawn a process and interact with it like
 a ``process`` tube.
 
 ::
@@ -170,14 +170,14 @@ But if you do, it's easy to suss out!
        5:   eb f9                   jmp    0x0
 
 However, you shouldn't even need to write your own shellcode most of the
-time!  Pwntools comes with the :mod:`pwnlib.shellcraft` module, which is
+time!  pwntools comes with the :mod:`pwnlib.shellcraft` module, which is
 loaded with useful time-saving shellcodes.
 
 Let's say that we want to `setreuid(getuid(), getuid())` followed by `dup`ing
 file descriptor 4 to `stdin`, `stdout`, and `stderr`, and then pop a shell!
 
     >>> asm(shellcraft.setreuid() + shellcraft.dupsh(4)).encode('hex')
-    '6a3158cd8089c389d96a4658cd806a045b6a0359496a3f58cd8075f86a68682f2f2f73682f62696e89e331c96a0b5899cd80'
+    '6a3158cd8089c36a465889d9cd806a045b6a0359496a3f58cd8075f86a68682f2f2f73682f62696e6a0b5889e331c999cd80'
 
 
 Misc Tools
@@ -190,7 +190,7 @@ Find offsets in your buffer that cause a crash, thanks to :mod:`pwnlib.cyclic`.
 
     >>> print cyclic(20)
     aaaabaaacaaadaaaeaaa
-    >>> # Assume EIP = 0x62616166 ('faab') at crash time
+    >>> # Assume EIP = 0x62616166 ('faab' which is pack(0x62616166))  at crash time
     >>> print cyclic_find('faab')
     120
 

docs/source/log.rst

@@ -1,7 +1,21 @@
-:mod:`pwnlib.log` and   --- Logging stuff
-=================================================================
+:mod:`pwnlib.log` --- Logging stuff
+===================================
 
 .. automodule:: pwnlib.log
+   :members: getLogger, install_default_handler, rootlogger
+
+.. autoclass:: pwnlib.log.Progress
+   :members:
+   :member-order: bysource
 
 .. autoclass:: pwnlib.log.Logger
-   :members: debug, info, warn, error, progress, success, failure, indented, info_once, warn_once
+   :members:
+   :member-order: bysource
+
+.. autoclass:: pwnlib.log.Handler
+   :members:
+   :member-order: bysource
+
+.. autoclass:: pwnlib.log.Formatter
+   :members:
+   :member-order: bysource

docs/source/rop.rst

@@ -1,11 +1,14 @@
 .. testsetup:: *
 
-   from pwnlib.elf import *
-   from pwnlib.rop import *
-   from pwnlib.util.misc import which
+   from pwn import *
 
 :mod:`pwnlib.rop` --- Return Oriented Programming
 =================================================
 
-.. automodule:: pwnlib.rop
-   :members:
+Submodules
+----------
+
+.. toctree::
+   :glob:
+
+   rop/*

docs/source/rop/rop.rst

@@ -0,0 +1,9 @@
+.. testsetup:: *
+
+   from pwn import *
+
+:mod:`pwnlib.rop.rop` --- Return Oriented Programming
+==========================================================
+
+.. automodule:: pwnlib.rop.rop
+   :members:

docs/source/rop/srop.rst

@@ -0,0 +1,9 @@
+.. testsetup:: *
+
+   from pwn import *
+
+:mod:`pwnlib.rop.srop` --- Sigreturn Oriented Programming
+==========================================================
+
+.. automodule:: pwnlib.rop.srop
+   :members:

docs/source/runner.rst

@@ -0,0 +1,9 @@
+.. testsetup:: *
+
+   from pwn import *
+
+:mod:`pwnlib.runner` --- Running Shellcode
+===========================================
+
+.. automodule:: pwnlib.runner
+   :members:

docs/source/shellcraft/amd64.rst

@@ -1,6 +1,7 @@
 .. testsetup:: *
 
    from pwn import *
+   context.clear(arch='amd64')
 
 :mod:`pwnlib.shellcraft.amd64` --- Shellcode for AMD64
 ===========================================================

docs/source/shellcraft/arm.rst

@@ -1,6 +1,7 @@
 .. testsetup:: *
 
    from pwn import *
+   context.clear(arch='arm')
 
 :mod:`pwnlib.shellcraft.arm` --- Shellcode for ARM
 ===========================================================

docs/source/shellcraft/i386.rst

@@ -1,6 +1,7 @@
 .. testsetup:: *
 
    from pwn import *
+   context.clear(arch='i386')
 
 :mod:`pwnlib.shellcraft.i386` --- Shellcode for Intel 80386
 ===========================================================

docs/source/shellcraft/regsort.rst

@@ -0,0 +1,9 @@
+.. testsetup:: *
+
+    from pwnlib.regsort import *
+
+:mod:`pwnlib.regsort` --- Register sorting
+===========================================================
+
+.. automodule:: pwnlib.regsort
+   :members:

docs/source/shellcraft/thumb.rst

@@ -1,6 +1,7 @@
 .. testsetup:: *
 
    from pwn import *
+   context.clear(arch='thumb')
 
 :mod:`pwnlib.shellcraft.thumb` --- Shellcode for Thumb Mode
 ===========================================================

docs/source/testexample.rst

@@ -0,0 +1,10 @@
+.. testsetup:: *
+
+   import os
+   from pwnlib.testexample import add
+
+:mod:`pwnlib.testexample` --- Example Test Module
+==================================================
+
+.. automodule:: pwnlib.testexample
+   :members:

docs/source/timeout.rst

@@ -5,7 +5,7 @@
    import time
 
 :mod:`pwnlib.timeout` --- Timeout handling
-========================================
+============================================
 
 .. automodule:: pwnlib.timeout
    :members:

docs/source/tubes.rst

@@ -1,69 +1,30 @@
 .. testsetup:: *
 
-   from pwnlib.tubes.tube import tube
-   from pwnlib.tubes.ssh import *
-   from pwnlib.tubes.remote import remote
-   from pwnlib.util.misc import which
-   from pwnlib.context import context
+   from pwn import *
 
 :mod:`pwnlib.tubes` --- Talking to the World!
 =============================================
 
 .. automodule:: pwnlib.tubes
 
-   Sockets
-   -------
 
-   .. automodule:: pwnlib.tubes.remote
+Types of Tubes
+-------------------
 
-      .. autoclass:: pwnlib.tubes.remote.remote
-         :members:
-         :show-inheritance:
+.. toctree::
+    :maxdepth: 3
+    :glob:
 
-   .. automodule:: pwnlib.tubes.listen
+    tubes/*
 
-      .. autoclass:: pwnlib.tubes.listen.listen
-         :members:
-         :show-inheritance:
 
-   .. automodule:: pwnlib.tubes.sock
+:mod:`pwnlib.tubes.tube` --- Common Functionality
+-------------------------------------------------
 
-      .. autoclass:: pwnlib.tubes.sock.sock()
-         :show-inheritance:
 
-   Processes
-   ---------
+.. automodule:: pwnlib.tubes.tube
 
-   .. automodule:: pwnlib.tubes.process
-
-      .. autoclass:: pwnlib.tubes.process.process
-         :members: kill, poll, communicate
-         :show-inheritance:
-
-   SSH
-   ---
-
-   .. automodule:: pwnlib.tubes.ssh
-
-      .. autoclass:: pwnlib.tubes.ssh.ssh
-         :members:
-
-      .. autoclass:: pwnlib.tubes.ssh.ssh_channel()
-         :members: kill, poll, interactive
-         :show-inheritance:
-
-      .. autoclass:: pwnlib.tubes.ssh.ssh_connecter()
-         :show-inheritance:
-
-      .. autoclass:: pwnlib.tubes.ssh.ssh_listener()
-         :show-inheritance:
-
-   Common functionality
-   --------------------
-
-   .. automodule:: pwnlib.tubes.tube
-
-      .. autoclass:: pwnlib.tubes.tube.tube()
-         :members:
-         :exclude-members: recv_raw, send_raw, settimeout_raw,
-                           can_recv_raw
+  .. autoclass:: pwnlib.tubes.tube.tube()
+     :members:
+     :exclude-members: recv_raw, send_raw, settimeout_raw,
+                       can_recv_raw

docs/source/tubes/processes.rst

@@ -0,0 +1,12 @@
+.. testsetup:: *
+
+   from pwn import *
+
+:mod:`pwnlib.tubes.process` --- Processes
+===========================================================
+
+.. automodule:: pwnlib.tubes.process
+
+  .. autoclass:: pwnlib.tubes.process.process
+     :members:
+     :show-inheritance:

docs/source/tubes/serial.rst

@@ -0,0 +1,11 @@
+.. testsetup:: *
+
+   from pwn import *
+
+:mod:`pwnlib.tubes.serialtube` --- Serial Ports
+===========================================================
+
+.. automodule:: pwnlib.tubes.serialtube
+
+   .. autoclass:: pwnlib.tubes.serialtube.serialtube
+      :members:

docs/source/tubes/sockets.rst

@@ -0,0 +1,25 @@
+.. testsetup:: *
+
+   from pwn import *
+
+:mod:`pwnlib.tubes.sock` --- Sockets
+===========================================================
+
+
+.. automodule:: pwnlib.tubes.sock
+
+   .. autoclass:: pwnlib.tubes.sock.sock()
+      :show-inheritance:
+
+
+.. automodule:: pwnlib.tubes.remote
+
+   .. autoclass:: pwnlib.tubes.remote.remote
+      :members:
+      :show-inheritance:
+
+.. automodule:: pwnlib.tubes.listen
+
+   .. autoclass:: pwnlib.tubes.listen.listen
+      :members:
+      :show-inheritance:

docs/source/tubes/ssh.rst

@@ -0,0 +1,21 @@
+.. testsetup:: *
+
+   from pwn import *
+
+:mod:`pwnlib.tubes.ssh` --- SSH
+===========================================================
+
+.. automodule:: pwnlib.tubes.ssh
+
+   .. autoclass:: pwnlib.tubes.ssh.ssh
+      :members:
+
+   .. autoclass:: pwnlib.tubes.ssh.ssh_channel()
+      :members: kill, poll, interactive
+      :show-inheritance:
+
+   .. autoclass:: pwnlib.tubes.ssh.ssh_connecter()
+      :show-inheritance:
+
+   .. autoclass:: pwnlib.tubes.ssh.ssh_listener()
+      :show-inheritance:

examples/README.md

@@ -4,7 +4,7 @@ the pwntools project.
 
 We have a plan to create a separate repository with examples, primarily
 exploits. Until we do so, we recommend new users to look at
-https://pwntools.readthedocs.org, as this is a better overview of our features.
+https://docs.pwntools.com, as this is a better overview of our features.
 
 In no particular order the docstrings for each example:
 

examples/android.py

@@ -0,0 +1,22 @@
+from pwn import *
+
+# Tell pwntools that the target is an Android device
+context.os='android'
+context.arch='aarch64' # or 'arm'
+
+# Optionally, set the remote ADB server address
+context.adb_host='172.16.110.1'
+
+# Wait for a device to become available
+print adb.wait_for_device()
+
+# Who am I?
+print adb.process('id').recvall().strip()
+
+# Interactive sessions!
+io = adb.shell()
+io.sendline('echo Hello, world; exit')
+print io.recvall().replace('\r\n', '\n').strip()
+
+# Debugging!
+gdb.debug('sh').interactive()

examples/asm.py

@@ -3,7 +3,8 @@ Example showing the interface to `pwnlib.asm.asm` and `pwnlib.shellcraft`.
 """
 
 from pwn import *
-context(arch='i386', os='linux', net='tcp4')
+
+context(arch='i386', os='linux')
 
 shellcode = shellcraft.i386_to_amd64()
 shellcode_asm = asm(shellcode)

examples/attach.py

@@ -0,0 +1,12 @@
+"""
+Example showing `pwnlib.gdb.attach()`
+"""
+
+from pwn import *
+
+bash = process('/bin/bash')
+gdb.attach(bash, execute = '''
+p "hello from pwnlib"
+c
+''')
+bash.interactive()

examples/clean_and_log.py

@@ -26,4 +26,3 @@ atexit.register(r.clean_and_log)
 while True:
     line = r.recvline()
     print re.findall('^prefix (\S+)$', line)[0]
-

examples/gen-README.py

@@ -4,13 +4,14 @@ Script to generate README.md
 
 from pwn import *
 
+
 out = '''# Examples
 While these examples should all work, they are not very representative of
 the pwntools project.
 
 We have a plan to create a separate repository with examples, primarily
 exploits. Until we do so, we recommend new users to look at
-https://pwntools.readthedocs.org, as this is a better overview of our features.
+https://docs.pwntools.com, as this is a better overview of our features.
 
 In no particular order the docstrings for each example:
 

examples/readline_completers.py

@@ -5,8 +5,8 @@ off some proof-of-concepts.
 """
 
 from pwn import *
-from pwnlib.term.completer import LongestPrefixCompleter, \
-                                  PathCompleter
+from pwnlib.term.completer import LongestPrefixCompleter
+from pwnlib.term.completer import PathCompleter
 
 c1 = LongestPrefixCompleter([
     'foobar',

examples/remote_gdb_debugging.py

@@ -3,9 +3,10 @@ Simple example showing how to use the remote
 gdb debugging features available in pwntools.
 """
 
-from pwn import *
 import getpass
 
+from pwn import *
+
 s = ssh(getpass.getuser(), '127.0.0.1', port = 22, keyfile = "~/.ssh/id_rsa")
 c = gdb.ssh_gdb(s, '/bin/sh', execute = '''
 p/x $pc

examples/yesno.py

@@ -0,0 +1,10 @@
+"""
+Example showing `pwnlib.ui.yesno()`
+"""
+
+from pwn import *
+
+if ui.yesno('Do you like Pwntools?'):
+    print ':D'
+else:
+    print ':('

extra/bash_completion.d/shellcraft

@@ -0,0 +1,46 @@
+# cache list of shellcodes
+_shellcraft_shellcodes=$(shellcraft)
+
+_shellcraft()
+{
+    COMPREPLY=()
+    local cur prev opts word code
+    cur="${COMP_WORDS[COMP_CWORD]}"
+    prev="${COMP_WORDS[COMP_CWORD-1]}"
+    opts="-h --help -? --show -o --out -f --format"
+
+    if [ "${prev}" == "-f" -o    \
+         "${prev}" == "--format" \
+        ] ; then
+        opts="raw str c hex asm p hexii"
+        COMPREPLY=( $(compgen -W "${opts}" -- ${cur}))
+        return 0
+    fi
+
+    if [ "${prev}" == "-o" -o \
+         "${prev}" == "--out" \
+        ] ; then
+        COMPREPLY=( $(compgen -f ${cur}))
+        return 0
+    fi
+
+    if [[ "${cur}" == -* ]] ; then
+        COMPREPLY=( $(compgen -W "${opts}" -- ${cur}) )
+        return 0
+    fi
+
+    # check if a shellcode was already chosen
+    for word in "${COMP_WORDS[@]}" ; do
+        for code in ${_shellcraft_shellcodes} ; do
+            if [ "${word}" == "${code}" ] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- ${cur}) )
+                return 0
+            fi
+        done
+    done
+
+    # complete shellcode name
+    COMPREPLY=( $(compgen -W "${_shellcraft_shellcodes}" -- ${cur}) )
+}
+
+complete -F _shellcraft shellcraft

extra/docker/Dockerfile

@@ -0,0 +1,58 @@
+############################################################
+# Dockerfile to build Pwntools container
+# Based on Ubuntu
+############################################################
+
+FROM ubuntu:trusty
+MAINTAINER Maintainer Gallopsled et al.
+
+RUN apt-get update && apt-get install -y software-properties-common
+RUN apt-add-repository --yes ppa:pwntools/binutils
+RUN apt-get update
+RUN apt-get install -y \
+	binutils \
+	binutils-aarch64-linux-gnu \
+	binutils-arm-linux-gnueabihf \
+	curl \
+	gdb \
+	gdbserver \
+	gdb-multiarch \
+	git \
+	libc6-i386 \
+	libc6-arm64-cross \
+	libc6-armhf-cross \
+	libc6-dev-i386 \
+	libffi-dev \
+	libglib2.0-dev \
+	libncurses5-dev \
+	libncursesw5-dev \
+	ltrace \
+	python-dev \
+	python-pip \
+	python3-pip \
+	python2.7 \
+	qemu \
+	qemu-user-static \
+	strace \
+	tmux \
+	wget
+RUN pip install --upgrade ipython
+RUN useradd -m zerocool
+RUN usermod -U zerocool
+
+RUN mkdir -p /etc/qemu-binfmt
+RUN ln -s /usr/aarch64-linux-gnu /etc/qemu-binfmt/aarch64
+RUN ln -s /usr/arm-linux-gnueabihf /etc/qemu-binfmt/arm
+
+RUN pip install --upgrade pip pycparser psutil python-ptrace
+RUN pip3 install --upgrade pip pycparser psutil python-ptrace
+
+RUN pip install --upgrade git+https://github.com/Gallopsled/pwntools.git
+
+RUN locale-gen en_US.UTF-8
+ENV LANG en_US.UTF-8
+ENV LANGUAGE en_US:en
+ENV LC_ALL en_US.UTF-8
+
+RUN chown -R zerocool.zerocool /home/zerocool
+RUN chsh -s /bin/bash zerocool

extra/textmate/README.md

@@ -0,0 +1,19 @@
+# Pwntools Mako Assembly Syntax Highlighting
+
+This should work for TextMate and anything that's compatible (e.g. Sublime Text).
+
+![screenshot](screenshot.png)
+
+## Installation
+
+### Sublime Text
+
+Copy the `tmLanguage` files into the `Packages/User` folder in your Sublime Text configuration folder.  
+
+These folders are located at the paths shown below.  Replace `2` with `3` if you're a ST3 user.
+
+- OS X: `~/Library/Application Support/Sublime Text 2`
+- Windows: `%APPDATA%\Sublime Text 2`
+- Linux: `~/.config/sublime-text-2`
+
+Open a `.asm` file, and choose `View > Syntax > Open All ... > Pwntools ...`.

extra/textmate/pwntools.YAML-tmLanguage

@@ -0,0 +1,209 @@
+# [PackageDev] target_format: plist, ext: tmLanguage
+---
+name: Pwntools Mako ASM
+scopeName: source.pwntools
+fileTypes: ['.asm']
+uuid: 19bbf78d-4ad8-4385-bb20-5bde8df453bf
+
+patterns:
+- comment: x86 instruction
+  name: support.function.mnemonic.x86.all
+  match: \b(?i)(v)?(aaa|aad|aam|aas|adc|add|addpd|addps|addsd|addss|addsubpd|addsubps|aesdec|aesdeclast|aesenc|aesenclast|aesimc|aeskeygenassist|and|andpd|andps|andnpd|andnps|arpl|blendpd|bmi|blendps|blendvpd|blendvps|bound|bsf|bsr|bswap|bt|btc|btr|bts|cbw|cwde|cdqe|clc|cld|cflush|clts|cmc|cmov(n?e|ge?|ae?|le?|be?|n?o|n?z)|cmp|cmppd|cmpps|cmps|cnpsb|cmpsw|cmpsd|cmpsq|cmpss|cmpxchg|cmpxchg8b|cmpxchg16b|comisd|comiss|cpuid|crc32|cvtdq2pd|cvtdq2ps|cvtpd2dq|cvtpd2pi|cvtpd2ps|cvtpi2pd|cvtpi2ps|cvtps2dq|cvtps2pd|cvtps2pi|cvtsd2si|cvtsd2ss|cvts2sd|cvtsi2ss|cvtss2sd|cvtss2si|cvttpd2dq|cvtpd2pi|cvttps2dq|cvttps2pi|cvttps2dq|cvttps2pi|cvttsd2si|cvttss2si|cwd|cdq|cqo|daa|das|dec|div|divpd|divps|divsd|divss|dppd|dpps|emms|enter|extractps|f2xm1|fabs|fadd|faddp|fiadd|fbld|fbstp|fchs|fclex|fnclex|fcmov(n?e|ge?|ae?|le?|be?|n?o|n?z)|fcom|fcmop|fcompp|fcomi|fcomip|fucomi|fucomip|fcos|fdecstp|fdiv|fdivp|fidiv|fdivr|fdivrp|fidivr|ffree|ficom|ficomp|fild|fincstp|finit|fnint|fist|fistp|fisttp|fld|fld1|fldl2t|fldl2e|fldpi|fldlg2|fldln2|fldz|fldcw|fldenv|fmul|fmulp|fimul|fnop|fpatan|fprem|fprem1|fptan|frndint|frstor|fsave|fnsave|fscale|fsin|fsincos|fsqrt|fst|fstp|fstcw|fnstcw|fstenv|fnstenv|fsts(w?)|fnstsw|fsub|fsubp|fisub|fsubr|fsubrp|fisubr|ftst|fucom|fucomp|fucompp|fxam|fxch|fxrstor|fxsave|fxtract|fyl2x|fyl2xp1|haddpd|haddps|husbpd|hsubps|idiv|imul|in|inc|ins|insb|insw|insd|insertps|int|into|invd|invplg|invpcid|iret|iretd|iretq|lahf|lar|lddqu|ldmxcsr|lds|les|lfs|lgs|lss|lea|leave|lfence|lgdt|lidt|llgdt|lmsw|lock|lods|lodsb|lodsw|lodsd|lodsq|lsl|ltr|maskmovdqu|maskmovq|maxpd|maxps|maxsd|maxss|mfence|minpd|minps|minsd|minss|monitor|mov|movapd|movaps|movbe|movd|movq|movddup|movdqa|movdqu|movq2q|movhlps|movhpd|movhps|movlhps|movlpd|movlps|movmskpd|movmskps|movntdqa|movntdq|movnti|movntpd|movntps|movntq|movq|movq2dq|movs|movsb|movsw|movsd|movsq|movsd|movshdup|movsldup|movss|movsx|movsxd|movupd|movups|movzx|mpsadbw|mul|mulpd|mulps|mulsd|mulss|mwait|neg|not|or|orpd|orps|out|outs|outsb|outsw|outsd|pabsb|pabsw|pabsd|packsswb|packssdw|packusdw|packuswbpaddb|paddw|paddd|paddq|paddsb|paddsw|paddusb|paddusw|palignr|pand|pandn|pause|pavgb|pavgw|pblendvb|pblendw|pclmulqdq|pcmpeqb|pcmpeqw|pcmpeqd|pcmpeqq|pcmpestri|pcmpestrm|pcmptb|pcmptgw|pcmpgtd|pcmpgtq|pcmpistri|pcmpisrm|pdep|pext|pextrb|pextrd|pextrq|pextrw|phaddw|phaddd|phaddsw|phinposuw|phsubw|phsubd|phsubsw|pinsrb|pinsrd|pinsrq|pinsrw|pmaddubsw|pmadddwd|pmaxsb|pmaxsd|pmaxsw|pmaxsw|pmaxub|pmaxud|pmaxuw|pminsb|pminsd|pminsw|pminub|pminud|pminuw|pmovmskb|pmovsx|pmovzx|pmuldq|pmulhrsw|pmulhuw|pmulhw|pmulld|pmullw|pmuludw|pop|popa|popad|popcnt|popf|popfd|popfq|por|prefetch|psadbw|pshufb|pshufd|pshufhw|pshuflw|pshufw|psignb|psignw|psignd|pslldq|psllw|pslld|psllq|psraw|psrad|psrldq|psrlw|psrld|psrlq|psubb|psubw|psubd|psubq|psubsb|psubsw|psubusb|psubusw|test|ptest|punpckhbw|punpckhwd|punpckhdq|punpckhddq|punpcklbw|punpcklwd|punpckldq|punpckldqd|push|pusha|pushad|pushf|pushfd|pxor|prcl|rcr|rol|ror|rcpps|rcpss|rdfsbase|rdgsbase|rdmsr|rdpmc|rdrand|rdtsc|rdtscp|rep|repe|repz|repne|repnz|roundpd|roundps|roundsd|roundss|rsm|rsqrps|rsqrtss|sahf|sal|sar|shl|shr|sbb|scas|scasb|scasw|scasd|set(n?e|ge?|ae?|le?|be?|n?o|n?z)|sfence|sgdt|shld|shrd|shufpd|shufps|sidt|sldt|smsw|sqrtpd|sqrtps|sqrtsd|sqrtss|stc|std|stmxcsr|stos|stosb|stosw|stosd|stosq|str|sub|subpd|subps|subsd|subss|swapgs|syscall|sysenter|sysexit|sysret|teset|ucomisd|ucomiss|ud2|unpckhpd|unpckhps|unpcklpd|unpcklps|vbroadcast|vcvtph2ps|vcvtp2sph|verr|verw|vextractf128|vinsertf128|vmaskmov|vpermilpd|vpermilps|vperm2f128|vtestpd|vzeroall|vzeroupper|wait|fwait|wbinvd|wrfsbase|wrgsbase|wrmsr|xadd|xchg|xgetbv|xlat|xlatb|xor|xorpd|xorps|xrstor|xsave|xsaveopt|xsetbv|lzcnt|extrq|insertq|movntsd|movntss|vfmaddpd|vfmaddps|vfmaddsd|vfmaddss|vfmaddsubbpd|vfmaddsubps|vfmsubaddpd|vfmsubaddps|vfmsubpd|vfmsubps|vfmsubsd|vfnmaddpd|vfnmaddps|vfnmaddsd|vfnmaddss|vfnmsubpd|vfnmusbps|vfnmusbsd|vfnmusbss|vbroadcastss|vbroadcastsd|vbroadcastf128|vmaskmovps|vmaskmovpd|cvt|xor|cli|sti|hlt|nop|lock|wait|enter|leave|ret|loop(n?e|n?z)?|call|j(mp|n?e|n?ge?|n?ae?|le?|be?|n?o|n?z|n?c|n?p|n?b))\b
+- comment: ARM instruction
+  name: support.function.mnemonic.arm.arithmetic
+  match: >
+    (?x)\b((?i)
+    ( (bf(c|i)|(u|s)bfx|(u|s)xta?(h|b)?)
+      | (v(add|cvt|sub|mov|trn|cmp|div|qdmulh|mrs|mul|ld1|qadd|qshrun|st[1234]|addw|mull|mlal|rshrn|swp|qmovun)|qmovun)(\.([isup]?8|[isupf]?16|[isuf]?32|[isu]?64))*
+      | (mul|mla|mull|smlabb)
+      | (mov(w|t))
+      | rev(8|16)?
+      | (pld|adr|adrl|vswp)
+      | bkpt
+    )?(?-i))?\b
+- comment: ARM instruction
+  name: support.function.mnemonic.arm.memory
+  match: >
+    (?x)\b((?i)(
+            swi|svc|wfi|
+            dmb | clrex | dsb | isb |
+            v(ldr|str|push|pop) |
+            (push|pop) |
+            (st|ld)(
+                p |
+                    r(ex|s?(h|b)|d)? |
+                    m(
+                            (f|e)(d|a) |
+                            (d|i)(b|a)
+                    )?
+            ) |
+            b(l|x|lx|lr|r)? |
+            (i|e)?ret|
+            b\.(eq|ne|hs|cs|lo|cc|mi|pl|vs|vc|hi|ls|ge|lt|gt|le|al|nv)+ |
+            (c|t)?bn?z|
+    )+(ne|eq|cs|hs|cc|lo|mi|pl|vs|vc|hi|ls|lt|le|gt|ge|al)?(?-i))\b
+- comment: ARM instruction
+  name: meta.preprocessor.c.include
+  match: >
+    \b((?i)(def(b|w|s)|equ|(include|get)(\s+([a-zA-Z_]+[0-9a-zA-Z_]*|[0-9]+[a-zA-Z_]+[0-9a-zA-Z_]*?)\.s)?)?(?-i))\b
+- comment: ARM instruction
+  name: comment.nop
+  match: >
+    \b((?i)nop(ne|eq|cs|hs|cc|lo|mi|pl|vs|vc|hi|ls|lt|le|gt|ge|al)?(?-i))?\b
+- comment: Comment Block
+  begin: /\*
+  end: \*/
+  name: comment.block
+- comment: Directive
+  name: keyword.control.directive
+  match: \.(?i)(globl|global|macro|endm|purgem|if|elseif|else|endif|section|text|arm|align|balign|irp|rept|endr|req|unreq|error|short|func|endfunc|hidden|type|fpu|arch|code|altmacro|object_arch|word|int|string)(?-i)\b
+- comment: ARM register
+  name: storage.other.register.arm
+  match: \b((?i)\$?([xw][0-9]|[xw]1[0-9]||[xw]2[0-9]|[wx]30|wzr|xzr|wsp|fpsr|fpcr|[rcp]1[0-5]|[rcp][0-9]|a[1-4]|v[1-8]|sl|sb|fp|ip|sp|lr|(c|s)psr(_c)?|pc|[sd]3[0-1]|[sd][12][0-9]|[sd][0-9]|fpsid|fpscr|fpexc|q3[0-1]|q2[0-9]|q1[0-9]|q[0-9]|APSR_nzcv|sy)!?(?-i))?\b
+- comment: x86 register
+  name: storage.other.register.x86
+  match: \b((?i)(al|ah|ax|eax|rax|bl|bh|bx|ebx|rbx|cl|ch|cx|ecx|rcx|dl|dh|dx|edx|rdx|sil|si|esi|rsi|di|di|edi|rdi|bpl|bp|ebp|rbp|sp|esp|rsp|cs|ds|ss|es|fs|gs|ip|eip|rip|flags|eflags|rflags|r8|r9|r10|r11|r12|r13|r14|r15|r8d|r9d|r10d|r11d|r12d|r13d|r14d|r15d|r8w|r9w|r10w|r11w|r12w|r13w|r14w|r15w|r8l|r9l|r10l|r11l|r12l|r13l|r14l|r15l|st0|st1|st2|st3|st4|st5|st6|st7|mm0|mm1|mm2|mm3|mm4|mm5|mm6|mm7|xmm0|xmm1|xmm2|xmm3|xmm4|xmm5|xmm6|xmm7|xmm8|xmm9|xmm10|xmm11|xmm12|xmm13|xmm14|xmm15|xmm16|xmm17|xmm18|xmm19|xmm20|xmm21|xmm22|xmm23|xmm24|xmm25|xmm26|xmm27|xmm28|xmm29|xmm30|xmm31|ymm0|ymm1|ymm2|ymm3|ymm4|ymm5|ymm6|ymm7|ymm8|ymm9|ymm10|ymm11|ymm12|ymm13|ymm14|ymm15|ymm16|ymm17|ymm18|ymm19|ymm20|ymm21|ymm22|ymm23|ymm24|ymm25|ymm26|ymm27|ymm28|ymm29|ymm30|ymm31|zmm0|zmm1|zmm2|zmm3|zmm4|zmm5|zmm6|zmm7|zmm8|zmm9|zmm10|zmm11|zmm12|zmm13|zmm14|zmm15|zmm16|zmm17|zmm18|zmm19|zmm20|zmm21|zmm22|zmm23|zmm24|zmm25|zmm26|zmm27|zmm28|zmm29|zmm30|zmm31|cr0|cr2|cr3|cr4|gdtr|ldtr|idtr|dr0|dr1|dr2|dr3|dr4|dr5|dr6|dr7|msr)!?(?-i))?\b
+- comment: SPARC register
+  name: storage.other.register.sparc
+  match: \b((?i)\$?([gloi][0-9])!?(?-i))?\b
+- comment: MIPS register
+  name: storage.other.register.mips
+  match: \b((?i)\$?(r[0-3][0-9]|v[0-2]|a[0-4]|t[0-8]|s[0-9]|t([89]|10|k[0-2]))!?(?-i))?\b
+- comment: Numeric Hex
+  name: constant.numeric.hex
+  match: (\b|\s+)(\#)?-?(0x|&)[0-9a-fA-F_]+\b
+- comment: Numeric Literal
+  name: constant.numeric.literal
+  match: (\b|\s+)\#-?[0-9a-zA-Z_]+\b
+- comment: Numeric Decimal
+  name: constant.numeric.dec
+  match: (\b|\s+)[0-9]+\b
+- comment: Label
+  name: entity.name.tag
+  match: ([\w${}]+[:])
+- comment: Inline Python
+  name: pwntools.raw.block.python
+  begin: (<%\s)
+  end: (%>)
+  beginCaptures:
+    '1': {name: 'keyword.control'}
+  endCaptures:
+    '1': {name: 'keyword.control'}
+  patterns:
+    - {include: source.python}
+- comment: Inline Docstring
+  begin: (<%(\S+)>)
+  end: (</%(\2)>)
+  beginCaptures:
+    '1': {name: 'keyword.control'}
+  endCaptures:
+    '1': {name: 'keyword.control'}
+  patterns:
+    - {include: comment.block}
+- comment: Mako Tag
+  name: source.mako.tag
+  begin: (<%\w+\s)
+  end: (/>)
+  beginCaptures:
+    '1': {name: 'keyword.control'}
+  endCaptures:
+    '1': {name: 'keyword.control'}
+  patterns:
+    - {include: comment.block}
+- comment: Mako Substitution
+  name: source.mako.expression
+  begin: (\${)
+  end: (})
+  beginCaptures:
+    '1': {name: 'keyword.control'}
+  endCaptures:
+    '1': {name: 'keyword.control'}
+  patterns:
+    - {include: source.python}
+- comment: Mako Comment
+  match: (^##(.*)$)
+  name: comment.line.mako
+- comment: Mako Directive
+  begin: ^\s*(%)(\s*((endfor)|(endif)|(endwhile)))?
+  end: $
+  beginCaptures:
+    '1': {name: 'keyword.control'}
+    '2': {name: 'keyword.control'}
+  patterns:
+    - {include: source.python}
+  name: source.doc.python.mako.controlline
+
+    #   <key>begin</key>
+    #   <string>^(#)</string>
+    #   <key>beginCaptures</key>
+    #   <dict>
+    #     <key>1</key>
+    #     <dict>
+    #       <key>name</key>
+    #       <string>keyword.control</string>
+    #     </dict>
+    #   </dict>
+    #   <key>end</key>
+    #   <string>$</string>
+    #   <key>name</key>
+    #   <string>source.python.mako.line</string>
+    #   <key>patterns</key>
+    #   <array>
+    #     <dict>
+    #       <key>include</key>
+    #       <string>comment.block</string>
+    #     </dict>
+    #   </array>
+    # </dict>
+
+      # <key>begin</key>
+      # <string>^\s*(%)(\s*((endfor)|(endif)|(endwhile)))?</string>
+      # <key>beginCaptures</key>
+      # <dict>
+      #   <key>1</key>
+      #   <dict>
+      #     <key>name</key>
+      #     <string>keyword.control</string>
+      #   </dict>
+      #   <key>2</key>
+      #   <dict>
+      #     <key>name</key>
+      #     <string>keyword.control</string>
+      #   </dict>
+      # </dict>
+
+
+      # <key>begin</key>
+      # <string>(&lt;%\s)</string>
+      # <key>captures</key>
+      # <dict>
+      #   <key>1</key>
+      #   <dict>
+      #     <key>name</key>
+      #     <string>keyword.control</string>
+      #   </dict>
+      # </dict>
+      # <key>end</key>
+      # <string>(%&gt;)</string>
+      # <key>name</key>
+      # <string>source.mako.substitution</string>
+      # <key>patterns</key>
+      # <array>
+      #   <dict>
+      #     <key>include</key>
+      #     <string>source.python</string>
+      #   </dict>
+      # </array>
+
+  # match: "(
+  #           (bf(c|i)|(u|s)bfx|(u|s)xta?(h|b)?) |
+  #           (v(add|cvt|sub|mov|trn|cmp|div|qdmulh|mrs|mul|ld1|qadd|qshrun|st[1234]|addw|mull|mlal|rshrn|swp|qmovun)|qmovun)(\.([isup]?8|[isupf]?16|[isuf]?32|[isu]?64))* |
+  #           (and|m(rs|sr)|eor|sub|rsb|add|adc|sbc|rsc|tst|teq|cmp|cmn|orr|mov|bic|mvn |
+  #                   (neg) |
+  #                   (lsr|lsl|ror|asr)
+  #           )s? |
+  #           (mul|mla|mull|smlabb) |
+  #           (mov(w|t)) |
+  #           rev(8|16)? |
+  #           (pld|adr|adrl|vswp)
+  #   )

extra/textmate/pwntools.tmLanguage

@@ -0,0 +1,337 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>fileTypes</key>
+	<array>
+		<string>.asm</string>
+	</array>
+	<key>name</key>
+	<string>Pwntools Mako ASM</string>
+	<key>patterns</key>
+	<array>
+		<dict>
+			<key>comment</key>
+			<string>x86 instruction</string>
+			<key>match</key>
+			<string>\b(?i)(v)?(aaa|aad|aam|aas|adc|add|addpd|addps|addsd|addss|addsubpd|addsubps|aesdec|aesdeclast|aesenc|aesenclast|aesimc|aeskeygenassist|and|andpd|andps|andnpd|andnps|arpl|blendpd|bmi|blendps|blendvpd|blendvps|bound|bsf|bsr|bswap|bt|btc|btr|bts|cbw|cwde|cdqe|clc|cld|cflush|clts|cmc|cmov(n?e|ge?|ae?|le?|be?|n?o|n?z)|cmp|cmppd|cmpps|cmps|cnpsb|cmpsw|cmpsd|cmpsq|cmpss|cmpxchg|cmpxchg8b|cmpxchg16b|comisd|comiss|cpuid|crc32|cvtdq2pd|cvtdq2ps|cvtpd2dq|cvtpd2pi|cvtpd2ps|cvtpi2pd|cvtpi2ps|cvtps2dq|cvtps2pd|cvtps2pi|cvtsd2si|cvtsd2ss|cvts2sd|cvtsi2ss|cvtss2sd|cvtss2si|cvttpd2dq|cvtpd2pi|cvttps2dq|cvttps2pi|cvttps2dq|cvttps2pi|cvttsd2si|cvttss2si|cwd|cdq|cqo|daa|das|dec|div|divpd|divps|divsd|divss|dppd|dpps|emms|enter|extractps|f2xm1|fabs|fadd|faddp|fiadd|fbld|fbstp|fchs|fclex|fnclex|fcmov(n?e|ge?|ae?|le?|be?|n?o|n?z)|fcom|fcmop|fcompp|fcomi|fcomip|fucomi|fucomip|fcos|fdecstp|fdiv|fdivp|fidiv|fdivr|fdivrp|fidivr|ffree|ficom|ficomp|fild|fincstp|finit|fnint|fist|fistp|fisttp|fld|fld1|fldl2t|fldl2e|fldpi|fldlg2|fldln2|fldz|fldcw|fldenv|fmul|fmulp|fimul|fnop|fpatan|fprem|fprem1|fptan|frndint|frstor|fsave|fnsave|fscale|fsin|fsincos|fsqrt|fst|fstp|fstcw|fnstcw|fstenv|fnstenv|fsts(w?)|fnstsw|fsub|fsubp|fisub|fsubr|fsubrp|fisubr|ftst|fucom|fucomp|fucompp|fxam|fxch|fxrstor|fxsave|fxtract|fyl2x|fyl2xp1|haddpd|haddps|husbpd|hsubps|idiv|imul|in|inc|ins|insb|insw|insd|insertps|int|into|invd|invplg|invpcid|iret|iretd|iretq|lahf|lar|lddqu|ldmxcsr|lds|les|lfs|lgs|lss|lea|leave|lfence|lgdt|lidt|llgdt|lmsw|lock|lods|lodsb|lodsw|lodsd|lodsq|lsl|ltr|maskmovdqu|maskmovq|maxpd|maxps|maxsd|maxss|mfence|minpd|minps|minsd|minss|monitor|mov|movapd|movaps|movbe|movd|movq|movddup|movdqa|movdqu|movq2q|movhlps|movhpd|movhps|movlhps|movlpd|movlps|movmskpd|movmskps|movntdqa|movntdq|movnti|movntpd|movntps|movntq|movq|movq2dq|movs|movsb|movsw|movsd|movsq|movsd|movshdup|movsldup|movss|movsx|movsxd|movupd|movups|movzx|mpsadbw|mul|mulpd|mulps|mulsd|mulss|mwait|neg|not|or|orpd|orps|out|outs|outsb|outsw|outsd|pabsb|pabsw|pabsd|packsswb|packssdw|packusdw|packuswbpaddb|paddw|paddd|paddq|paddsb|paddsw|paddusb|paddusw|palignr|pand|pandn|pause|pavgb|pavgw|pblendvb|pblendw|pclmulqdq|pcmpeqb|pcmpeqw|pcmpeqd|pcmpeqq|pcmpestri|pcmpestrm|pcmptb|pcmptgw|pcmpgtd|pcmpgtq|pcmpistri|pcmpisrm|pdep|pext|pextrb|pextrd|pextrq|pextrw|phaddw|phaddd|phaddsw|phinposuw|phsubw|phsubd|phsubsw|pinsrb|pinsrd|pinsrq|pinsrw|pmaddubsw|pmadddwd|pmaxsb|pmaxsd|pmaxsw|pmaxsw|pmaxub|pmaxud|pmaxuw|pminsb|pminsd|pminsw|pminub|pminud|pminuw|pmovmskb|pmovsx|pmovzx|pmuldq|pmulhrsw|pmulhuw|pmulhw|pmulld|pmullw|pmuludw|pop|popa|popad|popcnt|popf|popfd|popfq|por|prefetch|psadbw|pshufb|pshufd|pshufhw|pshuflw|pshufw|psignb|psignw|psignd|pslldq|psllw|pslld|psllq|psraw|psrad|psrldq|psrlw|psrld|psrlq|psubb|psubw|psubd|psubq|psubsb|psubsw|psubusb|psubusw|test|ptest|punpckhbw|punpckhwd|punpckhdq|punpckhddq|punpcklbw|punpcklwd|punpckldq|punpckldqd|push|pusha|pushad|pushf|pushfd|pxor|prcl|rcr|rol|ror|rcpps|rcpss|rdfsbase|rdgsbase|rdmsr|rdpmc|rdrand|rdtsc|rdtscp|rep|repe|repz|repne|repnz|roundpd|roundps|roundsd|roundss|rsm|rsqrps|rsqrtss|sahf|sal|sar|shl|shr|sbb|scas|scasb|scasw|scasd|set(n?e|ge?|ae?|le?|be?|n?o|n?z)|sfence|sgdt|shld|shrd|shufpd|shufps|sidt|sldt|smsw|sqrtpd|sqrtps|sqrtsd|sqrtss|stc|std|stmxcsr|stos|stosb|stosw|stosd|stosq|str|sub|subpd|subps|subsd|subss|swapgs|syscall|sysenter|sysexit|sysret|teset|ucomisd|ucomiss|ud2|unpckhpd|unpckhps|unpcklpd|unpcklps|vbroadcast|vcvtph2ps|vcvtp2sph|verr|verw|vextractf128|vinsertf128|vmaskmov|vpermilpd|vpermilps|vperm2f128|vtestpd|vzeroall|vzeroupper|wait|fwait|wbinvd|wrfsbase|wrgsbase|wrmsr|xadd|xchg|xgetbv|xlat|xlatb|xor|xorpd|xorps|xrstor|xsave|xsaveopt|xsetbv|lzcnt|extrq|insertq|movntsd|movntss|vfmaddpd|vfmaddps|vfmaddsd|vfmaddss|vfmaddsubbpd|vfmaddsubps|vfmsubaddpd|vfmsubaddps|vfmsubpd|vfmsubps|vfmsubsd|vfnmaddpd|vfnmaddps|vfnmaddsd|vfnmaddss|vfnmsubpd|vfnmusbps|vfnmusbsd|vfnmusbss|vbroadcastss|vbroadcastsd|vbroadcastf128|vmaskmovps|vmaskmovpd|cvt|xor|cli|sti|hlt|nop|lock|wait|enter|leave|ret|loop(n?e|n?z)?|call|j(mp|n?e|n?ge?|n?ae?|le?|be?|n?o|n?z|n?c|n?p|n?b))\b</string>
+			<key>name</key>
+			<string>support.function.mnemonic.x86.all</string>
+		</dict>
+		<dict>
+			<key>comment</key>
+			<string>ARM instruction</string>
+			<key>match</key>
+			<string>(?x)\b((?i) ( (bf(c|i)|(u|s)bfx|(u|s)xta?(h|b)?)
+  | (v(add|cvt|sub|mov|trn|cmp|div|qdmulh|mrs|mul|ld1|qadd|qshrun|st[1234]|addw|mull|mlal|rshrn|swp|qmovun)|qmovun)(\.([isup]?8|[isupf]?16|[isuf]?32|[isu]?64))*
+  | (mul|mla|mull|smlabb)
+  | (mov(w|t))
+  | rev(8|16)?
+  | (pld|adr|adrl|vswp)
+  | bkpt
+)?(?-i))?\b
+</string>
+			<key>name</key>
+			<string>support.function.mnemonic.arm.arithmetic</string>
+		</dict>
+		<dict>
+			<key>comment</key>
+			<string>ARM instruction</string>
+			<key>match</key>
+			<string>(?x)\b((?i)(
+        swi|svc|wfi|
+        dmb | clrex | dsb | isb |
+        v(ldr|str|push|pop) |
+        (push|pop) |
+        (st|ld)(
+            p |
+                r(ex|s?(h|b)|d)? |
+                m(
+                        (f|e)(d|a) |
+                        (d|i)(b|a)
+                )?
+        ) |
+        b(l|x|lx|lr|r)? |
+        (i|e)?ret|
+        b\.(eq|ne|hs|cs|lo|cc|mi|pl|vs|vc|hi|ls|ge|lt|gt|le|al|nv)+ |
+        (c|t)?bn?z|
+)+(ne|eq|cs|hs|cc|lo|mi|pl|vs|vc|hi|ls|lt|le|gt|ge|al)?(?-i))\b
+</string>
+			<key>name</key>
+			<string>support.function.mnemonic.arm.memory</string>
+		</dict>
+		<dict>
+			<key>comment</key>
+			<string>ARM instruction</string>
+			<key>match</key>
+			<string>\b((?i)(def(b|w|s)|equ|(include|get)(\s+([a-zA-Z_]+[0-9a-zA-Z_]*|[0-9]+[a-zA-Z_]+[0-9a-zA-Z_]*?)\.s)?)?(?-i))\b
+</string>
+			<key>name</key>
+			<string>meta.preprocessor.c.include</string>
+		</dict>
+		<dict>
+			<key>comment</key>
+			<string>ARM instruction</string>
+			<key>match</key>
+			<string>\b((?i)nop(ne|eq|cs|hs|cc|lo|mi|pl|vs|vc|hi|ls|lt|le|gt|ge|al)?(?-i))?\b
+</string>
+			<key>name</key>
+			<string>comment.nop</string>
+		</dict>
+		<dict>
+			<key>begin</key>
+			<string>/\*</string>
+			<key>comment</key>
+			<string>Comment Block</string>
+			<key>end</key>
+			<string>\*/</string>
+			<key>name</key>
+			<string>comment.block</string>
+		</dict>
+		<dict>
+			<key>comment</key>
+			<string>Directive</string>
+			<key>match</key>
+			<string>\.(?i)(globl|global|macro|endm|purgem|if|elseif|else|endif|section|text|arm|align|balign|irp|rept|endr|req|unreq|error|short|func|endfunc|hidden|type|fpu|arch|code|altmacro|object_arch|word|int|string)(?-i)\b</string>
+			<key>name</key>
+			<string>keyword.control.directive</string>
+		</dict>
+		<dict>
+			<key>comment</key>
+			<string>ARM register</string>
+			<key>match</key>
+			<string>\b((?i)\$?([xw][0-9]|[xw]1[0-9]||[xw]2[0-9]|[wx]30|wzr|xzr|wsp|fpsr|fpcr|[rcp]1[0-5]|[rcp][0-9]|a[1-4]|v[1-8]|sl|sb|fp|ip|sp|lr|(c|s)psr(_c)?|pc|[sd]3[0-1]|[sd][12][0-9]|[sd][0-9]|fpsid|fpscr|fpexc|q3[0-1]|q2[0-9]|q1[0-9]|q[0-9]|APSR_nzcv|sy)!?(?-i))?\b</string>
+			<key>name</key>
+			<string>storage.other.register.arm</string>
+		</dict>
+		<dict>
+			<key>comment</key>
+			<string>x86 register</string>
+			<key>match</key>
+			<string>\b((?i)(al|ah|ax|eax|rax|bl|bh|bx|ebx|rbx|cl|ch|cx|ecx|rcx|dl|dh|dx|edx|rdx|sil|si|esi|rsi|di|di|edi|rdi|bpl|bp|ebp|rbp|sp|esp|rsp|cs|ds|ss|es|fs|gs|ip|eip|rip|flags|eflags|rflags|r8|r9|r10|r11|r12|r13|r14|r15|r8d|r9d|r10d|r11d|r12d|r13d|r14d|r15d|r8w|r9w|r10w|r11w|r12w|r13w|r14w|r15w|r8l|r9l|r10l|r11l|r12l|r13l|r14l|r15l|st0|st1|st2|st3|st4|st5|st6|st7|mm0|mm1|mm2|mm3|mm4|mm5|mm6|mm7|xmm0|xmm1|xmm2|xmm3|xmm4|xmm5|xmm6|xmm7|xmm8|xmm9|xmm10|xmm11|xmm12|xmm13|xmm14|xmm15|xmm16|xmm17|xmm18|xmm19|xmm20|xmm21|xmm22|xmm23|xmm24|xmm25|xmm26|xmm27|xmm28|xmm29|xmm30|xmm31|ymm0|ymm1|ymm2|ymm3|ymm4|ymm5|ymm6|ymm7|ymm8|ymm9|ymm10|ymm11|ymm12|ymm13|ymm14|ymm15|ymm16|ymm17|ymm18|ymm19|ymm20|ymm21|ymm22|ymm23|ymm24|ymm25|ymm26|ymm27|ymm28|ymm29|ymm30|ymm31|zmm0|zmm1|zmm2|zmm3|zmm4|zmm5|zmm6|zmm7|zmm8|zmm9|zmm10|zmm11|zmm12|zmm13|zmm14|zmm15|zmm16|zmm17|zmm18|zmm19|zmm20|zmm21|zmm22|zmm23|zmm24|zmm25|zmm26|zmm27|zmm28|zmm29|zmm30|zmm31|cr0|cr2|cr3|cr4|gdtr|ldtr|idtr|dr0|dr1|dr2|dr3|dr4|dr5|dr6|dr7|msr)!?(?-i))?\b</string>
+			<key>name</key>
+			<string>storage.other.register.x86</string>
+		</dict>
+		<dict>
+			<key>comment</key>
+			<string>SPARC register</string>
+			<key>match</key>
+			<string>\b((?i)\$?([gloi][0-9])!?(?-i))?\b</string>
+			<key>name</key>
+			<string>storage.other.register.sparc</string>
+		</dict>
+		<dict>
+			<key>comment</key>
+			<string>MIPS register</string>
+			<key>match</key>
+			<string>\b((?i)\$?(r[0-3][0-9]|v[0-2]|a[0-4]|t[0-8]|s[0-9]|t([89]|10|k[0-2]))!?(?-i))?\b</string>
+			<key>name</key>
+			<string>storage.other.register.mips</string>
+		</dict>
+		<dict>
+			<key>comment</key>
+			<string>Numeric Hex</string>
+			<key>match</key>
+			<string>(\b|\s+)(\#)?-?(0x|&amp;amp;)[0-9a-fA-F_]+\b</string>
+			<key>name</key>
+			<string>constant.numeric.hex</string>
+		</dict>
+		<dict>
+			<key>comment</key>
+			<string>Numeric Literal</string>
+			<key>match</key>
+			<string>(\b|\s+)\#-?[0-9a-zA-Z_]+\b</string>
+			<key>name</key>
+			<string>constant.numeric.literal</string>
+		</dict>
+		<dict>
+			<key>comment</key>
+			<string>Numeric Decimal</string>
+			<key>match</key>
+			<string>(\b|\s+)[0-9]+\b</string>
+			<key>name</key>
+			<string>constant.numeric.dec</string>
+		</dict>
+		<dict>
+			<key>comment</key>
+			<string>Label</string>
+			<key>match</key>
+			<string>([\w${}]+[:])</string>
+			<key>name</key>
+			<string>entity.name.tag</string>
+		</dict>
+		<dict>
+			<key>begin</key>
+			<string>(&lt;%\s)</string>
+			<key>beginCaptures</key>
+			<dict>
+				<key>1</key>
+				<dict>
+					<key>name</key>
+					<string>keyword.control</string>
+				</dict>
+			</dict>
+			<key>comment</key>
+			<string>Inline Python</string>
+			<key>end</key>
+			<string>(%&gt;)</string>
+			<key>endCaptures</key>
+			<dict>
+				<key>1</key>
+				<dict>
+					<key>name</key>
+					<string>keyword.control</string>
+				</dict>
+			</dict>
+			<key>name</key>
+			<string>pwntools.raw.block.python</string>
+			<key>patterns</key>
+			<array>
+				<dict>
+					<key>include</key>
+					<string>source.python</string>
+				</dict>
+			</array>
+		</dict>
+		<dict>
+			<key>begin</key>
+			<string>(&lt;%(\S+)&gt;)</string>
+			<key>beginCaptures</key>
+			<dict>
+				<key>1</key>
+				<dict>
+					<key>name</key>
+					<string>keyword.control</string>
+				</dict>
+			</dict>
+			<key>comment</key>
+			<string>Inline Docstring</string>
+			<key>end</key>
+			<string>(&lt;/%(\2)&gt;)</string>
+			<key>endCaptures</key>
+			<dict>
+				<key>1</key>
+				<dict>
+					<key>name</key>
+					<string>keyword.control</string>
+				</dict>
+			</dict>
+			<key>patterns</key>
+			<array>
+				<dict>
+					<key>include</key>
+					<string>comment.block</string>
+				</dict>
+			</array>
+		</dict>
+		<dict>
+			<key>begin</key>
+			<string>(&lt;%\w+\s)</string>
+			<key>beginCaptures</key>
+			<dict>
+				<key>1</key>
+				<dict>
+					<key>name</key>
+					<string>keyword.control</string>
+				</dict>
+			</dict>
+			<key>comment</key>
+			<string>Mako Tag</string>
+			<key>end</key>
+			<string>(/&gt;)</string>
+			<key>endCaptures</key>
+			<dict>
+				<key>1</key>
+				<dict>
+					<key>name</key>
+					<string>keyword.control</string>
+				</dict>
+			</dict>
+			<key>name</key>
+			<string>source.mako.tag</string>
+			<key>patterns</key>
+			<array>
+				<dict>
+					<key>include</key>
+					<string>comment.block</string>
+				</dict>
+			</array>
+		</dict>
+		<dict>
+			<key>begin</key>
+			<string>(\${)</string>
+			<key>beginCaptures</key>
+			<dict>
+				<key>1</key>
+				<dict>
+					<key>name</key>
+					<string>keyword.control</string>
+				</dict>
+			</dict>
+			<key>comment</key>
+			<string>Mako Substitution</string>
+			<key>end</key>
+			<string>(})</string>
+			<key>endCaptures</key>
+			<dict>
+				<key>1</key>
+				<dict>
+					<key>name</key>
+					<string>keyword.control</string>
+				</dict>
+			</dict>
+			<key>name</key>
+			<string>source.mako.expression</string>
+			<key>patterns</key>
+			<array>
+				<dict>
+					<key>include</key>
+					<string>source.python</string>
+				</dict>
+			</array>
+		</dict>
+		<dict>
+			<key>comment</key>
+			<string>Mako Comment</string>
+			<key>match</key>
+			<string>(^##(.*)$)</string>
+			<key>name</key>
+			<string>comment.line.mako</string>
+		</dict>
+		<dict>
+			<key>begin</key>
+			<string>^\s*(%)(\s*((endfor)|(endif)|(endwhile)))?</string>
+			<key>beginCaptures</key>
+			<dict>
+				<key>1</key>
+				<dict>
+					<key>name</key>
+					<string>keyword.control</string>
+				</dict>
+				<key>2</key>
+				<dict>
+					<key>name</key>
+					<string>keyword.control</string>
+				</dict>
+			</dict>
+			<key>comment</key>
+			<string>Mako Directive</string>
+			<key>end</key>
+			<string>$</string>
+			<key>name</key>
+			<string>source.doc.python.mako.controlline</string>
+			<key>patterns</key>
+			<array>
+				<dict>
+					<key>include</key>
+					<string>source.python</string>
+				</dict>
+			</array>
+		</dict>
+	</array>
+	<key>scopeName</key>
+	<string>source.pwntools</string>
+	<key>uuid</key>
+	<string>19bbf78d-4ad8-4385-bb20-5bde8df453bf</string>
+</dict>
+</plist>

install_local.sh

@@ -1,12 +0,0 @@
-#!/bin/sh
-sudo pip2 install -r requirements.txt
-
-echo "================================================"
-echo "Now please put this directory in your PYTHONPATH"
-echo "and the bin directory in your PATH."
-echo
-echo "If you are using bash, you do can this by putting"
-echo "These in your .bashrc:"
-echo
-echo "export PATH=\"`realpath bin`:\$PATH\""
-echo "export PYTHONPATH=\"`realpath .`:\$PYTHONPATH\""

pwn/__init__.py

@@ -1,74 +1,16 @@
 # Promote useful stuff to toplevel
 from .toplevel import *
 
-# look for special args in argv
-def closure():
-    term_mode = True
-    import sys
-    if not hasattr(sys, 'argv'):
-        return
-    import string, collections
-    global args
-    args = collections.defaultdict(str)
-    def isident(s):
-        first = string.uppercase + '_'
-        body = string.digits + first
-        if not s:
-            return False
-        if s[0] not in first:
-            return False
-        if not all(c in body for c in s[1:]):
-            return False
-        return True
-    def asbool(s):
-        if   s.lower() == 'true':
-            return True
-        elif s.lower() == 'false':
-            return False
-        elif s.isdigit():
-            return bool(int(s))
-        else:
-            raise ValueError('must be integer or boolean')
-    # parse environtment variables
-    for k, v in os.environ.items():
-        if not k.startswith('PWNLIB_'):
-            continue
-        k = k[7:]
-        if   k == 'DEBUG':
-            if asbool(v):
-                context.log_level = 'debug'
-        elif k == 'SILENT':
-            if asbool(v):
-                context.log_level = 'ERROR'
-        elif k == 'NOTERM':
-            if asbool(v):
-                term_mode = False
-        elif k == 'LOG_LEVEL':
-            context.log_level = v
-        elif isident(k):
-            args[k] = v
-    # parse command line
-    for arg in sys.argv[:]:
-        if   arg == 'DEBUG':
-            sys.argv.remove(arg)
-            context.log_level = 'debug'
-        elif arg == 'SILENT':
-            sys.argv.remove(arg)
-            context.log_level = 'ERROR'
-        elif arg == 'NOTERM':
-            term_mode = False
-        elif arg.find('=') > 0:
-            k, v = arg.split('=', 1)
-            if not isident(k):
-                continue
-            sys.argv.remove(arg)
-            args[k] = v
-    # put the terminal in rawmode unless NOTERM was specified
-    if term_mode:
-        term.init()
-    else:
-        term.text.when = 'never'
-closure()
-del closure
+pwnlib.args.initialize()
+pwnlib.log.install_default_handler()
 
-log = logging.getLogger('pwnlib.exploit')
+log = pwnlib.log.getLogger('pwnlib.exploit')
+args = pwnlib.args.args
+
+if not platform.architecture()[0].startswith('64'):
+    """Determines if the current Python interpreter is supported by Pwntools.
+
+    See Gallopsled/pwntools#518 for more information."""
+    log.warn_once('Pwntools does not support 32-bit Python.  Use a 64-bit release.')
+
+pwnlib.update.check_automatically()

pwn/toplevel.py

@@ -1,36 +1,78 @@
 # Get all the modules from pwnlib
-from pwnlib                  import *
+import collections
+import logging
+import math
+import operator
+import os
+import re
+import socks
+import string
+import struct
+import subprocess
+import sys
+import tempfile
+import threading
+import time
 
-# Promote functions from these modules to toplevel
-from pwnlib.asm              import asm, disasm, cpp
-from pwnlib.context          import context, Thread
-from pwnlib.dynelf           import DynELF
-from pwnlib.elf              import ELF, load
-from pwnlib.exception        import PwnlibException
-from pwnlib.memleak          import MemLeak
-from pwnlib.replacements     import *
-from pwnlib.rop              import ROP
-from pwnlib.timeout          import Timeout
-from pwnlib.tubes.listen     import listen
-from pwnlib.tubes.process    import process
-from pwnlib.tubes.remote     import remote
+import pwnlib
+from pwnlib import *
+from pwnlib.asm import *
+from pwnlib.context import Thread
+from pwnlib.context import context
+from pwnlib.dynelf import DynELF
+from pwnlib.encoders import *
+from pwnlib.elf import Core
+from pwnlib.elf import ELF
+from pwnlib.elf import load
+from pwnlib.encoders import *
+from pwnlib.exception import PwnlibException
+from pwnlib.fmtstr import FmtStr, fmtstr_payload
+from pwnlib.log import getLogger
+from pwnlib.memleak import MemLeak
+from pwnlib.regsort import *
+from pwnlib.replacements import *
+from pwnlib.rop import ROP
+from pwnlib.rop.srop import SigreturnFrame
+from pwnlib.runner import *
+from pwnlib.timeout import Timeout
+from pwnlib.tubes.listen import listen
+from pwnlib.tubes.process import process
+from pwnlib.tubes.remote import remote, tcp, udp
 from pwnlib.tubes.serialtube import serialtube
-from pwnlib.tubes.ssh        import ssh
-from pwnlib.tubes.tube       import tube
-from pwnlib.ui               import *
-from pwnlib.util             import crc, net, proc, iters, safeeval
-from pwnlib.util.cyclic      import *
-from pwnlib.util.fiddling    import *
-from pwnlib.util.hashes      import *
-from pwnlib.util.lists       import *
-from pwnlib.util.misc        import *
-from pwnlib.util.packing     import *
-from pwnlib.util.proc        import pidof
-from pwnlib.util.splash      import *
-from pwnlib.util.web         import *
+from pwnlib.tubes.ssh import ssh
+from pwnlib.tubes.tube import tube
+from pwnlib.ui import *
+from pwnlib.util import crc
+from pwnlib.util import iters
+from pwnlib.util import net
+from pwnlib.util import proc
+from pwnlib.util import safeeval
+from pwnlib.util.cyclic import *
+from pwnlib.util.fiddling import *
+from pwnlib.util.getdents import *
+from pwnlib.util.hashes import *
+from pwnlib.util.lists import *
+from pwnlib.util.misc import *
+from pwnlib.util.packing import *
+from pwnlib.util.proc import pidof
+from pwnlib.util.splash import *
+from pwnlib.util.web import *
 
 # Promote these modules, so that "from pwn import *" will let you access them
-import \
-    collections   , operator      , os            , pwnlib        , \
-    re            , string        , struct        , subprocess    , \
-    sys           , threading     , time          , tempfile
+
+try:
+    import cPickle as pickle
+except ImportError:
+    import pickle
+
+try:
+    from cStringIO import StringIO
+except ImportError:
+    from StringIO import StringIO
+
+error   = log.error
+warning = log.warning
+warn    = log.warning
+info    = log.info
+debug   = log.debug
+success = log.success

pwnlib/__init__.py

@@ -1,19 +1,40 @@
+import importlib
+
+from .version import __version__
+
+version = __version__
+
 __all__ = [
-    'atexception' , 'atexit'      , 'asm'         , 'constants'   ,
-    'context'     , 'dynelf'      , 'elf'         , 'exception'   ,
-    'gdb'                         , 'log'         , 'memleak'     ,
-    'replacements', 'rop'         , 'shellcraft'  , 'term'        ,
-    'tubes'       , 'ui'          , 'useragents'  , 'util'
+    'args',
+    'asm',
+    'atexception',
+    'atexit',
+    'commandline',
+    'constants',
+    'context',
+    'dynelf',
+    'encoders',
+    'elf',
+    'exception',
+    'fmtstr',
+    'gdb',
+    'libcdb',
+    'log',
+    'memleak',
+    'pep237',
+    'regsort',
+    'replacements',
+    'rop',
+    'runner',
+    'shellcraft',
+    'term',
+    'tubes',
+    'ui',
+    'useragents',
+    'util',
+    'adb',
+    'update',
 ]
 
-
-from . import \
-    atexception   , atexit        , asm           , constants     , \
-                    dynelf        , elf           , exception     , \
-    gdb                           , log           , memleak       , \
-    replacements  , rop           , shellcraft    , term          , \
-    tubes         , ui            , useragents    , util,           \
-    pep237
-
-# from .context import context
-from .version import __version__
+for module in __all__:
+    importlib.import_module('.%s' % module, 'pwnlib')

pwnlib/abi.py

@@ -0,0 +1,106 @@
+# -*- coding: utf-8 -*-
+from .context import LocalContext
+from .context import context
+
+
+class ABI(object):
+    """
+    Encapsulates information about a calling convention.
+    """
+    #: List or registers which should be filled with arguments before
+    #: spilling onto the stack.
+    register_arguments = []
+
+    #: Minimum alignment of the stack.
+    #: The value used is min(context.bytes, stack_alignment)
+    #: This is necessary as Windows x64 frames must be 32-byte aligned.
+    #: "Alignment" is considered with respect to the last argument on the stack.
+    arg_alignment    = 1
+
+    #: Minimum number of stack slots used by a function call
+    #: This is necessary as Windows x64 requires using 4 slots on the stack
+    stack_minimum      = 0
+
+    #: Indicates that this ABI returns to the next address on the slot
+    returns            = True
+
+    def __init__(self, regs, align, minimum):
+        self.register_arguments = regs
+        self.arg_alignment      = align
+        self.stack_minimum      = minimum
+
+    @staticmethod
+    @LocalContext
+    def default():
+        return {
+        (32, 'i386', 'linux'):  linux_i386,
+        (64, 'amd64', 'linux'): linux_amd64,
+        (32, 'arm', 'linux'):   linux_arm,
+        (32, 'thumb', 'linux'):   linux_arm,
+        (32, 'mips', 'linux'):   linux_mips,
+        (32, 'i386', 'windows'):  windows_i386,
+        (64, 'amd64', 'windows'): windows_amd64,
+        }[(context.bits, context.arch, context.os)]
+
+    @staticmethod
+    @LocalContext
+    def syscall():
+        return {
+        (32, 'i386', 'linux'):  linux_i386_syscall,
+        (64, 'amd64', 'linux'): linux_amd64_syscall,
+        (32, 'arm', 'linux'):   linux_arm_syscall,
+        (32, 'thumb', 'linux'):   linux_arm_syscall,
+        (32, 'mips', 'linux'):   linux_mips_syscall,
+        }[(context.bits, context.arch, context.os)]
+
+    @staticmethod
+    @LocalContext
+    def sigreturn():
+        return {
+        (32, 'i386', 'linux'):  linux_i386_sigreturn,
+        (64, 'amd64', 'linux'): linux_amd64_sigreturn,
+        (32, 'arm', 'linux'):   linux_arm_sigreturn,
+        (32, 'thumb', 'linux'):   linux_arm_sigreturn,
+        }[(context.bits, context.arch, context.os)]
+
+class SyscallABI(ABI):
+    """
+    The syscall ABI treats the syscall number as the zeroth argument,
+    which must be loaded into the specified register.
+    """
+    def __init__(self, register_arguments, *a, **kw):
+        super(SyscallABI, self).__init__(register_arguments, *a, **kw)
+        self.syscall_register = register_arguments[0]
+
+class SigreturnABI(SyscallABI):
+    """
+    The sigreturn ABI is similar to the syscall ABI, except that
+    both PC and SP are loaded from the stack.  Because of this, there
+    is no 'return' slot necessary on the stack.
+    """
+    returns = False
+
+
+linux_i386   = ABI([], 4, 0)
+linux_amd64  = ABI(['rdi','rsi','rdx','rcx','r8','r9'], 8, 0)
+linux_arm    = ABI(['r0', 'r1', 'r2', 'r3'], 8, 0)
+linux_aarch64 = ABI(['x0', 'x1', 'x2', 'x3'], 16, 0)
+linux_mips  = ABI(['$a0','$a1','$a2','$a3'], 4, 0)
+
+linux_i386_syscall = SyscallABI(['eax', 'ebx', 'ecx', 'edx', 'esi', 'edi', 'ebp'], 4, 0)
+linux_amd64_syscall = SyscallABI(['rax','rdi', 'rsi', 'rdx', 'r10', 'r8', 'r9'],   8, 0)
+linux_arm_syscall   = SyscallABI(['r7', 'r0', 'r1', 'r2', 'r3', 'r4', 'r5', 'r6'], 4, 0)
+linux_aarch64_syscall   = SyscallABI(['x8', 'x0', 'x1', 'x2', 'x3', 'x4', 'x5', 'x6'], 16, 0)
+linux_mips_syscall  = ABI(['$v0', '$a0','$a1','$a2','$a3'], 4, 0)
+
+linux_i386_sigreturn = SigreturnABI(['eax'], 4, 0)
+linux_amd64_sigreturn = SigreturnABI(['rax'], 4, 0)
+linux_arm_sigreturn = SigreturnABI(['r7'], 4, 0)
+
+windows_i386  = ABI([], 4, 0)
+windows_amd64 = ABI(['rcx','rdx','r8','r9'], 32, 32)
+
+# Fake ABIs used by SROP
+linux_i386_srop = ABI(['eax'], 4, 0)
+linux_amd64_srop = ABI(['rax'], 4, 0)
+linux_arm_srop = ABI(['r7'], 4, 0)

pwnlib/adb.py

@@ -0,0 +1,723 @@
+"""Provides utilities for interacting with Android devices via the Android Debug Bridge.
+"""
+import glob
+import os
+import platform
+import re
+import shutil
+import tempfile
+import time
+
+import dateutil.parser
+
+from . import atexit
+from . import tubes
+from .context import context
+from .context import LocalContext
+from .device import Device
+from .log import getLogger
+from .util import misc
+
+log = getLogger(__name__)
+
+def adb(argv, *a, **kw):
+    """Returns the output of an ADB subcommand."""
+    if isinstance(argv, (str, unicode)):
+        argv = [argv]
+
+    log.debug("$ " + ' '.join(context.adb + argv))
+
+    return tubes.process.process(context.adb + argv, *a, **kw).recvall()
+
+def root():
+    """Restarts adbd as root."""
+    log.info("Enabling root on %s" % context.device)
+
+    with context.quiet:
+        reply  = adb('root')
+
+    if 'already running as root' in reply:
+        return
+
+    elif not reply or 'restarting adbd as root' in reply:
+        with context.quiet:
+            wait_for_device()
+
+    else:
+        log.error("Could not run as root:\n%s" % reply)
+
+
+def reboot(wait=True):
+    """Reboots the device."""
+    log.info('Rebooting device %s' % context.device)
+
+    with context.quiet:
+        adb('reboot')
+
+    if wait:
+        wait_for_device()
+
+def reboot_bootloader():
+    """Reboots the device to the bootloader."""
+    log.info('Rebooting %s to bootloader' % context.device)
+
+    with context.quiet:
+        adb('reboot-bootloader')
+
+class AdbDevice(Device):
+    """Encapsulates information about a connected device."""
+    def __init__(self, serial, type, port, product='unknown', model='unknown', device='unknown'):
+        self.serial  = serial
+        self.type    = type
+        self.port    = port
+        self.product = product
+        self.model   = model.replace('_', ' ')
+        self.device  = device
+
+        if product == 'unknown':
+            return
+
+        with context.local(device=serial):
+            abi = str(properties.ro.product.cpu.abi)
+            context.clear()
+            context.arch = str(abi)
+            self.arch = context.arch
+            self.bits = context.bits
+            self.endian = context.endian
+
+    def __str__(self):
+        return self.serial
+
+    def __repr__(self):
+        fields = ['serial', 'type', 'port', 'product', 'model', 'device']
+        return '%s(%s)' % (self.__class__.__name__,
+                           ', '.join(('%s=%r' % (field, getattr(self, field)) for field in fields)))
+
+    @staticmethod
+    def from_adb_output(line):
+        fields = line.split()
+
+        """
+        Example output:
+        ZX1G22LM7G             device usb:336789504X product:shamu model:Nexus_6 device:shamu features:cmd,shell_v2
+        84B5T15A29020449       device usb:336855040X product:angler model:Nexus_6P device:angler
+        0062741b0e54b353       unauthorized usb:337641472X
+        """
+
+        # The last few fields need to be split at colons.
+        split  = lambda x: x.split(':')[-1]
+        fields[3:] = list(map(split, fields[3:]))
+
+        return AdbDevice(*fields[:6])
+
+@context.quiet
+def devices(serial=None):
+    """Returns a list of ``Device`` objects corresponding to the connected devices."""
+    lines = adb(['devices', '-l'])
+    result = []
+
+    for line in lines.splitlines():
+        # Skip the first 'List of devices attached' line, and the final empty line.
+        if 'List of devices' in line or not line.strip():
+            continue
+        device = AdbDevice.from_adb_output(line)
+        if device.serial == serial:
+            return device
+        result.append(device)
+
+    return tuple(result)
+
+@LocalContext
+def wait_for_device(kick=False):
+    """Waits for a device to be connected."""
+    with log.waitfor("Waiting for device to come online") as w:
+        with context.quiet:
+            if kick:
+                try:
+                    adb(['reconnect'])
+                except Exception:
+                    pass
+            adb('wait-for-device')
+
+        for device in devices():
+            if context.device == device:
+                return device
+            break
+        else:
+            log.error("Could not find any devices")
+
+        with context.local(device=device):
+            # There may be multiple devices, so context.device is
+            # insufficient.  Pick the first device reported.
+            w.success('%s (%s %s %s)' % (device,
+                                         product(),
+                                         build(),
+                                         _build_date()))
+
+            return context.device
+
+def disable_verity():
+    """Disables dm-verity on the device."""
+    with log.waitfor("Disabling dm-verity on %s" % context.device) as w:
+        root()
+
+        with context.quiet:
+            reply = adb('disable-verity')
+
+        if 'Verity already disabled' in reply:
+            return
+        elif 'Now reboot your device' in reply:
+            reboot(wait=True)
+        else:
+            log.error("Could not disable verity:\n%s" % reply)
+
+
+def remount():
+    """Remounts the filesystem as writable."""
+    with log.waitfor("Remounting filesystem on %s" % context.device) as w:
+        disable_verity()
+        root()
+
+        with context.quiet:
+            reply = adb('remount')
+
+        if 'remount succeeded' not in reply:
+            log.error("Could not remount filesystem:\n%s" % reply)
+
+def unroot():
+    """Restarts adbd as AID_SHELL."""
+    log.info("Unrooting %s" % context.device)
+    with context.quiet:
+        reply  = adb('unroot')
+
+    if 'restarting adbd as non root' not in reply:
+        log.error("Could not run as root:\n%s" % reply)
+
+def pull(remote_path, local_path=None):
+    """Download a file from the device.
+
+    Arguments:
+        remote_path(str): Path or directory of the file on the device.
+        local_path(str): Path to save the file to.
+            Uses the file's name by default.
+    """
+    if local_path is None:
+        local_path = os.path.basename(remote_path)
+
+    msg = "Pulling %r from %r" % (remote_path, local_path)
+
+    if context.log_level == 'debug':
+        msg += ' (%s)' % context.device
+
+    result = ''
+    with log.waitfor(msg) as w:
+        with context.quiet:
+            args = context.adb + ['pull', remote_path, local_path]
+            io = tubes.process.process(args)
+            result = io.recvall()
+
+            if 0 != io.poll(block=True):
+                log.error(result)
+
+    return result
+
+def push(local_path, remote_path):
+    """Upload a file to the device.
+
+    Arguments:
+        local_path(str): Path to the local file to push.
+        remote_path(str): Path or directory to store the file on the device.
+    """
+    msg = "Pushing %r to %r" % (local_path, remote_path)
+
+    if context.log_level == 'debug':
+        msg += ' (%s)' % context.device
+
+    with log.waitfor(msg) as w:
+        with context.quiet:
+            args = context.adb + ['push', local_path, remote_path]
+            io = tubes.process.process(args)
+            result = io.recvall()
+
+            if 0 != io.poll(block=True):
+                log.error(result)
+
+    return result
+
+@context.quiet
+def read(path, target=None):
+    """Download a file from the device, and extract its contents.
+
+    Arguments:
+        path(str): Path to the file on the device.
+        target(str): Optional, location to store the file.
+            Uses a temporary file by default.
+    """
+    with tempfile.NamedTemporaryFile() as temp:
+        target = target or temp.name
+        pull(path, target)
+        result = misc.read(target)
+    return result
+
+@context.quiet
+def write(path, data=''):
+    """Create a file on the device with the provided contents.
+
+    Arguments:
+        path(str): Path to the file on the device
+        data(str): Contents to store in the file
+    """
+    with tempfile.NamedTemporaryFile() as temp:
+        misc.write(temp.name, data)
+        push(temp.name, path)
+
+def process(argv, *a, **kw):
+    """Execute a process on the device.
+
+    See ``pwnlib.tubes.process.process`` documentation for more info.
+
+    Returns:
+        A ``process`` tube.
+    """
+    argv = argv or []
+    if isinstance(argv, (str, unicode)):
+        argv = [argv]
+
+    display = argv
+    argv = context.adb + ['shell'] + argv
+
+    kw.setdefault('display', display)
+    kw.setdefault('where', 'Android')
+
+    return tubes.process.process(argv, *a, **kw)
+
+def interactive(**kw):
+    """Spawns an interactive shell."""
+    return shell(**kw).interactive()
+
+def shell(**kw):
+    """Returns an interactive shell."""
+    return process([], **kw)
+
+@context.quiet
+def which(name):
+    """Retrieves the full path to a binary in ``PATH`` on the device"""
+    return process(['which', name]).recvall().strip()
+
+def whoami():
+    return process(['whoami']).recvall().strip()
+
+def forward(port):
+    """Sets up a port to forward to the device."""
+    tcp_port = 'tcp:%s' % port
+    start_forwarding = adb(['forward', tcp_port, tcp_port])
+    atexit.register(lambda: adb(['forward', '--remove', tcp_port]))
+
+@context.quiet
+def logcat(stream=False):
+    """Reads the system log file.
+
+    By default, causes logcat to exit after reading the file.
+
+    Arguments:
+        stream(bool): If ``True``, the contents are streamed rather than
+            read in a one-shot manner.  Default is ``False``.
+
+    Returns:
+        If ``stream`` is ``False``, returns a string containing the log data.
+        Otherwise, it returns a ``tube`` connected to the log output.
+    """
+
+    if stream:
+        return process(['logcat'])
+    else:
+        return adb(['logcat', '-d'])
+
+def pidof(name):
+    """Returns a list of PIDs for the named process."""
+    with context.quiet:
+        io = process(['pidof', name])
+        data = io.recvall().split()
+    return list(map(int, data))
+
+def proc_exe(pid):
+    """Returns the full path of the executable for the provided PID."""
+    with context.quiet:
+        io  = process(['readlink','-e','/proc/%d/exe' % pid])
+        data = io.recvall().strip()
+    return data
+
+def getprop(name=None):
+    """Reads a properties from the system property store.
+
+    Arguments:
+        name(str): Optional, read a single property.
+
+    Returns:
+        If ``name`` is not specified, a ``dict`` of all properties is returned.
+        Otherwise, a string is returned with the contents of the named property.
+    """
+    with context.quiet:
+        if name:
+            return process(['getprop', name]).recvall().strip()
+
+
+        result = process(['getprop']).recvall()
+
+    expr = r'\[([^\]]+)\]: \[(.*)\]'
+
+    props = {}
+
+    for line in result.splitlines():
+        if not line.startswith('['):
+            continue
+
+        name, value = re.search(expr, line).groups()
+
+        if value.isdigit():
+            value = int(value)
+
+        props[name] = value
+
+    return props
+
+def setprop(name, value):
+    """Writes a property to the system property store."""
+    return process(['setprop', name, value]).recvall().strip()
+
+def listdir(directory='/'):
+    """Returns a list containing the entries in the provided directory.
+
+    Note:
+        Because ``adb shell`` is used to retrieve the listing, shell
+        environment variable expansion and globbing are in effect.
+    """
+    io = process(['find', directory, '-maxdepth', '1', '-print0'])
+    data = io.recvall()
+    paths = filter(len, data.split('\x00'))
+    relpaths = [os.path.relpath(path, directory) for path in paths]
+    if '.' in relpaths:
+        relpaths.remove('.')
+    return relpaths
+
+def fastboot(args, *a, **kw):
+    """Executes a fastboot command.
+
+    Returns:
+        The command output.
+    """
+    serial = context.device
+    if not serial:
+        log.error("Unknown device")
+    return tubes.process.process(['fastboot', '-s', serial] + list(args), **kw).recvall()
+
+def fingerprint():
+    """Returns the device build fingerprint."""
+    return str(properties.ro.build.fingerprint)
+
+def product():
+    """Returns the device product identifier."""
+    return str(properties.ro.build.product)
+
+def build():
+    """Returns the Build ID of the device."""
+    return str(properties.ro.build.id)
+
+def unlock_bootloader():
+    """Unlocks the bootloader of the device.
+
+    Note:
+        This requires physical interaction with the device.
+    """
+    adb(['reboot-bootloader'])
+    fastboot(['oem', 'unlock'])
+    fastboot(['continue'])
+
+class Kernel(object):
+    _kallsyms = None
+
+    @property
+    def address(self):
+        return self.symbols['_text']
+
+    @property
+    @context.quiet
+    def symbols(self):
+        """Returns a dictionary of kernel symbols"""
+        result = {}
+        for line in self.kallsyms.splitlines():
+            fields = line.split()
+            address = int(fields[0], 16)
+            name    = fields[-1]
+            result[name] = address
+        return result
+
+    @property
+    @context.quiet
+    def kallsyms(self):
+        """Returns the raw output of kallsyms"""
+        if not self._kallsyms:
+            self._kallsyms = {}
+            root()
+            write('/proc/sys/kernel/kptr_restrict', '1')
+            self._kallsyms = read('/proc/kallsyms')
+        return self._kallsyms
+
+    @property
+    @context.quiet
+    def version(self):
+        """Returns the kernel version of the device."""
+        root()
+        return read('/proc/version').strip()
+
+    @property
+    @context.quiet
+    def cmdline(self):
+        root()
+        return read('/proc/cmdline').strip()
+
+    @property
+    @context.quiet
+    def lastmsg(self):
+        root()
+        if 'last_kmsg' in listdir('/proc'):
+            return read('/proc/last_kmsg')
+
+        if 'console-ramoops' in listdir('/sys/fs/pstore/'):
+            return read('/sys/fs/pstore/console-ramoops')
+
+    def enable_uart(self):
+        """Reboots the device with kernel logging to the UART enabled."""
+        model = str(properties.ro.product.model)
+
+        known_commands = {
+            'Nexus 4': None,
+            'Nexus 5': None,
+            'Nexus 6': 'oem config console enable',
+            'Nexus 5X': None,
+            'Nexus 6P': 'oem uart enable',
+            'Nexus 7': 'oem uart-on',
+        }
+
+        with log.waitfor('Enabling kernel UART') as w:
+
+            if model not in known_commands:
+                log.error("Device UART is unsupported.")
+
+            command = known_commands[model]
+
+            if command is None:
+                w.success('Always enabled')
+                return
+
+            # Check the current commandline, it may already be enabled.
+            if any(s.startswith('console=tty') for s in self.cmdline.split()):
+                w.success("Already enabled")
+                return
+
+            # Need to be root
+            with context.local(device=context.device):
+                # Save off the command line before rebooting to the bootloader
+                cmdline = kernel.cmdline
+
+                reboot_bootloader()
+
+                # Wait for device to come online
+                while context.device not in fastboot(['devices',' -l']):
+                    time.sleep(0.5)
+
+                # Try the 'new' way
+                fastboot(command.split())
+                fastboot(['continue'])
+                wait_for_device()
+
+
+kernel = Kernel()
+
+class Property(object):
+    def __init__(self, name=None):
+        self.__dict__['_name'] = name
+
+    def __str__(self):
+        return getprop(self._name).strip()
+
+    def __repr__(self):
+        return repr(str(self))
+
+    def __getattr__(self, attr):
+        if self._name:
+            attr = '%s.%s' % (self._name, attr)
+        return Property(attr)
+
+    def __setattr__(self, attr, value):
+        if attr in self.__dict__:
+            return super(Property, self).__setattr__(attr, value)
+
+        if self._name:
+            attr = '%s.%s' % (self._name, attr)
+        setprop(attr, value)
+
+properties = Property()
+
+def _build_date():
+    """Returns the build date in the form YYYY-MM-DD as a string"""
+    as_string = getprop('ro.build.date')
+    as_datetime =  dateutil.parser.parse(as_string)
+    return as_datetime.strftime('%Y-%b-%d')
+
+def find_ndk_project_root(source):
+    '''Given a directory path, find the topmost project root.
+
+    tl;dr "foo/bar/jni/baz.cpp" ==> "foo/bar"
+    '''
+    ndk_directory = os.path.abspath(source)
+    while ndk_directory != '/':
+        if os.path.exists(os.path.join(ndk_directory, 'jni')):
+            break
+        ndk_directory = os.path.dirname(ndk_directory)
+    else:
+        return None
+
+    return ndk_directory
+
+_android_mk_template = '''
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := poc
+LOCAL_SRC_FILES := %(local_src_files)s
+
+include $(BUILD_EXECUTABLE)
+'''.lstrip()
+
+_application_mk_template = '''
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+APP_ABI:= %(app_abi)s
+APP_PLATFORM:=%(app_platform)s
+'''.lstrip()
+
+def _generate_ndk_project(file_list, abi='arm-v7a', platform_version=21):
+    # Create our project root
+    root = tempfile.mkdtemp()
+
+    if not isinstance(file_list, (list, tuple)):
+        file_list = [file_list]
+
+    # Copy over the source file(s)
+    jni_directory = os.path.join(root, 'jni')
+    os.mkdir(jni_directory)
+    for file in file_list:
+        shutil.copy(file, jni_directory)
+
+    # Create the directories
+
+    # Populate Android.mk
+    local_src_files = ' '.join(list(map(os.path.basename, file_list)))
+    Android_mk = os.path.join(jni_directory, 'Android.mk')
+    with open(Android_mk, 'w+') as f:
+        f.write(_android_mk_template % locals())
+
+    # Populate Application.mk
+    app_abi = abi
+    app_platform = 'android-%s' % platform_version
+    Application_mk = os.path.join(jni_directory, 'Application.mk')
+    with open(Application_mk, 'w+') as f:
+        f.write(_application_mk_template % locals())
+
+    return root
+
+def compile(source):
+    """Compile a source file or project with the Android NDK."""
+
+    # Ensure that we can find the NDK.
+    ndk = os.environ.get('NDK', None)
+    if ndk is None:
+        log.error('$NDK must be set to the Android NDK directory')
+    ndk_build = os.path.join(ndk, 'ndk-build')
+
+    # Determine whether the source is an NDK project or a single source file.
+    project = find_ndk_project_root(source)
+
+    if not project:
+        project = _generate_ndk_project(source,
+                                        str(properties.ro.product.cpu.abi),
+                                        str(properties.ro.build.version.sdk))
+
+    # Remove any output files
+    lib = os.path.join(project, 'libs')
+    if os.path.exists(lib):
+        shutil.rmtree(lib)
+
+    # Build the project
+    io = tubes.process.process(ndk_build, cwd=os.path.join(project, 'jni'))
+
+    result = io.recvall()
+
+    if 0 != io.poll():
+        log.error("Build failed:\n%s" % result)
+
+    # Find all of the output files
+    output = glob.glob(os.path.join(lib, '*', '*'))
+
+    return output[0]
+
+class Partition(object):
+    def __init__(self, path, name, blocks=0):
+        self.path = path
+        self.name = name
+        self.blocks = blocks
+        self.size = blocks * 1024
+
+    @property
+    def data(self):
+        with log.waitfor('Fetching %r partition (%s)' % (self.name, self.path)):
+            return read(self.path)
+
+class Partitions(object):
+    @property
+    @context.quiet
+    def by_name_dir(self):
+        cmd = ['shell','find /dev/block/platform -type d -name by-name']
+        return adb(cmd).strip()
+
+    @context.quiet
+    def __dir__(self):
+        return list(self)
+
+    @context.quiet
+    def __iter__(self):
+        root()
+
+        # Find all named partitions
+        for name in listdir(self.by_name_dir):
+            yield name
+
+    @context.quiet
+    def __getattr__(self, attr):
+        for name in self:
+            if name == attr:
+                break
+        else:
+            raise AttributeError("No partition %r" % attr)
+
+        path = os.path.join(self.by_name_dir, name)
+
+        # Find the actual path of the device
+        devpath = process(['readlink', '-n', path]).recvall()
+        devname = os.path.basename(devpath)
+
+        # Get the size of the partition
+        for line in read('/proc/partitions').splitlines():
+            if not line.strip():
+                continue
+            major, minor, blocks, name = line.split(None, 4)
+            if devname == name:
+                break
+        else:
+            log.error("Could not find size of partition %r" % name)
+
+        return Partition(devpath, attr, int(blocks))
+
+partitions = Partitions()

pwnlib/args.py

@@ -0,0 +1,121 @@
+#!/usr/bin/env python2
+"""
+"""
+import collections
+import logging
+import os
+import string
+import sys
+
+from . import term
+from .context import context
+
+term_mode  = True
+args       = collections.defaultdict(str)
+env_prefix = 'PWNLIB_'
+
+def isident(s):
+    """
+    Helper function to check whether a string is a valid identifier,
+    as passed in on the command-line.
+    """
+    first = string.uppercase + '_'
+    body = string.digits + first
+    if not s:
+        return False
+    if s[0] not in first:
+        return False
+    if not all(c in body for c in s[1:]):
+        return False
+    return True
+
+def asbool(s):
+    """
+    Convert a string to its boolean value
+    """
+    if   s.lower() == 'true':
+        return True
+    elif s.lower() == 'false':
+        return False
+    elif s.isdigit():
+        return bool(int(s))
+    else:
+        raise ValueError('must be integer or boolean: %r' % s)
+
+def set_log_level(x):
+    with context.local(log_level=x):
+        context.defaults['log_level']=context.log_level
+
+def set_log_file(x):
+    context.log_file=x
+
+def set_log_level_error(x):
+    set_log_level('error')
+
+def set_log_level_debug(x):
+    set_log_level('debug')
+
+def set_noterm(v):
+    if asbool(v):
+        global term_mode
+        term_mode = False
+
+def set_timeout(v):
+    context.defaults['timeout'] = int(v)
+
+def set_randomize(v):
+    context.defaults['randomize'] = asbool(v)
+
+def set_aslr(v):
+    context.defaults['aslr'] = not asbool(v)
+
+def set_noptrace(v):
+    context.defaults['noptrace'] = asbool(v)
+
+hooks = {
+    'LOG_LEVEL': set_log_level,
+    'LOG_FILE': set_log_file,
+    'DEBUG': set_log_level_debug,
+    'NOTERM': set_noterm,
+    'SILENT': set_log_level_error,
+    'RANDOMIZE': set_randomize,
+    'TIMEOUT': set_timeout,
+    'NOASLR': set_aslr,
+    'NOPTRACE': set_noptrace,
+}
+
+def initialize():
+    global args, term_mode
+
+    # Hack for readthedocs.org
+    if 'READTHEDOCS' in os.environ:
+        os.environ['PWNLIB_NOTERM'] = '1'
+
+    for k, v in os.environ.items():
+        if not k.startswith(env_prefix):
+            continue
+        k = k[len(env_prefix):]
+
+        if k in hooks:
+            hooks[k](v)
+        elif isident(k):
+            args[k] = v
+
+    argv = sys.argv[:]
+    for arg in sys.argv[:]:
+        orig  = arg
+        value = 'True'
+
+        if '=' in arg:
+            arg, value = arg.split('=')
+
+        if arg in hooks:
+            sys.argv.remove(orig)
+            hooks[arg](value)
+
+        elif isident(arg):
+            sys.argv.remove(orig)
+            args[arg] = value
+
+    if term_mode:
+        term.init()

pwnlib/asm.py

@@ -28,7 +28,7 @@ Assembly
     in the :mod:`shellcraft` module.
 
         >>> asm(shellcraft.sh())
-        'jhh///sh/bin\x89\xe31\xc9j\x0bX\x99\xcd\x80'
+        'jhh///sh/binj\x0bX\x89\xe31\xc9\x99\xcd\x80'
 
 Disassembly
 ------------------------
@@ -39,20 +39,35 @@ Disassembly
     '   0:   b8 0b 00 00 00          mov    eax,0xb'
 
 """
-import tempfile, subprocess, shutil, tempfile, errno, logging, platform
-from os import path, environ
+import errno
+import os
+import platform
+import re
+import shutil
+import string
+import subprocess
+import sys
+import tempfile
+from collections import defaultdict
 from glob import glob
-from . import log
+from os import environ
+from os import path
+
+from . import atexit
+from . import shellcraft
+from .context import LocalContext
 from .context import context
+from .log import getLogger
 
-log = logging.getLogger(__name__)
+log = getLogger(__name__)
 
-__all__ = ['asm', 'cpp', 'disasm', 'which_binutils']
+__all__ = ['asm', 'cpp', 'disasm', 'make_elf', 'make_elf_from_assembly']
 
 _basedir = path.split(__file__)[0]
 _incdir  = path.join(_basedir, 'data', 'includes')
 
-def which_binutils(util, **kwargs):
+@LocalContext
+def which_binutils(util):
     """
     Finds a binutils in the PATH somewhere.
     Expects that the utility is prefixed with the architecture name.
@@ -72,49 +87,57 @@ def which_binutils(util, **kwargs):
         ...
         Exception: Could not find 'as' installed for ContextType(arch = 'msp430')
     """
-    with context.local(**kwargs):
-        arch = context.arch
-        bits = context.bits
+    arch = context.arch
+    bits = context.bits
 
-        # Fix up pwntools vs Debian triplet naming, and account
-        # for 'thumb' being its own pwntools architecture.
-        arches = [arch] + {
-            'thumb':  ['arm',    'aarch64'],
-            'i386':   ['x86_64', 'amd64'],
-            'amd64':  ['x86_64', 'i386'],
-        }.get(arch, [])
+    # Fix up pwntools vs Debian triplet naming, and account
+    # for 'thumb' being its own pwntools architecture.
+    arches = [arch] + {
+        'thumb':  ['arm',    'aarch64'],
+        'i386':   ['x86_64', 'amd64'],
+        'i686':   ['x86_64', 'amd64'],
+        'amd64':  ['x86_64', 'i386'],
+    }.get(arch, [])
 
-        # If one of the candidate architectures matches the native
-        # architecture, use that as a last resort.
-        machine = platform.machine()
-        try:
-            with context.local(arch = machine):
-                if context.arch in arches:
-                    arches.append(None)
-        except AttributeError:
-            log.warn_once("Your local binutils won't be used because architecture %r is not supported." % machine)
+    # If one of the candidate architectures matches the native
+    # architecture, use that as a last resort.
+    machine = platform.machine()
+    machine = 'i386' if machine == 'i686' else machine
+    try:
+        with context.local(arch = machine):
+            if context.arch in arches:
+                arches.append(None)
+    except AttributeError:
+        log.warn_once("Your local binutils won't be used because architecture %r is not supported." % machine)
 
-        for arch in arches:
-            # hack for homebrew-installed binutils on mac
-            for gutil in ['g'+util, util]:
-                # e.g. objdump
-                if arch is None: pattern = gutil
+    utils = [util]
 
-                # e.g. aarch64-linux-gnu-objdump
-                else:       pattern = '%s*linux*-%s' % (arch,gutil)
+    # hack for homebrew-installed binutils on mac
+    if platform.system() == 'Darwin':
+        utils = ['g'+util, util]
 
-                for dir in environ['PATH'].split(':'):
-                    res = glob(path.join(dir, pattern))
-                    if res:
-                        return res[0]
+    for arch in arches:
+        for gutil in utils:
+            # e.g. objdump
+            if arch is None: pattern = gutil
 
-        locals()['context'] = context
-        log.warning("""
+            # e.g. aarch64-linux-gnu-objdump
+            else:       pattern = '%s*linux*-%s' % (arch,gutil)
+
+            for dir in environ['PATH'].split(':'):
+                res = sorted(glob(path.join(dir, pattern)))
+                if res:
+                    return res[0]
+
+    locals()['context'] = context
+    log.warning("""
 Could not find %(util)r installed for %(context)s
 Try installing binutils for this architecture:
-    https://pwntools.readthedocs.org/en/latest/install/binutils.html
+https://docs.pwntools.com/en/stable/install/binutils.html
 """.strip() % locals())
-        raise Exception('Could not find %(util)r installed for %(context)s' % locals())
+    raise Exception('Could not find %(util)r installed for %(context)s' % locals())
+
+checked_assembler_version = defaultdict(lambda: False)
 
 def _assembler():
     gas = which_binutils('as')
@@ -124,28 +147,58 @@ def _assembler():
         'little': '-EL'
     }[context.endianness]
 
+    B = '-%s' % context.bits
+
     assemblers = {
-        'i386'   : [gas, '--32'],
-        'amd64'  : [gas, '--64'],
+        'i386'   : [gas, B],
+        'amd64'  : [gas, B],
 
         # Most architectures accept -EL or -EB
         'thumb'  : [gas, '-mthumb', E],
         'arm'    : [gas, E],
         'aarch64': [gas, E],
-        'mips'   : [gas, E],
-        'mips64' : [gas, E],
-        'sparc':   [gas, E],
-        'sparc64': [gas, E],
+        'mips'   : [gas, E, B],
+        'mips64' : [gas, E, B],
+        'sparc':   [gas, E, B],
+        'sparc64': [gas, E, B],
 
-        # Powerpc wants -mbig or -mlittle
-        'powerpc':   [gas, '-m%s' % context.endianness],
-        'powerpc64': [gas, '-m%s' % context.endianness],
+        # Powerpc wants -mbig or -mlittle, and -mppc32 or -mppc64
+        'powerpc':   [gas, '-m%s' % context.endianness, '-mppc%s' % context.bits],
+        'powerpc64': [gas, '-m%s' % context.endianness, '-mppc%s' % context.bits],
 
         # ia64 only accepts -mbe or -mle
         'ia64':    [gas, '-m%ce' % context.endianness[0]]
     }
 
-    return assemblers.get(context.arch, [gas])
+    assembler = assemblers.get(context.arch, [gas])
+
+    if not checked_assembler_version[gas]:
+        checked_assembler_version[gas] = True
+        result = subprocess.check_output([gas, '--version','/dev/null'],
+                                         stderr=subprocess.STDOUT)
+        version = re.search(r' (\d\.\d+)', result).group(1)
+        if version < '2.19':
+            log.warn_once('Your binutils version is too old and may not work!\n'  + \
+                'Try updating with: https://docs.pwntools.com/en/stable/install/binutils.html\n' + \
+                'Reported Version: %r' % result.strip())
+
+
+    return assembler
+
+def _linker():
+    ld  = [which_binutils('ld')]
+    bfd = ['--oformat=' + _bfdname()]
+
+    E = {
+        'big':    '-EB',
+        'little': '-EL'
+    }[context.endianness]
+
+    arguments = {
+        'i386': ['-m', 'elf_i386'],
+    }.get(context.arch, [])
+
+    return ld + bfd + [E] + arguments
 
 def _objcopy():
     return [which_binutils('objcopy')]
@@ -161,11 +214,7 @@ def _objdump():
 def _include_header():
     os   = context.os
     arch = context.arch
-
-    if os == 'freebsd':
-        include = 'freebsd.h'
-    elif os == 'linux':
-        include = 'linux/%s.h' % arch
+    include = '%s/%s.h' % (os, arch)
 
     if not include or not path.exists(path.join(_incdir, include)):
         log.warn_once("Could not find system include headers for %s-%s" % (arch,os))
@@ -175,7 +224,11 @@ def _include_header():
 
 
 def _arch_header():
-    prefix  = ['.section .shellcode,"ax"']
+    prefix  = ['.section .shellcode,"awx"',
+                '.global _start',
+                '.global __start',
+                '_start:',
+                '__start:']
     headers = {
         'i386'  :  ['.intel_syntax noprefix'],
         'amd64' :  ['.intel_syntax noprefix'],
@@ -186,26 +239,33 @@ def _arch_header():
                    '.arch armv7-a',
                    '.thumb'],
         'mips'  : ['.set mips2',
-                   '.set noreorder'],
+                   '.set noreorder',
+                   ],
     }
 
     return '\n'.join(prefix + headers.get(context.arch, [])) + '\n'
 
 def _bfdname():
     arch = context.arch
+    E    = context.endianness
 
     bfdnames = {
         'i386'    : 'elf32-i386',
+        'aarch64' : 'elf64-%saarch64' % E,
         'amd64'   : 'elf64-x86-64',
-        'arm'     : 'elf32-littlearm',
-        'thumb'   : 'elf32-littlearm',
-        'mips'    : 'elf32-%smips' % context.endianness,
+        'arm'     : 'elf32-%sarm' % E,
+        'thumb'   : 'elf32-%sarm' % E,
+        'mips'    : 'elf32-trad%smips' % E,
+        'mips64'  : 'elf64-trad%smips' % E,
         'alpha'   : 'elf64-alpha',
         'cris'    : 'elf32-cris',
-        'ia64'    : 'elf64-ia64-%s' % context.endianness,
+        'ia64'    : 'elf64-ia64-%s' % E,
         'm68k'    : 'elf32-m68k',
         'powerpc' : 'elf32-powerpc',
+        'powerpc64' : 'elf64-powerpc',
         'vax'     : 'elf32-vax',
+        'sparc'   : 'elf32-sparc',
+        'sparc64' : 'elf64-sparc',
     }
 
     if arch in bfdnames:
@@ -255,7 +315,8 @@ def _run(cmd, stdin = None):
 
     return stdout
 
-def cpp(shellcode, **kwargs):
+@LocalContext
+def cpp(shellcode):
     r"""cpp(shellcode, ...) -> str
 
     Runs CPP over the given shellcode.
@@ -275,31 +336,170 @@ def cpp(shellcode, **kwargs):
             >>> cpp("mov al, SYS_setresuid", arch = "i386", os = "linux")
             'mov al, 164\n'
             >>> cpp("weee SYS_setresuid", arch = "arm", os = "linux")
-            'weee (0x900000+164)\n'
+            'weee (0+164)\n'
             >>> cpp("SYS_setresuid", arch = "thumb", os = "linux")
             '(0+164)\n'
             >>> cpp("SYS_setresuid", os = "freebsd")
             '311\n'
     """
+    arch = context.arch
+    os   = context.os
+    code = _include_header() + shellcode
+    cmd  = [
+        'cpp',
+        '-C',
+        '-nostdinc',
+        '-undef',
+        '-P',
+        '-I' + _incdir,
+        '/dev/stdin'
+    ]
+    return _run(cmd, code).strip('\n').rstrip() + '\n'
 
-    with context.local(**kwargs):
-        arch = context.arch
-        os   = context.os
-        code = _include_header() + shellcode
-        cmd  = [
-            'cpp',
-            '-C',
-            '-nostdinc',
-            '-undef',
-            '-P',
-            '-I' + _incdir,
-            '/dev/stdin'
-        ]
-        return _run(cmd, code).strip('\n').rstrip() + '\n'
+@LocalContext
+def make_elf_from_assembly(assembly, vma = None, extract=False, shared = False):
+    r"""
+    Builds an ELF file with the specified assembly as its
+    executable code.
+
+    Arguments:
+
+        assembly(str): Assembly
+        vma(int): Load address of the binary
+        extract(bool): Whether to return the data extracted from the file created,
+                       or the path to it.
+
+    Returns:
+
+        The path to the assembled ELF (extract=False), or the data
+        of the assembled ELF.
+
+    Example:
+
+        >>> context.clear()
+        >>> context.arch = 'amd64'
+        >>> sc = 'push rbp; mov rbp, rsp;'
+        >>> sc += shellcraft.echo('Hello\n')
+        >>> sc += 'mov rsp, rbp; pop rbp; ret'
+        >>> solib = make_elf_from_assembly(sc, shared=1)
+        >>> subprocess.check_output(['echo', 'World'], env={'LD_PRELOAD': solib})
+        'Hello\nWorld\n'
+    """
+    if shared and vma:
+        log.error("Cannot specify a VMA for a shared library.")
+
+    if vma is None:
+        if shared:
+            vma = 0
+        else:
+            vma = 0x10000000
+
+    if context.arch == 'thumb':
+        to_thumb = shellcraft.arm.to_thumb()
+
+        if not assembly.startswith(to_thumb):
+            assembly = to_thumb + assembly
+
+    path = asm(assembly, vma = vma, extract = extract, shared = shared)
+
+    if not extract:
+        os.chmod(path, 0755)
+
+    return path
+
+@LocalContext
+def make_elf(data, vma = None, strip=True, extract=True, shared=False):
+    r"""
+    Builds an ELF file with the specified binary data as its
+    executable code.
+
+    Arguments:
+        data(str): Assembled code
+        vma(int):  Load address for the ELF file
+
+    Examples:
+
+        This example creates an i386 ELF that just does
+        execve('/bin/sh',...).
+
+        >>> context.clear()
+        >>> context.arch = 'i386'
+        >>> context.bits = 32
+        >>> filename = tempfile.mktemp()
+        >>> bin_sh = '6a68682f2f2f73682f62696e89e331c96a0b5899cd80'.decode('hex')
+        >>> data = make_elf(bin_sh)
+        >>> with open(filename,'wb+') as f:
+        ...     f.write(data)
+        ...     f.flush()
+        >>> os.chmod(filename,0777)
+        >>> p = process(filename)
+        >>> p.sendline('echo Hello; exit')
+        >>> p.recvline()
+        'Hello\n'
+    """
+    retval = None
+
+    if shared and vma:
+        log.error("Cannot specify a VMA for a shared library.")
+
+    if context.arch == 'thumb':
+        to_thumb = asm(shellcraft.arm.to_thumb(), arch='arm')
+
+        if not data.startswith(to_thumb):
+            data = to_thumb + data
 
 
-def asm(shellcode, vma = 0, **kwargs):
-    r"""asm(code, vma = 0, ...) -> str
+    assembler = _assembler()
+    linker    = _linker()
+    code      = _arch_header()
+    code      += '.string "%s"' % ''.join('\\x%02x' % ord(c) for c in data)
+    code      += '\n'
+
+    log.debug("Building ELF:\n" + code)
+
+    tmpdir    = tempfile.mkdtemp(prefix = 'pwn-asm-')
+    step1     = path.join(tmpdir, 'step1-asm')
+    step2     = path.join(tmpdir, 'step2-obj')
+    step3     = path.join(tmpdir, 'step3-elf')
+
+    try:
+        with open(step1, 'wb+') as f:
+            f.write(code)
+
+        _run(assembler + ['-o', step2, step1])
+
+        linker_options = ['-z', 'execstack']
+        if vma:
+            linker_options += ['--section-start=.shellcode=%#x' % vma,
+                               '--entry=%#x' % vma]
+        elif shared:
+            linker_options += ['-shared', '-init=_start']
+
+        linker_options += ['-o', step3, step2]
+
+        _run(linker + linker_options)
+
+        if strip:
+            _run([which_binutils('objcopy'), '-Sg', step3])
+            _run([which_binutils('strip'), '--strip-unneeded', step3])
+
+        if not extract:
+            os.chmod(step3, 0755)
+            retval = step3
+
+        else:
+            with open(step3, 'r') as f:
+                retval = f.read()
+    except Exception:
+        log.exception("An error occurred while building an ELF:\n%s" % code)
+    else:
+        atexit.register(lambda: shutil.rmtree(tmpdir))
+
+    return retval
+
+@LocalContext
+def asm(shellcode, vma = 0, extract = True, shared = False):
+    r"""asm(code, vma = 0, extract = True, ...) -> str
 
     Runs :func:`cpp` over a given shellcode and then assembles it into bytes.
 
@@ -309,9 +509,12 @@ def asm(shellcode, vma = 0, **kwargs):
     To support all these architecture, we bundle the GNU assembler
     and objcopy with pwntools.
 
-    Args:
+    Arguments:
       shellcode(str): Assembler code to assemble.
       vma(int):       Virtual memory address of the beginning of assembly
+      extract(bool):  Extract the raw assembly bytes from the assembled
+                      file.  If ``False``, returns the path to an ELF file
+                      with the assembly embedded.
 
     Kwargs:
         Any arguments/properties that can be set on ``context``
@@ -326,51 +529,74 @@ def asm(shellcode, vma = 0, **kwargs):
             '\xb8\x17\x00\x00\x00'
             >>> asm("mov rax, SYS_select", arch = 'amd64', os = 'linux')
             'H\xc7\xc0\x17\x00\x00\x00'
-            >>> asm("ldr r0, =SYS_select", arch = 'arm', os = 'linux', bits=32)
-            '\x04\x00\x1f\xe5R\x00\x90\x00'
+            >>> asm("mov r0, #SYS_select", arch = 'arm', os = 'linux', bits=32)
+            'R\x00\xa0\xe3'
     """
     result = ''
 
-    with context.local(**kwargs):
-        assembler = _assembler()
-        objcopy   = _objcopy() + ['-j', '.shellcode', '-Obinary']
-        code      = '.org %#x\n' % vma
-        code      += _arch_header()
-        code      += cpp(shellcode)
+    assembler = _assembler()
+    linker    = _linker()
+    objcopy   = _objcopy() + ['-j', '.shellcode', '-Obinary']
+    code      = ''
+    code      += _arch_header()
+    code      += cpp(shellcode)
 
-        log.debug('Assembling\n%s' % code)
+    log.debug('Assembling\n%s' % code)
 
-        tmpdir    = tempfile.mkdtemp(prefix = 'pwn-asm-')
-        step1     = path.join(tmpdir, 'step1')
-        step2     = path.join(tmpdir, 'step2')
-        step3     = path.join(tmpdir, 'step3')
+    tmpdir    = tempfile.mkdtemp(prefix = 'pwn-asm-')
+    step1     = path.join(tmpdir, 'step1')
+    step2     = path.join(tmpdir, 'step2')
+    step3     = path.join(tmpdir, 'step3')
+    step4     = path.join(tmpdir, 'step4')
 
-        try:
-            with open(step1, 'w') as fd:
-                fd.write(code)
+    try:
+        with open(step1, 'w') as fd:
+            fd.write(code)
 
-            _run(assembler + ['-o', step2, step1])
+        _run(assembler + ['-o', step2, step1])
 
-            if file(step2,'rb').read(4) == '\x7fELF':
-                # Sanity check for seeing if the output has relocations
-                relocs = subprocess.check_output(
-                    [which_binutils('readelf'), '-r', step2]
-                ).strip()
-                if len(relocs.split('\n')) > 1:
-                    log.error('Shellcode contains relocations:\n%s' % relocs)
+        if not vma:
+            shutil.copy(step2, step3)
 
-            _run(objcopy + [step2, step3])
+        if vma or not extract:
+            ldflags = ['-z', 'execstack', '-o', step3, step2]
+            if vma:
+                ldflags += ['--section-start=.shellcode=%#x' % vma,
+                            '--entry=%#x' % vma,
+                            '-z', 'max-page-size=4096',
+                            '-z', 'common-page-size=4096']
+            elif shared:
+                ldflags += ['-shared', '-init=_start']
+            _run(linker + ldflags)
 
-            with open(step3) as fd:
-                result = fd.read()
-
-        except:
-            log.exception("An error occurred while assembling:\n%s" % code)
+        elif file(step2,'rb').read(4) == '\x7fELF':
+            # Sanity check for seeing if the output has relocations
+            relocs = subprocess.check_output(
+                [which_binutils('readelf'), '-r', step2]
+            ).strip()
+            if extract and len(relocs.split('\n')) > 1:
+                log.error('Shellcode contains relocations:\n%s' % relocs)
         else:
-            shutil.rmtree(tmpdir)
-            return result
+            shutil.copy(step2, step3)
 
-def disasm(data, vma = 0, **kwargs):
+        if not extract:
+            return step3
+
+        _run(objcopy + [step3, step4])
+
+        with open(step4) as fd:
+            result = fd.read()
+
+    except Exception:
+        lines = '\n'.join('%4i: %s' % (i+1,line) for (i,line) in enumerate(code.splitlines()))
+        log.exception("An error occurred while assembling:\n%s" % lines)
+    else:
+        atexit.register(lambda: shutil.rmtree(tmpdir))
+
+    return result
+
+@LocalContext
+def disasm(data, vma = 0, byte = True, offset = True, instructions = True):
     """disasm(data, ...) -> str
 
     Disassembles a bytestring into human readable assembler.
@@ -381,9 +607,11 @@ def disasm(data, vma = 0, **kwargs):
     To support all these architecture, we bundle the GNU objcopy
     and objdump with pwntools.
 
-    Args:
+    Arguments:
       data(str): Bytestring to disassemble.
       vma(int): Passed through to the --adjust-vma argument of objdump
+      byte(bool): Include the hex-printed bytes in the disassembly
+      offset(bool): Include the virtual memory address in the disassembly
 
     Kwargs:
       Any arguments/properties that can be set on ``context``
@@ -394,6 +622,10 @@ def disasm(data, vma = 0, **kwargs):
 
           >>> print disasm('b85d000000'.decode('hex'), arch = 'i386')
              0:   b8 5d 00 00 00          mov    eax,0x5d
+          >>> print disasm('b85d000000'.decode('hex'), arch = 'i386', byte = 0)
+             0:   mov    eax,0x5d
+          >>> print disasm('b85d000000'.decode('hex'), arch = 'i386', byte = 0, offset = 0)
+          mov    eax,0x5d
           >>> print disasm('b817000000'.decode('hex'), arch = 'amd64')
              0:   b8 17 00 00 00          mov    eax,0x17
           >>> print disasm('48c7c017000000'.decode('hex'), arch = 'amd64')
@@ -403,50 +635,70 @@ def disasm(data, vma = 0, **kwargs):
              4:   00900052        addseq  r0, r0, r2, asr r0
           >>> print disasm('4ff00500'.decode('hex'), arch = 'thumb', bits=32)
              0:   f04f 0005       mov.w   r0, #5
+          >>>
     """
     result = ''
 
-    with context.local(**kwargs):
-        arch   = context.arch
-        os     = context.os
+    arch   = context.arch
+    os     = context.os
 
-        tmpdir = tempfile.mkdtemp(prefix = 'pwn-disasm-')
-        step1  = path.join(tmpdir, 'step1')
-        step2  = path.join(tmpdir, 'step2')
+    tmpdir = tempfile.mkdtemp(prefix = 'pwn-disasm-')
+    step1  = path.join(tmpdir, 'step1')
+    step2  = path.join(tmpdir, 'step2')
 
-        bfdarch = _bfdarch()
-        bfdname = _bfdname()
-        objdump = _objdump() + ['-d', '--adjust-vma', str(vma), '-b', bfdname]
-        objcopy = _objcopy() + [
-            '-I', 'binary',
-            '-O', bfdname,
-            '-B', bfdarch,
-            '--set-section-flags', '.data=code',
-            '--rename-section', '.data=.text',
-        ]
+    bfdarch = _bfdarch()
+    bfdname = _bfdname()
+    objdump = _objdump() + ['-d', '--adjust-vma', str(vma), '-b', bfdname]
+    objcopy = _objcopy() + [
+        '-I', 'binary',
+        '-O', bfdname,
+        '-B', bfdarch,
+        '--set-section-flags', '.data=code',
+        '--rename-section', '.data=.text',
+    ]
 
-        if arch == 'thumb':
-            objcopy += ['--prefix-symbol=$t.']
-        else:
-            objcopy += ['-w', '-N', '*']
+    if arch == 'thumb':
+        objcopy += ['--prefix-symbol=$t.']
+    else:
+        objcopy += ['-w', '-N', '*']
 
+    try:
+
+        with open(step1, 'w') as fd:
+            fd.write(data)
+
+        res = _run(objcopy + [step1, step2])
+
+        output0 = subprocess.check_output(objdump + [step2])
+        output1 = output0.split('<.text>:\n')
+
+        if len(output1) != 2:
+            log.error('Could not find .text in objdump output:\n%s' % output0)
+
+        result = output1[1].strip('\n').rstrip().expandtabs()
+    except Exception:
+        log.exception("An error occurred while disassembling:\n%s" % data)
+    else:
+        atexit.register(lambda: shutil.rmtree(tmpdir))
+
+
+    lines = []
+    pattern = '^( *[0-9a-f]+: *)((?:[0-9a-f]+ )+ *)(.*)'
+    for line in result.splitlines():
         try:
-
-            with open(step1, 'w') as fd:
-                fd.write(data)
-
-            res = _run(objcopy + [step1, step2])
-
-            output0 = subprocess.check_output(objdump + [step2])
-            output1 = output0.split('<.text>:\n')
-
-            if len(output1) != 2:
-                log.error('Could not find .text in objdump output:\n%s' % output0)
-
-            result = output1[1].strip('\n').rstrip().expandtabs()
+            o, b, i = re.search(pattern, line).groups()
         except:
-            log.exception("An error occurred while disassembling:\n%s" % data)
-        else:
-            shutil.rmtree(tmpdir)
-            return result
+            lines.append(line)
+            continue
 
+        line = ''
+
+        if offset:
+            line += o
+        if byte:
+            line += b
+        if instructions:
+            line += i
+        lines.append(line)
+
+    return '\n'.join(lines)

pwnlib/atexception.py

@@ -3,7 +3,10 @@ Analogous to atexit, this module allows the programmer to register functions to
 be run if an unhandled exception occurs.
 """
 
-import sys, traceback, threading
+import sys
+import threading
+import traceback
+
 from .context import context
 
 __all__ = ['register', 'unregister']
@@ -68,25 +71,23 @@ def _run_handlers():
     If a handler raises an exception, it will be printed but nothing else
     happens, i.e. other handlers will be run.
     """
-    context.clear()
     for _ident, (func, args, kwargs, ctx) in \
         sorted(_handlers.items(), reverse = True):
         try:
-            with context.local(**ctx):
+            with context.local():
+                context.clear()
+                context.update(**ctx)
                 func(*args, **kwargs)
         except SystemExit:
             pass
-        except:
+        except Exception:
             # extract the current exception and rewind the traceback to where it
             # originated
             typ, val, tb = sys.exc_info()
             traceback.print_exception(typ, val, tb.tb_next)
 
 # we rely on the existing excepthook to print exceptions
-if hasattr(sys, 'excepthook'):
-    _oldhook = sys.excepthook
-else:
-    _oldhook = None
+_oldhook = getattr(sys, 'excepthook', None)
 
 def _newhook(typ, val, tb):
     """_newhook(typ, val, tb)
@@ -96,6 +97,7 @@ def _newhook(typ, val, tb):
     """
     if _oldhook:
         _oldhook(typ, val, tb)
-    _run_handlers()
+    if _run_handlers:
+        _run_handlers()
 
 sys.excepthook = _newhook

pwnlib/atexit.py

@@ -8,7 +8,10 @@ This module also fixes a the issue that exceptions raised by an exit handler is
 printed twice when the standard :mod:`atexit` is used.
 """
 
-import sys, traceback, threading
+import sys
+import threading
+import traceback
+
 from .context import context
 
 __all__ = ['register', 'unregister']
@@ -80,7 +83,7 @@ def _run_handlers():
                 func(*args, **kwargs)
         except SystemExit:
             pass
-        except:
+        except Exception:
             # extract the current exception and rewind the traceback to where it
             # originated
             typ, val, tb = sys.exc_info()

pwnlib/commandline/__init__.py

@@ -0,0 +1 @@
+# empty

pwnlib/commandline/asm.py

@@ -1,9 +1,10 @@
 #!/usr/bin/env python2
+import argparse
+import sys
 
-import argparse, sys
-from pwnlib.asm           import asm
-from pwnlib.context       import context
-from pwnlib.util.fiddling import enhex
+from pwn import *
+
+from . import common
 
 parser = argparse.ArgumentParser(
     description = 'Assemble shellcode into bytes'
@@ -19,7 +20,7 @@ parser.add_argument(
 parser.add_argument(
     "-f", "--format",
     help="Output format (defaults to hex for ttys, otherwise raw)",
-    choices=['raw', 'hex', 'string']
+    choices=['raw', 'hex', 'string', 'elf']
 )
 
 parser.add_argument(
@@ -32,31 +33,94 @@ parser.add_argument(
 
 parser.add_argument(
     '-c', '--context',
-    metavar = '<opt>',
-    choices = context.oses + list(context.architectures),
-    default = ['i386','linux'],
+    metavar = 'context',
     action = 'append',
-    help = 'The os/architecture the shellcode will run in (default: linux/i386), choose from: %s' % \
-      ', '.join(sorted(context.oses + list(context.architectures)))
+    type   = common.context_arg,
+    choices = common.choices,
+    help = 'The os/architecture/endianness/bits the shellcode will run in (default: linux/i386), choose from: %s' % common.choices,
+)
+
+parser.add_argument(
+    '-v', '--avoid',
+    action='append',
+    help = 'Encode the shellcode to avoid the listed bytes (provided as hex; default: 000a)'
+)
+
+parser.add_argument(
+    '-n', '--newline',
+    dest='avoid',
+    action='append_const',
+    const='\n',
+    help = 'Encode the shellcode to avoid newlines'
+)
+
+parser.add_argument(
+    '-z', '--zero',
+    dest='avoid',
+    action='append_const',
+    const='\x00',
+    help = 'Encode the shellcode to avoid NULL bytes'
+)
+
+
+parser.add_argument(
+    '-d',
+    '--debug',
+    help='Debug the shellcode with GDB',
+    action='store_true'
+)
+
+parser.add_argument(
+    '-e',
+    '--encoder',
+    help="Specific encoder to use"
+)
+
+parser.add_argument(
+    '-i',
+    '--infile',
+    help="Specify input file",
+    default=sys.stdin,
+    type=file
+)
+
+parser.add_argument(
+    '-r',
+    '--run',
+    help="Run output",
+    action='store_true'
 )
 
 def main():
     args   = parser.parse_args()
     tty    = args.output.isatty()
 
-    for arch in args.context[::-1]:
-        if arch in context.architectures: break
-    for os in args.context[::-1]:
-        if os in context.oses: break
-
-    data   = '\n'.join(args.lines) or sys.stdin.read()
-    output = asm(data.replace(';', '\n'), arch = arch, os = os)
+    data   = '\n'.join(args.lines) or args.infile.read()
+    output = asm(data.replace(';', '\n'))
     fmt    = args.format or ('hex' if tty else 'raw')
     formatters = {'r':str, 'h':enhex, 's':repr}
 
-    args.output.write(formatters[fmt[0]](output))
+    if args.avoid:
+        output = encode(output, args.avoid)
+
+    if args.debug:
+        proc = gdb.debug_shellcode(output, arch=context.arch)
+        proc.interactive()
+        sys.exit(0)
+
+    if args.run:
+        proc = run_shellcode(output)
+        proc.interactive()
+        sys.exit(0)
+
+    if fmt[0] == 'e':
+        args.output.write(make_elf(output))
+        try: os.fchmod(args.output.fileno(), 0700)
+        except OSError: pass
+    else:
+        args.output.write(formatters[fmt[0]](output))
 
     if tty and fmt is not 'raw':
         args.output.write('\n')
 
-if __name__ == '__main__': main()
+if __name__ == '__main__': main()

pwnlib/commandline/checksec.py

@@ -0,0 +1,40 @@
+#!/usr/bin/env python2
+import argparse
+import sys
+
+from pwn import *
+
+from . import common
+
+parser = argparse.ArgumentParser(
+    description = 'Check binary security settings'
+)
+
+
+parser.add_argument(
+    'elf',
+    nargs='*',
+    type=file,
+    help='Files to check'
+)
+parser.add_argument(
+    '--file',
+    nargs='*',
+    dest='elf2',
+    metavar='elf',
+    type=file,
+    help='File to check (for compatibility with checksec.sh)'
+)
+
+def main():
+    args   = parser.parse_args()
+    files  = args.elf or args.elf2 or []
+
+    if not files:
+        parser.print_usage()
+        return
+
+    for f in files:
+        e = ELF(f.name)
+
+if __name__ == '__main__': main()

pwnlib/commandline/common.py

@@ -0,0 +1,22 @@
+import sys
+
+import pwnlib
+from pwnlib.context import context
+
+pwnlib.log.console.stream = sys.stderr
+
+choices = map(str, [16,32,64])
+choices += list(context.oses)
+choices += list(context.architectures)
+choices += list(context.endiannesses)
+
+def context_arg(arg):
+    try: context.arch = arg
+    except Exception: pass
+    try: context.os = arg
+    except Exception: pass
+    try: context.bits = int(arg)
+    except Exception: arg
+    try: context.endian = arg
+    except Exception: pass
+    return arg

pwnlib/commandline/constgrep.py

@@ -1,10 +1,11 @@
 #!/usr/bin/env python2
 
-import argparse, os, re
-from pwnlib import asm, constants
-from pwnlib.util import safeeval
-# from pwnlib.context import __possible__ as contexts
-from pwnlib.context import context
+import argparse
+import os
+import re
+
+from pwn import *
+from . import common
 
 p = argparse.ArgumentParser(
     description = "Looking up constants from header files.\n\nExample: constgrep -c freebsd -m  ^PROT_ '3 + 4'",
@@ -14,7 +15,7 @@ p = argparse.ArgumentParser(
 group = p.add_mutually_exclusive_group()
 group.add_argument(
     '-e', '--exact',
-    metavar = '<constant name>',
+    metavar = 'constant',
     # nargs = 1,
     default = None,
     help = 'Do an exact match for a constant instead of searching for a regex',
@@ -47,33 +48,26 @@ p.add_argument(
 
 p.add_argument(
     '-c', '--context',
-    metavar = '<opt>',
-    choices = context.oses + list(context.architectures),
-    default = ['i386','linux'],
+    metavar = 'arch_or_os',
     action = 'append',
-    help = 'The os/architecture to find constants for (default: linux/i386), choose from: %s' % \
-    ', '.join(sorted(context.oses + context.architectures.keys()))
+    type   = common.context_arg,
+    choices = common.choices,
+    help = 'The os/architecture/endianness/bits the shellcode will run in (default: linux/i386), choose from: %s' % common.choices,
 )
 
 def main():
     args = p.parse_args()
 
-    # Find the architecture and os from the list of contexts
-    for arch in args.context[::-1]:
-        if arch in context.architectures: break
-    for os in args.context[::-1]:
-        if os in context.oses: break
-
     if args.exact:
         # This is the simple case
-        print asm.cpp(args.exact, os = os, arch = arch).strip()
+        print cpp(args.exact).strip()
     else:
         # New we search in the right module.
         # But first: We find the right module
-        if os == 'freebsd':
+        if context.os == 'freebsd':
             mod = constants.freebsd
         else:
-            mod = getattr(getattr(constants, os), arch)
+            mod = getattr(getattr(constants, context.os), context.arch)
 
         # Compile the given regex, for optimized lookup
         if args.case_insensitive:
@@ -83,7 +77,10 @@ def main():
 
         # Evaluate the given constant
         if args.constant:
-            constant = safeeval.expr(args.constant)
+            try:
+                constant = safeeval.expr(args.constant)
+            except:
+                log.error("Could not evaluate constant %r" % args.constant)
         else:
             constant = None
 
@@ -116,7 +113,7 @@ def main():
 
         # Output all matching constants
         for _, k in sorted(out):
-            print '#define %s %s' % (k.ljust(maxlen), asm.cpp(k, os = os, arch = arch).strip())
+            print '#define %s %s' % (k.ljust(maxlen), cpp(k).strip())
 
         # If we are in match_mode, then try to find a combination of
         # constants that yield the exact given value

pwnlib/commandline/cyclic.py

@@ -1,7 +1,11 @@
 #!/usr/bin/env python2
-import argparse, string, sys
-from pwnlib.util import cyclic, packing
-from pwnlib import log
+import argparse
+import string
+import sys
+
+from pwn import *
+
+from . import common
 
 parser = argparse.ArgumentParser(
     description = "Cyclic pattern creator/finder"
@@ -22,11 +26,20 @@ parser.add_argument(
     help = 'Size of the unique subsequences (defaults to 4).'
 )
 
+parser.add_argument(
+    '-c', '--context',
+    metavar = 'context',
+    action = 'append',
+    type   = common.context_arg,
+    choices = common.choices,
+    help = 'The os/architecture/endianness/bits the shellcode will run in (default: linux/i386), choose from: %s' % common.choices,
+)
+
 group = parser.add_mutually_exclusive_group(required = True)
 group.add_argument(
     '-l', '-o', '--offset', '--lookup',
     dest = 'lookup',
-    metavar = '<lookup value>',
+    metavar = 'lookup_value',
     help = 'Do a lookup instead printing the alphabet',
 )
 
@@ -45,26 +58,29 @@ def main():
     if args.lookup:
         pat = args.lookup
 
-        if pat.startswith('0x'):
-            pat = packing.pack(int(pat[2:], 16), subsize*8, 'little', 'unsigned')
-        elif pat.isdigit():
-            pat = packing.pack(int(pat, 10), subsize*8, 'little', 'unsigned')
+        try:
+            pat = packing.pack(int(pat, 0), subsize*8)
+        except ValueError:
+            pass
 
-        if len(pat) != 4:
-            log.fatal('Subpattern must be 4 bytes', 1)
+        if len(pat) != subsize:
+            log.critical('Subpattern must be %d bytes' % subsize)
+            sys.exit(1)
 
         if not all(c in alphabet for c in pat):
-            log.fatal('Pattern contains characters not present in the alphabet', 1)
+            log.critical('Pattern contains characters not present in the alphabet')
+            sys.exit(1)
 
-        offset = cyclic.cyclic_find(pat, alphabet, subsize)
+        offset = cyclic_find(pat, alphabet, subsize)
 
         if offset == -1:
-            log.fatal('Given pattern does not exist in cyclic pattern', 1)
+            log.critical('Given pattern does not exist in cyclic pattern')
+            sys.exit(1)
         else:
             print offset
     else:
         want   = args.count
-        result = cyclic.cyclic(want, alphabet, subsize)
+        result = cyclic(want, alphabet, subsize)
         got    = len(result)
         if got < want:
             log.failure("Alphabet too small (max length = %i)" % got)
@@ -74,4 +90,4 @@ def main():
         if sys.stdout.isatty():
             sys.stdout.write('\n')
 
-if __name__ == '__main__': main()
+if __name__ == '__main__': main()

pwnlib/commandline/disasm.py

@@ -1,9 +1,11 @@
 #!/usr/bin/env python2
+import argparse
+import string
+import sys
 
-import argparse, sys
-from pwnlib import asm
-from pwnlib.context import context
-from string import whitespace, hexdigits
+from pwn import *
+
+from . import common
 
 parser = argparse.ArgumentParser(
     description = 'Disassemble bytes into text format'
@@ -18,25 +20,72 @@ parser.add_argument(
 
 parser.add_argument(
     '-c', '--context',
-    metavar = '<opt>',
-    choices = context.architectures,
-    default = 'i386',
-    help = 'The architecture of the shellcode (default: i386), choose from:\n%s' % ', '.join(context.architectures)
+    metavar = 'arch_or_os',
+    action = 'append',
+    type   = common.context_arg,
+    choices = common.choices,
+    help = 'The os/architecture/endianness/bits the shellcode will run in (default: linux/i386), choose from: %s' % common.choices,
 )
 
+
+parser.add_argument(
+    "-a","--address",
+    metavar='address',
+    help="Base address",
+    type=str,
+    default='0'
+)
+
+
+parser.add_argument(
+    '--color',
+    help="Color output",
+    action='store_true',
+    default=sys.stdout.isatty()
+)
+
+parser.add_argument(
+    '--no-color',
+    help="Disable color output",
+    action='store_false',
+    dest='color'
+)
+
+
 def main():
     args = parser.parse_args()
 
     if len(args.hex) > 0:
         dat = ''.join(args.hex)
-        dat = dat.translate(None, whitespace)
-        if not set(hexdigits) >= set(dat):
+        dat = dat.translate(None, string.whitespace)
+        if not set(string.hexdigits) >= set(dat):
             print "This is not a hex string"
             exit(-1)
         dat = dat.decode('hex')
     else:
         dat = sys.stdin.read()
 
-    print asm.disasm(dat, arch = args.context)
 
-if __name__ == '__main__': main()
+    if args.color:
+        from pygments import highlight
+        from pygments.formatters import TerminalFormatter
+        from pwnlib.lexer import PwntoolsLexer
+
+        offsets = disasm(dat, vma=safeeval.const(args.address), instructions=False, byte=False)
+        bytes   = disasm(dat, vma=safeeval.const(args.address), instructions=False, offset=False)
+        instrs  = disasm(dat, vma=safeeval.const(args.address), byte=False, offset=False)
+        # instrs  = highlight(instrs, PwntoolsLexer(), TerminalFormatter())
+
+        split = lambda x: x.splitlines()
+        for o,b,i in zip(*list(map(split, (offsets, bytes, instrs)))):
+            b = b.replace('00', text.red('00'))
+            b = b.replace('0a', text.red('0a'))
+            i = highlight(i.strip(), PwntoolsLexer(), TerminalFormatter()).strip()
+            i = i.replace(',',', ')
+
+            print o,b,i
+        return
+
+    print disasm(dat, vma=safeeval.const(args.address))
+
+if __name__ == '__main__': main()

pwnlib/commandline/elfdiff.py

@@ -1,11 +1,16 @@
 #!/usr/bin/env python2
+import shutil
+
 from argparse import ArgumentParser
-from subprocess import check_output, CalledProcessError
+from subprocess import CalledProcessError
+from subprocess import check_output
 from tempfile import NamedTemporaryFile
 
-def dump(x):
+from pwn import *
+
+def dump(objdump, path):
     n = NamedTemporaryFile(delete=False)
-    o = check_output(['objdump','-d','-x','-s',x])
+    o = check_output([objdump,'-d','-x','-s',path])
     n.write(o)
     n.flush()
     return n.name
@@ -15,13 +20,33 @@ def diff(a,b):
     except CalledProcessError as e:
         return e.output
 
-
 p = ArgumentParser()
 p.add_argument('a')
 p.add_argument('b')
 
 def main():
     a = p.parse_args()
-    print diff(dump(a.a), dump(a.b))
 
-if __name__ == '__main__': main()
+    with context.silent:
+        x = ELF(a.a)
+        y = ELF(a.b)
+
+    if x.arch != y.arch:
+        log.error("Architectures are not the same: %s vs %s" % (x.arch, y.arch))
+
+    context.arch = x.arch
+
+    objdump = pwnlib.asm.which_binutils('objdump')
+
+    tmp = NamedTemporaryFile()
+    name = tmp.name
+
+    shutil.copy(x.path, name)
+    x = dump(objdump, name)
+
+    shutil.copy(y.path, name)
+    y = dump(objdump, name)
+
+    print diff(x, y)
+
+if __name__ == '__main__': main()

pwnlib/commandline/elfpatch.py

@@ -1,8 +1,9 @@
 #!/usr/bin/env python2
+import argparse
+import sys
+
+from pwn import *
 
-import argparse, sys
-from pwnlib.elf import ELF
-from pwnlib.util.fiddling import unhex
 p = argparse.ArgumentParser()
 p.add_argument('elf',help="File to patch")
 p.add_argument('offset',help="Offset to patch in virtual address (hex encoded)")
@@ -17,7 +18,9 @@ def main():
 
     offset = int(a.offset, 16)
     bytes  = unhex(a.bytes)
-    elf    = ELF(a.elf)
+
+    with context.silent:
+        elf    = ELF(a.elf)
 
     elf.write(offset, bytes)
     sys.stdout.write(elf.get_data())

pwnlib/commandline/errno.py

@@ -0,0 +1,43 @@
+import argparse
+import os
+
+parser = argparse.ArgumentParser(
+    description = 'Prints out error messages'
+)
+
+parser.add_argument(
+    'error', help='Error message or value', type=str
+)
+
+def main():
+  args, unknown = parser.parse_known_args()
+
+  try:
+    value = int(args.error, 0)
+
+    if value < 0:
+      value = -value
+
+    if 0x100000000 - value < 0x200:
+      value = 0x100000000 - value
+
+    if value not in os.errno.errorcode:
+      print "No errno for %s" % value
+      return
+
+    name = os.errno.errorcode[value]
+
+  except ValueError:
+    name = args.error.upper()
+
+    if not hasattr(os.errno, name):
+      print "No errno for %s" % name
+      return
+
+    value = getattr(os.errno, name)
+
+
+  print '#define', name, value
+  print os.strerror(value)
+
+if __name__ == '__main__': main()

pwnlib/commandline/hex.py

@@ -1,5 +1,6 @@
 #!/usr/bin/env python2
-import sys, argparse
+import argparse
+import sys
 
 parser = argparse.ArgumentParser(description='''
 Hex-encodes data provided on the command line or via stdin.
@@ -14,4 +15,4 @@ def main():
     else:
         print ' '.join(args.data).encode('hex')
 
-if __name__ == '__main__': main()
+if __name__ == '__main__': main()

pwnlib/commandline/phd.py

@@ -1,8 +1,9 @@
 #!/usr/bin/env python2
+import argparse
+import os
+import sys
 
-import argparse, sys, os
-import pwnlib.term.text as text
-from pwnlib.util.fiddling import hexdump_iter
+from pwn import *
 
 parser = argparse.ArgumentParser(
     description = 'Pwnlib HexDump'
@@ -82,8 +83,6 @@ def main():
         else:
             infile.seek(skip, os.SEEK_CUR)
 
-    data = infile.read(count)
-
     hl = []
     if args.highlight:
         for hs in args.highlight:
@@ -91,9 +90,9 @@ def main():
                 hl.append(asint(h))
 
     try:
-        for line in hexdump_iter(data, width, highlight = hl, begin = offset + skip):
+        for line in hexdump_iter(infile, width, highlight = hl, begin = offset + skip):
             print line
     except (KeyboardInterrupt, IOError):
         pass
 
-if __name__ == '__main__': main()
+if __name__ == '__main__': main()

pwnlib/commandline/pwnstrip.py

@@ -0,0 +1,53 @@
+import argparse
+
+from pwn import *
+
+from . import common
+
+p = argparse.ArgumentParser(
+    description = 'Strip binaries for CTF usage',
+    formatter_class = argparse.RawDescriptionHelpFormatter,
+)
+
+g = p.add_argument_group("actions")
+g.add_argument('-b', '--build-id', help="Strip build ID", action='store_true')
+g.add_argument('-p', '--patch', metavar='FUNCTION', help="Patch function", action='append')
+p.add_argument('-o', '--output', type=file, default=sys.stdout)
+p.add_argument('file', type=file)
+
+def main():
+    args = p.parse_args()
+
+    if not (args.patch or args.build_id):
+        sys.stderr.write("Must specify at least one action\n")
+        sys.stderr.write(p.format_usage())
+        sys.exit(0)
+
+    elf = ELF(args.file.name)
+    context.clear(arch=elf.arch)
+
+    if args.build_id:
+        for offset in pwnlib.libcdb.get_build_id_offsets():
+            data = elf.read(elf.address + offset + 0xC, 4)
+            if data == 'GNU\x00':
+                elf.write(elf.address + offset + 0x10, read('/dev/urandom', 20))
+
+    for function in args.patch:
+        if function not in elf.symbols:
+            log.error("Could not find function %r" % function)
+
+        trap = asm(shellcraft.trap())
+        offset = elf.symbols[function]
+
+        elf.write(elf.address + offset, trap)
+
+    result = elf.data
+
+    if args.output.isatty():
+        result = enhex(result)
+
+    args.output.write(result)
+
+
+if __name__ == '__main__':
+    main()

pwnlib/commandline/scramble.py

@@ -0,0 +1,103 @@
+import argparse
+import sys
+
+from pwn import *
+
+from . import common
+
+parser = argparse.ArgumentParser(
+    description = 'Shellcode encoder'
+)
+
+
+parser.add_argument(
+    "-f", "--format",
+    help="Output format (defaults to hex for ttys, otherwise raw)",
+    choices=['raw', 'hex', 'string', 'elf']
+)
+
+parser.add_argument(
+    "-o","--output",
+    metavar='file',
+    help="Output file (defaults to stdout)",
+    type=argparse.FileType('w'),
+    default=sys.stdout
+)
+
+parser.add_argument(
+    '-c', '--context',
+    metavar = 'context',
+    action = 'append',
+    type   = common.context_arg,
+    choices = common.choices,
+    help = 'The os/architecture/endianness/bits the shellcode will run in (default: linux/i386), choose from: %s' % common.choices,
+)
+
+parser.add_argument(
+    '-p', '--alphanumeric',
+    action='store_true',
+    help = 'Encode the shellcode with an alphanumeric encoder'
+)
+
+parser.add_argument(
+    '-v', '--avoid',
+    action='append',
+    help = 'Encode the shellcode to avoid the listed bytes'
+)
+
+parser.add_argument(
+    '-n', '--newline',
+    dest='avoid',
+    action='append_const',
+    const='\n',
+    help = 'Encode the shellcode to avoid newlines'
+)
+
+parser.add_argument(
+    '-z', '--zero',
+    dest='avoid',
+    action='append_const',
+    const='\x00',
+    help = 'Encode the shellcode to avoid NULL bytes'
+)
+
+parser.add_argument(
+    '-d',
+    '--debug',
+    help='Debug the shellcode with GDB',
+    action='store_true'
+)
+
+def main():
+    args   = parser.parse_args()
+    tty    = args.output.isatty()
+
+    if sys.stdin.isatty():
+        parser.print_usage()
+        sys.exit(0)
+
+    data   = sys.stdin.read()
+    output = data
+    fmt    = args.format or ('hex' if tty else 'raw')
+    formatters = {'r':str, 'h':enhex, 's':repr}
+
+    if args.alphanumeric:
+        output = alphanumeric(output)
+
+    if args.avoid:
+        output = avoid(output, ''.join(args.avoid))
+
+    if args.debug:
+        proc = gdb.debug_shellcode(output, arch=context.arch)
+        proc.interactive()
+        sys.exit(0)
+
+    if fmt[0] == 'e':
+        sys.stdout.write(make_elf(output))
+    else:
+        args.output.write(formatters[fmt[0]](output))
+
+    if tty and fmt is not 'raw':
+        args.output.write('\n')
+
+if __name__ == '__main__': main()

pwnlib/commandline/shellcraft.py

@@ -1,9 +1,12 @@
 #!/usr/bin/env python2
-import argparse, sys, os, types
-import pwnlib
-from pwnlib import log, util
-import pwnlib.term.text as text
-from pwnlib.context import context
+import argparse
+import os
+import sys
+import types
+
+from pwn import *
+
+from . import common
 
 r = text.red
 g = text.green
@@ -34,15 +37,6 @@ def _string(s):
             out.append('\\x%02x' % co)
     return '"' + ''.join(out) + '"\n'
 
-def _carray(s):
-    out = []
-    for c in s:
-        out.append('0x' + util.fiddling.enhex(c))
-    return '{' + ', '.join(out) + '};\n'
-
-def _hex(s):
-    return pwnlib.util.fiddling.enhex(s) + '\n'
-
 p = argparse.ArgumentParser(
     description = 'Microwave shellcode -- Easy, fast and delicious',
     formatter_class = argparse.RawDescriptionHelpFormatter,
@@ -57,7 +51,7 @@ p.add_argument(
 
 p.add_argument(
     '-o', '--out',
-    metavar = '<file>',
+    metavar = 'file',
     type = argparse.FileType('w'),
     default = sys.stdout,
     help = 'Output file (default: stdout)',
@@ -65,7 +59,7 @@ p.add_argument(
 
 p.add_argument(
     '-f', '--format',
-    metavar = '<format>',
+    metavar = 'format',
     choices = ['r', 'raw',
                's', 'str', 'string',
                'c',
@@ -73,104 +67,188 @@ p.add_argument(
                'a', 'asm', 'assembly',
                'p',
                'i', 'hexii',
+               'e', 'elf',
                'default'],
     default = 'default',
     help = 'Output format (default: hex), choose from {r}aw, {s}tring, {c}-style array, {h}ex string, hex{i}i, {a}ssembly code, {p}reprocssed code',
 )
 
-
-class NoDefaultContextValues(object):
-    def __enter__(self):
-        self.old = context.defaults.copy()
-        context.defaults['os'] = None
-        context.defaults['arch'] = None
-    def __exit__(self, *a):
-        context.defaults.update(self.old)
-
-
-
-def get_tree(path, val, result):
-    with NoDefaultContextValues():
-        if path:
-            path += '.'
-
-        if path.startswith('common.'):
-            return
-
-        mods = []
-
-        for k in sorted(dir(val)):
-            if k and k[0] != '_':
-                cur = getattr(val, k)
-                if isinstance(cur, types.ModuleType):
-                    mods.append((path + k, cur))
-                else:
-                    result.append((path + k, cur))
-
-        for path, val in mods:
-            get_tree(path, val, result)
-        return result
-
-# Enumearte all of the shellcode names
-all_shellcodes = get_tree('', pwnlib.shellcraft, [])
-names = '\n'.join('    ' + sc[0] for sc in all_shellcodes)
-
 p.add_argument(
     'shellcode',
     nargs = '?',
-    default = '',
-    metavar = '<shellcode>',
+    choices = shellcraft.templates,
+    metavar = 'shellcode',
     help = 'The shellcode you want',
 )
 
-p.epilog = 'Available shellcodes are:\n' + names
-
+p.epilog = 'Available shellcodes are:\n' + '\n'.join(shellcraft.templates)
 
 p.add_argument(
     'args',
     nargs = '*',
-    metavar = '<arg>',
+    metavar = 'arg',
     default = (),
     help = 'Argument to the chosen shellcode',
 )
 
+p.add_argument(
+    '-d',
+    '--debug',
+    help='Debug the shellcode with GDB',
+    action='store_true'
+)
+
+p.add_argument(
+    '-b',
+    '--before',
+    help='Insert a debug trap before the code',
+    action='store_true'
+)
+
+p.add_argument(
+    '-a',
+    '--after',
+    help='Insert a debug trap after the code',
+    action='store_true'
+)
+
+p.add_argument(
+    '-v', '--avoid',
+    action='append',
+    help = 'Encode the shellcode to avoid the listed bytes'
+)
+
+p.add_argument(
+    '-n', '--newline',
+    dest='avoid',
+    action='append_const',
+    const='\n',
+    help = 'Encode the shellcode to avoid newlines'
+)
+
+p.add_argument(
+    '-z', '--zero',
+    dest='avoid',
+    action='append_const',
+    const='\x00',
+    help = 'Encode the shellcode to avoid NULL bytes'
+)
+
+p.add_argument(
+    '-r',
+    '--run',
+    help="Run output",
+    action='store_true'
+)
+
+p.add_argument(
+    '--color',
+    help="Color output",
+    action='store_true',
+    default=sys.stdout.isatty()
+)
+
+p.add_argument(
+    '--no-color',
+    help="Disable color output",
+    action='store_false',
+    dest='color'
+)
+
+p.add_argument(
+    '--syscalls',
+    help="List syscalls",
+    action='store_true'
+)
+
+p.add_argument(
+    '--address',
+    help="Load address",
+    default=None
+)
+
+def get_template(name):
+    func = shellcraft
+    for attr in name.split('.'):
+        func = getattr(func, attr)
+    return func
+
+def is_not_a_syscall_template(name):
+    template_src = shellcraft._get_source(name)
+    return 'man 2' not in read(template_src)
+
 def main():
     # Banner must be added here so that it doesn't appear in the autodoc
     # generation for command line tools
     p.description = banner + p.description
     args = p.parse_args()
 
-    if args.format == 'default':
-        if sys.stdout.isatty():
-            args.format = 'hex'
-        else:
-            args.format = 'raw'
+    if not args.shellcode:
+        templates = shellcraft.templates
 
+        if not args.syscalls:
+            templates = filter(is_not_a_syscall_template, templates)
 
-    vals = get_tree('', pwnlib.shellcraft, [])
-    if args.shellcode:
-        vals = [(k, val) for k, val in vals if k.startswith(args.shellcode + '.') or k == args.shellcode]
-
-    if len(vals) == 0:
-        log.fatal("Cannot find subtree by the name of %r" % args.shellcode)
-    elif len(vals) > 1:
-        for k, _ in vals:
-            print k
+        print '\n'.join(templates)
         exit()
-    else:
-        func = vals[0][1]
+
+    func = get_template(args.shellcode)
 
     if args.show:
-        print func.__doc__
+        # remove doctests
+        doc = []
+        in_doctest = False
+        block_indent = None
+        caption = None
+        lines = func.__doc__.splitlines()
+        i = 0
+        while i < len(lines):
+            line = lines[i]
+            if line.lstrip().startswith('>>>'):
+                # this line starts a doctest
+                in_doctest = True
+                block_indent = None
+                if caption:
+                    # delete back up to the caption
+                    doc = doc[:caption - i]
+                    caption = None
+            elif line == '':
+                # skip blank lines
+                pass
+            elif in_doctest:
+                # indentation marks the end of a doctest
+                indent = len(line) - len(line.lstrip())
+                if block_indent is None:
+                    if not line.lstrip().startswith('...'):
+                        block_indent = indent
+                elif indent < block_indent:
+                    in_doctest = False
+                    block_indent = None
+                    # re-evalutate this line
+                    continue
+            elif line.endswith(':'):
+                # save index of caption
+                caption = i
+            else:
+                # this is not blank space and we're not in a doctest, so the
+                # previous caption (if any) was not for a doctest
+                caption = None
+
+            if not in_doctest:
+                doc.append(line)
+            i += 1
+        print '\n'.join(doc).rstrip()
         exit()
 
     defargs = len(func.func_defaults or ())
     reqargs = func.func_code.co_argcount - defargs
     if len(args.args) < reqargs:
         if defargs > 0:
-            log.fatal('%s takes at least %d arguments' % (args.shellcode, reqargs))
+            log.critical('%s takes at least %d arguments' % (args.shellcode, reqargs))
+            sys.exit(1)
         else:
-            log.fatal('%s takes exactly %d arguments' % (args.shellcode, reqargs))
+            log.critical('%s takes exactly %d arguments' % (args.shellcode, reqargs))
+            sys.exit(1)
 
     # Captain uglyness saves the day!
     for i, val in enumerate(args.args):
@@ -180,36 +258,85 @@ def main():
             pass
 
     # And he strikes again!
-    os = arch = None
-    for k in args.shellcode.split('.')[:-1]:
-        if k in context.architectures:
-            arch = k
-        elif k in context.oses:
-            os = k
-
+    map(common.context_arg, args.shellcode.split('.'))
     code = func(*args.args)
 
+
+    if args.before:
+        code = shellcraft.trap() + code
+    if args.after:
+        code = code + shellcraft.trap()
+
+
     if args.format in ['a', 'asm', 'assembly']:
+        if args.color:
+            from pygments import highlight
+            from pygments.formatters import TerminalFormatter
+            from pwnlib.lexer import PwntoolsLexer
+
+            code = highlight(code, PwntoolsLexer(), TerminalFormatter())
+
         print code
         exit()
     if args.format == 'p':
-        print pwnlib.asm.cpp(code, arch = arch, os = os)
+        print cpp(code)
         exit()
 
-    code = pwnlib.asm.asm(code, arch = arch, os = os)
+    assembly = code
+
+    vma = args.address
+    if vma:
+        vma = eval(vma)
+
+    if args.format in ['e','elf']:
+        args.format = 'default'
+        try: os.fchmod(args.out.fileno(), 0700)
+        except OSError: pass
+
+
+        if not args.avoid:
+            code = read(make_elf_from_assembly(assembly, vma=vma))
+        else:
+            code = asm(assembly)
+            code = encode(code, args.avoid)
+            code = make_elf(code, vma=vma)
+            # code = read(make_elf(encode(asm(code), args.avoid)))
+    else:
+        code = encode(asm(assembly), args.avoid)
+
+    if args.format == 'default':
+        if args.out.isatty():
+            args.format = 'hex'
+        else:
+            args.format = 'raw'
+
+    arch = args.shellcode.split('.')[0]
+
+    if args.debug:
+        if not args.avoid:
+            proc = gdb.debug_assembly(assembly, arch=arch, vma=vma)
+        else:
+            proc = gdb.debug_shellcode(code, arch=arch, vma=vma)
+        proc.interactive()
+        sys.exit(0)
+
+    if args.run:
+        proc = run_shellcode(code, arch=arch)
+        proc.interactive()
+        sys.exit(0)
 
     if args.format in ['s', 'str', 'string']:
-        code = _string(code)
+        code = _string(code) + '"\n'
     elif args.format == 'c':
-        code = _carray(code)
+        code = '{' + ', '.join(map(hex, bytearray(code))) + '}' + '\n'
     elif args.format in ['h', 'hex']:
-        code = _hex(code)
+        code = pwnlib.util.fiddling.enhex(code) + '\n'
     elif args.format in ['i', 'hexii']:
-        code = pwnlib.util.fiddling.hexii(code) + '\n'
+        code = hexii(code) + '\n'
 
     if not sys.stdin.isatty():
-        sys.stdout.write(sys.stdin.read())
+        args.out.write(sys.stdin.read())
 
-    sys.stdout.write(code)
+    args.out.write(code)
 
 if __name__ == '__main__': main()

pwnlib/commandline/unhex.py

@@ -1,5 +1,6 @@
 #!/usr/bin/env python2
-import sys, argparse
+import argparse
+import sys
 from string import whitespace
 
 parser = argparse.ArgumentParser(description='''
@@ -19,4 +20,4 @@ def main():
     except TypeError, e:
         sys.stderr.write(str(e) + '\n')
 
-if __name__ == '__main__': main()
+if __name__ == '__main__': main()

pwnlib/constants/__init__.py

@@ -3,13 +3,21 @@
 The purpose of this module is to provide quick access to constants from
 different architectures and operating systems.
 
+The constants are wrapped by a convenience class that allows accessing
+the name of the constant, while performing all normal mathematical
+operations on it.
+
 Example:
 
-    >>> print constants.freebsd.SYS_stat
+    >>> str(constants.freebsd.SYS_stat)
+    'SYS_stat'
+    >>> int(constants.freebsd.SYS_stat)
     188
-    >>> print constants.linux.i386.SYS_stat
+    >>> hex(constants.freebsd.SYS_stat)
+    '0xbc'
+    >>> 0 | constants.linux.i386.SYS_stat
     106
-    >>> print constants.linux.amd64.SYS_stat
+    >>> 0 + constants.linux.amd64.SYS_stat
     4
 
 The submodule ``freebsd`` contains all constants for FreeBSD, while the
@@ -22,54 +30,122 @@ what happens in :mod:`pwnlib.shellcraft`.
 Example:
 
     >>> with context.local(os = 'freebsd'):
-    ...     print constants.SYS_stat
+    ...     print int(constants.SYS_stat)
     188
     >>> with context.local(os = 'linux', arch = 'i386'):
-    ...     print constants.SYS_stat
+    ...     print int(constants.SYS_stat)
     106
     >>> with context.local(os = 'linux', arch = 'amd64'):
-    ...     print constants.SYS_stat
+    ...     print int(constants.SYS_stat)
     4
 
 """
+import importlib
+import sys
 from types import ModuleType
-import importlib, sys
+
 from ..context import context
+from ..util import safeeval
+from .constant import Constant
 
-class module(ModuleType):
-    def __init__(self, submodules):
-        super(module, self).__init__(__name__)
 
-        # Insert nice properties
-        self.__dict__.update({
-            '__doc__':     __doc__,
-            '__file__':    __file__,
-            '__package__': __package__,
-            '__path__':    __path__,
-            '__all__':     submodules,
-        })
+class ConstantsModule(ModuleType):
+    """
+    ModuleType specialization in order to automatically
+    route queries down to the correct module based on the
+    current context arch / os.
+
+        >>> with context.local(arch = 'i386', os = 'linux'):
+        ...    print constants.SYS_execve + constants.PROT_WRITE
+        13
+        >>> with context.local(arch = 'amd64', os = 'linux'):
+        ...    print constants.SYS_execve + constants.PROT_WRITE
+        61
+        >>> with context.local(arch = 'amd64', os = 'linux'):
+        ...    print constants.SYS_execve + constants.PROT_WRITE
+        61
+        >>> False
+        True
+
+    """
+    Constant = Constant
+
+    possible_submodules = set(context.oses) | set(context.architectures)
+
+    def __init__(self, name, module):
+        super(ConstantsModule, self).__init__(name)
+        self.__dict__.update(module.__dict__)
+        self._env_store = {}
+
+    def guess(self):
+        if context.os in self.__name__ and context.arch in self.__name__:
+            return self
+
+        mod = self
+        mod = getattr(mod, context.os, mod)
+        mod = getattr(mod, context.arch, mod)
+        return mod
+
+    def __dir__(self):
+        return self.__all__
 
     def __getattr__(self, key):
-        if key in self.__all__:
-            mod = importlib.import_module('.' + key, __package__)
-            setattr(self, key, mod)
-            return mod
+        # Special case for __all__, we want to return the contextually
+        # relevant module.
+        if key == '__all__':
+            return self.guess().__dict__.keys()
 
-        if context.os in self.__all__:
-            return getattr(getattr(self, context.os), key)
+        # Special case for all other special properties which aren't defined
+        if key.endswith('__'):
+            raise AttributeError
+
+        # This code is only hit if the attribute doesn't already exist.
+        # Attempt to import a module by the specified name.
+        if key in self.possible_submodules:
+            try:
+                mod = importlib.import_module('.' + key, self.__name__)
+                mod = ConstantsModule(mod.__name__, mod)
+                setattr(self, key, mod)
+                sys.modules[mod.__name__] = mod
+                return mod
+            except ImportError:
+                pass
+        else:
+            mod = self.guess()
+            if hasattr(mod, key):
+                return getattr(mod, key)
 
         raise AttributeError("'module' object has no attribute '%s'" % key)
 
-    def __dir__(self):
-        result = list(self.__all__)
-        if context.os in self.__all__:
-            result.extend(dir(getattr(self, context.os)))
+    def eval(self, string):
+        """eval(string) -> value
 
+        Evaluates a string in the context of values of this module.
+
+        Example:
+
+            >>> with context.local(arch = 'i386', os = 'linux'):
+            ...    print 13 == constants.eval('SYS_execve + PROT_WRITE')
+            True
+            >>> with context.local(arch = 'amd64', os = 'linux'):
+            ...    print 61 == constants.eval('SYS_execve + PROT_WRITE')
+            True
+            >>> with context.local(arch = 'amd64', os = 'linux'):
+            ...    print 61 == constants.eval('SYS_execve + PROT_WRITE')
+            True
+        """
+        if not isinstance(string, str):
+            return string
+
+        key = context.os, context.arch
+        if key not in self._env_store:
+            self._env_store[key] = {key: getattr(self, key) for key in dir(self) if not key.endswith('__')}
+
+        return Constant('(%s)' % string, safeeval.values(string, self._env_store[key]))
 
-        return result
 
 # To prevent garbage collection
 tether = sys.modules[__name__]
 
 # Create the module structure
-sys.modules[__name__] = module(['linux', 'freebsd'])
+sys.modules[__name__] = ConstantsModule(__name__, tether)

pwnlib/constants/android

@@ -0,0 +1 @@
+linux

pwnlib/constants/cgc/aarch64.py

@@ -0,0 +1 @@
+thumb.py

pwnlib/constants/cgc/alpha.py

@@ -0,0 +1 @@
+thumb.py

pwnlib/constants/cgc/amd64.py

@@ -0,0 +1 @@
+thumb.py

pwnlib/constants/cgc/arm.py

@@ -0,0 +1 @@
+thumb.py

pwnlib/constants/cgc/i386.py

@@ -0,0 +1 @@
+thumb.py

pwnlib/constants/cgc/ia64.py

@@ -0,0 +1 @@
+thumb.py

pwnlib/constants/cgc/mips.py

@@ -0,0 +1 @@
+thumb.py

pwnlib/constants/cgc/powerpc.py

@@ -0,0 +1 @@
+thumb.py

pwnlib/constants/cgc/powerpc64.py

@@ -0,0 +1 @@
+thumb.py