Release 4.0.1

Fix gadget caching for ROP objects with multiple ELFs (#1115 )
* Fix test breakage caused by Sphinx deprecation Closes #1112 * Fix gadget caching for ROP objects with multiple ELFs Fixes Gallopsled/pwntools#1114 * Update requirements, fix travis failing Co-authored-by: Arusekk <[email protected]>
2026-11-08 01:58:16 -10:00 · 2020-01-22 21:57:27 +01:00 · 2020-01-22 21:49:10 +01:00 · 2020-01-18 20:46:22 +01:00 · 2020-01-09 18:54:49 +01:00 · 2019-12-13 23:25:36 +01:00
3773 changed files with 57773 additions and 28816 deletions
@@ -4,6 +4,11 @@ Thanks for contributing to Pwntools!

 When reporting an issue, be sure that you are running the latest released version of pwntools (`pip install --upgrade pwntools`).

-Please verify that your issue occurs on 64-bit Ubuntu 14.04.  You can use the Dockerfile in `extra/docker/Dockerfile` to save time.
+Please verify that your issue occurs on 64-bit Ubuntu 14.04.  You can use the Dockerfile on `docker.io` for quick testing.
+
+```
+$ docker pull pwntools/pwntools:stable
+$ docker run -it pwntools/pwntools:stable
+```

 If possible, provide a proof-of-concept which demonstrates the problem.  Include any binaries or scripts necessary to reproduce the issue, and please include the full debug output via setting the environment variable `PWNLIB_DEBUG=1`.
@@ -11,6 +11,8 @@ docs/build
 build
 MANIFEST
 dist
+venv
+.vscode
 *.egg-info
 *.core
 .coverage
@@ -1,10 +1,9 @@
-sudo: false
+dist: xenial
 language: python
 addons:
  apt:
    packages:
    - gcc-multilib
-    - gcc-4.6-arm-linux-gnueabihf
    - lib32stdc++6
    - ash
    - bash
@@ -13,25 +12,39 @@ addons:
    - mksh
    - zsh
    - pandoc
+    - gdb
+    - binutils
+    - qemu-user-static
+    - binutils-multiarch
+    - binutils-aarch64-linux-gnu
+    - binutils-arm-linux-gnueabihf
+    - binutils-mips-linux-gnu
+    - binutils-powerpc-linux-gnu
 cache:
    - pip
    - directories:
        - usr
-        - /home/travis/virtualenv/python2.7.9/lib/python2.7/site-packages/
-        - /home/travis/virtualenv/python2.7.9/bin/
+        - /home/travis/virtualenv/python2.7.15/lib/python2.7/site-packages/
+        - /home/travis/virtualenv/python2.7.15/bin/
 python:
-  - "2.7"
+  - "2.7.15"
+  - "3.6"
 before_install:
+  - echo $-
  - source travis/install.sh
  - source travis/ssh_setup.sh
+  - echo $-
 install:
+  - pip install --upgrade pip
+  - pip install --upgrade appdirs # https://github.com/ActiveState/appdirs/issues/89#issuecomment-282326570
+  - python setup.py egg_info      # pypa/pip#6275
  - pip install --upgrade --editable .
-  - pip install --requirement docs/requirements.txt
+  - pip install --upgrade --requirement docs/requirements.txt
 before_script:
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
 script:
  - PWNLIB_NOTERM=1 coverage run -m sphinx -b doctest docs/source docs/build/doctest
 after_success:
@@ -9,9 +9,30 @@ The table below shows which release corresponds to each branch, and what date th

 | Version          | Branch   | Release Date           |
 | ---------------- | -------- | ---------------------- |
-| [3.5.0](#350)    | `dev`    | Mar 18, 2017 (planned)
-| [3.4.0](#340)    | `beta`   | Feb 4, 2017 (planned)
-| [3.3.2](#332)    | `stable` | Jan 10, 2016
+| [4.2.0](#420)    | `dev`    | Feb 10, 2020 (planned)
+| [4.1.0](#410)    | `beta`   | Jan 30, 2020 (planned)
+| [4.0.1](#401)    | `stable` | Jan 22, 2020
+| [4.0.0](#400)    |          | Jan 09, 2020
+| [3.13.0](#3130)  |          | Nov 5, 2019
+| [3.12.1](#3121)  |          | Sept 17, 2018
+| [3.12.0](#3120)  |          | Feb 22, 2018
+| [3.11.0](#3110)  |          | Jan 3, 2018
+| [3.10.0](#3100)  |          | Oct 25, 2017
+| [3.9.2](#392)    |          | Oct 5, 2017
+| [3.9.1](#391)    |          | Sep 28, 2017
+| [3.9.0](#390)    |          | Sep 11, 2017
+| [3.8.0](#380)    |          | Jul 29, 2017
+| [3.7.1](#371)    |          | Jul 14, 2017
+| [3.7.0](#370)    |          | Jun 19, 2017
+| [3.6.1](#361)    |          | May 12, 2017
+| [3.6.0](#360)    |          | May 8, 2017
+| [3.5.1](#351)    |          | Apr 15, 2017
+| [3.5.0](#350)    |          | Mar 26, 2017
+| [3.4.1](#341)    |          | Feb 17, 2017
+| [3.4.0](#340)    |          | Feb 13, 2017
+| [3.3.4](#334)    |          | Jan 12, 2016
+| [3.3.3](#333)    |          | Jan 10, 2016
+| [3.3.2](#332)    |          | Jan 10, 2016
 | [3.3.1](#331)    |          | Jan 10, 2016
 | [3.3.0](#330)    |          | Dec 24, 2016
 | [3.2.1](#321)    |          | Dec 24, 2016
@@ -25,19 +46,391 @@ The table below shows which release corresponds to each branch, and what date th
 | [3.0.0](#300)    |          | Aug 20, 2016
 | [2.2.0](#220)    |          | Jan 5, 2015

+## 4.2.0 (`dev`)
+
+To be released on Feb 10, 2020.
+
+## 4.1.0 (`beta`)
+
+To be released on Jan 30, 2020.
+
+- [#1316][1316] Fix connect shellcraft in python 3
+- [#1323][1323] Fix issues related with debugging
+- [#1001][1001] Enhance `unlock_bootloader` with better status messages
+- [#1389][1389] remove old dependencies
+- [#1241][1241] Launch QEMU with sysroot if specified
+- [#1218][1218] Support for FileStructure exploitation
+
+[1241]: https://github.com/Gallopsled/pwntools/pulls/1218
+[1218]: https://github.com/Gallopsled/pwntools/pulls/1218
+
+## 4.0.1 (`stable`)
+
+- [#1412][1412] `recvline_pred()` and similar do not reorder data
+- Bypass unicorn-engine/unicorn#1100 and unicorn-engine/unicorn#1170 requiring unstable package
+
+[1412]: https://github.com/Gallopsled/pwntools/pulls/1412
+
+## 4.0.0
+
+- **Python 3 support! <3**
+- [#1402][1402] Fix serialtube in python 3
+- [#1391][1391] Fix process.libs
+- [#1317][1317] Tubes with `context.encoding`
+- [#1216][1216] Improve format string generator
+- [#1285][1285] Add freebsd generic syscall templates
+- [76413f][76413f] Add pwnlib.adb.bootimg for 'ANDROID!' format boot.img images
+- [#1202][1202] Docker: Kill 14 layers in pwntools base images
+- [#1182][1182] shellcraft.dupio() for mips
+
+[1391]: https://github.com/Gallopsled/pwntools/pulls/1391
+[1317]: https://github.com/Gallopsled/pwntools/pulls/1317
+[1285]: https://github.com/Gallopsled/pwntools/pulls/1285
+[1216]: https://github.com/Gallopsled/pwntools/pulls/1216
+[1202]: https://github.com/Gallopsled/pwntools/pulls/1202
+[1182]: https://github.com/Gallopsled/pwntools/pulls/1182
+[76413f]: https://github.com/Gallopsled/pwntools/commit/76413f
+
+## 3.13.0
+
+- [#1204][1204] Reduce ROP cache filename length
+- [#1175][1175] Fix nested SSH connectors
+- [#1355][1355] Fix 'break' syscall
+- [#1277][1277] Fix timeout parameter passing in sendlineafter and other similar functions
+- [#1292][1292] Provide correct arch name to gdb for sparc64
+
+[1175]: https://github.com/Gallopsled/pwntools/pulls/1175
+[1204]: https://github.com/Gallopsled/pwntools/pulls/1355
+[1277]: https://github.com/Gallopsled/pwntools/pulls/1277
+[1292]: https://github.com/Gallopsled/pwntools/pulls/1292
+[1355]: https://github.com/Gallopsled/pwntools/pulls/1355
+
+## 3.12.1
+
+- [#1104][1104] Add `DynELF.dump()` for dumping remote ELF files
+- [#1101][1101] Set `context.os` via `context.binary`, useful for Android exploitation
+- [5fdc08][5fdc08] Work around broken `pidof` on Android
+- [63dfed][63dfed] Print warning when Corefile deletion fails instead of throwing an exception
+- [#1094][1094] Make hexdump output alignment more consistent
+- [#1096][1096] `flat()` and `fit()` are now the same function
+
+[1104]: https://github.com/Gallopsled/pwntools/pull/1104
+[1101]: https://github.com/Gallopsled/pwntools/pull/1101
+[1094]: https://github.com/Gallopsled/pwntools/pull/1094
+[1096]: https://github.com/Gallopsled/pwntools/pull/1096
+[5fdc08]: https://github.com/Gallopsled/pwntools/commit/5fdc08
+[63dfed]: https://github.com/Gallopsled/pwntools/commit/63dfed
+
+## 3.12.2
+
+- [1242][1242] Use IntervalTree 2.xx, disallow use of 3.xx
+- [1243][1243] Fix a typo that caused an exception when executing a binary with `process()` which returns `-ENOEXEC` and the system does not have `qemu-user` binaries installed.
+
+[1242]: https://github.com/Gallopsled/pwntools/pull/1242
+[1243]: https://github.com/Gallopsled/pwntools/pull/1243
+
+## 3.12.1
+
+- [#1198][1198] More compatibility fixes for pyelftools==0.25, and pin Sphinx<1.8.0 since it causes testing errors
+- [#1191][1191] Fix compatibility with pyelftools==0.25
+- [#1159][1159] Fix check for `/proc/.../status`
+- [#1162][1162] Fix broken package versions
+- [#1150][1150] Fix exception raised when a cache file is missing
+- [#1156][1156] Fix ROP gadget selection logic involving `int` and `syscall` instructions
+- [#1152][1152] Fix QEMU LD_PREFIX calculation (wrong parameter passed)
+- [#1155][1155] Use Ubuntu Trusty for all CI builds
+- [#1131][1131] Add "libc-" to libc prefixes in `process` tubes
+- [#1125][1125] Fix a typo
+- [#1121][1121] Fix tests which were broken by an upstream Sphinx change
+
+[1159]: https://github.com/Gallopsled/pwntools/pull/1159
+[1162]: https://github.com/Gallopsled/pwntools/pull/1162
+[1150]: https://github.com/Gallopsled/pwntools/pull/1150
+[1156]: https://github.com/Gallopsled/pwntools/pull/1156
+[1152]: https://github.com/Gallopsled/pwntools/pull/1152
+[1155]: https://github.com/Gallopsled/pwntools/pull/1155
+[1131]: https://github.com/Gallopsled/pwntools/pull/1131
+[1125]: https://github.com/Gallopsled/pwntools/pull/1125
+[1121]: https://github.com/Gallopsled/pwntools/pull/1121
+
+## 3.12.0
+
+- [#1083][1083] Better error messages for `gdb` when `LD_PRELOAD` is incorrect
+- [#1085][1085] Add support for extracting Android `BOOTLDR!` images
+- [#1075][1075] Add support for detecting GNU Screen for `run_in_new_terminal`
+- [#1074][1074] Add support for running `pwntools-gdb` wrapper script instead of `gdb`
+- [#1068][1068] Work around very old OpenSSL versions which don't have sha256 support *AND* don't exit with an error code when trying to use it
+- [#1067][1067] Add `pwnlib.tubes.server` module, which adds a reusable `server` listener
+- [#1063][1063] Add support for labels in `fit()`, allowing dynamic contents to be injected.  (This feature is really cool, check out the pull request!)
+
+[1083]: https://github.com/Gallopsled/pwntools/pull/1083
+[1085]: https://github.com/Gallopsled/pwntools/pull/1085
+[1075]: https://github.com/Gallopsled/pwntools/pull/1075
+[1074]: https://github.com/Gallopsled/pwntools/pull/1074
+[1068]: https://github.com/Gallopsled/pwntools/pull/1068
+[1067]: https://github.com/Gallopsled/pwntools/pull/1067
+[1063]: https://github.com/Gallopsled/pwntools/pull/1063
+
+## 3.11.0
+
+- [#1044][1044] Enhancements to ROP
+    + Much better support for 64-bit Intel (amd64) ROP
+    + ROP gadget selection is optimized to favor multi-pops instead of multiple single-pop gadgets
+    + Added support for blacklisting byte values in ROP gadget addresses
+- [#1049][1049] Enhancements to `cyclic`
+    + `context` now has two additional attributes, `cyclic_alphabet` and `cyclic_length`, which correspond to the arguments `alphabet` and `n` to `cyclic()` and `cyclic_find()` and related routines.
+    + The motivation for this change is to allow setting the `alphabet` globally, so that any padding / patterns generated internally to pwntools can be controlled.  The specific motivation is blacklisting values in ROP padding.
+- [#1052][1052] Enhancements for detecting `QEMU_LD_PREFIX` used by QEMU user-mode emulation for sysroots
+- [#1035][1035] Minor documentation changes
+- [#1032][1032] Enhancements to `pwn template`
+- [#1031][1031] More accurate `Coredump.fault_addr` on amd64
+- [#1084][1084] Fix broken tests due to `ftp.debian.org` going down
+
+[1044]: https://github.com/Gallopsled/pwntools/pull/1044
+[1049]: https://github.com/Gallopsled/pwntools/pull/1049
+[1052]: https://github.com/Gallopsled/pwntools/pull/1052
+[1035]: https://github.com/Gallopsled/pwntools/pull/1035
+[1032]: https://github.com/Gallopsled/pwntools/pull/1032
+[1031]: https://github.com/Gallopsled/pwntools/pull/1031
+[1084]: https://github.com/Gallopsled/pwntools/pull/1084
+
+## 3.10.0
+
+- [#1007][1007] Add support for setting a `gdbinit` file in the context
+- [#1055][1055] Fixes for `Corefile` stack parsing, speed up `ELF.string()`
+- [#1057][1057] Fix a variable name typo in `DynELF` logging which results in an exception being thrown
+- [#1058][1058] Fix an edge case in `ssh_process.exe`
+
+[1007]: https://github.com/Gallopsled/pwntools/pull/1007
+[1055]: https://github.com/Gallopsled/pwntools/pull/1055
+[1057]: https://github.com/Gallopsled/pwntools/pull/1057
+[1058]: https://github.com/Gallopsled/pwntools/pull/1058
+
+## 3.9.2
+
+- [#1043][1043] Do not attempt to populate the libraries used by statically-linked binaries
+
+[1043]: https://github.com/Gallopsled/pwntools/pull/1043
+
+## 3.9.1
+
+- [#1038][1038] Fix an issue with `process()` where glibc would buffer data internally, causing a hang on `select()`
+- [#1036][1036] Fix Travis CI logging verbosity
+- [#1029][1029] Fix some `unicode` issues when using the `readline` command history in `tube.interactive()`
+
+[1038]: https://github.com/Gallopsled/pwntools/pull/1038
+[1036]: https://github.com/Gallopsled/pwntools/pull/1036
+[1029]: https://github.com/Gallopsled/pwntools/pull/1029
+
+## 3.9.0
+
+- [#1003][1003] Make `concat_all` faster while also simplifying it's logic
+- [#1014][1014] Fix for overwritten env when parsing core file
+- [#1023][1023] Fixes to Travis CI
+
+[1003]: https://github.com/Gallopsled/pwntools/pull/1003
+[1014]: https://github.com/Gallopsled/pwntools/pull/1014
+[1023]: https://github.com/Gallopsled/pwntools/pull/1023
+
+## 3.8.0
+
+- [#981][981] Fixed RELRO detection logic
+- [#986][986] Enhancements to DynELF for controlling usage of LibcDB
+- A few documentation fixes
+- A few fixes for the Docker image
+
+[981]: https://github.com/Gallopsled/pwntools/pull/981
+[986]: https://github.com/Gallopsled/pwntools/pull/986
+
+## 3.7.1
+
+- [#998][998] Fix a bug where integer values could not be set in `.pwn.conf`.
+
+[998]: https://github.com/Gallopsled/pwntools/pull/998
+
+## 3.7.0
+
+- [#933][933] DynELF works better with different base addresses
+- [#952][952] A few small fixes were made to `pwn template`, and the CRC database was updated.
+- [5c72d62c][5c72d62c] Updated the CRC database
+
+[933]: https://github.com/Gallopsled/pwntools/pull/933
+[952]: https://github.com/Gallopsled/pwntools/pull/952
+[5c72d62c]: https://github.com/Gallopsled/pwntools/commit/5c72d62c
+
+## 3.6.1
+
+- [#979][979]+[1a4a1e1][1a4a1e1] Fixed [#974][974], a bug related to the terminal handling and numlock.
+- [#980][980] Fixed the `pwn template` command.
+
+[974]: https://github.com/Gallopsled/pwntools/issues/974
+[979]: https://github.com/Gallopsled/pwntools/pull/979
+[980]: https://github.com/Gallopsled/pwntools/pull/980
+[1a4a1e1]: https://github.com/Gallopsled/pwntools/commit/1a4a1e1
+
+## 3.6.0
+
+- [#895][895] Added a Dockerfile to simplify testing setup and allow testing on OSX
+- [#897][897] Fixed some incorrect AArch64 syscals
+- [#893][893] Added the `pwnlib.config` module
+    + Configuration options can now be set in `~/.pwn.conf`
+    + This replaces the old, **undocumented** mechanism for changing logging colors.  Only @br0ns and @ebeip90 were likely using this.
+    + More information is available in the documentation [here](http://docs.pwntools.com/en/dev/config.html).
+- [#899][899] Pwntools now uses Unicorn Engine to emulate PLT instructions to ensure correct mapping of PIE / RELRO binaries.
+- [#904][904] Enhancements to the accuracy of the `pwn checksec` command.
+- [#905][905] Added a `pwn debug` command-line utility which automates the process of `gdb.attach(process(...))` to spawn GDB
+    + More information is available in the documentation [here](http://docs.pwntools.com/en/dev/commandline.html#pwn-debug)
+- [#919][919] Added a `pwn template` command-line utility to simplify the process of bootstrapping a new exploit.
+    + More information is available in the documentation [here](http://docs.pwntools.com/en/dev/commandline.html#pwn-template).
+- [#948][948] Fix unnecessary warning for Core files
+- [#954][954] Fix list processing in `~/.pwn.conf`
+- [#967][967] Respect `TERM_PROGRAM` for `run_in_new_terminal`
+- [#970][970] Fix overly-aggressive corefile caching
+
+[947]: https://github.com/Gallopsled/pwntools/pull/947
+[948]: https://github.com/Gallopsled/pwntools/pull/948
+[954]: https://github.com/Gallopsled/pwntools/pull/954
+[960]: https://github.com/Gallopsled/pwntools/pull/960
+[967]: https://github.com/Gallopsled/pwntools/pull/967
+[968]: https://github.com/Gallopsled/pwntools/pull/968
+[970]: https://github.com/Gallopsled/pwntools/pull/970
+
+[895]: https://github.com/Gallopsled/pwntools/pull/895
+[897]: https://github.com/Gallopsled/pwntools/pull/897
+[893]: https://github.com/Gallopsled/pwntools/pull/893
+[899]: https://github.com/Gallopsled/pwntools/pull/899
+[904]: https://github.com/Gallopsled/pwntools/pull/904
+[905]: https://github.com/Gallopsled/pwntools/pull/905
+[919]: https://github.com/Gallopsled/pwntools/pull/919
+
+## 3.5.1
+
+- [#945][945] Speed up ssh via caching checksec results (fixes [#944][944])
+- [#950][950] Fixes a bug where setting `context.arch` does not have an effect on `adb.compile()` output architecture
+
+[944]: https://github.com/Gallopsled/pwntools/issues/944
+[945]: https://github.com/Gallopsled/pwntools/pull/945
+[950]: https://github.com/Gallopsled/pwntools/pull/950
+
 ## 3.5.0

-To be released on Mar 18, 2017.
+- [b584ca3][b584ca3] Fixed an issue running `setup.py` on ARM
+- [#822][822] Enabled relative leaks with `MemLeak`
+    + This should be useful for e.g. heap-relative leaks
+- [#832][832] Changed all internal imports to use absolute imports (no functional changes)
+- [a12d0b6][a12d0b6] Move `STDOUT`, `PIPE`, `PTY` constants to globals
+    + `process(..., stdin=process.PTY)` --> `process(..., stdin=PTY)`
+- [#828][828] Use `PR_SET_PTRACER` for all `process()` and `ssh.process()` instances
+    + This simplifies debugging on systems with YAMA ptrace enabled
+- Various documentation enhancements
+    + In particular, the [gdb][gdb], [elf][elf], and [ssh][ssh] docs are much better
+- [#833][833] Performance enhancements for `adb` module
+- [d0267f3][d0267f3] `packing.fit()` now treats large offsets as cyclic patterns (e.g. `0x61616161` behaves the same as `"aaaa"`)
+- [#835][835] Added `ssh.checksec`
+    + Reports the kernel version and other relevant information on connection
+- [#857][857] Slightly shortened `execve` shellcode
+- [300f8e0][300f8e0] Slightly speed up processing of large ELF files
+- [#861][861] Adds support for extracting `IKCONFIG` configs from Linux kernel images, and extends `checksec` to report on any insecure configurations discovered
+- [#871][871] Moves all of the basic syscall templates to `shellcraft/common` and exposes them via symlinks.  Closed [#685][685]
+    + Should not have any visible effects from any documented APIs
+    + `shellcraft.arch.os.syscall_function()` still works the same
+    + We now have the ability to differentiate between the `connect` syscall, and a TCP `connect` helper
+- [#887][887] `sh_string` now returns a quoted empty string `''` rather than just an empty string
+- [#839][839] Exposes a huge amount of functionality via corefiles which was not previously availble.  See the [docs][corefile_docs] for examples.
+    + `process().corefile` will automatically instantiate a Corefile for the process
+    + QEMU-emulated processes are supported
+    + Native processes are supported, including extraction of coredumps from `apport` crash logs
+    + Native processes can be dumped *while running*, in a manner similar to `GDB`'s `gcore` script
+- [#875][857] Added [documentation][aarch64] (and tests) for AArch64 shellcode
+- [#882][882] The `ROP` class now respects `context.bytes` instead of using the hard-coded value of `4` (fixed [#879][879])
+- [#869][869] Added several fields to the `process` class (`uid`, `gid`, `suid`, `sgid`) which are recorded at execution time, based on the file permissions
+- [#868][868] Changed the way that `ssh.process()` works internally, and it now returns a more specialized class, `ssh_process`.
+    + Added `ssh_process.corefile` for fetching remote corefiles
+    + Added `ssh_process.ELF` for getting an ELF of the remote executable
+    + The `uid`, `gid`, and `suid`, and `sgid` which are recorded at execution time, based on the file permissions
+- [#865][865] Fixes `ELF.read` to support contiguous memory reads across non-contiguous file-backed segments
+- [#862][862] Adds a `symlink=` argument to `ssh.set_working_directory`, which will automatically symlink all of the files in the "old" working directory into the "new" working directory
+
+[ssh]: http://docs.pwntools.com/en/dev/tubes/ssh.html
+[gdb]: http://docs.pwntools.com/en/dev/gdb.html
+[elf]: http://docs.pwntools.com/en/dev/elf.html
+[corefile_docs]: http://docs.pwntools.com/en/dev/elf/corefile.html
+[aarch64]: http://docs.pwntools.com/en/dev/shellcraft/aarch64.html
+
+[685]: https://github.com/Gallopsled/pwntools/pull/685
+[822]: https://github.com/Gallopsled/pwntools/pull/822
+[828]: https://github.com/Gallopsled/pwntools/pull/828
+[832]: https://github.com/Gallopsled/pwntools/pull/832
+[833]: https://github.com/Gallopsled/pwntools/pull/833
+[835]: https://github.com/Gallopsled/pwntools/pull/835
+[839]: https://github.com/Gallopsled/pwntools/pull/839
+[857]: https://github.com/Gallopsled/pwntools/pull/857
+[861]: https://github.com/Gallopsled/pwntools/pull/861
+[862]: https://github.com/Gallopsled/pwntools/pull/862
+[865]: https://github.com/Gallopsled/pwntools/pull/865
+[868]: https://github.com/Gallopsled/pwntools/pull/868
+[869]: https://github.com/Gallopsled/pwntools/pull/869
+[871]: https://github.com/Gallopsled/pwntools/pull/871
+[875]: https://github.com/Gallopsled/pwntools/pull/857
+[879]: https://github.com/Gallopsled/pwntools/issues/879
+[882]: https://github.com/Gallopsled/pwntools/pull/882
+[887]: https://github.com/Gallopsled/pwntools/pull/887
+
+
+[b584ca3]: https://github.com/Gallopsled/pwntools/commit/b584ca3
+[a12d0b6]: https://github.com/Gallopsled/pwntools/commit/a12d0b6
+[d0267f3]: https://github.com/Gallopsled/pwntools/commit/d0267f3
+[300f8e0]: https://github.com/Gallopsled/pwntools/commit/300f8e0
+
+## 3.4.1
+
+- [#894][894] Fix a bug when using `gdb.debug()` over ssh.
+- [e021f57][e021f57] Fix a bug ([#891][891]) in `rop` when needing to insert padding to fix alignment
+
+[e021f57]: https://github.com/Gallopsled/pwntools/commit/e021f57
+[894]: https://github.com/Gallopsled/pwntools/pull/894
+[891]: https://github.com/Gallopsled/pwntools/issues/891

 ## 3.4.0

-To be released on Feb 4, 2017.
+- [#800][800] Add `shell=` option to `ssh.process()`
+- [#806][806] Add `context.buffer_size` for fine-tuning `tube` performance
+    + Also adds `buffer_fill_size=` argument for all tubes
+- [b83a6c7][b83a6c7] Fix undocumented `process.leak` function
+- [546061e][546061e] Modify `coredump_filter` of all spawned processes, so that core dumps are more complete
+- [#809][809] Add several functions to `adb` (`unlink`, `mkdir`, `makedirs`, `isdir`, `exists`)
+- [#817][817] Make disconnection detection more robust
+
+[800]: https://github.com/Gallopsled/pwntools/pull/800
+[806]: https://github.com/Gallopsled/pwntools/pull/806
+[809]: https://github.com/Gallopsled/pwntools/pull/809
+[817]: https://github.com/Gallopsled/pwntools/pull/817
+[5d9792f]: https://github.com/Gallopsled/pwntools/commit/5d9792f
+[b83a6c7]: https://github.com/Gallopsled/pwntools/commit/b83a6c7
+[546061e]: https://github.com/Gallopsled/pwntools/commit/546061e
+
+## 3.3.4
+
+- [#850][850] and [#846][846] fix issues with `hexdump` and the `phd` command-line utility, when using pipes (e.g. `echo foo | phd`)
+- [#852][852] Fixes register ordering in `regsort`
+- [#853][853] Fixes the registers restored in `shellcraft.amd64.popad`
+
+[846]: https://github.com/gallopsled/pwntools/pull/846
+[850]: https://github.com/gallopsled/pwntools/pull/850
+[852]: https://github.com/gallopsled/pwntools/pull/852
+[853]: https://github.com/gallopsled/pwntools/pull/853
+
+## 3.3.3
+
+- [#843][843] fixed a bug in `amd64.mov`.
+
+[843]: https://github.com/gallopsled/pwntools/pull/843

 ## 3.3.2

- [#840][840] Fixed a regression introduced by [#837][837].
+- [#840][840] fixed a regression introduced by [#837][837].

-[840]: https://github.com/Gallopsled/pwntools/pull/840
+[840]: https://github.com/gallopsled/pwntools/pull/840

 ## 3.3.1

@@ -135,7 +528,7 @@ Multiple bug fixes.
 - [1e414af][1e414af] Added `connect()` alias for `remote()`
    + For example, `io=connect('google.com', 80)`
    + This also works with `tcp(...)` and `udp(...)` aliases
- [869ec42][869ec42] Added `ssh.read()` and `ssh.write()` aiases
+- [869ec42][869ec42] Added `ssh.read()` and `ssh.write()` aliases
 - [2af55c9][2af55c9] `AdbDevice` objects exposed via e.g. `adb.devices()` now offer scoped access to all `adb` module properties
    + It is now possible to e.g. `map(lambda d: d.process(['id']).recvall(), adb.devices())`

@@ -222,7 +615,7 @@ Android support via a new `adb` module, `context.device`, `context.adb_host`, an
 - Added `context.log_file` setting for sending logs to a file.  This can be set with the `LOG_FILE` magic command-line option.
 - Added `context.noptrace` setting for disabling actions which require `ptrace` support.  This is useful for turning all `gdb.debug` and `gdb.attach` options into no-ops, and can be set via the `NOPTRACE` magic command-line option.
 - Added `context.proxy` which hooks all connections and sends them to a SOCKS4/SOCKS5.  This can be set via the `PROXY` magic command-line option.
- Added `context.randomize` to control randommization of settings like XOR keys and register ordering (default off).
+- Added `context.randomize` to control randomization of settings like XOR keys and register ordering (default off).
 - Added `context.terminal` for setting how to launch commands in a new terminal.

 #### DynELF and MemLeak Module
@@ -235,7 +628,7 @@ Android support via a new `adb` module, `context.device`, `context.adb_host`, an
 #### Encoders Module

 - Added a `pwnlib.encoders` module for assembled-shellcode encoders/decoders
- Includes position-indepentent basic XOR encoders
+- Includes position-independent basic XOR encoders
 - Includes position-independent delta encoders
 - Includes non-position-independent alphanumeric encoders for Intel
 - Includes position-independent alphanumeric encoders for ARM/Thumb
@@ -2,6 +2,6 @@ graft examples
 graft extra
 include *.md *.txt *.sh *.yml MANIFEST.in
 recursive-include docs   *.rst *.png Makefile *.py *.txt
-recursive-include pwnlib *.py *.asm *.rst *.md *.txt *.sh
+recursive-include pwnlib *.py *.asm *.rst *.md *.txt *.sh __doc__ *.mako
 recursive-include pwn    *.py *.asm *.rst *.md *.txt *.sh
 recursive-exclude *.pyc
@@ -2,13 +2,13 @@
 ![pwntools logo](https://github.com/Gallopsled/pwntools/blob/stable/docs/source/logo.png?raw=true)

 [![Docs](https://readthedocs.org/projects/pwntools/badge/?version=stable)](https://docs.pwntools.com/)
-[![PyPI](https://img.shields.io/badge/pypi-v3.3.2-green.svg?style=flat)](https://pypi.python.org/pypi/pwntools/)
+[![PyPI](https://img.shields.io/badge/pypi-v3.13.0-green.svg?style=flat)](https://pypi.python.org/pypi/pwntools/)
 [![Travis](https://travis-ci.org/Gallopsled/pwntools.svg)](https://travis-ci.org/Gallopsled/pwntools)
 [![Coveralls](https://img.shields.io/coveralls/Gallopsled/pwntools/dev.svg)](https://coveralls.io/github/Gallopsled/pwntools?branch=dev)
 [![Twitter](https://img.shields.io/badge/twitter-pwntools-4099FF.svg?style=flat)](https://twitter.com/pwntools)
 [![MIT License](https://img.shields.io/badge/license-MIT-blue.svg?style=flat)](http://choosealicense.com/licenses/mit/)

-pwntools is a CTF framework and exploit development library. Written in Python, it is designed for rapid prototyping and development, and intended to make exploit writing as simple as possible.
+Pwntools is a CTF framework and exploit development library. Written in Python, it is designed for rapid prototyping and development, and intended to make exploit writing as simple as possible.

 ```python
 from pwn import *
@@ -32,14 +32,15 @@ To get you started, we've provided some example solutions for past CTF challenge

 # Installation

-pwntools is best supported on 64-bit Ubuntu 12.04 and 14.04, but most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).  Python 2.7 is required.
+Pwntools is best supported on 64-bit Ubuntu LTE releases (12.04, 14.04, 16.04 and 18.04).  Most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).  Python >= 2.7 is required (Python 3 suggested as best).

 Most of the functionality of pwntools is self-contained and Python-only.  You should be able to get running quickly with

 ```sh
 apt-get update
-apt-get install python2.7 python-pip python-dev git libssl-dev
-pip install --upgrade pwntools
+apt-get install python3 python3-pip python3-dev git libssl-dev libffi-dev build-essential
+python3 -m pip install --upgrade pip
+python3 -m pip install --upgrade git+https://github.com/Gallopsled/pwntools.git@dev3
 ```

 However, some of the features (assembling/disassembling foreign architectures) require non-Python dependencies.  For more information, see the [complete installation instructions here](https://docs.pwntools.com/en/stable/install.html).
@@ -4,7 +4,6 @@ Pwntools makes extensive use of unit tests and integration tests to ensure every

 ## Test Suite

-
 To run the test suite, it is best to use Ubuntu 12.04 or 14.04, and run the following commands.  **Be aware** that this will add a user to the machine, and create a public key for SSH login!

 ```sh
@@ -14,6 +13,12 @@ pip install --upgrade --editable .
 PWNLIB_NOTERM=1 make -C docs doctest
 ```

+## Testing in Docker
+
+A `Dockerfile` has been provided which has a clean testing environment with Ubuntu Xenial.  It is very similar to the online Travis CI testing environment, but uses a more modern version of Ubuntu.
+
+See `travis/docker/README.md` for more information.
+
 ## New Tests

 To add a new test to an existing module, just add an inline doctest.  If the test needs access to an external module, add the import statement to the `testsetup` block in the corresponding file in `docs/source/<module>.rst`.
@@ -44,7 +44,7 @@ def main(args):
 		doc2dash.__main__.main.main( \
 			[ os.path.join(dstdir, "html"), "-d", dstdir, "-n", name, \
 					"-f", "-I", "index.html"], "doc2dash", False)
-	except SystemExit,e:
+	except SystemExit as e:
 		pass

 	# Insert a link to the online version.
@@ -1,16 +1,18 @@
-sphinxcontrib-napoleon
-sphinxcontrib-autoprogram==0.1.2
-isort
-paramiko>=1.15.2
-mako>=1.0.0
-pyelftools>=0.2.3
 capstone
-ropgadget>=5.3
+coveralls
+doc2dash
+isort
+mako>=1.0.0
+paramiko>=1.15.2
+pip>=6.0.8
+pyelftools>=0.2.3
+pygments>=2.0
+pypandoc
 pyserial>=2.7
 requests>=2.5.1
-pip>=6.0.8
-tox>=1.8.1
-pygments>=2.0
+ropgadget>=5.3
+sphinx
 sphinx_rtd_theme
-doc2dash
-coveralls
+sphinxcontrib-napoleon
+sphinxcontrib-autoprogram
+tox>=1.8.1
@@ -1,5 +1,6 @@
 .. testsetup:: *

+   from pprint import pprint
   from pwn import *
   adb = pwnlib.adb

@@ -6,6 +6,7 @@
   from pwnlib.asm import *
   from pwnlib import shellcraft
   from pwnlib.tubes.process import process
+   from pwnlib.util.fiddling import unhex


 :mod:`pwnlib.asm` --- Assembler functions
@@ -13,3 +14,13 @@

 .. automodule:: pwnlib.asm
   :members:
+
+Internal Functions
+-----------------------------------------
+
+These are only included so that their tests are run.
+
+You should never need these.
+
+.. autofunction:: pwnlib.asm.dpkg_search_for_binutils
+.. autofunction:: pwnlib.asm.print_binutils_instructions
@@ -12,6 +12,8 @@
 # serve to show the default.

 import os
+import doctest
+import six
 import subprocess
 import sys

@@ -24,8 +26,6 @@ sys.path.insert(0, os.path.abspath('../..'))

 import pwnlib

-# -- General configuration -----------------------------------------------------
-
 # If your documentation needs a minimal Sphinx version, state it here.
 #needs_sphinx = '1.0'

@@ -44,14 +44,36 @@ extensions = [
    'sphinxcontrib.napoleon'
 ]

+# Disable "info" logging directly to stdout by Sphinx
+import logging
+
+class SphinxPwnlibFilter(logging.Filter):
+    def filter(self, record):
+        if record.name.startswith('pwn'):
+            return False
+        if record.name.startswith('paramiko'):
+            return False
+        return True
+
+log_filter = SphinxPwnlibFilter()
+
+for i, handler in enumerate(logging.root.handlers):
+    print("Filtering Sphinx handler", handler)
+    handler.addFilter(log_filter)
+
+# Napoleon settings
+napoleon_use_ivar = True
+napoleon_use_rtype = False
+
 doctest_global_setup = '''
 import sys, os
 os.environ['PWNLIB_NOTERM'] = '1'
 os.environ['PWNLIB_RANDOMIZE'] = '0'
-import pwnlib
+import pwnlib, logging
 pwnlib.context.context.reset_local()
-pwnlib.context.ContextType.defaults['log_level'] = 'ERROR'
+pwnlib.context.ContextType.defaults['log_level'] = logging.ERROR
 pwnlib.context.ContextType.defaults['randomize'] = False
+pwnlib.util.fiddling.default_style = {}
 pwnlib.term.text.when = 'never'
 pwnlib.log.install_default_handler()
 pwnlib.log.rootlogger.setLevel(1)
@@ -67,12 +89,13 @@ class stdout(object):
 pwnlib.context.ContextType.defaults['log_console'] = stdout()
 '''

-autodoc_member_order = 'alphabetical'
+autoclass_content = 'both'
+autodoc_member_order = 'groupwise' # 'alphabetical'

 # Add any paths that contain templates here, relative to this directory.
 templates_path = ['_templates']

-doctest_test_doctest_blocks = True
+doctest_test_doctest_blocks = 'true'

 # The suffix of source filenames.
 source_suffix = '.rst'
@@ -231,7 +254,7 @@ latex_documents = [
 ]

 intersphinx_mapping = {'python': ('https://docs.python.org/2.7', None),
-                       'paramiko': ('https://paramiko-docs.readthedocs.org/en/1.15/', None)}
+                       'paramiko': ('https://paramiko-docs.readthedocs.org/en/2.1/', None)}

 # The name of an image file (relative to this directory) to place at the top of
 # the title page.
@@ -290,13 +313,13 @@ texinfo_documents = [
 branch = release

 try:
-    git_branch = subprocess.check_output('git describe --tags', shell = True)
+    git_branch = subprocess.check_output('git describe --tags', shell = True, universal_newlines = True)
 except subprocess.CalledProcessError:
    git_branch = '-'

 try:
    if '-' in git_branch:
-        branch = subprocess.check_output('git rev-parse HEAD', shell = True).strip()[:10]
+        branch = subprocess.check_output('git rev-parse HEAD', shell = True, universal_newlines = True).strip()[:10]
 except subprocess.CalledProcessError:
    pass

@@ -324,11 +347,11 @@ def linkcode_resolve(domain, info):
    else:
        filename = info['module'].replace('.', '/') + '.py'

-        if isinstance(val, (types.ModuleType, types.ClassType, types.MethodType, types.FunctionType, types.TracebackType, types.FrameType, types.CodeType)):
+        if isinstance(val, (types.ModuleType, types.MethodType, types.FunctionType, types.TracebackType, types.FrameType, types.CodeType) + six.class_types):
            try:
                lines, first = inspect.getsourcelines(val)
                filename += '#L%d-%d' % (first, first + len(lines) - 1)
-            except IOError:
+            except (IOError, TypeError):
                pass

    return "https://github.com/Gallopsled/pwntools/blob/%s/%s" % (branch, filename)
@@ -347,3 +370,78 @@ if build_dash:
        html_theme_path = [sphinx_rtd_theme.get_html_theme_path()]

    # otherwise, readthedocs.org uses their theme by default, so no need to specify it
+
+
+# -- Customization to Sphinx autodoc generation --------------------------------------------
+import sphinx.ext.autodoc
+from sphinx.util.inspect import safe_getmembers, safe_getattr
+
+# Test hidden members (e.g. def _foo(...))
+def dont_skip_any_doctests(app, what, name, obj, skip, options):
+    return False
+
+def get_object_members_all(self, want_all):
+    if want_all:
+        # if not hasattr(self.object, '__all__'):
+        #     for implicit module members, check __module__ to avoid
+        #     documenting imported objects
+        return True, safe_getmembers(self.object)
+    # else:
+    #     memberlist = self.object.__all__
+    #     # Sometimes __all__ is broken...
+    #     if not isinstance(memberlist, (list, tuple)) or not \
+        #        all(isinstance(entry, string_types) for entry in memberlist):
+    #         self.directive.warn(
+    #             '__all__ should be a list of strings, not %r '
+    #             '(in module %s) -- ignoring __all__' %
+    #             (memberlist, self.fullname))
+    #         # fall back to all members
+    #         return True, safe_getmembers(self.object)
+    else:
+        memberlist = self.options.members or []
+        ret = []
+        for mname in memberlist:
+            try:
+                ret.append((mname, safe_getattr(self.object, mname)))
+            except AttributeError:
+                self.directive.warn(
+                    'missing attribute mentioned in :members: or __all__: '
+                    'module %s, attribute %s' % (
+                        safe_getattr(self.object, '__name__', '???'), mname))
+        return False, ret
+
+class _DummyClass(object): pass
+
+class Py2OutputChecker(_DummyClass, doctest.OutputChecker):
+    def check_output(self, want, got, optionflags):
+        sup = super(Py2OutputChecker, self).check_output
+        if sup(want, got, optionflags):
+            return True
+        try:
+            rly_want = pwnlib.util.safeeval.const(want)
+            if sup(repr(rly_want), got, optionflags):
+                return True
+            rly_got = pwnlib.util.safeeval.const(got)
+            if rly_want == rly_got:
+                return True
+        except ValueError:
+            pass
+        rly_want = ' '.join(x[:2].replace('b"','"').replace("b'","'")+x[2:] for x in want.replace('\n','\n ').split(' ')).replace('\n ','\n')
+        if sup(rly_want, got, optionflags):
+            return True
+        rly_want = ' '.join(x[:2].replace('b"',' "').replace("b'"," '")+x[2:] for x in want.replace('\n','\n ').split(' ')).replace('\n ','\n')
+        return sup(rly_want, got, optionflags)
+
+def py2_doctest_init(self, checker=None, verbose=None, optionflags=0):
+    if checker is None:
+        checker = Py2OutputChecker()
+    doctest.DocTestRunner.__init__(self, checker, verbose, optionflags)
+
+if 'doctest' in sys.argv:
+    def setup(app):
+        app.connect('autodoc-skip-member', dont_skip_any_doctests)
+
+    if sys.version_info[:1] < (3,):
+        import sphinx.ext.doctest
+        sphinx.ext.doctest.SphinxDocTestRunner.__init__ = py2_doctest_init
+    sphinx.ext.autodoc.ModuleDocumenter.get_object_members = get_object_members_all
@@ -0,0 +1,4 @@
+:mod:`pwnlib.config` --- Pwntools Configuration File
+====================================================
+
+.. automodule:: pwnlib.config
@@ -3,13 +3,31 @@
   from pwn import *
   import logging
   log = pwnlib.log.getLogger('pwnlib.context')
+   context.clear()

 :mod:`pwnlib.context` --- Setting runtime variables
 =====================================================

-.. autodata:: pwnlib.context.context
+Many settings in ``pwntools`` are controlled via the global variable :data:`.context`, such as the selected target operating system, architecture, and bit-width.

-.. autoclass:: pwnlib.context.ContextType
-    :members:
+In general, exploits will start with something like:

-.. autoclass:: pwnlib.context.Thread
+.. code-block:: python
+
+    from pwn import *
+    context.arch = 'amd64'
+
+Which sets up everything in the exploit for exploiting a 64-bit Intel binary.
+
+The recommended method is to use ``context.binary``  to automagically set all of the appropriate values.
+
+.. code-block:: python
+
+    from pwn import *
+    context.binary = './challenge-binary'
+
+Module Members
+----------------------------------------------------
+
+.. automodule:: pwnlib.context
+   :members:
@@ -3,8 +3,16 @@
   from pwnlib.elf import *
   from pwnlib.util.misc import which

-:mod:`pwnlib.elf` --- Working with ELF binaries
-===============================================
+:mod:`pwnlib.elf` --- ELF Executables and Libraries
+===================================================

 .. automodule:: pwnlib.elf
-   :members:
+
+
+ELF Modules
+-------------------
+
+.. toctree::
+    elf/elf
+    elf/config
+    elf/corefile
@@ -0,0 +1,10 @@
+.. testsetup:: *
+
+   from pwn import *
+   from pwnlib.elf.config import parse_kconfig
+
+:mod:`pwnlib.elf.config` --- Kernel Config Parsing
+===========================================================
+
+.. automodule:: pwnlib.elf.config
+  :members:
@@ -0,0 +1,16 @@
+.. testsetup:: *
+
+   from glob import glob
+   from pwn import *
+
+:mod:`pwnlib.elf.corefile` --- Core Files
+===========================================================
+
+.. automodule:: pwnlib.elf.corefile
+
+  .. autoclass:: pwnlib.elf.corefile.Corefile
+     :members:
+     :show-inheritance:
+
+  .. autoclass:: pwnlib.elf.corefile.Mapping
+     :members:
@@ -0,0 +1,29 @@
+.. testsetup:: *
+
+   from pwn import *
+   from glob import glob
+   from pwnlib.elf.maps import CAT_PROC_MAPS_EXIT
+
+:mod:`pwnlib.elf.elf` --- ELF Files
+===========================================================
+
+.. automodule:: pwnlib.elf.elf
+
+  .. autoclass:: pwnlib.elf.elf.ELF
+     :members:
+     :show-inheritance:
+     :inherited-members:
+     :exclude-members: address_offsets,
+                       get_data,
+                       get_dwarf_info,
+                       get_section,
+                       get_segment,
+                       has_dwarf_info,
+                       iter_sections,
+                       iter_segments
+
+  .. autoclass:: pwnlib.elf.elf.Function
+     :members:
+
+  .. autoclass:: pwnlib.elf.elf.dotdict
+     :members:
@@ -1,3 +1,7 @@
+.. testsetup:: *
+
+    from pwn import *
+
 :mod:`pwnlib.gdb` --- Working with GDB
 ======================================

@@ -13,11 +13,11 @@ Which imports a bazillion things into the global namespace to make your life eas

 This is a quick list of most of the objects and routines imported, in rough order of importance and frequency of use.

- ``context``
+- :mod:`pwnlib.context`
    - :data:`pwnlib.context.context`
    - Responsible for most of the pwntools convenience settings
    - Set `context.log_level = 'debug'` when troubleshooting your exploit
-    - Scope-aware, so you can disable logging for a subsection of code via ``pwnlib.context.ContextType.local``
+    - Scope-aware, so you can disable logging for a subsection of code via :meth:`.ContextType.local`
 - ``remote``, ``listen``, ``ssh``, ``process``
    - :mod:`pwnlib.tubes`
    - Super convenient wrappers around all of the common functionality for CTF challenges
@@ -57,11 +57,11 @@ This is a quick list of most of the objects and routines imported, in rough orde
 - ``gdb.debug`` and ``gdb.attach``
    - :mod:`pwnlib.gdb`
    - Launch a binary under GDB and pop up a new terminal to interact with it.  Automates setting breakpoints and makes iteration on exploits MUCH faster.
-    - Alternately, attach to a running process given a PID, ``pwnlib.tubes`` object, or even just a socket that's connected to it
+    - Alternately, attach to a running process given a PID, :mod:`pwnlib.tubes` object, or even just a socket that's connected to it
 - ``args``
-    - Dictionary contining all-caps command-line arguments for quick access
+    - Dictionary containing all-caps command-line arguments for quick access
    - Run via ``python foo.py REMOTE=1`` and ``args['REMOTE'] == '1'``.
-    - Can also control logging verbosity and terminal fancyness
+    - Can also control logging verbosity and terminal fanciness
        - `NOTERM`
        - `SILENT`
        - `DEBUG`
@@ -78,7 +78,7 @@ This is a quick list of most of the objects and routines imported, in rough orde
    - It's the new ``getch``
 - ``safeeval``
    - :mod:`pwnlib.util.safeeval`
-    - Functions for safely evalutaing python code without nasty side-effects.
+    - Functions for safely evaluating python code without nasty side-effects.

 These are all pretty self explanatory, but are useful to have in the global namespace.

@@ -48,6 +48,7 @@ Each of the ``pwntools`` modules is documented here.
   atexception
   atexit
   constants
+   config
   context
   dynelf
   encoders
@@ -56,8 +57,11 @@ Each of the ``pwntools`` modules is documented here.
   flag
   fmtstr
   gdb
+   libcdb
   log
   memleak
+   protocols
+   qemu
   replacements
   rop
   rop/*
@@ -24,7 +24,9 @@ pwntools is available as a ``pip`` package.

 .. code-block:: bash

-    $ apt-get install python2.7 python2.7-dev python-pip
+    $ apt-get update
+    $ apt-get install python2.7 python-pip python-dev git libssl-dev libffi-dev build-essential
+    $ pip install --upgrade pip
    $ pip install --upgrade pwntools

 Development
@@ -27,14 +27,14 @@ This exposes a standard interface to talk to processes, sockets, serial ports,
 and all manner of things, along with some nifty helpers for common tasks.
 For example, remote connections via :mod:`pwnlib.tubes.remote`.

-    >>> conn = remote('ftp.debian.org',21)
+    >>> conn = remote('ftp.ubuntu.com',21)
    >>> conn.recvline() # doctest: +ELLIPSIS
-    '220 ...'
-    >>> conn.send('USER anonymous\r\n')
-    >>> conn.recvuntil(' ', drop=True)
-    '331'
+    b'220 ...'
+    >>> conn.send(b'USER anonymous\r\n')
+    >>> conn.recvuntil(b' ', drop=True)
+    b'331'
    >>> conn.recvline()
-    'Please specify the password.\r\n'
+    b'Please specify the password.\r\n'
    >>> conn.close()

 It's also easy to spin up a listener
@@ -42,20 +42,20 @@ It's also easy to spin up a listener
    >>> l = listen()
    >>> r = remote('localhost', l.lport)
    >>> c = l.wait_for_connection()
-    >>> r.send('hello')
+    >>> r.send(b'hello')
    >>> c.recv()
-    'hello'
+    b'hello'

 Interacting with processes is easy thanks to :mod:`pwnlib.tubes.process`.

 ::

    >>> sh = process('/bin/sh')
-    >>> sh.sendline('sleep 3; echo hello world;')
+    >>> sh.sendline(b'sleep 3; echo hello world;')
    >>> sh.recvline(timeout=1)
-    ''
+    b''
    >>> sh.recvline(timeout=5)
-    'hello world\n'
+    b'hello world\n'
    >>> sh.close()

 Not only can you interact with processes programmatically, but you can
@@ -72,16 +72,16 @@ a ``process`` tube.

 ::

-    >>> shell = ssh('bandit0', 'bandit.labs.overthewire.org', password='bandit0')
+    >>> shell = ssh('bandit0', 'bandit.labs.overthewire.org', password='bandit0', port=2220)
    >>> shell['whoami']
-    'bandit0'
+    b'bandit0'
    >>> shell.download_file('/etc/motd')
    >>> sh = shell.run('sh')
-    >>> sh.sendline('sleep 3; echo hello world;') # doctest: +SKIP
+    >>> sh.sendline(b'sleep 3; echo hello world;') # doctest: +SKIP
    >>> sh.recvline(timeout=1)
-    ''
+    b''
    >>> sh.recvline(timeout=5)
-    'hello world\n'
+    b'hello world\n'
    >>> shell.close()

 Packing Integers
@@ -97,13 +97,13 @@ unpacking codes, and littering your code with helper routines.
    >>> import struct
    >>> p32(0xdeadbeef) == struct.pack('I', 0xdeadbeef)
    True
-    >>> leet = '37130000'.decode('hex')
-    >>> u32('abcd') == struct.unpack('I', 'abcd')[0]
+    >>> leet = unhex('37130000')
+    >>> u32(b'abcd') == struct.unpack('I', b'abcd')[0]
    True

 The packing/unpacking operations are defined for many common bit-widths.

-    >>> u8('A') == 0x41
+    >>> u8(b'A') == 0x41
    True

 Setting the Target Architecture and OS
@@ -112,9 +112,9 @@ Setting the Target Architecture and OS
 The target architecture can generally be specified as an argument to the routine that requires it.

    >>> asm('nop')
-    '\x90'
+    b'\x90'
    >>> asm('nop', arch='arm')
-    '\x00\xf0 \xe3'
+    b'\x00\xf0 \xe3'

 However, it can also be set once in the global ``context``.  The operating system, word size, and endianness can also be set here.

@@ -126,10 +126,10 @@ However, it can also be set once in the global ``context``.  The operating syste
 Additionally, you can use a shorthand to set all of the values at once.

    >>> asm('nop')
-    '\x90'
+    b'\x90'
    >>> context(arch='arm', os='linux', endian='big', word_size=32)
    >>> asm('nop')
-    '\xe3 \xf0\x00'
+    b'\xe3 \xf0\x00'

 .. doctest::
   :hide:
@@ -158,12 +158,12 @@ Assembly and Disassembly
 Never again will you need to run some already-assembled pile of shellcode
 from the internet!  The :mod:`pwnlib.asm` module is full of awesome.

-    >>> asm('mov eax, 0').encode('hex')
+    >>> enhex(asm('mov eax, 0'))
    'b800000000'

 But if you do, it's easy to suss out!

-    >>> print disasm('6a0258cd80ebf9'.decode('hex'))
+    >>> print(disasm(unhex('6a0258cd80ebf9')))
       0:   6a 02                   push   0x2
       2:   58                      pop    eax
       3:   cd 80                   int    0x80
@@ -176,7 +176,7 @@ loaded with useful time-saving shellcodes.
 Let's say that we want to `setreuid(getuid(), getuid())` followed by `dup`ing
 file descriptor 4 to `stdin`, `stdout`, and `stderr`, and then pop a shell!

-    >>> asm(shellcraft.setreuid() + shellcraft.dupsh(4)).encode('hex') # doctest: +ELLIPSIS
+    >>> enhex(asm(shellcraft.setreuid() + shellcraft.dupsh(4))) # doctest: +ELLIPSIS
    '6a3158cd80...'


@@ -188,10 +188,10 @@ Never write another hexdump, thanks to :mod:`pwnlib.util.fiddling`.

 Find offsets in your buffer that cause a crash, thanks to :mod:`pwnlib.cyclic`.

-    >>> print cyclic(20)
+    >>> print(cyclic(20).decode())
    aaaabaaacaaadaaaeaaa
-    >>> # Assume EIP = 0x62616166 ('faab' which is pack(0x62616166))  at crash time
-    >>> print cyclic_find('faab')
+    >>> # Assume EIP = 0x62616166 (b'faab' which is pack(0x62616166))  at crash time
+    >>> print(cyclic_find(b'faab'))
    120

 ELF Manipulation
@@ -200,22 +200,22 @@ ELF Manipulation
 Stop hard-coding things!  Look them up at runtime with :mod:`pwnlib.elf`.

    >>> e = ELF('/bin/cat')
-    >>> print hex(e.address) #doctest: +SKIP
+    >>> print(hex(e.address)) #doctest: +SKIP
    0x400000
-    >>> print hex(e.symbols['write']) #doctest: +SKIP
+    >>> print(hex(e.symbols['write'])) #doctest: +SKIP
    0x401680
-    >>> print hex(e.got['write']) #doctest: +SKIP
+    >>> print(hex(e.got['write'])) #doctest: +SKIP
    0x60b070
-    >>> print hex(e.plt['write']) #doctest: +SKIP
+    >>> print(hex(e.plt['write'])) #doctest: +SKIP
    0x401680

 You can even patch and save the files.

    >>> e = ELF('/bin/cat')
-    >>> e.read(e.address+1, 3)
-    'ELF'
+    >>> e.read(e.address, 4)
+    b'\x7fELF'
    >>> e.asm(e.address, 'ret')
    >>> e.save('/tmp/quiet-cat')
-    >>> disasm(file('/tmp/quiet-cat','rb').read(1))
+    >>> disasm(open('/tmp/quiet-cat','rb').read(1))
    '   0:   c3                      ret'

@@ -0,0 +1,10 @@
+.. testsetup:: *
+
+   from pwn import *
+   from pwnlib.libcdb import *
+
+:mod:`pwnlib.libcdb` --- Libc Database
+===========================================
+
+.. automodule:: pwnlib.libcdb
+   :members:
@@ -1,11 +1,9 @@
 .. testsetup:: *

-   from pwnlib.memleak import *
+    from pwn import *

 :mod:`pwnlib.memleak` --- Helper class for leaking memory
 =========================================================

-.. module:: pwnlib.memleak
-
-.. autoclass:: MemLeak
-   :members:
+.. automodule:: pwnlib.memleak
+    :members:
@@ -0,0 +1,15 @@
+:mod:`pwnlib.protocols` --- Wire Protocols
+=============================================
+
+.. automodule:: pwnlib.protocols
+
+
+Supported Protocols
+-------------------
+
+.. toctree::
+    :maxdepth: 3
+    :glob:
+
+    protocols/*
+
@@ -0,0 +1,10 @@
+.. testsetup:: *
+
+   from pwn import *
+   from pwnlib.protocols.adb import AdbClient
+
+:mod:`pwnlib.protocols.adb` --- ADB Protocol Implementation
+===========================================================
+
+.. automodule:: pwnlib.protocols.adb
+   :members:
@@ -0,0 +1,10 @@
+.. testsetup:: *
+
+   from pwn import *
+
+
+:mod:`pwnlib.qemu` --- QEMU Utilities
+==========================================
+
+.. automodule:: pwnlib.qemu
+   :members:
@@ -0,0 +1,19 @@
+.. testsetup:: *
+
+   from pwn import *
+   context.clear(arch='aarch64')
+
+:mod:`pwnlib.shellcraft.aarch64` --- Shellcode for AArch64
+===========================================================
+
+:mod:`pwnlib.shellcraft.aarch64`
+--------------------------------
+
+.. automodule:: pwnlib.shellcraft.aarch64
+   :members:
+
+:mod:`pwnlib.shellcraft.aarch64.linux`
+--------------------------------------
+
+.. automodule:: pwnlib.shellcraft.aarch64.linux
+   :members:
@@ -3,3 +3,9 @@

 .. automodule:: pwnlib.term
   :members:
+
+Term Modules
+-------------------
+
+.. toctree::
+    term/readline
@@ -27,4 +27,4 @@ Types of Tubes
  .. autoclass:: pwnlib.tubes.tube.tube()
     :members:
     :exclude-members: recv_raw, send_raw, settimeout_raw,
-                       can_recv_raw
+                       can_recv_raw, shutdown_raw, connected_raw,
@@ -0,0 +1,9 @@
+.. testsetup:: *
+
+   from pwnlib.tubes.buffer import *
+
+:mod:`pwnlib.tubes.buffer` --- buffer implementation for tubes
+==============================================================
+
+.. automodule:: pwnlib.tubes.buffer
+   :members:
@@ -1,6 +1,7 @@
 .. testsetup:: *

   from pwn import *
+   from pwnlib.tubes.server import server

 :mod:`pwnlib.tubes.sock` --- Sockets
 ===========================================================
@@ -23,3 +24,9 @@
   .. autoclass:: pwnlib.tubes.listen.listen
      :members:
      :show-inheritance:
+
+.. automodule:: pwnlib.tubes.server
+
+   .. autoclass:: pwnlib.tubes.server.server
+      :members:
+      :show-inheritance:
@@ -1,5 +1,6 @@
 .. testsetup:: *

+   from pwn import *
   from pwnlib.util.cyclic import *


@@ -1,6 +1,7 @@
 .. testsetup:: *

-   from pwnlib.util.fiddling import *
+    from pwn import *
+    from pwnlib.util.fiddling import *


 :mod:`pwnlib.util.fiddling` --- Utilities bit fiddling
@@ -0,0 +1,11 @@
+.. testsetup:: *
+
+   from pwnlib.util.getdents import *
+   from pwnlib.util.fiddling import unhex
+
+
+:mod:`pwnlib.util.getdents` --- Linux binary directory listing
+==============================================================
+
+.. automodule:: pwnlib.util.getdents
+   :members:
@@ -1,5 +1,6 @@
 .. testsetup:: *

+   from pprint import pprint
   from pwnlib.util.misc import *
   import os, subprocess
   os.chdir("..")
@@ -1,6 +1,7 @@
 .. testsetup:: *

   from pwnlib.util.proc import *
+   from pwnlib.tubes.process import process
   import os, sys


@@ -1,6 +1,7 @@
 .. testsetup:: *

   from pwnlib.util.safeeval import *
+   _get_opcodes = pwnlib.util.safeeval._get_opcodes


 :mod:`pwnlib.util.safeeval` --- Safe evaluation of python code
@@ -0,0 +1,51 @@
+CFLAGS := -Wno-unused-result -Wno-format-security
+TARGETS := printf.mips printf.mips64 printf.mipsel printf.mips64el printf.arm printf.aarch64 \
+	         printf.ppc printf.ppc64 printf.sparc64 printf.native printf.native32
+
+.PHONY: run
+run: all
+	./exploit.py
+
+.PHONY: all
+all: $(TARGETS)
+
+.PHONY: clean
+clean:
+	rm -f $(TARGETS)
+
+# mips variants
+%.mips: %.c
+	mips-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
+%.mipsel: %.c
+	mipsel-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
+%.mips64: %.c
+	mips64-linux-gnuabi64-gcc $(CFLAGS) -static -Os -o "$@" $^
+%.mips64el: %.c
+	mips64el-linux-gnuabi64-gcc $(CFLAGS) -static -Os -o "$@" $^
+
+# arm variants
+%.arm: %.c
+	arm-linux-gnueabi-gcc $(CFLAGS) -static -Os -o "$@" $^
+%.aarch64: %.c
+	aarch64-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
+
+# ppc variants
+%.ppc: %.c
+	powerpc-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
+%.ppc64: %.c
+	powerpc64-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
+
+# sparc variants
+%.sparc64: %.c
+	sparc64-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
+
+# native variants
+%.native: %.c
+	gcc $(CFLAGS) -o "$@" $^
+%.native32: %.c
+	i686-linux-gnu-gcc $(CFLAGS) -o "$@" $^
+
+# install deps on ubuntu xenial
+.PHONY: install-apt
+install-apt:
+	apt-get install -y make gcc-mips64el-linux-gnuabi64 gcc-sparc64-linux-gnu gcc-powerpc64-linux-gnu gcc-powerpc-linux-gnu gcc-arm-linux-gnueabi gcc-aarch64-linux-gnu gcc-mips64-linux-gnuabi64 gcc-mipsel-linux-gnu gcc-mips64el-linux-gnuabi64 gcc-mips-linux-gnu gcc-i686-linux-gnu gcc
@@ -0,0 +1,39 @@
+#!/usr/bin/env python2
+from pwn import *
+
+@context.quiet
+def exec_fmt(payload):
+    p = context.binary.process()
+    p.sendline(payload)
+    return p.recvall()
+
+def exploit(binary):
+    context.binary = ELF(binary)
+    autofmt = FmtStr(exec_fmt)
+    offset = autofmt.offset
+    with context.binary.process() as p:
+        addr = unpack(p.recv(context.bytes))
+        payload = fmtstr_payload(offset, {addr: p32(0x1337babe)})
+        p.sendline(payload)
+        p.recvuntil("DONE")
+        print hex(u32(p.recv(4)))
+
+binaries = [
+    "printf.mips",
+    "printf.mips64",
+    "printf.mipsel",
+    "printf.mips64el",
+    "printf.native",
+    "printf.native32",
+    "printf.ppc",
+    "printf.ppc64",
+    "printf.sparc64",
+    "printf.arm",
+    "printf.aarch64",
+]
+
+if len(sys.argv) > 1:
+    binaries = sys.argv[1:]
+
+for binary in binaries:
+    exploit(binary)
@@ -0,0 +1,29 @@
+#ifdef _FORTIFY_SOURCE
+#undef _FORTIFY_SOURCE
+#endif
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <sys/mman.h>
+#define MEMORY_ADDRESS ((void*)0x11110000)
+#define MEMORY_SIZE 1024
+#define TARGET ((int *) 0x11110100)
+int main(int argc, char const *argv[])
+{
+       char buff[1024];
+       void *ptr = NULL;
+       int *my_var = TARGET;
+       ptr = mmap(MEMORY_ADDRESS, MEMORY_SIZE, PROT_READ|PROT_WRITE, MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE, 0, 0);
+       if(ptr != MEMORY_ADDRESS)
+       {
+               perror("mmap");
+               return EXIT_FAILURE;
+       }
+       *my_var = 0x41414141;
+       write(1, &my_var, sizeof(int *));
+       scanf("%s", buff);
+       dprintf(2, buff);
+       write(1, "DONE", 4);
+       write(1, my_var, sizeof(int));
+       return 0;
+}
@@ -0,0 +1,31 @@
+from pwn import *
+context.arch='aarch64'
+frame = SigreturnFrame()
+
+registers = ['x%i' % i for i in range(0, 31)]
+registers += ['sp', 'pc']
+
+
+for index, register in enumerate(registers):
+    setattr(frame, register, index)
+
+assembly = '\n'.join([
+    shellcraft.read(constants.STDIN_FILENO, 'sp', 1024),
+    shellcraft.syscall(constants.SYS_rt_sigreturn)
+])
+
+binary = ELF.from_assembly(assembly)
+
+io = binary.process()
+io.flat(frame)
+io.wait()
+assert io.poll() == -11
+
+corefile = io.corefile
+
+for index, register in enumerate(registers):
+    value = getattr(corefile, register)
+    if index != value:
+        log.error("%s != %i (%i)" % (register, index, value))
+    else:
+        log.success("%s == %i" % (register, value))
@@ -0,0 +1,32 @@
+from pwn import *
+context.arch='amd64'
+frame = SigreturnFrame()
+
+registers = ['rax', 'rbx', 'rcx', 'rdx',
+             'rdi', 'rsi', 'rbp', 'rsp',
+             'rip',
+             'r8', 'r9', 'r10', 'r11', 'r12', 'r13', 'r14', 'r15']
+
+for index, register in enumerate(registers):
+    setattr(frame, register, index)
+
+assembly = '\n'.join([
+    shellcraft.read(constants.STDIN_FILENO, 'rsp', 1024),
+    shellcraft.sigreturn()
+])
+
+binary = ELF.from_assembly(assembly)
+
+io = binary.process()
+io.flat(frame)
+io.wait()
+assert io.poll() == -11
+
+corefile = io.corefile
+
+for index, register in enumerate(registers):
+    value = getattr(corefile, register)
+    if index != value:
+        log.error("%s != %i (%i)" % (register, index, value))
+    else:
+        log.success("%s == %i" % (register, value))
@@ -0,0 +1,32 @@
+from pwn import *
+
+context.arch='arm'
+frame = SigreturnFrame()
+
+registers = ['r0', 'r1', 'r2', 'r3', 'r4', 'r5', 'r6', 'r7',
+             'r8', 'r9', 'r10', 'fp', 'ip', 'sp', 'pc', 'lr']
+
+
+for index, register in enumerate(registers):
+    setattr(frame, register, index)
+
+assembly = '\n'.join([
+    shellcraft.read(constants.STDIN_FILENO, 'sp', 1024),
+    shellcraft.sigreturn()
+])
+
+binary = ELF.from_assembly(assembly)
+
+io = binary.process()
+io.flat(frame)
+io.wait()
+assert io.poll() == -11
+
+corefile = io.corefile
+
+for index, register in enumerate(registers):
+    value = getattr(corefile, register)
+    if index != value:
+        log.error("%s != %i (%i)" % (register, index, value))
+    else:
+        log.success("%s == %i" % (register, value))
@@ -0,0 +1,31 @@
+from pwn import *
+context.kernel='amd64'
+frame = SigreturnFrame()
+
+registers = ['eax', 'ebx', 'ecx', 'edx',
+             'edi', 'esi', 'ebp', 'esp',
+             'eip']
+
+for index, register in enumerate(registers):
+    setattr(frame, register, index)
+
+assembly = '\n'.join([
+    shellcraft.read(constants.STDIN_FILENO, 'esp', 1024),
+    shellcraft.sigreturn()
+])
+
+binary = ELF.from_assembly(assembly)
+
+io = binary.process()
+io.flat(frame)
+io.wait()
+assert io.poll() == -11
+
+corefile = io.corefile
+
+for index, register in enumerate(registers):
+    value = getattr(corefile, register)
+    if index != value:
+        log.error("%s != %i (%i)" % (register, index, value))
+    else:
+        log.success("%s == %i" % (register, value))
@@ -4,7 +4,7 @@ Example showing how to use the ssh class.

 from pwn import *

-shell = ssh(host='bandit.labs.overthewire.org',user='bandit0',password='bandit0')
+shell = ssh(host='bandit.labs.overthewire.org',user='bandit0',password='bandit0', port=2220)

 # Show basic command syntax
 log.info("username: %s" % shell.whoami())
@@ -1,58 +0,0 @@
-############################################################
-# Dockerfile to build Pwntools container
-# Based on Ubuntu
-############################################################
-
-FROM ubuntu:trusty
-MAINTAINER Maintainer Gallopsled et al.
-
-RUN apt-get update && apt-get install -y software-properties-common
-RUN apt-add-repository --yes ppa:pwntools/binutils
-RUN apt-get update
-RUN apt-get install -y \
-	binutils \
-	binutils-aarch64-linux-gnu \
-	binutils-arm-linux-gnueabihf \
-	curl \
-	gdb \
-	gdbserver \
-	gdb-multiarch \
-	git \
-	libc6-i386 \
-	libc6-arm64-cross \
-	libc6-armhf-cross \
-	libc6-dev-i386 \
-	libffi-dev \
-	libglib2.0-dev \
-	libncurses5-dev \
-	libncursesw5-dev \
-	ltrace \
-	python-dev \
-	python-pip \
-	python3-pip \
-	python2.7 \
-	qemu \
-	qemu-user-static \
-	strace \
-	tmux \
-	wget
-RUN pip install --upgrade ipython
-RUN useradd -m zerocool
-RUN usermod -U zerocool
-
-RUN mkdir -p /etc/qemu-binfmt
-RUN ln -s /usr/aarch64-linux-gnu /etc/qemu-binfmt/aarch64
-RUN ln -s /usr/arm-linux-gnueabihf /etc/qemu-binfmt/arm
-
-RUN pip install --upgrade pip pycparser psutil python-ptrace
-RUN pip3 install --upgrade pip pycparser psutil python-ptrace
-
-RUN pip install --upgrade git+https://github.com/Gallopsled/pwntools.git
-
-RUN locale-gen en_US.UTF-8
-ENV LANG en_US.UTF-8
-ENV LANGUAGE en_US:en
-ENV LC_ALL en_US.UTF-8
-
-RUN chown -R zerocool.zerocool /home/zerocool
-RUN chsh -s /bin/bash zerocool
@@ -0,0 +1,13 @@
+subdirs=xenial stable $(wildcard */)
+makefiles=$(wildcard */Makefile)
+tags=base stable beta dev
+
+all: $(makefiles) $(subdirs)
+
+$(subdirs):
+	docker build -t pwntools/pwntools:$(shell basename $(@)) "$@"
+
+$(makefiles):
+	make -C $(shell dirname $@)
+
+.PHONY: all $(subdirs) $(makefiles)
@@ -0,0 +1 @@
+xenial
@@ -0,0 +1,6 @@
+FROM pwntools/pwntools:stable
+
+USER root
+RUN pip install --upgrade git+https://github.com/Gallopsled/pwntools@beta
+RUN PWNLIB_NOTERM=1 pwn update
+USER pwntools
@@ -0,0 +1,6 @@
+FROM pwntools/pwntools:stable
+
+USER root
+RUN pip install --upgrade git+https://github.com/Gallopsled/pwntools@dev
+RUN PWNLIB_NOTERM=1 pwn update
+USER pwntools
@@ -0,0 +1,26 @@
+############################################################
+# Dockerfile to build Pwntools container
+# Based on Ubuntu
+############################################################
+
+FROM kalilinux/kali-linux-docker
+MAINTAINER Maintainer Gallopsled et al.
+
+RUN apt-get update \
+    && apt-get install -y \
+        build-essential \
+        git \
+        libssl-dev \
+        libffi-dev \
+        python2.7 \
+        python-pip \
+        python-dev \
+    && pip install --upgrade pip \
+    && python -m pip install --upgrade pwntools \
+    && PWNLIB_NOTERM=1 pwn update \
+    && apt-get install -y sudo \
+    && useradd -m pwntools \
+    && passwd --delete --unlock pwntools \
+    && echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
+USER pwntools
+WORKDIR /home/pwntools
@@ -0,0 +1,8 @@
+all: Dockerfile
+
+Dockerfile: ../xenial/Dockerfile FORCE
+	sed "s|ubuntu:xenial|kalilinux/kali-linux-docker|" < "$<" > "$@"
+
+FORCE:
+
+.PHONY: all
@@ -0,0 +1,26 @@
+############################################################
+# Dockerfile to build Pwntools container
+# Based on Ubuntu
+############################################################
+
+FROM ubuntu:precise
+MAINTAINER Maintainer Gallopsled et al.
+
+RUN apt-get update \
+    && apt-get install -y \
+        build-essential \
+        git \
+        libssl-dev \
+        libffi-dev \
+        python2.7 \
+        python-pip \
+        python-dev \
+    && pip install --upgrade pip \
+    && python -m pip install --upgrade pwntools \
+    && PWNLIB_NOTERM=1 pwn update \
+    && apt-get install -y sudo \
+    && useradd -m pwntools \
+    && passwd --delete --unlock pwntools \
+    && echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
+USER pwntools
+WORKDIR /home/pwntools
@@ -0,0 +1,8 @@
+all: Dockerfile
+
+Dockerfile: ../xenial/Dockerfile FORCE
+	sed "s|ubuntu:xenial|ubuntu:precise|" < "$<" > "$@"
+
+FORCE:
+
+.PHONY: all
@@ -0,0 +1,6 @@
+FROM pwntools/pwntools:base
+
+USER root
+RUN pip install --upgrade git+https://github.com/Gallopsled/pwntools@stable
+RUN PWNLIB_NOTERM=1 pwn update
+USER pwntools
@@ -0,0 +1,26 @@
+############################################################
+# Dockerfile to build Pwntools container
+# Based on Ubuntu
+############################################################
+
+FROM ubuntu:trusty
+MAINTAINER Maintainer Gallopsled et al.
+
+RUN apt-get update \
+    && apt-get install -y \
+        build-essential \
+        git \
+        libssl-dev \
+        libffi-dev \
+        python2.7 \
+        python-pip \
+        python-dev \
+    && pip install --upgrade pip \
+    && python -m pip install --upgrade pwntools \
+    && PWNLIB_NOTERM=1 pwn update \
+    && apt-get install -y sudo \
+    && useradd -m pwntools \
+    && passwd --delete --unlock pwntools \
+    && echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
+USER pwntools
+WORKDIR /home/pwntools
@@ -0,0 +1,8 @@
+all: Dockerfile
+
+Dockerfile: ../xenial/Dockerfile FORCE
+	sed "s|ubuntu:xenial|ubuntu:trusty|" < "$<" > "$@"
+
+FORCE:
+
+.PHONY: all
@@ -0,0 +1,26 @@
+############################################################
+# Dockerfile to build Pwntools container
+# Based on Ubuntu
+############################################################
+
+FROM ubuntu:xenial
+MAINTAINER Maintainer Gallopsled et al.
+
+RUN apt-get update \
+    && apt-get install -y \
+        build-essential \
+        git \
+        libssl-dev \
+        libffi-dev \
+        python2.7 \
+        python-pip \
+        python-dev \
+    && pip install --upgrade pip \
+    && python -m pip install --upgrade pwntools \
+    && PWNLIB_NOTERM=1 pwn update \
+    && apt-get install -y sudo \
+    && useradd -m pwntools \
+    && passwd --delete --unlock pwntools \
+    && echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
+USER pwntools
+WORKDIR /home/pwntools
@@ -1,8 +1,11 @@
 # Promote useful stuff to toplevel
-from .toplevel import *
+from __future__ import absolute_import
+
+from pwn.toplevel import *

 pwnlib.args.initialize()
 pwnlib.log.install_default_handler()
+pwnlib.config.initialize()

 log = pwnlib.log.getLogger('pwnlib.exploit')
 args = pwnlib.args.args
@@ -21,18 +21,18 @@ import pwnlib
 from pwnlib import *
 from pwnlib.asm import *
 from pwnlib.context import Thread
-from pwnlib.context import context
+from pwnlib.context import context, LocalContext
 from pwnlib.dynelf import DynELF
 from pwnlib.encoders import *
-from pwnlib.elf import Core
-from pwnlib.elf import ELF
-from pwnlib.elf import load
+from pwnlib.elf.corefile import Core, Corefile, Coredump
+from pwnlib.elf.elf import ELF, load
 from pwnlib.encoders import *
 from pwnlib.exception import PwnlibException
+from pwnlib.gdb import attach, debug, debug_assembly, debug_shellcode
 from pwnlib.flag import *
 from pwnlib.fmtstr import FmtStr, fmtstr_payload
 from pwnlib.log import getLogger
-from pwnlib.memleak import MemLeak
+from pwnlib.memleak import MemLeak, RelativeMemLeak
 from pwnlib.regsort import *
 from pwnlib.replacements import *
 from pwnlib.rop import ROP
@@ -40,9 +40,10 @@ from pwnlib.rop.srop import SigreturnFrame
 from pwnlib.runner import *
 from pwnlib.timeout import Timeout
 from pwnlib.tubes.listen import listen
-from pwnlib.tubes.process import process
+from pwnlib.tubes.process import process, PTY, PIPE, STDOUT
 from pwnlib.tubes.remote import remote, tcp, udp, connect
 from pwnlib.tubes.serialtube import serialtube
+from pwnlib.tubes.server import server
 from pwnlib.tubes.ssh import ssh
 from pwnlib.tubes.tube import tube
 from pwnlib.ui import *
@@ -66,15 +67,8 @@ from pwnlib.util.web import *

 # Promote these modules, so that "from pwn import *" will let you access them

-try:
-    import cPickle as pickle
-except ImportError:
-    import pickle
-
-try:
-    from cStringIO import StringIO
-except ImportError:
-    from StringIO import StringIO
+from six.moves import cPickle as pickle, cStringIO as StringIO
+from six import BytesIO

 error   = log.error
 warning = log.warning
@@ -82,3 +76,5 @@ warn    = log.warning
 info    = log.info
 debug   = log.debug
 success = log.success
+
+__all__ = [x for x in globals().keys() if x != '__name__']
@@ -1,6 +1,8 @@
+from __future__ import absolute_import
+
 import importlib

-from .version import __version__
+from pwnlib.version import __version__

 version = __version__

@@ -12,6 +14,7 @@ __all__ = [
    'commandline',
    'constants',
    'context',
+    'data',
    'dynelf',
    'encoders',
    'elf',
@@ -1,6 +1,9 @@
 # -*- coding: utf-8 -*-
-from .context import LocalContext
-from .context import context
+from __future__ import absolute_import
+from __future__ import division
+
+from pwnlib.context import LocalContext
+from pwnlib.context import context


 class ABI(object):
@@ -24,7 +27,8 @@ class ABI(object):
    #: Indicates that this ABI returns to the next address on the slot
    returns            = True

-    def __init__(self, regs, align, minimum):
+    def __init__(self, stack, regs, align, minimum):
+        self.stack              = stack
        self.register_arguments = regs
        self.arg_alignment      = align
        self.stack_minimum      = minimum
@@ -32,12 +36,26 @@ class ABI(object):
    @staticmethod
    @LocalContext
    def default():
+        if context.os == 'android':
+            context.os = 'linux'
+
        return {
        (32, 'i386', 'linux'):  linux_i386,
+        (64, 'aarch64', 'linux'): linux_aarch64,
        (64, 'amd64', 'linux'): linux_amd64,
        (32, 'arm', 'linux'):   linux_arm,
        (32, 'thumb', 'linux'):   linux_arm,
        (32, 'mips', 'linux'):   linux_mips,
+        (32, 'powerpc', 'linux'): linux_ppc,
+        (64, 'powerpc', 'linux'): linux_ppc64,
+        (32, 'i386', 'freebsd'):  freebsd_i386,
+        (64, 'aarch64', 'freebsd'): freebsd_aarch64,
+        (64, 'amd64', 'freebsd'): freebsd_amd64,
+        (32, 'arm', 'freebsd'):   freebsd_arm,
+        (32, 'thumb', 'freebsd'):   freebsd_arm,
+        (32, 'mips', 'freebsd'):   freebsd_mips,
+        (32, 'powerpc', 'freebsd'): freebsd_ppc,
+        (64, 'powerpc', 'freebsd'): freebsd_ppc64,
        (32, 'i386', 'windows'):  windows_i386,
        (64, 'amd64', 'windows'): windows_amd64,
        }[(context.bits, context.arch, context.os)]
@@ -45,22 +63,47 @@ class ABI(object):
    @staticmethod
    @LocalContext
    def syscall():
+        if context.os == 'android':
+            context.os = 'linux'
+
        return {
        (32, 'i386', 'linux'):  linux_i386_syscall,
        (64, 'amd64', 'linux'): linux_amd64_syscall,
+        (64, 'aarch64', 'linux'): linux_aarch64_syscall,
        (32, 'arm', 'linux'):   linux_arm_syscall,
        (32, 'thumb', 'linux'):   linux_arm_syscall,
        (32, 'mips', 'linux'):   linux_mips_syscall,
+        (64, 'aarch64', 'linux'):   linux_aarch64_syscall,
+        (32, 'powerpc', 'linux'): linux_ppc_syscall,
+        (64, 'powerpc', 'linux'): linux_ppc64_syscall,
+        (32, 'i386', 'freebsd'):  freebsd_i386_syscall,
+        (64, 'amd64', 'freebsd'): freebsd_amd64_syscall,
+        (64, 'aarch64', 'freebsd'): freebsd_aarch64_syscall,
+        (32, 'arm', 'freebsd'):   freebsd_arm_syscall,
+        (32, 'thumb', 'freebsd'):   freebsd_arm_syscall,
+        (32, 'mips', 'freebsd'):   freebsd_mips_syscall,
+        (64, 'aarch64', 'freebsd'):   freebsd_aarch64_syscall,
+        (32, 'powerpc', 'freebsd'): freebsd_ppc_syscall,
+        (64, 'powerpc', 'freebsd'): freebsd_ppc64_syscall,
        }[(context.bits, context.arch, context.os)]

    @staticmethod
    @LocalContext
    def sigreturn():
+        if context.os == 'android':
+            context.os = 'linux'
+
        return {
        (32, 'i386', 'linux'):  linux_i386_sigreturn,
        (64, 'amd64', 'linux'): linux_amd64_sigreturn,
        (32, 'arm', 'linux'):   linux_arm_sigreturn,
        (32, 'thumb', 'linux'):   linux_arm_sigreturn,
+        (64, 'aarch64', 'linux'):   linux_aarch64_sigreturn,
+        (32, 'i386', 'freebsd'):  freebsd_i386_sigreturn,
+        (64, 'amd64', 'freebsd'): freebsd_amd64_sigreturn,
+        (32, 'arm', 'freebsd'):   freebsd_arm_sigreturn,
+        (32, 'thumb', 'freebsd'):   freebsd_arm_sigreturn,
+        (64, 'aarch64', 'freebsd'):   freebsd_aarch64_sigreturn,
        }[(context.bits, context.arch, context.os)]

 class SyscallABI(ABI):
@@ -68,9 +111,9 @@ class SyscallABI(ABI):
    The syscall ABI treats the syscall number as the zeroth argument,
    which must be loaded into the specified register.
    """
-    def __init__(self, register_arguments, *a, **kw):
-        super(SyscallABI, self).__init__(register_arguments, *a, **kw)
-        self.syscall_register = register_arguments[0]
+    def __init__(self, *a, **kw):
+        super(SyscallABI, self).__init__(*a, **kw)
+        self.syscall_register = self.register_arguments[0]

 class SigreturnABI(SyscallABI):
    """
@@ -81,26 +124,61 @@ class SigreturnABI(SyscallABI):
    returns = False


-linux_i386   = ABI([], 4, 0)
-linux_amd64  = ABI(['rdi','rsi','rdx','rcx','r8','r9'], 8, 0)
-linux_arm    = ABI(['r0', 'r1', 'r2', 'r3'], 8, 0)
-linux_aarch64 = ABI(['x0', 'x1', 'x2', 'x3'], 16, 0)
-linux_mips  = ABI(['$a0','$a1','$a2','$a3'], 4, 0)
+# System V ABI used by many UNIXes
+linux_i386   = ABI('esp', [], 4, 0)
+linux_amd64  = ABI('rsp', ['rdi','rsi','rdx','rcx','r8','r9'], 8, 0)
+linux_arm    = ABI('sp', ['r0', 'r1', 'r2', 'r3'], 8, 0)
+linux_aarch64 = ABI('sp', ['x0', 'x1', 'x2', 'x3'], 16, 0)
+linux_mips  = ABI('$sp', ['$a0','$a1','$a2','$a3'], 4, 0)
+linux_ppc = ABI('sp', ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 4, 0)
+linux_ppc64 = ABI('sp', ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 8, 0)

-linux_i386_syscall = SyscallABI(['eax', 'ebx', 'ecx', 'edx', 'esi', 'edi', 'ebp'], 4, 0)
-linux_amd64_syscall = SyscallABI(['rax','rdi', 'rsi', 'rdx', 'r10', 'r8', 'r9'],   8, 0)
-linux_arm_syscall   = SyscallABI(['r7', 'r0', 'r1', 'r2', 'r3', 'r4', 'r5', 'r6'], 4, 0)
-linux_aarch64_syscall   = SyscallABI(['x8', 'x0', 'x1', 'x2', 'x3', 'x4', 'x5', 'x6'], 16, 0)
-linux_mips_syscall  = ABI(['$v0', '$a0','$a1','$a2','$a3'], 4, 0)
+sysv_i386 = linux_i386
+sysv_amd64 = linux_amd64
+sysv_arm = linux_arm
+sysv_aarch64 = linux_aarch64
+sysv_mips = linux_mips
+sysv_ppc = linux_ppc
+sysv_ppc64 = linux_ppc64

-linux_i386_sigreturn = SigreturnABI(['eax'], 4, 0)
-linux_amd64_sigreturn = SigreturnABI(['rax'], 4, 0)
-linux_arm_sigreturn = SigreturnABI(['r7'], 4, 0)
+linux_i386_syscall = SyscallABI('esp', ['eax', 'ebx', 'ecx', 'edx', 'esi', 'edi', 'ebp'], 4, 0)
+linux_amd64_syscall = SyscallABI('rsp', ['rax', 'rdi', 'rsi', 'rdx', 'r10', 'r8', 'r9'],   8, 0)
+linux_arm_syscall   = SyscallABI('sp', ['r7', 'r0', 'r1', 'r2', 'r3', 'r4', 'r5', 'r6'], 4, 0)
+linux_aarch64_syscall   = SyscallABI('sp', ['x8', 'x0', 'x1', 'x2', 'x3', 'x4', 'x5', 'x6'], 16, 0)
+linux_mips_syscall  = SyscallABI('$sp', ['$v0','$a0','$a1','$a2','$a3'], 4, 0)
+linux_ppc_syscall = ABI('sp', ['r0', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9'], 4, 0)
+linux_ppc64_syscall = ABI('sp', ['r0', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9'], 8, 0)

-windows_i386  = ABI([], 4, 0)
-windows_amd64 = ABI(['rcx','rdx','r8','r9'], 32, 32)
+linux_i386_sigreturn = SigreturnABI('esp', ['eax'], 4, 0)
+linux_amd64_sigreturn = SigreturnABI('rsp', ['rax'], 4, 0)
+linux_arm_sigreturn = SigreturnABI('sp', ['r7'], 4, 0)
+linux_aarch64_sigreturn = SigreturnABI('sp', ['x8'], 16, 0)

-# Fake ABIs used by SROP
-linux_i386_srop = ABI(['eax'], 4, 0)
-linux_amd64_srop = ABI(['rax'], 4, 0)
-linux_arm_srop = ABI(['r7'], 4, 0)
+sysv_i386_sigreturn = linux_i386_sigreturn
+sysv_amd64_sigreturn = linux_amd64_sigreturn
+sysv_arm_sigreturn = linux_arm_sigreturn
+sysv_aarch64_sigreturn = linux_aarch64_sigreturn
+
+freebsd_i386 = sysv_i386
+freebsd_amd64 = sysv_amd64
+freebsd_arm = sysv_arm
+freebsd_aarch64 = sysv_aarch64
+freebsd_mips = sysv_mips
+freebsd_ppc = sysv_ppc
+freebsd_ppc64 = sysv_ppc64
+
+freebsd_i386_syscall   = SyscallABI('esp', ['eax'], 4, 0)
+freebsd_amd64_syscall  = SyscallABI('rsp', ['rax','rdi','rsi','rdx','rcx','r8','r9'], 8, 0)
+freebsd_arm_syscall    = SyscallABI('sp', ['r7', 'r0', 'r1', 'r2', 'r3'], 8, 0)
+freebsd_aarch64_syscall = SyscallABI('sp', ['x8', 'x0', 'x1', 'x2', 'x3'], 16, 0)
+freebsd_mips_syscall  = SyscallABI('$sp', ['$v0','$a0','$a1','$a2','$a3'], 4, 0)
+freebsd_ppc_syscall = SyscallABI('sp', ['r0', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 4, 0)
+freebsd_ppc64_syscall = SyscallABI('sp', ['r0', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 8, 0)
+
+freebsd_i386_sigreturn = sysv_i386_sigreturn
+freebsd_amd64_sigreturn = sysv_amd64_sigreturn
+freebsd_arm_sigreturn = sysv_arm_sigreturn
+freebsd_aarch64_sigreturn = sysv_aarch64_sigreturn
+
+windows_i386  = ABI('esp', [], 4, 0)
+windows_amd64 = ABI('rsp', ['rcx','rdx','r8','r9'], 32, 32)
@@ -1,2 +1,6 @@
-from .adb import *
-from .protocol import Client
+from __future__ import absolute_import
+
+from pwnlib.adb.adb import *
+from pwnlib.adb.protocol import Client
+from pwnlib.adb.bootimg import BootImage
+from pwnlib.adb.bootloader import BootloaderImage
@@ -1,6 +1,7 @@
 """Provides utilities for interacting with Android devices via the Android Debug Bridge.

-# Using Android Devices with Pwntools
+Using Android Devices with Pwntools
+-----------------------------------

 Pwntools tries to be as easy as possible to use with Android devices.

@@ -29,42 +30,45 @@ instance.
        error("Could not find any shamus!")

 Once a device is selected, you can operate on it with any of the functions in
-the ``pwnlib.adb`` module.
+the :mod:`pwnlib.adb` module.

 .. code-block:: python

    # Get a process listing
-    print adb.process(['ps']).recvall()
+    print(adb.process(['ps']).recvall())

    # Fetch properties
-    print adb.properties.ro.build.fingerprint
+    print(adb.properties.ro.build.fingerprint)

    # Read and write files
-    print adb.read('/proc/version')
+    print(adb.read('/proc/version'))
    adb.write('/data/local/tmp/foo', 'my data')

 """
+from __future__ import absolute_import
+from __future__ import division
+
 import functools
 import glob
 import logging
 import os
-import platform
 import re
 import shutil
+import six
 import stat
 import tempfile
 import time

 import dateutil.parser

-from .. import atexit
-from .. import tubes
-from ..context import LocalContext
-from ..context import context
-from ..device import Device
-from ..log import getLogger
-from ..util import misc
-from .protocol import Client
+from pwnlib import atexit
+from pwnlib import tubes
+from pwnlib.context import LocalContext
+from pwnlib.context import context
+from pwnlib.device import Device
+from pwnlib.log import getLogger
+from pwnlib.protocols.adb import AdbClient
+from pwnlib.util import misc

 log = getLogger(__name__)

@@ -72,9 +76,9 @@ def adb(argv, *a, **kw):
    r"""Returns the output of an ADB subcommand.

    >>> adb.adb(['get-serialno'])
-    'emulator-5554\n'
+    b'emulator-5554\n'
    """
-    if isinstance(argv, (str, unicode)):
+    if isinstance(argv, (bytes, six.text_type)):
        argv = [argv]

    log.debug("$ " + ' '.join(context.adb + argv))
@@ -85,10 +89,10 @@ def adb(argv, *a, **kw):

    return tubes.process.process(context.adb + argv, *a, **kw).recvall()

-@context.quiet
+@context.quietfunc
 def devices(serial=None):
    """Returns a list of ``Device`` objects corresponding to the connected devices."""
-    with Client() as c:
+    with AdbClient() as c:
        lines = c.devices(long=True)
    result = []

@@ -143,7 +147,7 @@ def root():
    log.info("Enabling root on %s" % context.device)

    with context.quiet:
-        with Client() as c:
+        with AdbClient() as c:
            reply = c.root()

    if 'already running as root' in reply:
@@ -172,7 +176,7 @@ def reboot(wait=True):
    """
    log.info('Rebooting device %s' % context.device)

-    with Client() as c:
+    with AdbClient() as c:
        c.reboot()

    if wait:
@@ -185,7 +189,7 @@ def reboot_bootloader():
    """
    log.info('Rebooting %s to bootloader' % context.device)

-    with Client() as c:
+    with AdbClient() as c:
        c.reboot_bootloader()

@with_device
@@ -325,7 +329,7 @@ class AdbDevice(Device):
            kwargs['port'] = 'emulator'

        for field in fields[2:]:
-            k,v = field.split(':')
+            k,v = field.split(':', 1)
            kwargs[k] = v

        return AdbDevice(serial, type, **kwargs)
@@ -343,7 +347,7 @@ class AdbDevice(Device):
        of this device.

        >>> property = 'ro.build.fingerprint'
-        >>> device = adb.current_device()
+        >>> device = adb.wait_for_device()
        >>> adb.getprop(property) == device.getprop(property)
        True
        """
@@ -352,7 +356,6 @@ class AdbDevice(Device):

            if name not in g:
                raise AttributeError('%r object has no attribute %r' % (type(self).__name__,name))
-
            value = g[name]

        if not hasattr(value, '__call__'):
@@ -376,7 +379,7 @@ def wait_for_device(kick=False):
        >>> device = adb.wait_for_device()
    """
    with log.waitfor("Waiting for device to come online") as w:
-        with Client() as c:
+        with AdbClient() as c:
            if kick:
                try:
                    c.reconnect()
@@ -387,7 +390,7 @@ def wait_for_device(kick=False):
            if context.device:
                serial = str(context.device)

-        with Client() as c:
+        with AdbClient() as c:
            c.wait_for_device(serial)

        for device in devices():
@@ -412,10 +415,10 @@ def wait_for_device(kick=False):
@with_device
 def disable_verity():
    """Disables dm-verity on the device."""
-    with log.waitfor("Disabling dm-verity on %s" % context.device) as w:
+    with log.waitfor("Disabling dm-verity on %s" % context.device):
        root()

-        with Client() as c:
+        with AdbClient() as c:
            reply = c.disable_verity()

        if 'Verity already disabled' in reply:
@@ -430,11 +433,11 @@ def disable_verity():
@with_device
 def remount():
    """Remounts the filesystem as writable."""
-    with log.waitfor("Remounting filesystem on %s" % context.device) as w:
+    with log.waitfor("Remounting filesystem on %s" % context.device):
        disable_verity()
        root()

-        with Client() as c:
+        with AdbClient() as c:
            reply = c.remount()

        if 'remount succeeded' not in reply:
@@ -445,7 +448,7 @@ def unroot():
    """Restarts adbd as AID_SHELL."""
    log.info("Unrooting %s" % context.device)
    with context.quiet:
-        with Client() as c:
+        with AdbClient() as c:
            reply  = c.unroot()

    if '0006closed' == reply:
@@ -483,7 +486,7 @@ def pull(remote_path, local_path=None):
    Example:

        >>> _=adb.pull('/proc/version', './proc-version')
-        >>> print read('./proc-version') # doctest: +ELLIPSIS
+        >>> print(read('./proc-version').decode('utf-8')) # doctest: +ELLIPSIS
        Linux version ...
    """
    if local_path is None:
@@ -508,12 +511,16 @@ def push(local_path, remote_path):
        local_path(str): Path to the local file to push.
        remote_path(str): Path or directory to store the file on the device.

+    Returns:
+        Remote path of the file.
+
    Example:

        >>> write('./filename', 'contents')
-        >>> _=adb.push('./filename', '/data/local/tmp')
+        >>> adb.push('./filename', '/data/local/tmp')
+        '/data/local/tmp/filename'
        >>> adb.read('/data/local/tmp/filename')
-        'contents'
+        b'contents'
        >>> adb.push('./filename', '/does/not/exist')
        Traceback (most recent call last):
        ...
@@ -526,7 +533,7 @@ def push(local_path, remote_path):
        msg += ' (%s)' % context.device

    with log.waitfor(msg) as w:
-        with Client() as c:
+        with AdbClient() as c:

            # We need to discover whether remote_path is a directory or not.
            # If we cannot stat the full path, assume it's a path-plus-filename,
@@ -546,10 +553,13 @@ def push(local_path, remote_path):
            if stat.S_ISDIR(mode):
                remote_path = os.path.join(remote_path, remote_filename)

-            return c.write(remote_path,
-                           misc.read(local_path),
-                           callback=_create_adb_push_pull_callback(w))
-@context.quiet
+            c.write(remote_path,
+                    misc.read(local_path),
+                    callback=_create_adb_push_pull_callback(w))
+
+    return remote_path
+
+@context.quietfunc
@with_device
 def read(path, target=None, callback=None):
    """Download a file from the device, and extract its contents.
@@ -559,18 +569,18 @@ def read(path, target=None, callback=None):
        target(str): Optional, location to store the file.
            Uses a temporary file by default.
        callback(callable): See the documentation for
-            ``adb.protocol.Client.read``.
+            ``adb.protocol.AdbClient.read``.

    Examples:

-        >>> print adb.read('/proc/version') # doctest: +ELLIPSIS
+        >>> print(adb.read('/proc/version').decode('utf-8')) # doctest: +ELLIPSIS
        Linux version ...
        >>> adb.read('/does/not/exist')
        Traceback (most recent call last):
        ...
        PwnlibException: Could not stat '/does/not/exist'
    """
-    with Client() as c:
+    with AdbClient() as c:
        stat = c.stat(path)
        if not stat:
            log.error('Could not stat %r' % path)
@@ -581,9 +591,9 @@ def read(path, target=None, callback=None):

    return data

-@context.quiet
+@context.quietfunc
@with_device
-def write(path, data=''):
+def write(path, data=b''):
    """Create a file on the device with the provided contents.

    Arguments:
@@ -592,29 +602,173 @@ def write(path, data=''):

    Examples:

-        >>> adb.write('/dev/null', 'data')
+        >>> adb.write('/dev/null', b'data')
        >>> adb.write('/data/local/tmp/')
    """
    with tempfile.NamedTemporaryFile() as temp:
        misc.write(temp.name, data)
        push(temp.name, path)

+@context.quietfunc
+@with_device
+def mkdir(path):
+    """Create a directory on the target device.
+
+    Note:
+        Silently succeeds if the directory already exists.
+
+    Arguments:
+        path(str): Directory to create.
+
+    Examples:
+
+        >>> adb.mkdir('/')
+
+        >>> path = '/data/local/tmp/mkdir_test'
+        >>> adb.exists(path)
+        False
+        >>> adb.mkdir(path)
+        >>> adb.exists(path)
+        True
+
+        >>> adb.mkdir('/init')
+        Traceback (most recent call last):
+        ...
+        PwnlibException: mkdir failed for /init, File exists
+    """
+    if not path.startswith('/'):
+        log.error("Must provide an absolute path: %r" % path)
+
+    with AdbClient() as c:
+        st = c.stat(path)
+
+        # Don't re-create existing directories
+        if st and stat.S_ISDIR(st['mode']):
+            return
+
+        result = process(['mkdir', path]).recvall()
+
+        # Any output at all is an error
+        if result:
+            log.error(result.rstrip().decode('utf-8'))
+
+@context.quietfunc
+@with_device
+def makedirs(path):
+    """Create a directory and all parent directories on the target device.
+
+    Note:
+        Silently succeeds if the directory already exists.
+
+    Examples:
+
+        >>> adb.makedirs('/data/local/tmp/this/is/a/directory/heirarchy')
+        >>> adb.listdir('/data/local/tmp/this/is/a/directory')
+        ['heirarchy']
+    """
+    if path != '/':
+        makedirs(os.path.dirname(path))
+
+    mkdir(path)
+
+@context.quietfunc
+@with_device
+def exists(path):
+    """Return :const:`True` if ``path`` exists on the target device.
+
+    Examples:
+
+        >>> adb.exists('/')
+        True
+        >>> adb.exists('/init')
+        True
+        >>> adb.exists('/does/not/exist')
+        False
+    """
+    with AdbClient() as c:
+        return bool(c.stat(path))
+
+@context.quietfunc
+@with_device
+def isdir(path):
+    """Return :const:`True` if ``path`` is a on the target device.
+
+    Examples:
+
+        >>> adb.isdir('/')
+        True
+        >>> adb.isdir('/init')
+        False
+        >>> adb.isdir('/does/not/exist')
+        False
+    """
+    with AdbClient() as c:
+        st = c.stat(path)
+        return bool(st and stat.S_ISDIR(st['mode']))
+
+@context.quietfunc
+@with_device
+def unlink(path, recursive=False):
+    """Unlinks a file or directory on the target device.
+
+    Examples:
+
+        >>> adb.unlink("/does/not/exist")
+        Traceback (most recent call last):
+        ...
+        PwnlibException: Could not unlink '/does/not/exist': Does not exist
+
+        >>> filename = '/data/local/tmp/unlink-test'
+        >>> adb.write(filename, 'hello')
+        >>> adb.exists(filename)
+        True
+        >>> adb.unlink(filename)
+        >>> adb.exists(filename)
+        False
+
+        >>> adb.mkdir(filename)
+        >>> adb.write(filename + '/contents', 'hello')
+        >>> adb.unlink(filename)
+        Traceback (most recent call last):
+        ...
+        PwnlibException: Cannot delete non-empty directory '/data/local/tmp/unlink-test' without recursive=True
+
+        >>> adb.unlink(filename, recursive=True)
+        >>> adb.exists(filename)
+        False
+    """
+    with AdbClient() as c:
+        st = c.stat(path)
+        if not st:
+            log.error("Could not unlink %r: Does not exist" % path)
+
+        # If the directory is not empty, do not delete it
+        if isdir(path) and c.list(path) and not recursive:
+            log.error("Cannot delete non-empty directory %r without recursive=True" % path)
+
+        flags = '-rf' if recursive else '-f'
+
+        output = c.execute(['rm', flags, path]).recvall()
+
+        if output:
+            log.error(output.decode('utf-8'))
+
@with_device
 def process(argv, *a, **kw):
    """Execute a process on the device.

-    See ``pwnlib.tubes.process.process`` documentation for more info.
+    See :class:`pwnlib.tubes.process.process` documentation for more info.

    Returns:
-        A ``process`` tube.
+        A :class:`pwnlib.tubes.process.process` tube.

    Examples:

        >>> adb.root()
-        >>> print adb.process(['cat','/proc/version']).recvall() # doctest: +ELLIPSIS
+        >>> print(adb.process(['cat','/proc/version']).recvall().decode('utf-8')) # doctest: +ELLIPSIS
        Linux version ...
    """
-    if isinstance(argv, (str, unicode)):
+    if isinstance(argv, (bytes, six.text_type)):
        argv = [argv]

    message = "Starting %s process %r" % ('Android', argv[0])
@@ -623,7 +777,7 @@ def process(argv, *a, **kw):
        if argv != [argv[0]]: message += ' argv=%r ' % argv

    with log.progress(message) as p:
-        return Client().execute(argv)
+        return AdbClient().execute(argv)

@with_device
 def interactive(**kw):
@@ -636,27 +790,62 @@ def shell(**kw):
    return process(['sh', '-i'], **kw)

@with_device
-def which(name):
-    """Retrieves the full path to a binary in ``PATH`` on the device
+def which(name, all = False, *a, **kw):
+    """Retrieves the full path to a binary in ``$PATH`` on the device

-    >>> adb.which('sh')
-    '/system/bin/sh'
+    Arguments:
+        name(str): Binary name
+        all(bool): Whether to return all paths, or just the first
+        *a: Additional arguments for :func:`.adb.process`
+        **kw: Additional arguments for :func:`.adb.process`
+
+    Returns:
+        Either a path, or list of paths
+
+    Example:
+
+        >>> adb.which('sh')
+        '/system/bin/sh'
+        >>> adb.which('sh', all=True)
+        ['/system/bin/sh']
+
+        >>> adb.which('foobar') is None
+        True
+        >>> adb.which('foobar', all=True)
+        []
    """
    # Unfortunately, there is no native 'which' on many phones.
    which_cmd = '''
-IFS=:
-BINARY=%s
-P=($PATH)
-for path in "${P[@]}"; do \
-    if [ -e "$path/$BINARY" ]; then \
-        echo "$path/$BINARY";
-        break
-    fi
+echo $PATH | while read -d: directory; do
+    [ -x "$directory/{name}" ] || continue;
+    echo -n "$directory/{name}\\x00";
 done
-''' % name
+[ -x "{name}" ] && echo -n "$PWD/{name}\\x00"
+'''.format(name=name)

    which_cmd = which_cmd.strip()
-    return process(['sh','-c',which_cmd]).recvall().strip()
+    data = process(['sh','-c', which_cmd], *a, **kw).recvall()
+    if not hasattr(data, 'encode'):
+        data = data.decode('utf-8')
+    result = []
+
+    for path in data.split('\x00'):
+        # Skip empty entries
+        if not path:
+            continue
+
+        # Return the first entry if all=False
+        if not all:
+            return path
+
+        # Accumulate all entries if all=True
+        result.append(path)
+
+    if all:
+        return result
+
+    return None
+

@with_device
 def whoami():
@@ -666,10 +855,10 @@ def whoami():
 def forward(port):
    """Sets up a port to forward to the device."""
    tcp_port = 'tcp:%s' % port
-    start_forwarding = adb(['forward', tcp_port, tcp_port])
+    adb(['forward', tcp_port, tcp_port])
    atexit.register(lambda: adb(['forward', '--remove', tcp_port]))

-@context.quiet
+@context.quietfunc
@with_device
 def logcat(stream=False):
    """Reads the system log file.
@@ -677,12 +866,12 @@ def logcat(stream=False):
    By default, causes logcat to exit after reading the file.

    Arguments:
-        stream(bool): If ``True``, the contents are streamed rather than
-            read in a one-shot manner.  Default is ``False``.
+        stream(bool): If :const:`True`, the contents are streamed rather than
+            read in a one-shot manner.  Default is :const:`False`.

    Returns:
-        If ``stream`` is ``False``, returns a string containing the log data.
-        Otherwise, it returns a ``tube`` connected to the log output.
+        If ``stream`` is :const:`False`, returns a string containing the log data.
+        Otherwise, it returns a :class:`pwnlib.tubes.tube.tube` connected to the log output.
    """

    if stream:
@@ -694,9 +883,16 @@ def logcat(stream=False):
 def pidof(name):
    """Returns a list of PIDs for the named process."""
    with context.quiet:
-        io = process(['pidof', name])
-        data = io.recvall().split()
-    return list(map(int, data))
+        # Older devices have a broken 'pidof', apparently.
+        # Try pgrep first.
+        io = process(['pgrep', name])
+        data = io.recvall()
+
+        if 'not found' in data:
+            io = process(['pidof', name])
+            data = io.recvall()
+
+    return list(map(int, data.split()))

@with_device
 def proc_exe(pid):
@@ -719,11 +915,17 @@ def getprop(name=None):
    """
    with context.quiet:
        if name:
-            return process(['getprop', name]).recvall().strip()
+            result = process(['getprop', name]).recvall().strip()
+            if not hasattr(result, 'encode'):
+                result = result.decode('utf-8')
+            return result


        result = process(['getprop']).recvall()

+    if not hasattr(result, 'encode'):
+        result = result.decode('utf-8')
+
    expr = r'\[([^\]]+)\]: \[(.*)\]'

    props = {}
@@ -758,18 +960,17 @@ def listdir(directory='/'):
        Otherwise, less files may be returned due to restrictive SELinux
        policies on adbd.
    """
-    return list(sorted(Client().list(directory)))
+    return list(sorted(AdbClient().list(directory)))

+@with_device
 def fastboot(args, *a, **kw):
    """Executes a fastboot command.

    Returns:
        The command output.
    """
-    serial = context.device
-    if not serial:
-        log.error("Unknown device")
-    return tubes.process.process(['fastboot', '-s', serial] + list(args), **kw).recvall()
+    argv = ['fastboot', '-s', str(context.device)] + list(args)
+    return tubes.process.process(argv, *a, **kw).recvall()

@with_device
 def fingerprint():
@@ -794,7 +995,7 @@ def unlock_bootloader():
    Note:
        This requires physical interaction with the device.
    """
-    Client().reboot_bootloader()
+    AdbClient().reboot_bootloader()
    fastboot(['oem', 'unlock'])
    fastboot(['continue'])

@@ -806,7 +1007,7 @@ class Kernel(object):
        return self.symbols['_text']

    @property
-    @context.quiet
+    @context.quietfunc
    def symbols(self):
        """Returns a dictionary of kernel symbols"""
        result = {}
@@ -818,7 +1019,7 @@ class Kernel(object):
        return result

    @property
-    @context.quiet
+    @context.quietfunc
    def kallsyms(self):
        """Returns the raw output of kallsyms"""
        if not self._kallsyms:
@@ -829,20 +1030,20 @@ class Kernel(object):
        return self._kallsyms

    @property
-    @context.quiet
+    @context.quietfunc
    def version(self):
        """Returns the kernel version of the device."""
        root()
        return read('/proc/version').strip()

    @property
-    @context.quiet
+    @context.quietfunc
    def cmdline(self):
        root()
        return read('/proc/cmdline').strip()

    @property
-    @context.quiet
+    @context.quietfunc
    def lastmsg(self):
        root()
        if 'last_kmsg' in listdir('/proc'):
@@ -864,7 +1065,7 @@ class Kernel(object):
            'Nexus 7': 'oem uart-on',
        }

-        with log.waitfor('Enabling kernel UART') as w:
+        with log.waitfor('Enabling kernel UART'):

            if model not in known_commands:
                log.error("Device UART is unsupported.")
@@ -904,7 +1105,7 @@ class Property(object):
        self.__dict__['_name'] = name

    def __str__(self):
-        return getprop(self._name).strip()
+        return str(getprop(self._name)).strip()

    def __repr__(self):
        return repr(str(self))
@@ -1012,14 +1213,24 @@ def compile(source):
    if not project:
        # Realistically this should inherit from context.arch, but
        # this works for now.
-        abi = 'armeabi-v7a'
        sdk = '21'
+        abi = {
+            'aarch64': 'arm64-v8a',
+            'amd64':   'x86_64',
+            'arm':     'armeabi-v7a',
+            'i386':    'x86',
+            'mips':    'mips',
+            'mips64':  'mips64',
+        }.get(context.arch, None)

        # If we have an attached device, use its settings.
        if context.device:
            abi = str(properties.ro.product.cpu.abi)
            sdk = str(properties.ro.build.version.sdk)

+        if abi is None:
+            log.error("Unknown CPU ABI")
+
        project = _generate_ndk_project(source, abi, sdk)

    # Remove any output files
@@ -1056,7 +1267,7 @@ class Partition(object):
 def walk(top, topdown=True):
    join = os.path.join
    isdir = lambda x: stat.S_ISDIR(x['mode'])
-    client = Client()
+    client = AdbClient()
    names = client.list(top)

    dirs, nondirs = [], []
@@ -1094,15 +1305,15 @@ def readlink(path):

 class Partitions(object):
    @property
-    @context.quiet
+    @context.quietfunc
    def by_name_dir(self):
        return next(find('/dev/block/platform','by-name'))

-    @context.quiet
+    @context.quietfunc
    def __dir__(self):
        return list(self)

-    @context.quiet
+    @context.quietfunc
    @with_device
    def __iter__(self):
        root()
@@ -1111,7 +1322,7 @@ class Partitions(object):
        for name in listdir(self.by_name_dir):
            yield name

-    @context.quiet
+    @context.quietfunc
    @with_device
    def __getattr__(self, attr):
        for name in self:
@@ -1181,7 +1392,7 @@ def uninstall(package, *arguments):
        with context.quiet:
            return process(['pm','uninstall',package] + list(arguments)).recvall()

-@context.quiet
+@context.quietfunc
 def packages():
    """Returns a list of packages installed on the system"""
    packages = process(['pm', 'list', 'packages']).recvall()
@@ -0,0 +1,52 @@
+from __future__ import division
+
+import ctypes
+
+BOOT_MAGIC = b"ANDROID!"
+BOOT_MAGIC_SIZE = 8
+BOOT_NAME_SIZE = 16
+BOOT_ARGS_SIZE = 512
+BOOT_EXTRA_ARGS_SIZE = 1024
+
+
+class boot_img_hdr(ctypes.Structure):
+    _fields_ = [
+        ('magic', ctypes.c_char * BOOT_MAGIC_SIZE),
+
+        ('kernel_size', ctypes.c_uint32),
+        ('kernel_addr', ctypes.c_uint32),
+
+        ('ramdisk_size', ctypes.c_uint32),
+        ('ramdisk_addr', ctypes.c_uint32),
+
+        ('second_size', ctypes.c_uint32),
+        ('second_addr', ctypes.c_uint32),
+
+        ('tags_addr', ctypes.c_uint32),
+        ('page_size', ctypes.c_uint32),
+        ('unused', ctypes.c_uint32),
+
+        ('os_version', ctypes.c_uint32),
+
+        ('name', ctypes.c_char * BOOT_NAME_SIZE),
+        ('cmdline', ctypes.c_char * BOOT_ARGS_SIZE),
+        ('id', ctypes.c_char * 8),
+
+        ('extra_cmdline', ctypes.c_char * BOOT_EXTRA_ARGS_SIZE),
+    ]
+
+class BootImage(object):
+    def __init__(self, data):
+        self.data = data
+        self.header = boot_img_hdr.from_buffer_copy(data)
+
+        PAGE = self.page_size
+
+        # The kernel starts at the beginning of the second page.
+        self.kernel = self.data[PAGE:PAGE+self.kernel_size]
+
+    def __getattr__(self, name):
+        value = getattr(self.header, name, None)
+        if value is not None:
+            return value
+        return getattr(super(BootImage, self), name)
@@ -0,0 +1,124 @@
+from __future__ import unicode_literals
+from __future__ import division
+
+import ctypes
+import io
+import os
+import sys
+
+from pwnlib.log import getLogger
+
+log = getLogger(__name__)
+
+class img_info(ctypes.Structure):
+    _fields_ = [
+        ('name', ctypes.c_char * 64),
+        ('size', ctypes.c_uint32)
+    ]
+
+class bootloader_images_header(ctypes.Structure):
+    _fields_ = [
+        ('magic', ctypes.c_char * 8),
+        ('num_images', ctypes.c_uint32),
+        ('start_offset', ctypes.c_uint32),
+        ('bootldr_size', ctypes.c_uint32),
+    ]
+
+BOOTLDR_MAGIC = b'BOOTLDR!'
+
+class BootloaderImage(object):
+    def __init__(self, data):
+        """Android Bootloader image
+
+        Arguments:
+            data(str): Binary data from the image file.
+        """
+        self.data = data
+        self.header = bootloader_images_header.from_buffer_copy(data)
+
+        if self.magic != BOOTLDR_MAGIC:
+            log.error("Incorrect magic (%r, expected %r)" % (self.magic, BOOTLDR_MAGIC))
+
+        if(self.bootldr_size > len(data)):
+            log.warn_once("Bootloader is supposed to be %#x bytes, only have %#x",
+                          self.bootldr_size,
+                          len(data))
+
+        if(self.num_images >= 0x100):
+            old = self.num_images
+            self.num_images = 1
+            log.warn_once("Bootloader num_images (%#x) appears corrupted, truncating to 1",
+                          old)
+
+        imgarray = ctypes.ARRAY(img_info, self.num_images)
+        self.img_info = imgarray.from_buffer_copy(data, ctypes.sizeof(self.header))
+
+    def extract(self, index_or_name):
+        """extract(index_or_name) -> bytes
+
+        Extract the contents of an image.
+
+        Arguments:
+            index_or_name(str,int): Either an image index or name.
+
+        Returns:
+            Contents of the image.
+        """
+        if isinstance(index_or_name, int):
+            index = index_or_name
+        else:
+            for i in range(len(self.img_info)):
+                if self.img_info[i].name == index_or_name:
+                    index = i
+                    break
+            else:
+                raise ValueError("Invalid img name: %r" % index_or_name)
+
+        if index >= len(self.img_info):
+            raise ValueError("index out of range (%s, max %s)" % (index, len(self.img_info)))
+
+        offset = self.start_offset
+
+        for i in range(index):
+            offset += self.img_info[i].size
+
+        return self.data[offset:offset + self.img_info[index].size]
+
+    def extract_all(self, path):
+        """extract_all(path)
+
+        Extracts all images to the provided path.  The filenames are taken
+        from the image name, with '.img' appended.
+        """
+        if not os.path.isdir(path):
+            raise ValueError("%r does not exist or is not a directory" % path)
+
+        for img in self.img_info:
+            imgpath = os.path.join(path, img.name + '.img')
+            with open(imgpath, 'wb+') as f:
+                data = self.extract(img.name)
+                f.write(data)
+
+    def __str__(self):
+        rv = []
+        rv.append("Bootloader")
+        rv.append("  Magic:  %r" % self.magic)
+        rv.append("  Offset: %#x" % self.start_offset)
+        rv.append("  Size:   %#x" % self.bootldr_size)
+        rv.append("  Images: %s" % self.num_images)
+        for img in self.img_info:
+            rv.append("    Name: %s" % img.name)
+            rv.append("    Size: %#x" % img.size)
+            rv.append("    Data: %r..." % self.extract(img.name)[:32])
+        return '\n'.join(rv)
+
+    def __getattr__(self, name):
+        value = getattr(self.header, name, None)
+        if value is not None:
+            return value
+        return getattr(super(BootImage, self), name)
+
+if __name__ == '__main__':
+    # Easy sanity checking
+    b = BootloaderImage(open(sys.argv[1], 'rb').read())
+    print(b)
@@ -1,553 +1,5 @@
 """
-Implementation of the Android Debug Bridge (ADB) protocol, as far as Binjitsu needs it.
-
-Documentation is available here:
-https://android.googlesource.com/platform/system/core/+/master/adb/protocol.txt
+This file exists only for backward compatibility
 """
-import functools
-import stat
-import time
-
-from ..context import context
-from ..log import Logger
-from ..log import getLogger
-from ..tubes.listen import listen
-from ..tubes.process import process
-from ..tubes.remote import remote
-from ..util.lists import group
-from ..util.misc import size
-from ..util.packing import p32
-from ..util.proc import pidof
-from ..util.sh_string import sh_string
-
-log = getLogger(__name__)
-
-def pack(val):
-    return '%04x' % val
-
-def unpack(val):
-    return int(val, 16)
-
-OKAY = "OKAY"
-FAIL = "FAIL"
-
-class Message(object):
-    """An ADB hex-length-prefixed message"""
-    def __init__(self, string):
-        self.string = string
-    def __str__(self):
-        return ('%04x' % len(self.string)) + self.string
-    def __flat__(self):
-        return str(self)
-
-class Connection(remote):
-    """Connection to the ADB server"""
-    def __init__(self, host, port, level=None, *a, **kw):
-        super(Connection, self).__init__(host, port, level=level, *a, **kw)
-
-        self._executable = None
-        self._argv       = None
-        self._pid        = None
-        self._cwd        = None
-        self._env        = None
-
-    def close(self):
-        with context.quiet:
-            super(Connection, self).close()
-
-    def adb_send(self, message):
-        self.send(str(Message(message)))
-        return self.recvn(4)
-
-    def adb_unpack(self):
-        return unpack(self.recvn(4))
-
-    def flat(self, *a, **kw):
-        kw.setdefault('word_size', 32)
-        return super(Connection, self).flat(*a, **kw)
-
-class Process(Connection):
-    """Duck-typed ``tubes.remote`` object to add properties of a ``tubes.process``"""
-
-class Client(Logger):
-    """ADB Client"""
-    def __init__(self, level=None):
-        super(Client, self).__init__()
-
-        if level is not None:
-            self.setLevel(level)
-
-        self.host = context.adb_host
-        self.port = context.adb_port
-        self._c   = None
-
-    @property
-    def c(self):
-        """Client's connection to the ADB server"""
-        if not self._c:
-            try:
-                self._c = Connection(self.host, self.port, level=self.level)
-            except Exception:
-                # If the connection fails, try starting a server on that port
-                # as long as it's the *default* port.
-                if self.host == context.defaults['adb_host'] \
-                and self.port == context.defaults['adb_port']:
-                    log.warn("Could not connect to ADB server, trying to start it")
-                    process(context.adb + ['start-server']).recvall()
-                else:
-                    log.exception('Could not connect to ADB server')
-
-        # Final attempt...
-        if not self._c:
-            self._c = Connection(self.host, self.port, level=self.level)
-        return self._c
-
-    def _autoclose(fn):
-        """Decorator which automatically closes the connection to the ADB server
-        after calling the decorated function."""
-        @functools.wraps(fn)
-        def wrapper(self, *a, **kw):
-            rv = fn(self, *a, **kw)
-            if self._c:
-                self._c.close()
-                self._c = None
-            return rv
-        return wrapper
-
-    def _with_transport(fn):
-        """Decorator which automatically selects a device transport before calling
-        the decorated function, and closes the connection afterward."""
-        @functools.wraps(fn)
-        def wrapper(self, *a, **kw):
-            self.transport()
-            rv = fn(self, *a, **kw)
-            if self._c:
-                self._c.close()
-                self._c = None
-            return rv
-        return wrapper
-
-    def send(self, *a, **kw):
-        """Sends data to the ADB server"""
-        return self.c.adb_send(*a, **kw)
-
-    def unpack(self, *a, **kw):
-        """Receives a hex-ascii packed integer from the ADB server"""
-        return self.c.adb_unpack(*a, **kw)
-
-    def recvl(self):
-        """Receives a length-prefixed data buffer from the ADB server"""
-        length = self.c.adb_unpack()
-        return self.c.recvn(length)
-
-    @_autoclose
-    def kill(self):
-        """Kills the remote ADB server"
-
-        >>> c=adb.protocol.Client()
-        >>> c.kill()
-
-        The server is automatically re-started on the next request,
-        if the default host/port are used.
-
-        >>> c.version() > (4,0)
-        True
-        """
-        try:
-            self.send('host:kill')
-        except EOFError:
-            pass
-
-    @_autoclose
-    def version(self):
-        """
-        Returns:
-            Tuple containing the ``(major, minor)`` version from the ADB server
-
-        Example:
-
-            >>> adb.protocol.Client().version() # doctest: +SKIP
-            (4, 36)
-        """
-        response = self.send('host:version')
-        if response == OKAY:
-            return (self.c.adb_unpack(), self.c.adb_unpack())
-        self.error("Could not fetch version")
-
-    @_autoclose
-    def devices(self, long=False):
-        """
-        Arguments:
-            long(bool): If ``True``, fetch the long-format listing.
-        Returns:
-            String representation of all available devices.
-        """
-        msg = 'host:devices'
-        if long:
-            msg += '-l'
-        response = self.send(msg)
-        if response == 'OKAY':
-            return self.recvl()
-        self.error("Could not enumerate devices")
-
-    @_autoclose
-    def track_devices(self):
-        """
-        Returns:
-            Generator which returns a short-format listing of available
-            devices each time a device state changes.
-        """
-        self.send('host:track-devices')
-        while True:
-            yield self.recvl()
-
-    def transport(self, serial=None):
-        """Sets the Transport on the rmeote device.
-
-        Examples:
-
-            >>> adb.protocol.Client().transport()
-        """
-        msg = 'host:transport:%s' % (serial or context.device)
-        if self.send(msg) == FAIL:
-            self.error("Could not set transport to %r" % serial)
-
-    @_autoclose
-    @_with_transport
-    def execute(self, argv):
-        r"""Executes a program on the device.
-
-        Returns:
-            A ``tube`` which is connected to the process.
-
-        Examples:
-
-            >>> adb.protocol.Client().execute(['echo','hello']).recvall()
-            'hello\n'
-        """
-        self.transport(context.device)
-        if isinstance(argv, str):
-            argv = [argv]
-        argv = list(map(sh_string, argv))
-        cmd = 'exec:%s' % (' '.join(argv))
-        if OKAY == self.send(cmd):
-            rv = self._c
-            self._c = None
-            return rv
-
-    def _basic_wrapper(string):
-        @_autoclose
-        @_with_transport
-        def wrapper(self):
-            self.send(string)
-            return self.c.recvall()
-        return wrapper
-
-    @_autoclose
-    @_with_transport
-    def remount(self):
-        self.send('remount:')
-        return self.c.recvall()
-
-    @_autoclose
-    @_with_transport
-    def root(self):
-        self.send('root:')
-        return self.c.recvall()
-
-    @_autoclose
-    @_with_transport
-    def unroot(self):
-        self.send('unroot:')
-        return self.c.recvall()
-
-    @_autoclose
-    @_with_transport
-    def disable_verity(self):
-        self.send('disable-verity:')
-        return self.c.recvall()
-
-    @_autoclose
-    @_with_transport
-    def enable_verity(self):
-        self.send('enable-verity:')
-        return self.c.recvall()
-
-    @_autoclose
-    @_with_transport
-    def reconnect(self):
-        self.send('reconnect:')
-        return self.c.recvall()
-
-    @_autoclose
-    @_with_transport
-    def reboot(self):
-        self.send('reboot:')
-        return self.c.recvall()
-
-    @_autoclose
-    @_with_transport
-    def reboot_bootloader(self):
-        self.send('reboot:bootloader')
-        return self.c.recvall()
-
-    @_autoclose
-    def wait_for_device(self, serial=''):
-        response = self.send('host-serial:%s:wait-for-any-device' % serial)
-
-        # The first OKAY is that the command was understood
-        if response != 'OKAY':
-            self.error("An error occurred while waiting for device with serial %r" % serial)
-
-        # The second OKAY is that the device is available
-        response = self.c.recvn(4)
-        if response != 'OKAY':
-            self.error("An error occurred while waiting for device with serial %r" % serial)
-
-    def _sync(fn):
-        """Decorator which enters 'sync:' mode to the selected transport,
-        then invokes the decorated funciton."""
-        @functools.wraps(fn)
-        def wrapper(self, *a, **kw):
-            rv = None
-            if FAIL != self.send('sync:'):
-                rv = fn(self, *a, **kw)
-            return rv
-        return wrapper
-
-    def list(self, path):
-        """Execute the ``LIST`` command of the ``SYNC`` API.
-
-        Arguments:
-            path(str): Path of the directory to list.
-
-        Return:
-            A dictionary, where the keys are relative filenames,
-            and the values are a dictionary containing the same
-            values as ``stat()`` supplies.
-
-        Note:
-            In recent releases of Android (e.g. 7.0), the domain that
-            adbd executes from does not have access to everything that
-            the shell user does.
-
-            Because of this, while the shell user can get listings of
-            e.g. the root directory ('/'), adbd cannot.
-
-            The SYNC APIs are executed within the adbd context, not the
-            shell user context.
-
-            This issue is not a problem if the phone is rooted via
-            'adb root', since adbd then runs in the ``su`` domain.
-
-        Examples:
-
-            >>> pprint(adb.Client().list('/data/user'))
-            {'0': {'mode': 41471, 'size': 11, 'time': ...}}
-            >>> adb.Client().list('/does/not/exist')
-            Traceback (most recent call last):
-            ...
-            PwnlibException: Cannot list directory '/does/not/exist': Does not exist
-        """
-        st = self.stat(path)
-
-        if not st:
-            log.error("Cannot list directory %r: Does not exist" % path)
-
-        if not stat.S_ISDIR(st['mode']):
-            log.error("Cannot list directory %r: Path is not a directory" % path)
-
-        return self._list(path)
-
-    @_with_transport
-    @_sync
-    def _list(self, path):
-        self.c.flat('LIST', len(path), path)
-        files = {}
-        while True:
-            response = self.c.recvn(4)
-
-            if response == 'DONE':
-                break
-
-            if response != 'DENT':
-                self.error('Unexpected response: %r' % response)
-
-            mode = self.c.u32()
-            size = self.c.u32()
-            time = self.c.u32()
-            name = self.c.recvn(self.c.u32())
-
-            # Ignore the current directory and parent
-            if name in ('', '.', '..'):
-                continue
-
-            files[name] = {'mode': mode,
-                           'size': size,
-                           'time': time}
-
-        return files
-
-    @_with_transport
-    @_sync
-    def stat(self, path):
-        """Execute the ``STAT`` command of the ``SYNC`` API.
-
-        Arguments:
-            path(str): Path to the file to stat.
-
-        Return:
-            On success, a dictionary mapping the values returned.
-            If the file cannot be ``stat()``ed, None is returned.
-
-        Example:
-
-            >>> expected = {'mode': 16749, 'size': 0, 'time': 0}
-            >>> adb.protocol.Client().stat('/proc')           == expected
-            True
-            >>> adb.protocol.Client().stat('/does/not/exist') == None
-            True
-        """
-        self.c.flat('STAT', len(path), path)
-        if self.c.recvn(4) != 'STAT':
-            self.error("An error occured while attempting to STAT a file.")
-
-        mode = self.c.u32()
-        size = self.c.u32()
-        time = self.c.u32()
-
-        if (mode,size,time) == (0,0,0):
-            return None
-
-        return {'mode': mode, 'size': size, 'time': time}
-
-    def write(self, path, data, mode=0o755, timestamp=None, callback=None):
-        """Execute the ``WRITE`` command of the ``SYNC`` API.
-
-        Arguments:
-            path(str): Path to the file to write
-            data(str): Data to write to the file
-            mode(int): File mode to set (e.g. ``0o755``)
-            timestamp(int): Unix timestamp to set the file date to
-            callback(callable): Callback function invoked as data
-                is written.  Arguments provided are:
-
-                - File path
-                - All data
-                - Expected size of all data
-                - Current chunk
-                - Expected size of chunk
-        """
-        # We must ensure that 'path' is not a directory
-        # Writing to a directory is supported, but creates a temporary file
-        st = self.stat(path)
-
-        if st and stat.S_ISDIR(st['mode']):
-            log.error("Cannot write to %r: Path is a directory" % path)
-
-        return self._write(path, data, mode=0o755, timestamp=None, callback=None)
-
-    @_with_transport
-    @_sync
-    def _write(self, path, data, mode=0o755, timestamp=None, callback=None):
-        path += ',' + str(mode)
-        self.c.flat('SEND', len(path), path)
-
-        sent = 0
-
-        # Data needs to be broken up into chunks!
-        for chunk in group(0x10000, data):
-            self.c.flat('DATA', len(chunk), chunk)
-            if callback:
-                callback(path, data[:sent], len(data), chunk, len(chunk))
-            sent += len(chunk)
-
-        # Send completion notification and timestamp
-        if timestamp is None:
-            timestamp = int(time.time())
-        self.c.flat('DONE', timestamp)
-
-        result = self.c.recvn(4)
-        if result != 'OKAY':
-            log.error("Sync write failed: %r (expected OKAY)" % result)
-
-        return
-
-    @_with_transport
-    @_sync
-    def read(self, path, filesize=0, callback=lambda *a: True):
-        """Execute the ``READ`` command of the ``SYNC`` API.
-
-        Arguments:
-            path(str): Path to the file to read
-            filesize(int): Size of the file, in bytes.  Optional.
-            callback(callable): Callback function invoked as data
-                becomes available.  Arguments provided are:
-
-                - File path
-                - All data
-                - Expected size of all data
-                - Current chunk
-                - Expected size of chunk
-
-        Return:
-            The data received as a string.
-        """
-        self.c.send('RECV' + p32(len(path)) + path)
-
-        # Accumulate all data here
-        all_data = ''
-
-        while True:
-            magic = self.c.recvn(4)
-
-            # adbd says there is no more data to send
-            if magic == 'DONE':
-                break
-
-            if magic == 'FAIL':
-                self.error('Could not read file %r: Got FAIL.' % path)
-
-            # did we expect to be done?
-            if magic != 'DATA':
-                self.error('Error after file read: %r (expected DATA)' % magic)
-
-            # receive all of the data in the chunk
-            chunk_size = self.c.u32()
-            chunk_data  = ''
-            while len(chunk_data) != chunk_size:
-                chunk_data += self.c.recv(chunk_size - len(chunk_data))
-
-                if callback:
-                    callback(path,
-                             all_data,
-                             filesize,
-                             chunk_data,
-                             chunk_size)
-
-            # add the chunk onto what we have
-            all_data += chunk_data
-
-        zero = self.c.u32()
-        if zero != 0:
-            self.error('Error after file read: %r (expected ZERO)' % zero)
-
-        return all_data
-
-    @_with_transport
-    def forward(self, device, host_proto, host_port, device_proto, device_port):
-        self.send('host:forward:%s:%s;%s:%s' % (host_proto, host_port, device_proto, device_port))
-        self.c.recvall()
-
-    def __enter__(self, *a, **kw):
-        return self
-
-    @_autoclose
-    def __exit__(self, *a, **kw): pass
-
-def proxy(port=9999):
-    """Starts an ADB proxy on the specified port, for debugging purposes."""
-    l = listen(port)
-    l.wait_for_connection()
-    r = remote(context.adb_host, context.adb_port, level='debug')
-    l <> r
+from pwnlib.protocols.adb import AdbClient
+Client = AdbClient
@@ -1,3 +1,4 @@
+
 #!/usr/bin/env python2
 """
 Pwntools exposes several magic command-line arguments and environment
@@ -16,13 +17,13 @@ The easiest example is to enable more verbose debugging.  Just set ``DEBUG``.
    $ python exploit.py DEBUG

 These arguments are automatically extracted, regardless of their name, and
-exposed via ``pwnlib.args.args``, which is exposed as the global variable
-``args``.  Arguments which ``pwntools`` reserves internally are not exposed
+exposed via :mod:`pwnlib.args.args`, which is exposed as the global variable
+:data:`args`.  Arguments which ``pwntools`` reserves internally are not exposed
 this way.

 .. code-block:: bash

-    $ python -c 'from pwn import *; print args' A=1 B=Hello HOST=1.2.3.4 DEBUG
+    $ python -c 'from pwn import *; print(args)' A=1 B=Hello HOST=1.2.3.4 DEBUG
    defaultdict(<type 'str'>, {'A': '1', 'HOST': '1.2.3.4', 'B': 'Hello'})

 This is very useful for conditional code, for example determining whether to
@@ -36,28 +37,56 @@ not specified evaluate to an empty string.
    else:
        io = process('./pwnable')

+Arguments can also be accessed directly with the dot operator, e.g.:
+
+.. code-block:: python
+
+    if args.REMOTE:
+        ...
+
+Any undefined arguments evaluate to an empty string, ``''``.
+
 The full list of supported "magic arguments" and their effects are listed
 below.
+
 """
+from __future__ import absolute_import
+from __future__ import division
+
 import collections
 import logging
 import os
 import string
 import sys

-from . import term
-from .context import context
+from pwnlib import term
+from pwnlib.context import context

+class PwnlibArgs(collections.defaultdict):
+    def __getattr__(self, attr):
+        return self[attr]
+
+args = PwnlibArgs(str)
 term_mode  = True
-args       = collections.defaultdict(str)
 env_prefix = 'PWNLIB_'
+free_form  = True
+
+# Check to see if we were invoked as one of the 'pwn xxx' scripts.
+# If so, we don't want to remove e.g. "SYS_" from the end of the command
+# line, as this breaks things like constgrep.
+import pwnlib.commandline
+basename = os.path.basename(sys.argv[0])
+
+if basename == 'pwn' or basename in pwnlib.commandline.__all__:
+    free_form = False
+

 def isident(s):
    """
    Helper function to check whether a string is a valid identifier,
    as passed in on the command-line.
    """
-    first = string.uppercase + '_'
+    first = string.ascii_uppercase + '_'
    body = string.digits + first
    if not s:
        return False
@@ -166,13 +195,13 @@ def initialize():
        value = 'True'

        if '=' in arg:
-            arg, value = arg.split('=')
+            arg, value = arg.split('=', 1)

        if arg in hooks:
            sys.argv.remove(orig)
            hooks[arg](value)

-        elif isident(arg):
+        elif free_form and isident(arg):
            sys.argv.remove(orig)
            args[arg] = value

@@ -16,48 +16,49 @@ Assembly
    To assemble code, simply invoke :func:`asm` on the code to assemble.

        >>> asm('mov eax, 0')
-        '\xb8\x00\x00\x00\x00'
+        b'\xb8\x00\x00\x00\x00'

    Additionally, you can use constants as defined in the :mod:`pwnlib.constants`
    module.

        >>> asm('mov eax, SYS_execve')
-        '\xb8\x0b\x00\x00\x00'
+        b'\xb8\x0b\x00\x00\x00'

    Finally, :func:`asm` is used to assemble shellcode provided by ``pwntools``
    in the :mod:`shellcraft` module.

        >>> asm(shellcraft.nop())
-        '\x90'
+        b'\x90'

 Disassembly
 ------------------------

    To disassemble code, simply invoke :func:`disasm` on the bytes to disassemble.

-    >>> disasm('\xb8\x0b\x00\x00\x00')
-    '   0:   b8 0b 00 00 00          mov    eax,0xb'
+    >>> disasm(b'\xb8\x0b\x00\x00\x00')
+    '   0:   b8 0b 00 00 00          mov    eax, 0xb'

 """
+from __future__ import absolute_import
+from __future__ import division
+
 import errno
 import os
 import platform
 import re
 import shutil
-import string
 import subprocess
-import sys
 import tempfile
 from collections import defaultdict
 from glob import glob
 from os import environ
 from os import path

-from . import atexit
-from . import shellcraft
-from .context import LocalContext
-from .context import context
-from .log import getLogger
+from pwnlib import atexit
+from pwnlib import shellcraft
+from pwnlib.context import LocalContext
+from pwnlib.context import context
+from pwnlib.log import getLogger

 log = getLogger(__name__)

@@ -71,6 +72,11 @@ def dpkg_search_for_binutils(arch, util):

    Returns:
        A list of candidate package names.
+
+    ::
+
+        >>> pwnlib.asm.dpkg_search_for_binutils('aarch64', 'as')
+        ['binutils-aarch64-linux-gnu']
    """

    # Example output:
@@ -83,7 +89,7 @@ def dpkg_search_for_binutils(arch, util):

    try:
        filename = 'bin/%s*linux*-%s' % (arch, util)
-        output = subprocess.check_output(['dpkg','-S',filename])
+        output = subprocess.check_output(['dpkg','-S',filename], universal_newlines = True)
        for line in output.strip().splitlines():
            package, path = line.split(':', 1)
            packages.append(package)
@@ -97,6 +103,16 @@ def dpkg_search_for_binutils(arch, util):
 def print_binutils_instructions(util, context):
    """On failure to find a binutils utility, inform the user of a way
    they can get it easily.
+
+    Doctest:
+
+        >>> context.clear(arch = 'amd64')
+        >>> pwnlib.asm.print_binutils_instructions('as', context)
+        Traceback (most recent call last):
+        ...
+        PwnlibException: Could not find 'as' installed for ContextType(arch = 'amd64', bits = 64, endian = 'little')
+        Try installing binutils for this architecture:
+        $ sudo apt-get install binutils
    """
    # This links to our instructions on how to manually install binutils
    # for several architectures.
@@ -129,8 +145,9 @@ def which_binutils(util):
    Examples:

        >>> import platform
+        >>> which_binutils = pwnlib.asm.which_binutils
        >>> which_binutils('as', arch=platform.machine())
-        '.../bin/as'
+        '.../bin/...as'
        >>> which_binutils('as', arch='arm') #doctest: +ELLIPSIS
        '.../bin/arm-...-as'
        >>> which_binutils('as', arch='powerpc') #doctest: +ELLIPSIS
@@ -142,7 +159,6 @@ def which_binutils(util):
        Exception: Could not find 'as' installed for ContextType(arch = 'msp430')
    """
    arch = context.arch
-    bits = context.bits

    # Fix up pwntools vs Debian triplet naming, and account
    # for 'thumb' being its own pwntools architecture.
@@ -173,10 +189,12 @@ def which_binutils(util):
    for arch in arches:
        for gutil in utils:
            # e.g. objdump
-            if arch is None: pattern = gutil
+            if arch is None:
+                pattern = gutil

            # e.g. aarch64-linux-gnu-objdump
-            else:       pattern = '%s*linux*-%s' % (arch,gutil)
+            else:
+                pattern = '%s*linux*-%s' % (arch,gutil)

            for dir in environ['PATH'].split(':'):
                res = sorted(glob(path.join(dir, pattern)))
@@ -224,7 +242,7 @@ def _assembler():
    if not checked_assembler_version[gas]:
        checked_assembler_version[gas] = True
        result = subprocess.check_output([gas, '--version','/dev/null'],
-                                         stderr=subprocess.STDOUT)
+                                         stderr=subprocess.STDOUT, universal_newlines=True)
        version = re.search(r' (\d\.\d+)', result).group(1)
        if version < '2.19':
            log.warn_once('Your binutils version is too old and may not work!\n'  + \
@@ -344,7 +362,8 @@ def _run(cmd, stdin = None):
            cmd,
            stdin  = subprocess.PIPE,
            stdout = subprocess.PIPE,
-            stderr = subprocess.PIPE
+            stderr = subprocess.PIPE,
+            universal_newlines = True
        )
        stdout, stderr = proc.communicate(stdin)
        exitcode = proc.wait()
@@ -380,19 +399,15 @@ def cpp(shellcode):

    Examples:

-        .. doctest::
-
-            >>> cpp("mov al, SYS_setresuid", arch = "i386", os = "linux")
-            'mov al, 164\n'
-            >>> cpp("weee SYS_setresuid", arch = "arm", os = "linux")
-            'weee (0+164)\n'
-            >>> cpp("SYS_setresuid", arch = "thumb", os = "linux")
-            '(0+164)\n'
-            >>> cpp("SYS_setresuid", os = "freebsd")
-            '311\n'
+        >>> cpp("mov al, SYS_setresuid", arch = "i386", os = "linux")
+        'mov al, 164\n'
+        >>> cpp("weee SYS_setresuid", arch = "arm", os = "linux")
+        'weee (0+164)\n'
+        >>> cpp("SYS_setresuid", arch = "thumb", os = "linux")
+        '(0+164)\n'
+        >>> cpp("SYS_setresuid", os = "freebsd")
+        '311\n'
    """
-    arch = context.arch
-    os   = context.os
    code = _include_header() + shellcode
    cmd  = [
        'cpp',
@@ -406,17 +421,39 @@ def cpp(shellcode):
    return _run(cmd, code).strip('\n').rstrip() + '\n'

@LocalContext
-def make_elf_from_assembly(assembly, vma = None, extract=False, shared = False):
-    r"""
-    Builds an ELF file with the specified assembly as its
-    executable code.
+def make_elf_from_assembly(assembly,
+                           vma=None,
+                           extract=False,
+                           shared=False,
+                           strip=False,
+                           **kwargs):
+    r"""make_elf_from_assembly(assembly, vma=None, extract=None, shared=False, strip=False, **kwargs) -> str
+
+    Builds an ELF file with the specified assembly as its executable code.
+
+    This differs from :func:`.make_elf` in that all ELF symbols are preserved,
+    such as labels and local variables.  Use :func:`.make_elf` if size matters.
+    Additionally, the default value for ``extract`` in :func:`.make_elf` is
+    different.
+
+    Note:
+        This is effectively a wrapper around :func:`.asm`. with setting
+        ``extract=False``, ``vma=0x10000000``, and marking the resulting
+        file as executable (``chmod +x``).
+
+    Note:
+        ELF files created with `arch=thumb` will prepend an ARM stub
+        which switches to Thumb mode.

    Arguments:
-
-        assembly(str): Assembly
+        assembly(str): Assembly code to build into an ELF
        vma(int): Load address of the binary
-        extract(bool): Whether to return the data extracted from the file created,
-                       or the path to it.
+            (Default: ``0x10000000``, or ``0`` if ``shared=True``)
+        extract(bool): Extract the full ELF data from the file.
+            (Default: ``False``)
+        shared(bool): Create a shared library
+            (Default: ``False``)
+        kwargs(dict): Arguments to pass to :func:`.asm`.

    Returns:

@@ -425,14 +462,29 @@ def make_elf_from_assembly(assembly, vma = None, extract=False, shared = False):

    Example:

+        This example shows how to create a shared library, and load it via
+        ``LD_PRELOAD``.
+
        >>> context.clear()
        >>> context.arch = 'amd64'
        >>> sc = 'push rbp; mov rbp, rsp;'
        >>> sc += shellcraft.echo('Hello\n')
        >>> sc += 'mov rsp, rbp; pop rbp; ret'
        >>> solib = make_elf_from_assembly(sc, shared=1)
-        >>> subprocess.check_output(['echo', 'World'], env={'LD_PRELOAD': solib})
+        >>> subprocess.check_output(['echo', 'World'], env={'LD_PRELOAD': solib}, universal_newlines = True)
        'Hello\nWorld\n'
+
+        The same thing can be done with :func:`.make_elf`, though the sizes
+        are different.  They both
+
+        >>> file_a = make_elf(asm('nop'), extract=True)
+        >>> file_b = make_elf_from_assembly('nop', extract=True)
+        >>> file_a[:4] == file_b[:4]
+        True
+        >>> len(file_a) < 0x200
+        True
+        >>> len(file_b) > 0x1000
+        True
    """
    if shared and vma:
        log.error("Cannot specify a VMA for a shared library.")
@@ -449,42 +501,48 @@ def make_elf_from_assembly(assembly, vma = None, extract=False, shared = False):
        if not assembly.startswith(to_thumb):
            assembly = to_thumb + assembly

-    path = asm(assembly, vma = vma, extract = extract, shared = shared)
+    result = asm(assembly, vma = vma, shared = shared, extract = False, **kwargs)

    if not extract:
-        os.chmod(path, 0755)
+        os.chmod(result, 0o755)
+    else:
+        with open(result, 'rb') as io:
+            result = io.read()

-    return path
+    return result

@LocalContext
-def make_elf(data, vma = None, strip=True, extract=True, shared=False):
-    r"""
-    Builds an ELF file with the specified binary data as its
-    executable code.
+def make_elf(data,
+             vma=None,
+             strip=True,
+             extract=True,
+             shared=False):
+    r"""make_elf(data, vma=None, strip=True, extract=True, shared=False, **kwargs) -> str
+
+    Builds an ELF file with the specified binary data as its executable code.

    Arguments:
        data(str): Assembled code
        vma(int):  Load address for the ELF file
+        strip(bool): Strip the resulting ELF file. Only matters if ``extract=False``.
+            (Default: ``True``)
+        extract(bool): Extract the assembly from the ELF file.
+            If ``False``, the path of the ELF file is returned.
+            (Default: ``True``)
+        shared(bool): Create a Dynamic Shared Object (DSO, i.e. a ``.so``)
+            which can be loaded via ``dlopen`` or ``LD_PRELOAD``.

    Examples:
-
        This example creates an i386 ELF that just does
        execve('/bin/sh',...).

-        >>> context.clear()
-        >>> context.arch = 'i386'
-        >>> context.bits = 32
-        >>> filename = tempfile.mktemp()
-        >>> bin_sh = '6a68682f2f2f73682f62696e89e331c96a0b5899cd80'.decode('hex')
-        >>> data = make_elf(bin_sh)
-        >>> with open(filename,'wb+') as f:
-        ...     f.write(data)
-        ...     f.flush()
-        >>> os.chmod(filename,0777)
+        >>> context.clear(arch='i386')
+        >>> bin_sh = unhex('6a68682f2f2f73682f62696e89e331c96a0b5899cd80')
+        >>> filename = make_elf(bin_sh, extract=False)
        >>> p = process(filename)
-        >>> p.sendline('echo Hello; exit')
+        >>> p.sendline(b'echo Hello; exit')
        >>> p.recvline()
-        'Hello\n'
+        b'Hello\n'
    """
    retval = None

@@ -501,7 +559,7 @@ def make_elf(data, vma = None, strip=True, extract=True, shared=False):
    assembler = _assembler()
    linker    = _linker()
    code      = _arch_header()
-    code      += '.string "%s"' % ''.join('\\x%02x' % ord(c) for c in data)
+    code      += '.string "%s"' % ''.join('\\x%02x' % c for c in bytearray(data))
    code      += '\n'

    log.debug("Building ELF:\n" + code)
@@ -512,7 +570,7 @@ def make_elf(data, vma = None, strip=True, extract=True, shared=False):
    step3     = path.join(tmpdir, 'step3-elf')

    try:
-        with open(step1, 'wb+') as f:
+        with open(step1, 'w') as f:
            f.write(code)

        _run(assembler + ['-o', step2, step1])
@@ -533,11 +591,11 @@ def make_elf(data, vma = None, strip=True, extract=True, shared=False):
            _run([which_binutils('strip'), '--strip-unneeded', step3])

        if not extract:
-            os.chmod(step3, 0755)
+            os.chmod(step3, 0o755)
            retval = step3

        else:
-            with open(step3, 'r') as f:
+            with open(step3, 'rb') as f:
                retval = f.read()
    except Exception:
        log.exception("An error occurred while building an ELF:\n%s" % code)
@@ -548,38 +606,37 @@ def make_elf(data, vma = None, strip=True, extract=True, shared=False):

@LocalContext
 def asm(shellcode, vma = 0, extract = True, shared = False):
-    r"""asm(code, vma = 0, extract = True, ...) -> str
+    r"""asm(code, vma = 0, extract = True, shared = False, ...) -> str

    Runs :func:`cpp` over a given shellcode and then assembles it into bytes.

    To see which architectures or operating systems are supported,
-    look in :mod:`pwnlib.contex`.
+    look in :mod:`pwnlib.context`.

-    To support all these architecture, we bundle the GNU assembler
-    and objcopy with pwntools.
+    Assembling shellcode requires that the GNU assembler is installed
+    for the target architecture.
+    See :doc:`Installing Binutils </install/binutils>` for more information.

    Arguments:
-      shellcode(str): Assembler code to assemble.
-      vma(int):       Virtual memory address of the beginning of assembly
-      extract(bool):  Extract the raw assembly bytes from the assembled
-                      file.  If ``False``, returns the path to an ELF file
-                      with the assembly embedded.
-
-    Kwargs:
-        Any arguments/properties that can be set on ``context``
+        shellcode(str): Assembler code to assemble.
+        vma(int):       Virtual memory address of the beginning of assembly
+        extract(bool):  Extract the raw assembly bytes from the assembled
+                        file.  If :const:`False`, returns the path to an ELF file
+                        with the assembly embedded.
+        shared(bool):   Create a shared object.
+        kwargs(dict):   Any attributes on :data:`.context` can be set, e.g.set
+                        ``arch='arm'``.

    Examples:

-        .. doctest::
-
-            >>> asm("mov eax, SYS_select", arch = 'i386', os = 'freebsd')
-            '\xb8]\x00\x00\x00'
-            >>> asm("mov eax, SYS_select", arch = 'amd64', os = 'linux')
-            '\xb8\x17\x00\x00\x00'
-            >>> asm("mov rax, SYS_select", arch = 'amd64', os = 'linux')
-            'H\xc7\xc0\x17\x00\x00\x00'
-            >>> asm("mov r0, #SYS_select", arch = 'arm', os = 'linux', bits=32)
-            'R\x00\xa0\xe3'
+        >>> asm("mov eax, SYS_select", arch = 'i386', os = 'freebsd')
+        b'\xb8]\x00\x00\x00'
+        >>> asm("mov eax, SYS_select", arch = 'amd64', os = 'linux')
+        b'\xb8\x17\x00\x00\x00'
+        >>> asm("mov rax, SYS_select", arch = 'amd64', os = 'linux')
+        b'H\xc7\xc0\x17\x00\x00\x00'
+        >>> asm("mov r0, #SYS_select", arch = 'arm', os = 'linux', bits=32)
+        b'R\x00\xa0\xe3'
    """
    result = ''

@@ -611,17 +668,27 @@ def asm(shellcode, vma = 0, extract = True, shared = False):
            ldflags = ['-z', 'execstack', '-o', step3, step2]
            if vma:
                ldflags += ['--section-start=.shellcode=%#x' % vma,
-                            '--entry=%#x' % vma,
-                            '-z', 'max-page-size=4096',
-                            '-z', 'common-page-size=4096']
+                            '--entry=%#x' % vma]
            elif shared:
                ldflags += ['-shared', '-init=_start']
+
+            # In order to ensure that we generate ELF files with 4k pages,
+            # and not e.g. 65KB pages (AArch64), force the page size.
+            # This is a result of GNU Gold being silly.
+            #
+            # Introduced in commit dd58f409 without supporting evidence,
+            # this shouldn't do anything except keep consistent page granularity
+            # across architectures.
+            ldflags += ['-z', 'max-page-size=4096',
+                        '-z', 'common-page-size=4096']
+
            _run(linker + ldflags)

-        elif file(step2,'rb').read(4) == '\x7fELF':
+        elif open(step2,'rb').read(4) == b'\x7fELF':
            # Sanity check for seeing if the output has relocations
            relocs = subprocess.check_output(
-                [which_binutils('readelf'), '-r', step2]
+                [which_binutils('readelf'), '-r', step2],
+                universal_newlines = True
            ).strip()
            if extract and len(relocs.split('\n')) > 1:
                log.error('Shellcode contains relocations:\n%s' % relocs)
@@ -633,7 +700,7 @@ def asm(shellcode, vma = 0, extract = True, shared = False):

        _run(objcopy + [step3, step4])

-        with open(step4) as fd:
+        with open(step4, 'rb') as fd:
            result = fd.read()

    except Exception:
@@ -653,9 +720,6 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):
    To see which architectures are supported,
    look in :mod:`pwnlib.contex`.

-    To support all these architecture, we bundle the GNU objcopy
-    and objdump with pwntools.
-
    Arguments:
      data(str): Bytestring to disassemble.
      vma(int): Passed through to the --adjust-vma argument of objdump
@@ -667,29 +731,28 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):

    Examples:

-        .. doctest::
-
-          >>> print disasm('b85d000000'.decode('hex'), arch = 'i386')
-             0:   b8 5d 00 00 00          mov    eax,0x5d
-          >>> print disasm('b85d000000'.decode('hex'), arch = 'i386', byte = 0)
-             0:   mov    eax,0x5d
-          >>> print disasm('b85d000000'.decode('hex'), arch = 'i386', byte = 0, offset = 0)
-          mov    eax,0x5d
-          >>> print disasm('b817000000'.decode('hex'), arch = 'amd64')
-             0:   b8 17 00 00 00          mov    eax,0x17
-          >>> print disasm('48c7c017000000'.decode('hex'), arch = 'amd64')
-             0:   48 c7 c0 17 00 00 00    mov    rax,0x17
-          >>> print disasm('04001fe552009000'.decode('hex'), arch = 'arm')
-             0:   e51f0004        ldr     r0, [pc, #-4]   ; 0x4
-             4:   00900052        addseq  r0, r0, r2, asr r0
-          >>> print disasm('4ff00500'.decode('hex'), arch = 'thumb', bits=32)
-             0:   f04f 0005       mov.w   r0, #5
-          >>>
+        >>> print(disasm(unhex('b85d000000'), arch = 'i386'))
+           0:   b8 5d 00 00 00          mov    eax, 0x5d
+        >>> print(disasm(unhex('b85d000000'), arch = 'i386', byte = 0))
+           0:   mov    eax, 0x5d
+        >>> print(disasm(unhex('b85d000000'), arch = 'i386', byte = 0, offset = 0))
+        mov    eax, 0x5d
+        >>> print(disasm(unhex('b817000000'), arch = 'amd64'))
+           0:   b8 17 00 00 00          mov    eax, 0x17
+        >>> print(disasm(unhex('48c7c017000000'), arch = 'amd64'))
+           0:   48 c7 c0 17 00 00 00    mov    rax, 0x17
+        >>> print(disasm(unhex('04001fe552009000'), arch = 'arm'))
+           0:   e51f0004        ldr     r0, [pc, #-4]   ; 0x4
+           4:   00900052        addseq  r0, r0, r2, asr r0
+        >>> print(disasm(unhex('4ff00500'), arch = 'thumb', bits=32))
+           0:   f04f 0005       mov.w   r0, #5
+        >>> print(disasm(unhex('656664676665400F18A4000000000051'), byte=0, arch='amd64'))
+           0:   gs data16 fs data16 rex nop/reserved BYTE PTR gs:[eax+eax*1+0x0]
+           f:   push   rcx
    """
    result = ''

    arch   = context.arch
-    os     = context.os

    tmpdir = tempfile.mkdtemp(prefix = 'pwn-disasm-')
    step1  = path.join(tmpdir, 'step1')
@@ -706,6 +769,9 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):
        '--rename-section', '.data=.text',
    ]

+    if not byte:
+        objdump += ['--no-show-raw-insn']
+
    if arch == 'thumb':
        objcopy += ['--prefix-symbol=$t.']
    else:
@@ -713,12 +779,12 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):

    try:

-        with open(step1, 'w') as fd:
+        with open(step1, 'wb') as fd:
            fd.write(data)

-        res = _run(objcopy + [step1, step2])
+        _run(objcopy + [step1, step2])

-        output0 = subprocess.check_output(objdump + [step2])
+        output0 = _run(objdump + [step2])
        output1 = output0.split('<.text>:\n')

        if len(output1) != 2:
@@ -732,14 +798,22 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):


    lines = []
-    pattern = '^( *[0-9a-f]+: *)((?:[0-9a-f]+ )+ *)(.*)'
+    pattern = '^( *[0-9a-f]+: *)', '((?:[0-9a-f]+ )+ *)', '(.*)'
+    if not byte:
+        pattern = pattern[::2]
+    pattern = ''.join(pattern)
    for line in result.splitlines():
-        try:
-            o, b, i = re.search(pattern, line).groups()
-        except:
+        match = re.search(pattern, line)
+        if not match:
            lines.append(line)
            continue

+        groups = match.groups()
+        if byte:
+            o, b, i = groups
+        else:
+            o, i = groups
+
        line = ''

        if offset:
@@ -750,4 +824,4 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):
            line += i
        lines.append(line)

-    return '\n'.join(lines)
+    return re.sub(',([^ ])', r', \1', '\n'.join(lines))
@@ -2,12 +2,14 @@
 Analogous to atexit, this module allows the programmer to register functions to
 be run if an unhandled exception occurs.
 """
+from __future__ import absolute_import
+from __future__ import division

 import sys
 import threading
 import traceback

-from .context import context
+from pwnlib.context import context

 __all__ = ['register', 'unregister']

@@ -7,12 +7,14 @@ this replacement module also defines :func:`unregister`.
 This module also fixes a the issue that exceptions raised by an exit handler is
 printed twice when the standard :mod:`atexit` is used.
 """
+from __future__ import absolute_import
+from __future__ import division

 import sys
 import threading
 import traceback

-from .context import context
+from pwnlib.context import context

 __all__ = ['register', 'unregister']

@@ -1 +1,22 @@
 #!/usr/bin/env python2
+__all__ = [
+    'asm',
+    'checksec',
+    'common',
+    'constgrep',
+    'cyclic',
+    'debug',
+    'disasm',
+    'disablenx',
+    'elfdiff',
+    'elfpatch',
+    'errno',
+    'hex',
+    'main',
+    'phd',
+    'pwnstrip',
+    'scramble',
+    'shellcraft',
+    'unhex',
+    'update'
+]
@@ -1,10 +1,12 @@
 #!/usr/bin/env python2
+from __future__ import absolute_import
+from __future__ import division
+
 import argparse
 import sys

 from pwn import *
-
-from . import common
+from pwnlib.commandline import common

 parser = common.parser_commands.add_parser(
    'asm',
@@ -28,8 +30,8 @@ parser.add_argument(
    "-o","--output",
    metavar='file',
    help="Output file (defaults to stdout)",
-    type=argparse.FileType('w'),
-    default=sys.stdout
+    type=argparse.FileType('wb'),
+    default=getattr(sys.stdout, 'buffer', sys.stdout)
 )

 parser.add_argument(
@@ -44,14 +46,14 @@ parser.add_argument(
 parser.add_argument(
    '-v', '--avoid',
    action='append',
-    help = 'Encode the shellcode to avoid the listed bytes (provided as hex; default: 000a)'
+    help = 'Encode the shellcode to avoid the listed bytes (provided as hex)'
 )

 parser.add_argument(
    '-n', '--newline',
    dest='avoid',
    action='append_const',
-    const='\n',
+    const='0a',
    help = 'Encode the shellcode to avoid newlines'
 )

@@ -59,7 +61,7 @@ parser.add_argument(
    '-z', '--zero',
    dest='avoid',
    action='append_const',
-    const='\x00',
+    const='00',
    help = 'Encode the shellcode to avoid NULL bytes'
 )

@@ -82,7 +84,7 @@ parser.add_argument(
    '--infile',
    help="Specify input file",
    default=sys.stdin,
-    type=file
+    type=argparse.FileType('r')
 )

 parser.add_argument(
@@ -95,13 +97,18 @@ parser.add_argument(
 def main(args):
    tty    = args.output.isatty()

+    if args.infile.isatty() and not args.lines:
+        parser.print_usage()
+        sys.exit(1)
+
    data   = '\n'.join(args.lines) or args.infile.read()
    output = asm(data.replace(';', '\n'))
    fmt    = args.format or ('hex' if tty else 'raw')
-    formatters = {'r':str, 'h':enhex, 's':repr}
+    formatters = {'r':bytes, 'h':enhex, 's':repr}

    if args.avoid:
-        output = encode(output, args.avoid)
+        avoid = unhex(''.join(args.avoid))
+        output = encode(output, avoid)

    if args.debug:
        proc = gdb.debug_shellcode(output, arch=context.arch)
@@ -115,13 +122,16 @@ def main(args):

    if fmt[0] == 'e':
        args.output.write(make_elf(output))
-        try: os.fchmod(args.output.fileno(), 0700)
+        try: os.fchmod(args.output.fileno(), 0o700)
        except OSError: pass
    else:
-        args.output.write(formatters[fmt[0]](output))
+        output = formatters[fmt[0]](output)
+        if not hasattr(output, 'decode'):
+            output = output.encode('ascii')
+        args.output.write(output)

    if tty and fmt is not 'raw':
-        args.output.write('\n')
+        args.output.write(b'\n')

 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)
@@ -1,10 +1,12 @@
 #!/usr/bin/env python2
+from __future__ import absolute_import
+from __future__ import division
+
 import argparse
 import sys

 from pwn import *
-
-from . import common
+from pwnlib.commandline import common

 parser = common.parser_commands.add_parser(
    'checksec',
@@ -13,7 +15,7 @@ parser = common.parser_commands.add_parser(
 parser.add_argument(
    'elf',
    nargs='*',
-    type=file,
+    type=argparse.FileType('rb'),
    help='Files to check'
 )
 parser.add_argument(
@@ -21,7 +23,7 @@ parser.add_argument(
    nargs='*',
    dest='elf2',
    metavar='elf',
-    type=file,
+    type=argparse.FileType('rb'),
    help='File to check (for compatibility with checksec.sh)'
 )

@@ -36,4 +38,4 @@ def main(args):
        e = ELF(f.name)

 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)
@@ -5,7 +5,7 @@ import sys
 import pwnlib
 from pwnlib.context import context

-choices = map(str, [16,32,64])
+choices = list(map(str, [16,32,64]))
 choices += list(context.oses)
 choices += list(context.architectures)
 choices += list(context.endiannesses)
@@ -1,12 +1,17 @@
 #!/usr/bin/env python2
+from __future__ import absolute_import
+from __future__ import division

 import argparse
+import functools
 import os
 import re

-from pwn import *
+import pwnlib
+pwnlib.args.free_form = False

-from . import common
+from pwn import *
+from pwnlib.commandline import common

 p = common.parser_commands.add_parser(
    'constgrep',
@@ -60,7 +65,7 @@ p.add_argument(
 def main(args):
    if args.exact:
        # This is the simple case
-        print cpp(args.exact).strip()
+        print(cpp(args.exact).strip())
    else:
        # New we search in the right module.
        # But first: We find the right module
@@ -75,6 +80,7 @@ def main(args):
        else:
            matcher = re.compile(args.regex)

+
        # Evaluate the given constant
        if args.constant:
            try:
@@ -113,7 +119,7 @@ def main(args):

        # Output all matching constants
        for _, k in sorted(out):
-            print '#define %s %s' % (k.ljust(maxlen), cpp(k).strip())
+            print('#define %s %s' % (k.ljust(maxlen), cpp(k).strip()))

        # If we are in match_mode, then try to find a combination of
        # constants that yield the exact given value
@@ -130,9 +136,9 @@ def main(args):

                out = [(v, k) for v, k in out if mask & v == v]

-            if reduce(lambda x, cur: x | cur[0], good, 0) == constant:
-                print
-                print '(%s) == %s' % (' | '.join(k for v, k in good), args.constant)
+            if functools.reduce(lambda x, cur: x | cur[0], good, 0) == constant:
+                print('')
+                print('(%s) == %s' % (' | '.join(k for v, k in good), args.constant))

 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)
@@ -1,11 +1,16 @@
 #!/usr/bin/env python2
+from __future__ import absolute_import
+from __future__ import division
+
 import argparse
 import string
 import sys

-from pwn import *
+import pwnlib
+pwnlib.args.free_form = False

-from . import common
+from pwn import *
+from pwnlib.commandline import common

 parser = common.parser_commands.add_parser(
    'cyclic',
@@ -77,7 +82,7 @@ def main(args):
            log.critical('Given pattern does not exist in cyclic pattern')
            sys.exit(1)
        else:
-            print offset
+            print(offset)
    else:
        want   = args.count
        result = cyclic(want, alphabet, subsize)
@@ -91,4 +96,4 @@ def main(args):
            sys.stdout.write('\n')

 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)
@@ -0,0 +1,105 @@
+#!/usr/bin/env python2
+from __future__ import absolute_import
+from __future__ import division
+
+import argparse
+import sys
+
+from pwn import *
+from pwnlib.commandline import common
+
+parser = common.parser_commands.add_parser(
+    'debug',
+    help = 'Debug a binary in GDB'
+)
+parser.add_argument(
+    '-x', metavar='GDBSCRIPT',
+    type=argparse.FileType('r'),
+    help='Execute GDB commands from this file.'
+)
+parser.add_argument(
+    '--pid',
+    type=int,
+    help="PID to attach to"
+)
+parser.add_argument(
+    '-c', '--context',
+    metavar = 'context',
+    action = 'append',
+    type   = common.context_arg,
+    choices = common.choices,
+    help = 'The os/architecture/endianness/bits the shellcode will run in (default: linux/i386), choose from: %s' % common.choices,
+)
+parser.add_argument(
+    '--exec',
+
+    # NOTE: Type cannot be "file" because we may be referring to a remote
+    #       file, or a file on an Android device.
+    type=str,
+
+    dest='executable',
+    help='File to debug'
+)
+parser.add_argument(
+    '--process', metavar='PROCESS_NAME',
+    help='Name of the process to attach to (e.g. "bash")'
+)
+parser.add_argument(
+    '--sysroot', metavar='SYSROOT',
+    type=str,
+    default='',
+    help="GDB sysroot path"
+)
+
+def main(args):
+    gdbscript = ''
+    if args.x:
+        gdbscript = args.x.read()
+
+    if context.os == 'android':
+        context.device = adb.wait_for_device()
+
+    if args.executable:
+        if os.path.exists(args.executable):
+            context.binary = ELF(args.executable)
+            target = context.binary.path
+
+        # This path does nothing, but avoids the "print_usage()"
+        # path below.
+        elif context.os == 'android':
+            target = args.executable
+    elif args.pid:
+        target = int(args.pid)
+    elif args.process:
+        if context.os == 'android':
+            target = adb.pidof(args.process)
+        else:
+            target = pidof(args.process)
+
+        # pidof() returns a list
+        if not target:
+            log.error("Could not find a PID for %r", args.process)
+
+        target = target[0]
+
+        # pidof will sometimes return all PIDs, including init
+        if target == 1:
+            log.error("Got PID 1 from pidof.  Check the process name, or use --pid 1 to debug init")
+    else:
+        parser.print_usage()
+        return 1
+
+    if args.pid or args.process:
+        pid = gdb.attach(target, gdbscript=gdbscript, sysroot=args.sysroot)
+
+        # Since we spawned the gdbserver process, and process registers an
+        # atexit handler to close itself, gdbserver will be terminated when
+        # we exit.  This will manifest as a "remote connected ended" or
+        # similar error message.  Hold it open for the user.
+        log.info("GDB connection forwarding will terminate when you press enter")
+        pause()
+    else:
+        gdb.debug(target, gdbscript=gdbscript, sysroot=args.sysroot).interactive()
+
+if __name__ == '__main__':
+    pwnlib.commandline.common.main(__file__)
@@ -0,0 +1,27 @@
+#!/usr/bin/env python2
+from __future__ import absolute_import
+from __future__ import division
+
+import argparse
+from pwn import *
+from pwnlib.commandline import common
+
+parser = common.parser_commands.add_parser(
+    'disablenx',
+    help = 'Disable NX for an ELF binary'
+)
+parser.add_argument(
+    'elf',
+    nargs='+',
+    type=argparse.FileType('rb'),
+    help='Files to check'
+)
+
+def main(args):
+    for f in args.elf:
+        e = ELF(f.name)
+        e.disable_nx()
+        ELF(e.path)
+
+if __name__ == '__main__':
+    pwnlib.commandline.common.main(__file__)
@@ -1,11 +1,17 @@
 #!/usr/bin/env python2
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+
 import argparse
 import string
 import sys

-from pwn import *
+import pwnlib
+pwnlib.args.free_form = False

-from . import common
+from pwn import *
+from pwnlib.commandline import common

 parser = common.parser_commands.add_parser(
    'disasm',
@@ -16,7 +22,7 @@ parser.add_argument(
    'hex',
    metavar = 'hex',
    nargs = '*',
-    help = 'Hex-string to disasemble. If none are supplied, then it uses stdin in non-hex mode.'
+    help = 'Hex-string to disassemble. If none are supplied, then it uses stdin in non-hex mode.'
 )

 parser.add_argument(
@@ -55,14 +61,14 @@ parser.add_argument(

 def main(args):
    if len(args.hex) > 0:
-        dat = ''.join(args.hex)
-        dat = dat.translate(None, string.whitespace)
-        if not set(string.hexdigits) >= set(dat):
-            print "This is not a hex string"
+        dat = ''.join(args.hex).encode('utf-8', 'surrogateescape')
+        dat = dat.translate(None, string.whitespace.encode('ascii'))
+        if not set(string.hexdigits.encode('ascii')) >= set(dat):
+            print("This is not a hex string")
            exit(-1)
-        dat = dat.decode('hex')
+        dat = unhex(dat)
    else:
-        dat = sys.stdin.read()
+        dat = getattr(sys.stdin, 'buffer', sys.stdin).read()


    if args.color:
@@ -75,17 +81,16 @@ def main(args):
        instrs  = disasm(dat, vma=safeeval.const(args.address), byte=False, offset=False)
        # instrs  = highlight(instrs, PwntoolsLexer(), TerminalFormatter())

-        split = lambda x: x.splitlines()
-        for o,b,i in zip(*list(map(split, (offsets, bytes, instrs)))):
+        for o,b,i in zip(*map(str.splitlines, (offsets, bytes, instrs))):
            b = b.replace('00', text.red('00'))
            b = b.replace('0a', text.red('0a'))
            i = highlight(i.strip(), PwntoolsLexer(), TerminalFormatter()).strip()
            i = i.replace(',',', ')

-            print o,b,i
+            print(o,b,i)
        return

-    print disasm(dat, vma=safeeval.const(args.address))
+    print(disasm(dat, vma=safeeval.const(args.address)))

 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)
@@ -1,13 +1,18 @@
 #!/usr/bin/env python2
+from __future__ import absolute_import
+from __future__ import division
+
 import shutil
 from argparse import ArgumentParser
 from subprocess import CalledProcessError
 from subprocess import check_output
 from tempfile import NamedTemporaryFile

-from pwn import *
+import pwnlib
+pwnlib.args.free_form = False

-from . import common
+from pwn import *
+from pwnlib.commandline import common


 def dump(objdump, path):
@@ -18,7 +23,7 @@ def dump(objdump, path):
    return n.name

 def diff(a,b):
-    try: return check_output(['diff',a,b])
+    try: return check_output(['diff',a,b], universal_newlines=True)
    except CalledProcessError as e:
        return e.output

@@ -51,7 +56,7 @@ def main(a):
    shutil.copy(y.path, name)
    y = dump(objdump, name)

-    print diff(x, y)
+    print(diff(x, y))

 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)
@@ -1,17 +1,20 @@
 #!/usr/bin/env python2
-import argparse
+from __future__ import absolute_import
+from __future__ import division
+
 import sys

-from pwn import *
+import pwnlib
+pwnlib.args.free_form = False

-from . import common
+from pwn import *
+from pwnlib.commandline import common

 p = common.parser_commands.add_parser(
    'elfpatch',
    help = 'Patch an ELF file'
 )

-p = argparse.ArgumentParser()
 p.add_argument('elf',help="File to patch")
 p.add_argument('offset',help="Offset to patch in virtual address (hex encoded)")
 p.add_argument('bytes',help='Bytes to patch (hex encoded)')
@@ -28,7 +31,7 @@ def main(a):
        elf    = ELF(a.elf)

    elf.write(offset, bytes)
-    sys.stdout.write(elf.get_data())
+    getattr(sys.stdout, 'buffer', sys.stdout).write(elf.get_data())

 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)
@@ -1,7 +1,10 @@
+from __future__ import absolute_import, print_function
+
 import argparse
 import os
+import errno

-from . import common
+from pwnlib.commandline import common

 parser = common.parser_commands.add_parser(
    'errno',
@@ -22,24 +25,24 @@ def main(args):
    if 0x100000000 - value < 0x200:
      value = 0x100000000 - value

-    if value not in os.errno.errorcode:
-      print "No errno for %s" % value
+    if value not in errno.errorcode:
+      print("No errno for %s" % value)
      return

-    name = os.errno.errorcode[value]
+    name = errno.errorcode[value]

  except ValueError:
    name = args.error.upper()

-    if not hasattr(os.errno, name):
-      print "No errno for %s" % name
+    if not hasattr(errno, name):
+      print("No errno for %s" % name)
      return

-    value = getattr(os.errno, name)
+    value = getattr(errno, name)


-  print '#define', name, value
-  print os.strerror(value)
+  print('#define', name, value)
+  print(os.strerror(value))

 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)
@@ -1,8 +1,12 @@
 #!/usr/bin/env python2
+from __future__ import absolute_import
+from __future__ import division
+
 import argparse
 import sys

-from . import common
+from pwnlib.commandline import common
+from pwnlib.util.fiddling import enhex

 parser = common.parser_commands.add_parser(
    'hex',
@@ -14,9 +18,12 @@ parser.add_argument('data', nargs='*',

 def main(args):
    if not args.data:
-        print sys.stdin.read().encode('hex')
+        print(enhex(getattr(sys.stdin, 'buffer', sys.stdin).read()))
    else:
-        print ' '.join(args.data).encode('hex')
+        data = ' '.join(args.data)
+        if not hasattr(data, 'decode'):
+            data = data.encode('utf-8', 'surrogateescape')
+        print(enhex(data))

 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)
@@ -1,30 +1,37 @@
+from __future__ import absolute_import
+
 import sys

-from . import asm
-from . import checksec
-from . import common
-from . import constgrep
-from . import cyclic
-from . import disasm
-from . import elfdiff
-from . import elfpatch
-from . import errno
-from . import hex
-from . import phd
-from . import pwnstrip
-from . import scramble
-from . import shellcraft
-from . import unhex
-from . import update
-from .common import parser
-from ..context import context
+from pwnlib.commandline import asm
+from pwnlib.commandline import checksec
+from pwnlib.commandline import common
+from pwnlib.commandline import constgrep
+from pwnlib.commandline import cyclic
+from pwnlib.commandline import debug
+from pwnlib.commandline import disasm
+from pwnlib.commandline import disablenx
+from pwnlib.commandline import elfdiff
+from pwnlib.commandline import elfpatch
+from pwnlib.commandline import errno
+from pwnlib.commandline import hex
+from pwnlib.commandline import phd
+from pwnlib.commandline import pwnstrip
+from pwnlib.commandline import scramble
+from pwnlib.commandline import shellcraft
+from pwnlib.commandline import template
+from pwnlib.commandline import unhex
+from pwnlib.commandline import update
+from pwnlib.commandline.common import parser
+from pwnlib.context import context

 commands = {
    'asm': asm.main,
    'checksec': checksec.main,
    'constgrep': constgrep.main,
    'cyclic': cyclic.main,
+    'debug': debug.main,
    'disasm': disasm.main,
+    'disablenx': disablenx.main,
    'elfdiff': elfdiff.main,
    'elfpatch': elfpatch.main,
    'errno': errno.main,
@@ -33,11 +40,15 @@ commands = {
    'pwnstrip': pwnstrip.main,
    'scramble': scramble.main,
    'shellcraft': shellcraft.main,
+    'template': template.main,
    'unhex': unhex.main,
    'update': update.main,
 }

 def main():
+    if len(sys.argv) < 2:
+        parser.print_usage()
+        sys.exit()
    args = parser.parse_args()
    with context.local(log_console = sys.stderr):
        commands[args.command](args)
@@ -1,11 +1,17 @@
 #!/usr/bin/env python2
+from __future__ import absolute_import
+from __future__ import division
+
 import argparse
 import os
 import sys
+import io
+
+import pwnlib
+pwnlib.args.free_form = False

 from pwn import *
-
-from . import common
+from pwnlib.commandline import common

 parser = common.parser_commands.add_parser(
    'phd',
@@ -17,8 +23,8 @@ parser.add_argument(
    metavar='file',
    nargs='?',
    help='File to hexdump.  Reads from stdin if missing.',
-    type=argparse.FileType('r'),
-    default=sys.stdin
+    type=argparse.FileType('rb'),
+    default=getattr(sys.stdin, 'buffer', sys.stdin)
 )

 parser.add_argument(
@@ -84,6 +90,9 @@ def main(args):
        else:
            infile.seek(skip, os.SEEK_CUR)

+    if count:
+        infile = io.BytesIO(infile.read(count))
+
    hl = []
    if args.highlight:
        for hs in args.highlight:
@@ -92,9 +101,9 @@ def main(args):

    try:
        for line in hexdump_iter(infile, width, highlight = hl, begin = offset + skip):
-            print line
+            print(line)
    except (KeyboardInterrupt, IOError):
        pass

 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)
@@ -1,8 +1,13 @@
+from __future__ import absolute_import
+from __future__ import division
+
 import argparse

-from pwn import *
+import pwnlib
+pwnlib.args.free_form = False

-from . import common
+from pwn import *
+from pwnlib.commandline import common

 p = common.parser_commands.add_parser(
    'pwnstrip',
@@ -12,8 +17,8 @@ p = common.parser_commands.add_parser(
 g = p.add_argument_group("actions")
 g.add_argument('-b', '--build-id', help="Strip build ID", action='store_true')
 g.add_argument('-p', '--patch', metavar='FUNCTION', help="Patch function", action='append')
-p.add_argument('-o', '--output', type=file, default=sys.stdout)
-p.add_argument('file', type=file)
+p.add_argument('-o', '--output', type=argparse.FileType('wb'), default=getattr(sys.stdout, 'buffer', sys.stdout))
+p.add_argument('file', type=argparse.FileType('rb'))

 def main(args):
    if not (args.patch or args.build_id):
@@ -28,7 +33,7 @@ def main(args):
        for offset in pwnlib.libcdb.get_build_id_offsets():
            data = elf.read(elf.address + offset + 0xC, 4)
            if data == 'GNU\x00':
-                elf.write(elf.address + offset + 0x10, read('/dev/urandom', 20))
+                elf.write(elf.address + offset + 0x10, os.urandom(20))

    for function in args.patch:
        if function not in elf.symbols:
@@ -42,9 +47,9 @@ def main(args):
    result = elf.data

    if args.output.isatty():
-        result = enhex(result)
+        result = enhex(result).encode('ascii')

    args.output.write(result)

 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)