Release 3.9.2

This causes a background instance to be spawned, which is not intended.

.github/ISSUE_TEMPLATE.md

@@ -4,6 +4,11 @@ Thanks for contributing to Pwntools!
 
 When reporting an issue, be sure that you are running the latest released version of pwntools (`pip install --upgrade pwntools`).
 
-Please verify that your issue occurs on 64-bit Ubuntu 14.04.  You can use the Dockerfile in `extra/docker/Dockerfile` to save time.
+Please verify that your issue occurs on 64-bit Ubuntu 14.04.  You can use the Dockerfile on `docker.io` for quick testing.
+
+```
+$ docker pull pwntools/pwntools:stable
+$ docker run -it pwntools/pwntools:stable
+```
 
 If possible, provide a proof-of-concept which demonstrates the problem.  Include any binaries or scripts necessary to reproduce the issue, and please include the full debug output via setting the environment variable `PWNLIB_DEBUG=1`.

.travis.yml

@@ -1,10 +1,9 @@
-sudo: false
+dist: precise
 language: python
 addons:
   apt:
     packages:
     - gcc-multilib
-    - gcc-4.6-arm-linux-gnueabihf
     - lib32stdc++6
     - ash
     - bash
@@ -18,8 +17,8 @@ cache:
     - pip
     - directories:
         - usr
-        - /home/travis/virtualenv/python2.7.9/lib/python2.7/site-packages/
-        - /home/travis/virtualenv/python2.7.9/bin/
+        - /home/travis/virtualenv/python2.7.13/lib/python2.7/site-packages/
+        - /home/travis/virtualenv/python2.7.13/bin/
 python:
   - "2.7"
 before_install:
@@ -29,6 +28,7 @@ before_install:
   - echo $-
 install:
   - pip install --upgrade pip
+  - pip install --upgrade appdirs # https://github.com/ActiveState/appdirs/issues/89#issuecomment-282326570
   - pip install --upgrade --editable .
   - pip install --upgrade --requirement docs/requirements.txt
 before_script:

CHANGELOG.md

@@ -9,9 +9,19 @@ The table below shows which release corresponds to each branch, and what date th
 
 | Version          | Branch   | Release Date           |
 | ---------------- | -------- | ---------------------- |
-| [3.6.0](#350)    | `dev`    | May 6, 2017 (planned)
-| [3.5.0](#350)    | `beta`   | Mar 25, 2017 (planned)
-| [3.4.1](#341)    | `stable` | Feb 17, 2017
+| [3.11.0](#3110)  | `dev`    | Dec 2, 2017 (planned)
+| [3.10.0](#3100)  | `beta`   | Oct 21, 2017 (planned)
+| [3.9.2](#392)    | `stable` | Oct 5, 2017
+| [3.9.1](#391)    |          | Sep 28, 2017
+| [3.9.0](#390)    |          | Sep 11, 2017
+| [3.8.0](#380)    |          | Jul 29, 2017
+| [3.7.1](#371)    |          | Jul 14, 2017
+| [3.7.0](#370)    |          | Jun 19, 2017
+| [3.6.1](#361)    |          | May 12, 2017
+| [3.6.0](#360)    |          | May 8, 2017
+| [3.5.1](#351)    |          | Apr 15, 2017
+| [3.5.0](#350)    |          | Mar 26, 2017
+| [3.4.1](#341)    |          | Feb 17, 2017
 | [3.4.0](#340)    |          | Feb 13, 2017
 | [3.3.4](#334)    |          | Jan 12, 2016
 | [3.3.3](#333)    |          | Jan 10, 2016
@@ -29,14 +39,189 @@ The table below shows which release corresponds to each branch, and what date th
 | [3.0.0](#300)    |          | Aug 20, 2016
 | [2.2.0](#220)    |          | Jan 5, 2015
 
+## 3.11.0
+
+To be released on Dec 2, 2017.
+
+## 3.10.0
+
+To be released on Oct 21, 2017.
+
+## 3.9.2
+
+- [#1043][1043] Do not attempt to populate the libraries used by statically-linked binaries
+
+[1043]: https://github.com/Gallopsled/pwntools/pull/1043
+
+## 3.9.1
+
+- [#1038][1038] Fix an issue with `process()` where glibc would buffer data internally, causing a hang on `select()`
+- [#1036][1036] Fix Travis CI logging verbosity
+- [#1029][1029] Fix some `unicode` issues when using the `readline` command history in `tube.interactive()`
+
+[1038]: https://github.com/Gallopsled/pwntools/pull/1038
+[1036]: https://github.com/Gallopsled/pwntools/pull/1036
+[1029]: https://github.com/Gallopsled/pwntools/pull/1029
+
+## 3.9.0
+
+- [#1003][1003] Make `concat_all` faster while also simplifying it's logic
+- [#1014][1014] Fix for overwritten env when parsing core file
+- [#1023][1023] Fixes to Travis CI
+
+[1003]: https://github.com/Gallopsled/pwntools/pull/1003
+[1014]: https://github.com/Gallopsled/pwntools/pull/1014
+[1023]: https://github.com/Gallopsled/pwntools/pull/1023
+
+## 3.8.0
+
+- [#981][981] Fixed RELRO detection logic
+- [#986][986] Enhancements to DynELF for controlling usage of LibcDB
+- A few documentation fixes
+- A few fixes for the Docker image
+
+[981]: https://github.com/Gallopsled/pwntools/pull/981
+[986]: https://github.com/Gallopsled/pwntools/pull/986
+
+## 3.7.1
+
+- [#998][998] Fix a bug where integer values could not be set in `.pwn.conf`.
+
+[998]: https://github.com/Gallopsled/pwntools/pull/998
+
+## 3.7.0
+
+- [#933][933] DynELF works better with different base addresses
+- [#952][952] A few small fixes were made to `pwn template`, and the CRC database was updated.
+- [5c72d62c][5c72d62c] Updated the CRC database
+
+[933]: https://github.com/Gallopsled/pwntools/pull/933
+[952]: https://github.com/Gallopsled/pwntools/pull/952
+[5c72d62c]: https://github.com/Gallopsled/pwntools/commit/5c72d62c
+
+## 3.6.1
+
+- [#979][979]+[1a4a1e1][1a4a1e1] Fixed [#974][974], a bug related to the terminal handling and numlock.
+- [#980][980] Fixed the `pwn template` command.
+
+[974]: https://github.com/Gallopsled/pwntools/issues/974
+[979]: https://github.com/Gallopsled/pwntools/pull/979
+[980]: https://github.com/Gallopsled/pwntools/pull/980
+[1a4a1e1]: https://github.com/Gallopsled/pwntools/commit/1a4a1e1
 
 ## 3.6.0
 
-To be released on May 6, 2017.
+- [#895][895] Added a Dockerfile to simplify testing setup and allow testing on OSX
+- [#897][897] Fixed some incorrect AArch64 syscals
+- [#893][893] Added the `pwnlib.config` module
+    + Configuration options can now be set in `~/.pwn.conf`
+    + This replaces the old, **undocumented** mechanism for changing logging colors.  Only @br0ns and @ebeip90 were likely using this.
+    + More information is available in the documentation [here](http://docs.pwntools.com/en/dev/config.html).
+- [#899][899] Pwntools now uses Unicorn Engine to emulate PLT instructions to ensure correct mapping of PIE / RELRO binaries.
+- [#904][904] Enhancements to the accuracy of the `pwn checksec` command.
+- [#905][905] Added a `pwn debug` command-line utility which automates the process of `gdb.attach(process(...))` to spawn GDB
+    + More information is available in the documentation [here](http://docs.pwntools.com/en/dev/commandline.html#pwn-debug)
+- [#919][919] Added a `pwn template` command-line utility to simplify the process of bootstrapping a new exploit.
+    + More information is available in the documentation [here](http://docs.pwntools.com/en/dev/commandline.html#pwn-template).
+- [#948][948] Fix unnecessary warning for Core files
+- [#954][954] Fix list processing in `~/.pwn.conf`
+- [#967][967] Respect `TERM_PROGRAM` for `run_in_new_terminal`
+- [#970][970] Fix overly-aggressive corefile caching
+
+[947]: https://github.com/Gallopsled/pwntools/pull/947
+[948]: https://github.com/Gallopsled/pwntools/pull/948
+[954]: https://github.com/Gallopsled/pwntools/pull/954
+[960]: https://github.com/Gallopsled/pwntools/pull/960
+[967]: https://github.com/Gallopsled/pwntools/pull/967
+[968]: https://github.com/Gallopsled/pwntools/pull/968
+[970]: https://github.com/Gallopsled/pwntools/pull/970
+
+[895]: https://github.com/Gallopsled/pwntools/pull/895
+[897]: https://github.com/Gallopsled/pwntools/pull/897
+[893]: https://github.com/Gallopsled/pwntools/pull/893
+[899]: https://github.com/Gallopsled/pwntools/pull/899
+[904]: https://github.com/Gallopsled/pwntools/pull/904
+[905]: https://github.com/Gallopsled/pwntools/pull/905
+[919]: https://github.com/Gallopsled/pwntools/pull/919
+
+## 3.5.1
+
+- [#945][945] Speed up ssh via caching checksec results (fixes [#944][944])
+- [#950][950] Fixes a bug where setting `context.arch` does not have an effect on `adb.compile()` output architecture
+
+[944]: https://github.com/Gallopsled/pwntools/issues/944
+[945]: https://github.com/Gallopsled/pwntools/pull/945
+[950]: https://github.com/Gallopsled/pwntools/pull/950
 
 ## 3.5.0
 
-To be released on Mar 25, 2017.
+- [b584ca3][b584ca3] Fixed an issue running `setup.py` on ARM
+- [#822][822] Enabled relative leaks with `MemLeak`
+    + This should be useful for e.g. heap-relative leaks
+- [#832][832] Changed all internal imports to use absolute imports (no functional changes)
+- [a12d0b6][a12d0b6] Move `STDOUT`, `PIPE`, `PTY` constants to globals
+    + `process(..., stdin=process.PTY)` --> `process(..., stdin=PTY)`
+- [#828][828] Use `PR_SET_PTRACER` for all `process()` and `ssh.process()` instances
+    + This simplifies debugging on systems with YAMA ptrace enabled
+- Various documentation enhancements
+    + In particular, the [gdb][gdb], [elf][elf], and [ssh][ssh] docs are much better
+- [#833][833] Performance enhancements for `adb` module
+- [d0267f3][d0267f3] `packing.fit()` now treats large offsets as cyclic patterns (e.g. `0x61616161` behaves the same as `"aaaa"`)
+- [#835][835] Added `ssh.checksec`
+    + Reports the kernel version and other relevant information on connection
+- [#857][857] Slightly shortened `execve` shellcode
+- [300f8e0][300f8e0] Slightly speed up processing of large ELF files
+- [#861][861] Adds support for extracting `IKCONFIG` configs from Linux kernel images, and extends `checksec` to report on any insecure configurations discovered
+- [#871][871] Moves all of the basic syscall templates to `shellcraft/common` and exposes them via symlinks.  Closed [#685][685]
+    + Should not have any visible effects from any documented APIs
+    + `shellcraft.arch.os.syscall_function()` still works the same
+    + We now have the ability to differentiate between the `connect` syscall, and a TCP `connect` helper
+- [#887][887] `sh_string` now returns a quoted empty string `''` rather than just an empty string
+- [#839][839] Exposes a huge amount of functionality via corefiles which was not previously availble.  See the [docs][corefile_docs] for examples.
+    + `process().corefile` will automatically instantiate a Corefile for the process
+    + QEMU-emulated processes are supported
+    + Native processes are supported, including extraction of coredumps from `apport` crash logs
+    + Native processes can be dumped *while running*, in a manner similar to `GDB`'s `gcore` script
+- [#875][857] Added [documentation][aarch64] (and tests) for AArch64 shellcode
+- [#882][882] The `ROP` class now respects `context.bytes` instead of using the hard-coded value of `4` (fixed [#879][879])
+- [#869][869] Added several fields to the `process` class (`uid`, `gid`, `suid`, `sgid`) which are recorded at execution time, based on the file permissions
+- [#868][868] Changed the way that `ssh.process()` works internally, and it now returns a more specialized class, `ssh_process`.
+    + Added `ssh_process.corefile` for fetching remote corefiles
+    + Added `ssh_process.ELF` for getting an ELF of the remote executable
+    + The `uid`, `gid`, and `suid`, and `sgid` which are recorded at execution time, based on the file permissions
+- [#865][865] Fixes `ELF.read` to support contiguous memory reads across non-contiguous file-backed segments
+- [#862][862] Adds a `symlink=` argument to `ssh.set_working_directory`, which will automatically symlink all of the files in the "old" working directory into the "new" working directory
+
+[ssh]: http://docs.pwntools.com/en/dev/tubes/ssh.html
+[gdb]: http://docs.pwntools.com/en/dev/gdb.html
+[elf]: http://docs.pwntools.com/en/dev/elf.html
+[corefile_docs]: http://docs.pwntools.com/en/dev/elf/corefile.html
+[aarch64]: http://docs.pwntools.com/en/dev/shellcraft/aarch64.html
+
+[685]: https://github.com/Gallopsled/pwntools/pull/685
+[822]: https://github.com/Gallopsled/pwntools/pull/822
+[828]: https://github.com/Gallopsled/pwntools/pull/828
+[832]: https://github.com/Gallopsled/pwntools/pull/832
+[833]: https://github.com/Gallopsled/pwntools/pull/833
+[835]: https://github.com/Gallopsled/pwntools/pull/835
+[839]: https://github.com/Gallopsled/pwntools/pull/839
+[857]: https://github.com/Gallopsled/pwntools/pull/857
+[861]: https://github.com/Gallopsled/pwntools/pull/861
+[862]: https://github.com/Gallopsled/pwntools/pull/862
+[865]: https://github.com/Gallopsled/pwntools/pull/865
+[868]: https://github.com/Gallopsled/pwntools/pull/868
+[869]: https://github.com/Gallopsled/pwntools/pull/869
+[871]: https://github.com/Gallopsled/pwntools/pull/871
+[875]: https://github.com/Gallopsled/pwntools/pull/857
+[879]: https://github.com/Gallopsled/pwntools/issues/879
+[882]: https://github.com/Gallopsled/pwntools/pull/882
+[887]: https://github.com/Gallopsled/pwntools/pull/887
+
+
+[b584ca3]: https://github.com/Gallopsled/pwntools/commit/b584ca3
+[a12d0b6]: https://github.com/Gallopsled/pwntools/commit/a12d0b6
+[d0267f3]: https://github.com/Gallopsled/pwntools/commit/d0267f3
+[300f8e0]: https://github.com/Gallopsled/pwntools/commit/300f8e0
 
 ## 3.4.1
 
@@ -47,7 +232,6 @@ To be released on Mar 25, 2017.
 [894]: https://github.com/Gallopsled/pwntools/pull/894
 [891]: https://github.com/Gallopsled/pwntools/issues/891
 
-
 ## 3.4.0
 
 - [#800][800] Add `shell=` option to `ssh.process()`

MANIFEST.in

@@ -2,6 +2,6 @@ graft examples
 graft extra
 include *.md *.txt *.sh *.yml MANIFEST.in
 recursive-include docs   *.rst *.png Makefile *.py *.txt
-recursive-include pwnlib *.py *.asm *.rst *.md *.txt *.sh
+recursive-include pwnlib *.py *.asm *.rst *.md *.txt *.sh __doc__ *.mako
 recursive-include pwn    *.py *.asm *.rst *.md *.txt *.sh
 recursive-exclude *.pyc

README.md

@@ -2,13 +2,13 @@
 ![pwntools logo](https://github.com/Gallopsled/pwntools/blob/stable/docs/source/logo.png?raw=true)
 
 [![Docs](https://readthedocs.org/projects/pwntools/badge/?version=stable)](https://docs.pwntools.com/)
-[![PyPI](https://img.shields.io/badge/pypi-v3.4.1-green.svg?style=flat)](https://pypi.python.org/pypi/pwntools/)
+[![PyPI](https://img.shields.io/badge/pypi-v3.9.2-green.svg?style=flat)](https://pypi.python.org/pypi/pwntools/)
 [![Travis](https://travis-ci.org/Gallopsled/pwntools.svg)](https://travis-ci.org/Gallopsled/pwntools)
 [![Coveralls](https://img.shields.io/coveralls/Gallopsled/pwntools/dev.svg)](https://coveralls.io/github/Gallopsled/pwntools?branch=dev)
 [![Twitter](https://img.shields.io/badge/twitter-pwntools-4099FF.svg?style=flat)](https://twitter.com/pwntools)
 [![MIT License](https://img.shields.io/badge/license-MIT-blue.svg?style=flat)](http://choosealicense.com/licenses/mit/)
 
-pwntools is a CTF framework and exploit development library. Written in Python, it is designed for rapid prototyping and development, and intended to make exploit writing as simple as possible.
+Pwntools is a CTF framework and exploit development library. Written in Python, it is designed for rapid prototyping and development, and intended to make exploit writing as simple as possible.
 
 ```python
 from pwn import *
@@ -32,13 +32,14 @@ To get you started, we've provided some example solutions for past CTF challenge
 
 # Installation
 
-pwntools is best supported on 64-bit Ubuntu 12.04 and 14.04, but most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).  Python 2.7 is required.
+Pwntools is best supported on 64-bit Ubuntu LTE releases (12.04, 14.04, and 16.04).  Most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).  Python 2.7 is required.
 
 Most of the functionality of pwntools is self-contained and Python-only.  You should be able to get running quickly with
 
 ```sh
 apt-get update
-apt-get install python2.7 python-pip python-dev git libssl-dev libffi-dev
+apt-get install python2.7 python-pip python-dev git libssl-dev libffi-dev build-essential
+pip install --upgrade pip
 pip install --upgrade pwntools
 ```
 

TESTING.md

@@ -4,7 +4,6 @@ Pwntools makes extensive use of unit tests and integration tests to ensure every
 
 ## Test Suite
 
-
 To run the test suite, it is best to use Ubuntu 12.04 or 14.04, and run the following commands.  **Be aware** that this will add a user to the machine, and create a public key for SSH login!
 
 ```sh
@@ -14,6 +13,12 @@ pip install --upgrade --editable .
 PWNLIB_NOTERM=1 make -C docs doctest
 ```
 
+## Testing in Docker
+
+A `Dockerfile` has been provided which has a clean testing environment with Ubuntu Xenial.  It is very similar to the online Travis CI testing environment, but uses a more modern version of Ubuntu.
+
+See `travis/docker/README.md` for more information.
+
 ## New Tests
 
 To add a new test to an existing module, just add an inline doctest.  If the test needs access to an external module, add the import statement to the `testsetup` block in the corresponding file in `docs/source/<module>.rst`.

docs/source/asm.rst

@@ -13,3 +13,13 @@
 
 .. automodule:: pwnlib.asm
    :members:
+
+Internal Functions
+-----------------------------------------
+
+These are only included so that their tests are run.
+
+You should never need these.
+
+.. autofunction:: pwnlib.asm.dpkg_search_for_binutils
+.. autofunction:: pwnlib.asm.print_binutils_instructions

docs/source/conf.py

@@ -44,6 +44,27 @@ extensions = [
     'sphinxcontrib.napoleon'
 ]
 
+# Disable "info" logging directly to stdout by Sphinx
+import logging
+
+class SphinxPwnlibFilter(logging.Filter):
+    def filter(self, record):
+        if record.name.startswith('pwn'):
+            return False
+        if record.name.startswith('paramiko'):
+            return False
+        return True
+
+log_filter = SphinxPwnlibFilter()
+
+for i, handler in enumerate(logging.root.handlers):
+    print("Filtering Sphinx handler", handler)
+    handler.addFilter(log_filter)
+
+# Napoleon settings
+napoleon_use_ivar = True
+napoleon_use_rtype = False
+
 doctest_global_setup = '''
 import sys, os
 os.environ['PWNLIB_NOTERM'] = '1'
@@ -52,6 +73,7 @@ import pwnlib
 pwnlib.context.context.reset_local()
 pwnlib.context.ContextType.defaults['log_level'] = 'ERROR'
 pwnlib.context.ContextType.defaults['randomize'] = False
+pwnlib.util.fiddling.default_style = {}
 pwnlib.term.text.when = 'never'
 pwnlib.log.install_default_handler()
 pwnlib.log.rootlogger.setLevel(1)
@@ -67,12 +89,13 @@ class stdout(object):
 pwnlib.context.ContextType.defaults['log_console'] = stdout()
 '''
 
-autodoc_member_order = 'alphabetical'
+autoclass_content = 'both'
+autodoc_member_order = 'groupwise' # 'alphabetical'
 
 # Add any paths that contain templates here, relative to this directory.
 templates_path = ['_templates']
 
-doctest_test_doctest_blocks = True
+doctest_test_doctest_blocks = 'true'
 
 # The suffix of source filenames.
 source_suffix = '.rst'
@@ -231,7 +254,7 @@ latex_documents = [
 ]
 
 intersphinx_mapping = {'python': ('https://docs.python.org/2.7', None),
-                       'paramiko': ('https://paramiko-docs.readthedocs.org/en/1.15/', None)}
+                       'paramiko': ('https://paramiko-docs.readthedocs.org/en/2.1/', None)}
 
 # The name of an image file (relative to this directory) to place at the top of
 # the title page.
@@ -347,3 +370,50 @@ if build_dash:
         html_theme_path = [sphinx_rtd_theme.get_html_theme_path()]
 
     # otherwise, readthedocs.org uses their theme by default, so no need to specify it
+
+
+# -- Customization to Sphinx autodoc generation --------------------------------------------
+import sphinx.ext.autodoc
+from sphinx.util.inspect import safe_getmembers, safe_getattr
+
+# Test hidden members (e.g. def _foo(...))
+def dont_skip_any_doctests(app, what, name, obj, skip, options):
+    return False
+
+# Test non-exported members
+class ModuleDocumenter(sphinx.ext.autodoc.ModuleDocumenter):
+    def get_object_members(self, want_all):
+        if want_all:
+            # if not hasattr(self.object, '__all__'):
+            #     for implicit module members, check __module__ to avoid
+            #     documenting imported objects
+                return True, safe_getmembers(self.object)
+            # else:
+            #     memberlist = self.object.__all__
+            #     # Sometimes __all__ is broken...
+            #     if not isinstance(memberlist, (list, tuple)) or not \
+            #        all(isinstance(entry, string_types) for entry in memberlist):
+            #         self.directive.warn(
+            #             '__all__ should be a list of strings, not %r '
+            #             '(in module %s) -- ignoring __all__' %
+            #             (memberlist, self.fullname))
+            #         # fall back to all members
+            #         return True, safe_getmembers(self.object)
+        else:
+            memberlist = self.options.members or []
+        ret = []
+        for mname in memberlist:
+            try:
+                ret.append((mname, safe_getattr(self.object, mname)))
+            except AttributeError:
+                self.directive.warn(
+                    'missing attribute mentioned in :members: or __all__: '
+                    'module %s, attribute %s' % (
+                        safe_getattr(self.object, '__name__', '???'), mname))
+        return False, ret
+
+if 'doctest' in sys.argv:
+    def setup(app):
+        app.connect('autodoc-skip-member', dont_skip_any_doctests)
+
+    sphinx.ext.autodoc.ModuleDocumenter = ModuleDocumenter

docs/source/config.rst

@@ -0,0 +1,4 @@
+:mod:`pwnlib.config` --- Pwntools Configuration File
+====================================================
+
+.. automodule:: pwnlib.config

docs/source/context.rst

@@ -3,13 +3,31 @@
    from pwn import *
    import logging
    log = pwnlib.log.getLogger('pwnlib.context')
+   context.clear()
 
 :mod:`pwnlib.context` --- Setting runtime variables
 =====================================================
 
-.. autodata:: pwnlib.context.context
+Many settings in ``pwntools`` are controlled via the global variable :data:`.context, such as the selected target operating system, architecture, and bit-width.
 
-.. autoclass:: pwnlib.context.ContextType
-    :members:
+In general, exploits will start with something like:
 
-.. autoclass:: pwnlib.context.Thread
+.. code-block:: python
+
+    from pwn import *
+    context.arch = 'amd64'
+
+Which sets up everything in the exploit for exploiting a 64-bit Intel binary.
+
+The recommended method is to use ``context.binary``  to automagically set all of the appropriate values.
+
+.. code-block:: python
+
+    from pwn import *
+    context.binary = './challenge-binary'
+
+Module Members
+----------------------------------------------------
+
+.. automodule:: pwnlib.context
+   :members:

docs/source/elf.rst

@@ -3,8 +3,16 @@
    from pwnlib.elf import *
    from pwnlib.util.misc import which
 
-:mod:`pwnlib.elf` --- Working with ELF binaries
-===============================================
+:mod:`pwnlib.elf` --- ELF Executables and Libraries
+===================================================
 
 .. automodule:: pwnlib.elf
-   :members:
+
+
+ELF Modules
+-------------------
+
+.. toctree::
+    elf/elf
+    elf/config
+    elf/corefile

docs/source/elf/config.rst

@@ -0,0 +1,10 @@
+.. testsetup:: *
+
+   from pwn import *
+   from pwnlib.elf.config import parse_kconfig
+
+:mod:`pwnlib.elf.config` --- Kernel Config Parsing
+===========================================================
+
+.. automodule:: pwnlib.elf.config
+  :members:

docs/source/elf/corefile.rst

@@ -0,0 +1,15 @@
+.. testsetup:: *
+
+   from pwn import *
+
+:mod:`pwnlib.elf.corefile` --- Core Files
+===========================================================
+
+.. automodule:: pwnlib.elf.corefile
+
+  .. autoclass:: pwnlib.elf.corefile.Corefile
+     :members:
+     :show-inheritance:
+
+  .. autoclass:: pwnlib.elf.corefile.Mapping
+     :members:

docs/source/elf/elf.rst

@@ -0,0 +1,28 @@
+.. testsetup:: *
+
+   from pwn import *
+   from glob import glob
+
+:mod:`pwnlib.elf.elf` --- ELF Files
+===========================================================
+
+.. automodule:: pwnlib.elf.elf
+
+  .. autoclass:: pwnlib.elf.elf.ELF
+     :members:
+     :show-inheritance:
+     :inherited-members:
+     :exclude-members: address_offsets,
+                       get_data,
+                       get_dwarf_info,
+                       get_section,
+                       get_segment,
+                       has_dwarf_info,
+                       iter_sections,
+                       iter_segments
+
+  .. autoclass:: pwnlib.elf.elf.Function
+     :members:
+
+  .. autoclass:: pwnlib.elf.elf.dotdict
+     :members:

docs/source/gdb.rst

@@ -1,3 +1,7 @@
+.. testsetup:: *
+
+    from pwn import *
+
 :mod:`pwnlib.gdb` --- Working with GDB
 ======================================
 

docs/source/globals.rst

@@ -13,11 +13,11 @@ Which imports a bazillion things into the global namespace to make your life eas
 
 This is a quick list of most of the objects and routines imported, in rough order of importance and frequency of use.
 
-- ``context``
+- :obj:`.context`
     - :data:`pwnlib.context.context`
     - Responsible for most of the pwntools convenience settings
     - Set `context.log_level = 'debug'` when troubleshooting your exploit
-    - Scope-aware, so you can disable logging for a subsection of code via ``pwnlib.context.ContextType.local``
+    - Scope-aware, so you can disable logging for a subsection of code via :meth:`.ContextType.local`
 - ``remote``, ``listen``, ``ssh``, ``process``
     - :mod:`pwnlib.tubes`
     - Super convenient wrappers around all of the common functionality for CTF challenges
@@ -57,11 +57,11 @@ This is a quick list of most of the objects and routines imported, in rough orde
 - ``gdb.debug`` and ``gdb.attach``
     - :mod:`pwnlib.gdb`
     - Launch a binary under GDB and pop up a new terminal to interact with it.  Automates setting breakpoints and makes iteration on exploits MUCH faster.
-    - Alternately, attach to a running process given a PID, ``pwnlib.tubes`` object, or even just a socket that's connected to it
+    - Alternately, attach to a running process given a PID, :mod:`pwnlib.tubes` object, or even just a socket that's connected to it
 - ``args``
-    - Dictionary contining all-caps command-line arguments for quick access
+    - Dictionary containing all-caps command-line arguments for quick access
     - Run via ``python foo.py REMOTE=1`` and ``args['REMOTE'] == '1'``.
-    - Can also control logging verbosity and terminal fancyness
+    - Can also control logging verbosity and terminal fanciness
         - `NOTERM`
         - `SILENT`
         - `DEBUG`
@@ -78,7 +78,7 @@ This is a quick list of most of the objects and routines imported, in rough orde
     - It's the new ``getch``
 - ``safeeval``
     - :mod:`pwnlib.util.safeeval`
-    - Functions for safely evalutaing python code without nasty side-effects.
+    - Functions for safely evaluating python code without nasty side-effects.
 
 These are all pretty self explanatory, but are useful to have in the global namespace.
 

docs/source/index.rst

@@ -48,6 +48,7 @@ Each of the ``pwntools`` modules is documented here.
    atexception
    atexit
    constants
+   config
    context
    dynelf
    encoders
@@ -56,8 +57,10 @@ Each of the ``pwntools`` modules is documented here.
    flag
    fmtstr
    gdb
+   libcdb
    log
    memleak
+   protocols
    replacements
    rop
    rop/*

docs/source/install.rst

@@ -25,7 +25,8 @@ pwntools is available as a ``pip`` package.
 .. code-block:: bash
 
     $ apt-get update
-    $ apt-get install python2.7 python-pip python-dev git libssl-dev libffi-dev
+    $ apt-get install python2.7 python-pip python-dev git libssl-dev libffi-dev build-essential
+    $ pip install --upgrade pip
     $ pip install --upgrade pwntools
 
 Development

docs/source/intro.rst

@@ -72,7 +72,7 @@ a ``process`` tube.
 
 ::
 
-    >>> shell = ssh('bandit0', 'bandit.labs.overthewire.org', password='bandit0')
+    >>> shell = ssh('bandit0', 'bandit.labs.overthewire.org', password='bandit0', port=2220)
     >>> shell['whoami']
     'bandit0'
     >>> shell.download_file('/etc/motd')
@@ -212,8 +212,8 @@ Stop hard-coding things!  Look them up at runtime with :mod:`pwnlib.elf`.
 You can even patch and save the files.
 
     >>> e = ELF('/bin/cat')
-    >>> e.read(e.address+1, 3)
-    'ELF'
+    >>> e.read(e.address, 4)
+    '\x7fELF'
     >>> e.asm(e.address, 'ret')
     >>> e.save('/tmp/quiet-cat')
     >>> disasm(file('/tmp/quiet-cat','rb').read(1))

docs/source/libcdb.rst

@@ -0,0 +1,10 @@
+.. testsetup:: *
+
+   from pwn import *
+   from pwnlib.libcdb import *
+
+:mod:`pwnlib.libcdb` --- Libc Database
+===========================================
+
+.. automodule:: pwnlib.libcdb
+   :members:

docs/source/memleak.rst

@@ -1,11 +1,9 @@
 .. testsetup:: *
 
-   from pwnlib.memleak import *
+    from pwn import *
 
 :mod:`pwnlib.memleak` --- Helper class for leaking memory
 =========================================================
 
-.. module:: pwnlib.memleak
-
-.. autoclass:: MemLeak
-   :members:
+.. automodule:: pwnlib.memleak
+    :members:

docs/source/protocols.rst

@@ -0,0 +1,15 @@
+:mod:`pwnlib.protocols` --- Wire Protocols
+=============================================
+
+.. automodule:: pwnlib.protocols
+
+
+Supported Protocols
+-------------------
+
+.. toctree::
+    :maxdepth: 3
+    :glob:
+
+    protocols/*
+

docs/source/protocols/adb.rst

@@ -0,0 +1,10 @@
+.. testsetup:: *
+
+   from pwn import *
+   from pwnlib.protocols.adb import AdbClient
+
+:mod:`pwnlib.protocols.adb` --- ADB Protocol Implementation
+===========================================================
+
+.. automodule:: pwnlib.protocols.adb
+   :members:

docs/source/shellcraft/aarch64.rst

@@ -0,0 +1,19 @@
+.. testsetup:: *
+
+   from pwn import *
+   context.clear(arch='aarch64')
+
+:mod:`pwnlib.shellcraft.aarch64` --- Shellcode for AArch64
+===========================================================
+
+:mod:`pwnlib.shellcraft.aarch64`
+--------------------------------
+
+.. automodule:: pwnlib.shellcraft.aarch64
+   :members:
+
+:mod:`pwnlib.shellcraft.aarch64.linux`
+--------------------------------------
+
+.. automodule:: pwnlib.shellcraft.aarch64.linux
+   :members:

docs/source/tubes.rst

@@ -27,4 +27,4 @@ Types of Tubes
   .. autoclass:: pwnlib.tubes.tube.tube()
      :members:
      :exclude-members: recv_raw, send_raw, settimeout_raw,
-                       can_recv_raw
+                       can_recv_raw, shutdown_raw, connected_raw,

docs/source/util/fiddling.rst

@@ -1,6 +1,7 @@
 .. testsetup:: *
 
-   from pwnlib.util.fiddling import *
+    from pwn import *
+    from pwnlib.util.fiddling import *
 
 
 :mod:`pwnlib.util.fiddling` --- Utilities bit fiddling

docs/source/util/safeeval.rst

@@ -1,6 +1,7 @@
 .. testsetup:: *
 
    from pwnlib.util.safeeval import *
+   _get_opcodes = pwnlib.util.safeeval._get_opcodes
 
 
 :mod:`pwnlib.util.safeeval` --- Safe evaluation of python code

examples/sigreturn_corefile_aarch64.py

@@ -0,0 +1,31 @@
+from pwn import *
+context.arch='aarch64'
+frame = SigreturnFrame()
+
+registers = ['x%i' % i for i in range(0, 31)]
+registers += ['sp', 'pc']
+
+
+for index, register in enumerate(registers):
+    setattr(frame, register, index)
+
+assembly = '\n'.join([
+    shellcraft.read(constants.STDIN_FILENO, 'sp', 1024),
+    shellcraft.syscall(constants.SYS_rt_sigreturn)
+])
+
+binary = ELF.from_assembly(assembly)
+
+io = binary.process()
+io.flat(frame)
+io.wait()
+assert io.poll() == -11
+
+corefile = io.corefile
+
+for index, register in enumerate(registers):
+    value = getattr(corefile, register)
+    if index != value:
+        log.error("%s != %i (%i)" % (register, index, value))
+    else:
+        log.success("%s == %i" % (register, value))

examples/sigreturn_corefile_amd64.py

@@ -0,0 +1,32 @@
+from pwn import *
+context.arch='amd64'
+frame = SigreturnFrame()
+
+registers = ['rax', 'rbx', 'rcx', 'rdx',
+             'rdi', 'rsi', 'rbp', 'rsp',
+             'rip',
+             'r8', 'r9', 'r10', 'r11', 'r12', 'r13', 'r14', 'r15']
+
+for index, register in enumerate(registers):
+    setattr(frame, register, index)
+
+assembly = '\n'.join([
+    shellcraft.read(constants.STDIN_FILENO, 'rsp', 1024),
+    shellcraft.sigreturn()
+])
+
+binary = ELF.from_assembly(assembly)
+
+io = binary.process()
+io.flat(frame)
+io.wait()
+assert io.poll() == -11
+
+corefile = io.corefile
+
+for index, register in enumerate(registers):
+    value = getattr(corefile, register)
+    if index != value:
+        log.error("%s != %i (%i)" % (register, index, value))
+    else:
+        log.success("%s == %i" % (register, value))

examples/sigreturn_corefile_arm.py

@@ -0,0 +1,32 @@
+from pwn import *
+
+context.arch='arm'
+frame = SigreturnFrame()
+
+registers = ['r0', 'r1', 'r2', 'r3', 'r4', 'r5', 'r6', 'r7',
+             'r8', 'r9', 'r10', 'fp', 'ip', 'sp', 'pc', 'lr']
+
+
+for index, register in enumerate(registers):
+    setattr(frame, register, index)
+
+assembly = '\n'.join([
+    shellcraft.read(constants.STDIN_FILENO, 'sp', 1024),
+    shellcraft.sigreturn()
+])
+
+binary = ELF.from_assembly(assembly)
+
+io = binary.process()
+io.flat(frame)
+io.wait()
+assert io.poll() == -11
+
+corefile = io.corefile
+
+for index, register in enumerate(registers):
+    value = getattr(corefile, register)
+    if index != value:
+        log.error("%s != %i (%i)" % (register, index, value))
+    else:
+        log.success("%s == %i" % (register, value))

examples/sigreturn_corefile_i386.py

@@ -0,0 +1,31 @@
+from pwn import *
+context.kernel='amd64'
+frame = SigreturnFrame()
+
+registers = ['eax', 'ebx', 'ecx', 'edx',
+             'edi', 'esi', 'ebp', 'esp',
+             'eip']
+
+for index, register in enumerate(registers):
+    setattr(frame, register, index)
+
+assembly = '\n'.join([
+    shellcraft.read(constants.STDIN_FILENO, 'esp', 1024),
+    shellcraft.sigreturn()
+])
+
+binary = ELF.from_assembly(assembly)
+
+io = binary.process()
+io.flat(frame)
+io.wait()
+assert io.poll() == -11
+
+corefile = io.corefile
+
+for index, register in enumerate(registers):
+    value = getattr(corefile, register)
+    if index != value:
+        log.error("%s != %i (%i)" % (register, index, value))
+    else:
+        log.success("%s == %i" % (register, value))

examples/ssh.py

@@ -4,7 +4,7 @@ Example showing how to use the ssh class.
 
 from pwn import *
 
-shell = ssh(host='bandit.labs.overthewire.org',user='bandit0',password='bandit0')
+shell = ssh(host='bandit.labs.overthewire.org',user='bandit0',password='bandit0', port=2220)
 
 # Show basic command syntax
 log.info("username: %s" % shell.whoami())

extra/docker/Dockerfile

@@ -1,58 +0,0 @@
-############################################################
-# Dockerfile to build Pwntools container
-# Based on Ubuntu
-############################################################
-
-FROM ubuntu:trusty
-MAINTAINER Maintainer Gallopsled et al.
-
-RUN apt-get update && apt-get install -y software-properties-common
-RUN apt-add-repository --yes ppa:pwntools/binutils
-RUN apt-get update
-RUN apt-get install -y \
-	binutils \
-	binutils-aarch64-linux-gnu \
-	binutils-arm-linux-gnueabihf \
-	curl \
-	gdb \
-	gdbserver \
-	gdb-multiarch \
-	git \
-	libc6-i386 \
-	libc6-arm64-cross \
-	libc6-armhf-cross \
-	libc6-dev-i386 \
-	libffi-dev \
-	libglib2.0-dev \
-	libncurses5-dev \
-	libncursesw5-dev \
-	ltrace \
-	python-dev \
-	python-pip \
-	python3-pip \
-	python2.7 \
-	qemu \
-	qemu-user-static \
-	strace \
-	tmux \
-	wget
-RUN pip install --upgrade ipython
-RUN useradd -m zerocool
-RUN usermod -U zerocool
-
-RUN mkdir -p /etc/qemu-binfmt
-RUN ln -s /usr/aarch64-linux-gnu /etc/qemu-binfmt/aarch64
-RUN ln -s /usr/arm-linux-gnueabihf /etc/qemu-binfmt/arm
-
-RUN pip install --upgrade pip pycparser psutil python-ptrace
-RUN pip3 install --upgrade pip pycparser psutil python-ptrace
-
-RUN pip install --upgrade git+https://github.com/Gallopsled/pwntools.git
-
-RUN locale-gen en_US.UTF-8
-ENV LANG en_US.UTF-8
-ENV LANGUAGE en_US:en
-ENV LC_ALL en_US.UTF-8
-
-RUN chown -R zerocool.zerocool /home/zerocool
-RUN chsh -s /bin/bash zerocool

extra/docker/Makefile

@@ -0,0 +1,13 @@
+subdirs=xenial stable $(wildcard */)
+makefiles=$(wildcard */Makefile)
+tags=base stable beta dev
+
+all: $(makefiles) $(subdirs)
+
+$(subdirs):
+	docker build -t pwntools/pwntools:$(shell basename $(@)) "$@"
+
+$(makefiles):
+	make -C $(shell dirname $@)
+
+.PHONY: all $(subdirs) $(makefiles)

extra/docker/base

@@ -0,0 +1 @@
+xenial

extra/docker/beta/Dockerfile

@@ -0,0 +1,6 @@
+FROM pwntools/pwntools:stable
+
+USER root
+RUN pip install --upgrade git+https://github.com/Gallopsled/pwntools@beta
+RUN PWNLIB_NOTERM=1 pwn update
+USER pwntools

extra/docker/dev/Dockerfile

@@ -0,0 +1,6 @@
+FROM pwntools/pwntools:stable
+
+USER root
+RUN pip install --upgrade git+https://github.com/Gallopsled/pwntools@dev
+RUN PWNLIB_NOTERM=1 pwn update
+USER pwntools

extra/docker/kali/Dockerfile

@@ -0,0 +1,26 @@
+############################################################
+# Dockerfile to build Pwntools container
+# Based on Ubuntu
+############################################################
+
+FROM kalilinux/kali-linux-docker
+MAINTAINER Maintainer Gallopsled et al.
+
+RUN apt-get update
+RUN apt-get install -y build-essential
+RUN apt-get install -y git
+RUN apt-get install -y libssl-dev
+RUN apt-get install -y libffi-dev
+RUN apt-get install -y python2.7
+RUN apt-get install -y python-pip
+RUN apt-get install -y python-dev
+RUN pip install --upgrade pip
+RUN python -m pip install --upgrade pwntools
+RUN PWNLIB_NOTERM=1 pwn update
+
+RUN apt-get install -y sudo
+RUN useradd -m pwntools
+RUN passwd --delete --unlock pwntools
+RUN echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
+USER pwntools
+WORKDIR /home/pwntools

extra/docker/kali/Makefile

@@ -0,0 +1,8 @@
+all: Dockerfile
+
+Dockerfile: ../xenial/Dockerfile FORCE
+	sed "s|ubuntu:xenial|kalilinux/kali-linux-docker|" < "$<" > "$@"
+
+FORCE:
+
+.PHONY: all

extra/docker/precise/Dockerfile

@@ -0,0 +1,26 @@
+############################################################
+# Dockerfile to build Pwntools container
+# Based on Ubuntu
+############################################################
+
+FROM ubuntu:precise
+MAINTAINER Maintainer Gallopsled et al.
+
+RUN apt-get update
+RUN apt-get install -y build-essential
+RUN apt-get install -y git
+RUN apt-get install -y libssl-dev
+RUN apt-get install -y libffi-dev
+RUN apt-get install -y python2.7
+RUN apt-get install -y python-pip
+RUN apt-get install -y python-dev
+RUN pip install --upgrade pip
+RUN python -m pip install --upgrade pwntools
+RUN PWNLIB_NOTERM=1 pwn update
+
+RUN apt-get install -y sudo
+RUN useradd -m pwntools
+RUN passwd --delete --unlock pwntools
+RUN echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
+USER pwntools
+WORKDIR /home/pwntools

extra/docker/precise/Makefile

@@ -0,0 +1,8 @@
+all: Dockerfile
+
+Dockerfile: ../xenial/Dockerfile FORCE
+	sed "s|ubuntu:xenial|ubuntu:precise|" < "$<" > "$@"
+
+FORCE:
+
+.PHONY: all

extra/docker/stable/Dockerfile

@@ -0,0 +1,6 @@
+FROM pwntools/pwntools:base
+
+USER root
+RUN pip install --upgrade git+https://github.com/Gallopsled/pwntools@stable
+RUN PWNLIB_NOTERM=1 pwn update
+USER pwntools

extra/docker/trusty/Dockerfile

@@ -0,0 +1,26 @@
+############################################################
+# Dockerfile to build Pwntools container
+# Based on Ubuntu
+############################################################
+
+FROM ubuntu:trusty
+MAINTAINER Maintainer Gallopsled et al.
+
+RUN apt-get update
+RUN apt-get install -y build-essential
+RUN apt-get install -y git
+RUN apt-get install -y libssl-dev
+RUN apt-get install -y libffi-dev
+RUN apt-get install -y python2.7
+RUN apt-get install -y python-pip
+RUN apt-get install -y python-dev
+RUN pip install --upgrade pip
+RUN python -m pip install --upgrade pwntools
+RUN PWNLIB_NOTERM=1 pwn update
+
+RUN apt-get install -y sudo
+RUN useradd -m pwntools
+RUN passwd --delete --unlock pwntools
+RUN echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
+USER pwntools
+WORKDIR /home/pwntools

extra/docker/trusty/Makefile

@@ -0,0 +1,8 @@
+all: Dockerfile
+
+Dockerfile: ../xenial/Dockerfile FORCE
+	sed "s|ubuntu:xenial|ubuntu:trusty|" < "$<" > "$@"
+
+FORCE:
+
+.PHONY: all

extra/docker/xenial/Dockerfile

@@ -0,0 +1,26 @@
+############################################################
+# Dockerfile to build Pwntools container
+# Based on Ubuntu
+############################################################
+
+FROM ubuntu:xenial
+MAINTAINER Maintainer Gallopsled et al.
+
+RUN apt-get update
+RUN apt-get install -y build-essential
+RUN apt-get install -y git
+RUN apt-get install -y libssl-dev
+RUN apt-get install -y libffi-dev
+RUN apt-get install -y python2.7
+RUN apt-get install -y python-pip
+RUN apt-get install -y python-dev
+RUN pip install --upgrade pip
+RUN python -m pip install --upgrade pwntools
+RUN PWNLIB_NOTERM=1 pwn update
+
+RUN apt-get install -y sudo
+RUN useradd -m pwntools
+RUN passwd --delete --unlock pwntools
+RUN echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
+USER pwntools
+WORKDIR /home/pwntools

pwn/__init__.py

@@ -1,8 +1,11 @@
 # Promote useful stuff to toplevel
-from .toplevel import *
+from __future__ import absolute_import
+
+from pwn.toplevel import *
 
 pwnlib.args.initialize()
 pwnlib.log.install_default_handler()
+pwnlib.config.initialize()
 
 log = pwnlib.log.getLogger('pwnlib.exploit')
 args = pwnlib.args.args

pwn/toplevel.py

@@ -24,15 +24,15 @@ from pwnlib.context import Thread
 from pwnlib.context import context
 from pwnlib.dynelf import DynELF
 from pwnlib.encoders import *
-from pwnlib.elf import Core
-from pwnlib.elf import ELF
-from pwnlib.elf import load
+from pwnlib.elf.corefile import Core, Corefile, Coredump
+from pwnlib.elf.elf import ELF, load
 from pwnlib.encoders import *
 from pwnlib.exception import PwnlibException
+from pwnlib.gdb import attach, debug, debug_assembly, debug_shellcode
 from pwnlib.flag import *
 from pwnlib.fmtstr import FmtStr, fmtstr_payload
 from pwnlib.log import getLogger
-from pwnlib.memleak import MemLeak
+from pwnlib.memleak import MemLeak, RelativeMemLeak
 from pwnlib.regsort import *
 from pwnlib.replacements import *
 from pwnlib.rop import ROP
@@ -40,7 +40,7 @@ from pwnlib.rop.srop import SigreturnFrame
 from pwnlib.runner import *
 from pwnlib.timeout import Timeout
 from pwnlib.tubes.listen import listen
-from pwnlib.tubes.process import process
+from pwnlib.tubes.process import process, PTY, PIPE, STDOUT
 from pwnlib.tubes.remote import remote, tcp, udp, connect
 from pwnlib.tubes.serialtube import serialtube
 from pwnlib.tubes.ssh import ssh

pwnlib/__init__.py

@@ -1,6 +1,8 @@
+from __future__ import absolute_import
+
 import importlib
 
-from .version import __version__
+from pwnlib.version import __version__
 
 version = __version__
 
@@ -12,6 +14,7 @@ __all__ = [
     'commandline',
     'constants',
     'context',
+    'data',
     'dynelf',
     'encoders',
     'elf',

pwnlib/abi.py

@@ -1,6 +1,8 @@
 # -*- coding: utf-8 -*-
-from .context import LocalContext
-from .context import context
+from __future__ import absolute_import
+
+from pwnlib.context import LocalContext
+from pwnlib.context import context
 
 
 class ABI(object):
@@ -24,7 +26,8 @@ class ABI(object):
     #: Indicates that this ABI returns to the next address on the slot
     returns            = True
 
-    def __init__(self, regs, align, minimum):
+    def __init__(self, stack, regs, align, minimum):
+        self.stack              = stack
         self.register_arguments = regs
         self.arg_alignment      = align
         self.stack_minimum      = minimum
@@ -32,35 +35,52 @@ class ABI(object):
     @staticmethod
     @LocalContext
     def default():
+        if context.os == 'android':
+            context.os = 'linux'
+
         return {
         (32, 'i386', 'linux'):  linux_i386,
+        (64, 'aarch64', 'linux'): linux_aarch64,
         (64, 'amd64', 'linux'): linux_amd64,
         (32, 'arm', 'linux'):   linux_arm,
         (32, 'thumb', 'linux'):   linux_arm,
         (32, 'mips', 'linux'):   linux_mips,
         (32, 'i386', 'windows'):  windows_i386,
         (64, 'amd64', 'windows'): windows_amd64,
+        (32, 'powerpc', 'linux'): linux_ppc,
+        (64, 'powerpc', 'linux'): linux_ppc64,
         }[(context.bits, context.arch, context.os)]
 
     @staticmethod
     @LocalContext
     def syscall():
+        if context.os == 'android':
+            context.os = 'linux'
+
         return {
         (32, 'i386', 'linux'):  linux_i386_syscall,
         (64, 'amd64', 'linux'): linux_amd64_syscall,
+        (64, 'aarch64', 'linux'): linux_aarch64_syscall,
         (32, 'arm', 'linux'):   linux_arm_syscall,
         (32, 'thumb', 'linux'):   linux_arm_syscall,
         (32, 'mips', 'linux'):   linux_mips_syscall,
+        (64, 'aarch64', 'linux'):   linux_aarch64_syscall,
+        (32, 'powerpc', 'linux'): linux_ppc_syscall,
+        (64, 'powerpc', 'linux'): linux_ppc64_syscall,
         }[(context.bits, context.arch, context.os)]
 
     @staticmethod
     @LocalContext
     def sigreturn():
+        if context.os == 'android':
+            context.os = 'linux'
+
         return {
         (32, 'i386', 'linux'):  linux_i386_sigreturn,
         (64, 'amd64', 'linux'): linux_amd64_sigreturn,
         (32, 'arm', 'linux'):   linux_arm_sigreturn,
         (32, 'thumb', 'linux'):   linux_arm_sigreturn,
+        (64, 'aarch64', 'linux'):   linux_aarch64_sigreturn,
         }[(context.bits, context.arch, context.os)]
 
 class SyscallABI(ABI):
@@ -68,9 +88,9 @@ class SyscallABI(ABI):
     The syscall ABI treats the syscall number as the zeroth argument,
     which must be loaded into the specified register.
     """
-    def __init__(self, register_arguments, *a, **kw):
-        super(SyscallABI, self).__init__(register_arguments, *a, **kw)
-        self.syscall_register = register_arguments[0]
+    def __init__(self, *a, **kw):
+        super(SyscallABI, self).__init__(*a, **kw)
+        self.syscall_register = self.register_arguments[0]
 
 class SigreturnABI(SyscallABI):
     """
@@ -81,26 +101,31 @@ class SigreturnABI(SyscallABI):
     returns = False
 
 
-linux_i386   = ABI([], 4, 0)
-linux_amd64  = ABI(['rdi','rsi','rdx','rcx','r8','r9'], 8, 0)
-linux_arm    = ABI(['r0', 'r1', 'r2', 'r3'], 8, 0)
-linux_aarch64 = ABI(['x0', 'x1', 'x2', 'x3'], 16, 0)
-linux_mips  = ABI(['$a0','$a1','$a2','$a3'], 4, 0)
+linux_i386   = ABI('esp', [], 4, 0)
+linux_amd64  = ABI('rsp', ['rdi','rsi','rdx','rcx','r8','r9'], 8, 0)
+linux_arm    = ABI('sp', ['r0', 'r1', 'r2', 'r3'], 8, 0)
+linux_aarch64 = ABI('sp', ['x0', 'x1', 'x2', 'x3'], 16, 0)
+linux_mips  = ABI('$sp', ['$a0','$a1','$a2','$a3'], 4, 0)
+linux_ppc = ABI('sp', ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 4, 0)
+linux_ppc64 = ABI('sp', ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 8, 0)
 
-linux_i386_syscall = SyscallABI(['eax', 'ebx', 'ecx', 'edx', 'esi', 'edi', 'ebp'], 4, 0)
-linux_amd64_syscall = SyscallABI(['rax','rdi', 'rsi', 'rdx', 'r10', 'r8', 'r9'],   8, 0)
-linux_arm_syscall   = SyscallABI(['r7', 'r0', 'r1', 'r2', 'r3', 'r4', 'r5', 'r6'], 4, 0)
-linux_aarch64_syscall   = SyscallABI(['x8', 'x0', 'x1', 'x2', 'x3', 'x4', 'x5', 'x6'], 16, 0)
-linux_mips_syscall  = ABI(['$v0', '$a0','$a1','$a2','$a3'], 4, 0)
+linux_i386_syscall = SyscallABI('esp', ['eax', 'ebx', 'ecx', 'edx', 'esi', 'edi', 'ebp'], 4, 0)
+linux_amd64_syscall = SyscallABI('rsp', ['rax', 'rdi', 'rsi', 'rdx', 'r10', 'r8', 'r9'],   8, 0)
+linux_arm_syscall   = SyscallABI('sp', ['r7', 'r0', 'r1', 'r2', 'r3', 'r4', 'r5', 'r6'], 4, 0)
+linux_aarch64_syscall   = SyscallABI('sp', ['x8', 'x0', 'x1', 'x2', 'x3', 'x4', 'x5', 'x6'], 16, 0)
+linux_mips_syscall  = SyscallABI('$sp', ['$v0','$a0','$a1','$a2','$a3'], 4, 0)
+linux_ppc_syscall = ABI('sp', ['r0', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9'], 4, 0)
+linux_ppc64_syscall = ABI('sp', ['r0', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9'], 8, 0)
 
-linux_i386_sigreturn = SigreturnABI(['eax'], 4, 0)
-linux_amd64_sigreturn = SigreturnABI(['rax'], 4, 0)
-linux_arm_sigreturn = SigreturnABI(['r7'], 4, 0)
+linux_i386_sigreturn = SigreturnABI('esp', ['eax'], 4, 0)
+linux_amd64_sigreturn = SigreturnABI('rsp', ['rax'], 4, 0)
+linux_arm_sigreturn = SigreturnABI('sp', ['r7'], 4, 0)
+linux_aarch64_sigreturn = SigreturnABI('sp', ['x8'], 16, 0)
 
-windows_i386  = ABI([], 4, 0)
-windows_amd64 = ABI(['rcx','rdx','r8','r9'], 32, 32)
+windows_i386  = ABI('esp', [], 4, 0)
+windows_amd64 = ABI('rsp', ['rcx','rdx','r8','r9'], 32, 32)
 
 # Fake ABIs used by SROP
-linux_i386_srop = ABI(['eax'], 4, 0)
-linux_amd64_srop = ABI(['rax'], 4, 0)
-linux_arm_srop = ABI(['r7'], 4, 0)
+linux_i386_srop = ABI('esp', ['eax'], 4, 0)
+linux_amd64_srop = ABI('rsp', ['rax'], 4, 0)
+linux_arm_srop = ABI('sp', ['r7'], 4, 0)

pwnlib/adb/__init__.py

@@ -1,2 +1,4 @@
-from .adb import *
-from .protocol import Client
+from __future__ import absolute_import
+
+from pwnlib.adb.adb import *
+from pwnlib.adb.protocol import Client

pwnlib/adb/adb.py

@@ -1,6 +1,7 @@
 """Provides utilities for interacting with Android devices via the Android Debug Bridge.
 
-# Using Android Devices with Pwntools
+Using Android Devices with Pwntools
+-----------------------------------
 
 Pwntools tries to be as easy as possible to use with Android devices.
 
@@ -29,7 +30,7 @@ instance.
         error("Could not find any shamus!")
 
 Once a device is selected, you can operate on it with any of the functions in
-the ``pwnlib.adb`` module.
+the :mod:`pwnlib.adb` module.
 
 .. code-block:: python
 
@@ -44,6 +45,8 @@ the ``pwnlib.adb`` module.
     adb.write('/data/local/tmp/foo', 'my data')
 
 """
+from __future__ import absolute_import
+
 import functools
 import glob
 import logging
@@ -57,14 +60,14 @@ import time
 
 import dateutil.parser
 
-from .. import atexit
-from .. import tubes
-from ..context import LocalContext
-from ..context import context
-from ..device import Device
-from ..log import getLogger
-from ..util import misc
-from .protocol import Client
+from pwnlib import atexit
+from pwnlib import tubes
+from pwnlib.context import LocalContext
+from pwnlib.context import context
+from pwnlib.device import Device
+from pwnlib.log import getLogger
+from pwnlib.protocols.adb import AdbClient
+from pwnlib.util import misc
 
 log = getLogger(__name__)
 
@@ -85,10 +88,10 @@ def adb(argv, *a, **kw):
 
     return tubes.process.process(context.adb + argv, *a, **kw).recvall()
 
-@context.quiet
+@context.quietfunc
 def devices(serial=None):
     """Returns a list of ``Device`` objects corresponding to the connected devices."""
-    with Client() as c:
+    with AdbClient() as c:
         lines = c.devices(long=True)
     result = []
 
@@ -143,7 +146,7 @@ def root():
     log.info("Enabling root on %s" % context.device)
 
     with context.quiet:
-        with Client() as c:
+        with AdbClient() as c:
             reply = c.root()
 
     if 'already running as root' in reply:
@@ -172,7 +175,7 @@ def reboot(wait=True):
     """
     log.info('Rebooting device %s' % context.device)
 
-    with Client() as c:
+    with AdbClient() as c:
         c.reboot()
 
     if wait:
@@ -185,7 +188,7 @@ def reboot_bootloader():
     """
     log.info('Rebooting %s to bootloader' % context.device)
 
-    with Client() as c:
+    with AdbClient() as c:
         c.reboot_bootloader()
 
 @with_device
@@ -325,7 +328,7 @@ class AdbDevice(Device):
             kwargs['port'] = 'emulator'
 
         for field in fields[2:]:
-            k,v = field.split(':')
+            k,v = field.split(':', 1)
             kwargs[k] = v
 
         return AdbDevice(serial, type, **kwargs)
@@ -343,7 +346,7 @@ class AdbDevice(Device):
         of this device.
 
         >>> property = 'ro.build.fingerprint'
-        >>> device = adb.current_device()
+        >>> device = adb.wait_for_device()
         >>> adb.getprop(property) == device.getprop(property)
         True
         """
@@ -376,7 +379,7 @@ def wait_for_device(kick=False):
         >>> device = adb.wait_for_device()
     """
     with log.waitfor("Waiting for device to come online") as w:
-        with Client() as c:
+        with AdbClient() as c:
             if kick:
                 try:
                     c.reconnect()
@@ -387,7 +390,7 @@ def wait_for_device(kick=False):
             if context.device:
                 serial = str(context.device)
 
-        with Client() as c:
+        with AdbClient() as c:
             c.wait_for_device(serial)
 
         for device in devices():
@@ -415,7 +418,7 @@ def disable_verity():
     with log.waitfor("Disabling dm-verity on %s" % context.device) as w:
         root()
 
-        with Client() as c:
+        with AdbClient() as c:
             reply = c.disable_verity()
 
         if 'Verity already disabled' in reply:
@@ -434,7 +437,7 @@ def remount():
         disable_verity()
         root()
 
-        with Client() as c:
+        with AdbClient() as c:
             reply = c.remount()
 
         if 'remount succeeded' not in reply:
@@ -445,7 +448,7 @@ def unroot():
     """Restarts adbd as AID_SHELL."""
     log.info("Unrooting %s" % context.device)
     with context.quiet:
-        with Client() as c:
+        with AdbClient() as c:
             reply  = c.unroot()
 
     if '0006closed' == reply:
@@ -508,10 +511,14 @@ def push(local_path, remote_path):
         local_path(str): Path to the local file to push.
         remote_path(str): Path or directory to store the file on the device.
 
+    Returns:
+        Remote path of the file.
+
     Example:
 
         >>> write('./filename', 'contents')
-        >>> _=adb.push('./filename', '/data/local/tmp')
+        >>> adb.push('./filename', '/data/local/tmp')
+        '/data/local/tmp/filename'
         >>> adb.read('/data/local/tmp/filename')
         'contents'
         >>> adb.push('./filename', '/does/not/exist')
@@ -526,7 +533,7 @@ def push(local_path, remote_path):
         msg += ' (%s)' % context.device
 
     with log.waitfor(msg) as w:
-        with Client() as c:
+        with AdbClient() as c:
 
             # We need to discover whether remote_path is a directory or not.
             # If we cannot stat the full path, assume it's a path-plus-filename,
@@ -546,10 +553,13 @@ def push(local_path, remote_path):
             if stat.S_ISDIR(mode):
                 remote_path = os.path.join(remote_path, remote_filename)
 
-            return c.write(remote_path,
-                           misc.read(local_path),
-                           callback=_create_adb_push_pull_callback(w))
-@context.quiet
+            c.write(remote_path,
+                    misc.read(local_path),
+                    callback=_create_adb_push_pull_callback(w))
+
+    return remote_path
+
+@context.quietfunc
 @with_device
 def read(path, target=None, callback=None):
     """Download a file from the device, and extract its contents.
@@ -559,7 +569,7 @@ def read(path, target=None, callback=None):
         target(str): Optional, location to store the file.
             Uses a temporary file by default.
         callback(callable): See the documentation for
-            ``adb.protocol.Client.read``.
+            ``adb.protocol.AdbClient.read``.
 
     Examples:
 
@@ -570,7 +580,7 @@ def read(path, target=None, callback=None):
         ...
         PwnlibException: Could not stat '/does/not/exist'
     """
-    with Client() as c:
+    with AdbClient() as c:
         stat = c.stat(path)
         if not stat:
             log.error('Could not stat %r' % path)
@@ -581,7 +591,7 @@ def read(path, target=None, callback=None):
 
     return data
 
-@context.quiet
+@context.quietfunc
 @with_device
 def write(path, data=''):
     """Create a file on the device with the provided contents.
@@ -599,7 +609,7 @@ def write(path, data=''):
         misc.write(temp.name, data)
         push(temp.name, path)
 
-@context.quiet
+@context.quietfunc
 @with_device
 def mkdir(path):
     """Create a directory on the target device.
@@ -629,7 +639,7 @@ def mkdir(path):
     if not path.startswith('/'):
         log.error("Must provide an absolute path: %r" % path)
 
-    with Client() as c:
+    with AdbClient() as c:
         st = c.stat(path)
 
         # Don't re-create existing directories
@@ -642,7 +652,7 @@ def mkdir(path):
         if result:
             log.error(result)
 
-@context.quiet
+@context.quietfunc
 @with_device
 def makedirs(path):
     """Create a directory and all parent directories on the target device.
@@ -661,10 +671,10 @@ def makedirs(path):
 
     mkdir(path)
 
-@context.quiet
+@context.quietfunc
 @with_device
 def exists(path):
-    """Return ``True`` if ``path`` exists on the target device.
+    """Return :const:`True` if ``path`` exists on the target device.
 
     Examples:
 
@@ -675,13 +685,13 @@ def exists(path):
         >>> adb.exists('/does/not/exist')
         False
     """
-    with Client() as c:
+    with AdbClient() as c:
         return bool(c.stat(path))
 
-@context.quiet
+@context.quietfunc
 @with_device
 def isdir(path):
-    """Return ``True`` if ``path`` is a on the target device.
+    """Return :const:`True` if ``path`` is a on the target device.
 
     Examples:
 
@@ -692,11 +702,11 @@ def isdir(path):
         >>> adb.isdir('/does/not/exist')
         False
     """
-    with Client() as c:
+    with AdbClient() as c:
         st = c.stat(path)
         return bool(st and stat.S_ISDIR(st['mode']))
 
-@context.quiet
+@context.quietfunc
 @with_device
 def unlink(path, recursive=False):
     """Unlinks a file or directory on the target device.
@@ -727,7 +737,7 @@ def unlink(path, recursive=False):
         >>> adb.exists(filename)
         False
     """
-    with Client() as c:
+    with AdbClient() as c:
         st = c.stat(path)
         if not st:
             log.error("Could not unlink %r: Does not exist" % path)
@@ -747,10 +757,10 @@ def unlink(path, recursive=False):
 def process(argv, *a, **kw):
     """Execute a process on the device.
 
-    See ``pwnlib.tubes.process.process`` documentation for more info.
+    See :class:`pwnlib.tubes.process.process` documentation for more info.
 
     Returns:
-        A ``process`` tube.
+        A :class:`pwnlib.tubes.process.process` tube.
 
     Examples:
 
@@ -767,7 +777,7 @@ def process(argv, *a, **kw):
         if argv != [argv[0]]: message += ' argv=%r ' % argv
 
     with log.progress(message) as p:
-        return Client().execute(argv)
+        return AdbClient().execute(argv)
 
 @with_device
 def interactive(**kw):
@@ -780,27 +790,59 @@ def shell(**kw):
     return process(['sh', '-i'], **kw)
 
 @with_device
-def which(name):
-    """Retrieves the full path to a binary in ``PATH`` on the device
+def which(name, all = False, *a, **kw):
+    """Retrieves the full path to a binary in ``$PATH`` on the device
 
-    >>> adb.which('sh')
-    '/system/bin/sh'
+    Arguments:
+        name(str): Binary name
+        all(bool): Whether to return all paths, or just the first
+        *a: Additional arguments for :func:`.adb.process`
+        **kw: Additional arguments for :func:`.adb.process`
+
+    Returns:
+        Either a path, or list of paths
+
+    Example:
+
+        >>> adb.which('sh')
+        '/system/bin/sh'
+        >>> adb.which('sh', all=True)
+        ['/system/bin/sh']
+
+        >>> adb.which('foobar') is None
+        True
+        >>> adb.which('foobar', all=True)
+        []
     """
     # Unfortunately, there is no native 'which' on many phones.
     which_cmd = '''
-IFS=:
-BINARY=%s
-P=($PATH)
-for path in "${P[@]}"; do \
-    if [ -e "$path/$BINARY" ]; then \
-        echo "$path/$BINARY";
-        break
-    fi
+echo $PATH | while read -d: directory; do
+    [ -x "$directory/{name}" ] || continue;
+    echo -n "$directory/{name}\\x00";
 done
-''' % name
+'''.format(name=name)
 
     which_cmd = which_cmd.strip()
-    return process(['sh','-c',which_cmd]).recvall().strip()
+    data = process(['sh','-c', which_cmd], *a, **kw).recvall()
+    result = []
+
+    for path in data.split('\x00'):
+        # Skip empty entries
+        if not path:
+            continue
+
+        # Return the first entry if all=False
+        if not all:
+            return path
+
+        # Accumulate all entries if all=True
+        result.append(path)
+
+    if all:
+        return result
+
+    return None
+
 
 @with_device
 def whoami():
@@ -813,7 +855,7 @@ def forward(port):
     start_forwarding = adb(['forward', tcp_port, tcp_port])
     atexit.register(lambda: adb(['forward', '--remove', tcp_port]))
 
-@context.quiet
+@context.quietfunc
 @with_device
 def logcat(stream=False):
     """Reads the system log file.
@@ -821,12 +863,12 @@ def logcat(stream=False):
     By default, causes logcat to exit after reading the file.
 
     Arguments:
-        stream(bool): If ``True``, the contents are streamed rather than
-            read in a one-shot manner.  Default is ``False``.
+        stream(bool): If :const:`True`, the contents are streamed rather than
+            read in a one-shot manner.  Default is :const:`False`.
 
     Returns:
-        If ``stream`` is ``False``, returns a string containing the log data.
-        Otherwise, it returns a ``tube`` connected to the log output.
+        If ``stream`` is :const:`False`, returns a string containing the log data.
+        Otherwise, it returns a :class:`pwnlib.tubes.tube.tube` connected to the log output.
     """
 
     if stream:
@@ -902,7 +944,7 @@ def listdir(directory='/'):
         Otherwise, less files may be returned due to restrictive SELinux
         policies on adbd.
     """
-    return list(sorted(Client().list(directory)))
+    return list(sorted(AdbClient().list(directory)))
 
 @with_device
 def fastboot(args, *a, **kw):
@@ -937,7 +979,7 @@ def unlock_bootloader():
     Note:
         This requires physical interaction with the device.
     """
-    Client().reboot_bootloader()
+    AdbClient().reboot_bootloader()
     fastboot(['oem', 'unlock'])
     fastboot(['continue'])
 
@@ -949,7 +991,7 @@ class Kernel(object):
         return self.symbols['_text']
 
     @property
-    @context.quiet
+    @context.quietfunc
     def symbols(self):
         """Returns a dictionary of kernel symbols"""
         result = {}
@@ -961,7 +1003,7 @@ class Kernel(object):
         return result
 
     @property
-    @context.quiet
+    @context.quietfunc
     def kallsyms(self):
         """Returns the raw output of kallsyms"""
         if not self._kallsyms:
@@ -972,20 +1014,20 @@ class Kernel(object):
         return self._kallsyms
 
     @property
-    @context.quiet
+    @context.quietfunc
     def version(self):
         """Returns the kernel version of the device."""
         root()
         return read('/proc/version').strip()
 
     @property
-    @context.quiet
+    @context.quietfunc
     def cmdline(self):
         root()
         return read('/proc/cmdline').strip()
 
     @property
-    @context.quiet
+    @context.quietfunc
     def lastmsg(self):
         root()
         if 'last_kmsg' in listdir('/proc'):
@@ -1155,14 +1197,24 @@ def compile(source):
     if not project:
         # Realistically this should inherit from context.arch, but
         # this works for now.
-        abi = 'armeabi-v7a'
         sdk = '21'
+        abi = {
+            'aarch64': 'arm64-v8a',
+            'amd64':   'x86_64',
+            'arm':     'armeabi-v7a',
+            'i386':    'x86',
+            'mips':    'mips',
+            'mips64':  'mips64',
+        }.get(context.arch, None)
 
         # If we have an attached device, use its settings.
         if context.device:
             abi = str(properties.ro.product.cpu.abi)
             sdk = str(properties.ro.build.version.sdk)
 
+        if abi is None:
+            log.error("Unknown CPU ABI")
+
         project = _generate_ndk_project(source, abi, sdk)
 
     # Remove any output files
@@ -1199,7 +1251,7 @@ class Partition(object):
 def walk(top, topdown=True):
     join = os.path.join
     isdir = lambda x: stat.S_ISDIR(x['mode'])
-    client = Client()
+    client = AdbClient()
     names = client.list(top)
 
     dirs, nondirs = [], []
@@ -1237,15 +1289,15 @@ def readlink(path):
 
 class Partitions(object):
     @property
-    @context.quiet
+    @context.quietfunc
     def by_name_dir(self):
         return next(find('/dev/block/platform','by-name'))
 
-    @context.quiet
+    @context.quietfunc
     def __dir__(self):
         return list(self)
 
-    @context.quiet
+    @context.quietfunc
     @with_device
     def __iter__(self):
         root()
@@ -1254,7 +1306,7 @@ class Partitions(object):
         for name in listdir(self.by_name_dir):
             yield name
 
-    @context.quiet
+    @context.quietfunc
     @with_device
     def __getattr__(self, attr):
         for name in self:
@@ -1324,7 +1376,7 @@ def uninstall(package, *arguments):
         with context.quiet:
             return process(['pm','uninstall',package] + list(arguments)).recvall()
 
-@context.quiet
+@context.quietfunc
 def packages():
     """Returns a list of packages installed on the system"""
     packages = process(['pm', 'list', 'packages']).recvall()

pwnlib/adb/protocol.py

@@ -1,553 +1,5 @@
 """
-Implementation of the Android Debug Bridge (ADB) protocol, as far as Binjitsu needs it.
-
-Documentation is available here:
-https://android.googlesource.com/platform/system/core/+/master/adb/protocol.txt
+This file exists only for backward compatibility
 """
-import functools
-import stat
-import time
-
-from ..context import context
-from ..log import Logger
-from ..log import getLogger
-from ..tubes.listen import listen
-from ..tubes.process import process
-from ..tubes.remote import remote
-from ..util.lists import group
-from ..util.misc import size
-from ..util.packing import p32
-from ..util.proc import pidof
-from ..util.sh_string import sh_string
-
-log = getLogger(__name__)
-
-def pack(val):
-    return '%04x' % val
-
-def unpack(val):
-    return int(val, 16)
-
-OKAY = "OKAY"
-FAIL = "FAIL"
-
-class Message(object):
-    """An ADB hex-length-prefixed message"""
-    def __init__(self, string):
-        self.string = string
-    def __str__(self):
-        return ('%04x' % len(self.string)) + self.string
-    def __flat__(self):
-        return str(self)
-
-class Connection(remote):
-    """Connection to the ADB server"""
-    def __init__(self, host, port, level=None, *a, **kw):
-        super(Connection, self).__init__(host, port, level=level, *a, **kw)
-
-        self._executable = None
-        self._argv       = None
-        self._pid        = None
-        self._cwd        = None
-        self._env        = None
-
-    def close(self):
-        with context.quiet:
-            super(Connection, self).close()
-
-    def adb_send(self, message):
-        self.send(str(Message(message)))
-        return self.recvn(4)
-
-    def adb_unpack(self):
-        return unpack(self.recvn(4))
-
-    def flat(self, *a, **kw):
-        kw.setdefault('word_size', 32)
-        return super(Connection, self).flat(*a, **kw)
-
-class Process(Connection):
-    """Duck-typed ``tubes.remote`` object to add properties of a ``tubes.process``"""
-
-class Client(Logger):
-    """ADB Client"""
-    def __init__(self, level=None):
-        super(Client, self).__init__()
-
-        if level is not None:
-            self.setLevel(level)
-
-        self.host = context.adb_host
-        self.port = context.adb_port
-        self._c   = None
-
-    @property
-    def c(self):
-        """Client's connection to the ADB server"""
-        if not self._c:
-            try:
-                self._c = Connection(self.host, self.port, level=self.level)
-            except Exception:
-                # If the connection fails, try starting a server on that port
-                # as long as it's the *default* port.
-                if self.host == context.defaults['adb_host'] \
-                and self.port == context.defaults['adb_port']:
-                    log.warn("Could not connect to ADB server, trying to start it")
-                    process(context.adb + ['start-server']).recvall()
-                else:
-                    log.exception('Could not connect to ADB server')
-
-        # Final attempt...
-        if not self._c:
-            self._c = Connection(self.host, self.port, level=self.level)
-        return self._c
-
-    def _autoclose(fn):
-        """Decorator which automatically closes the connection to the ADB server
-        after calling the decorated function."""
-        @functools.wraps(fn)
-        def wrapper(self, *a, **kw):
-            rv = fn(self, *a, **kw)
-            if self._c:
-                self._c.close()
-                self._c = None
-            return rv
-        return wrapper
-
-    def _with_transport(fn):
-        """Decorator which automatically selects a device transport before calling
-        the decorated function, and closes the connection afterward."""
-        @functools.wraps(fn)
-        def wrapper(self, *a, **kw):
-            self.transport()
-            rv = fn(self, *a, **kw)
-            if self._c:
-                self._c.close()
-                self._c = None
-            return rv
-        return wrapper
-
-    def send(self, *a, **kw):
-        """Sends data to the ADB server"""
-        return self.c.adb_send(*a, **kw)
-
-    def unpack(self, *a, **kw):
-        """Receives a hex-ascii packed integer from the ADB server"""
-        return self.c.adb_unpack(*a, **kw)
-
-    def recvl(self):
-        """Receives a length-prefixed data buffer from the ADB server"""
-        length = self.c.adb_unpack()
-        return self.c.recvn(length)
-
-    @_autoclose
-    def kill(self):
-        """Kills the remote ADB server"
-
-        >>> c=adb.protocol.Client()
-        >>> c.kill()
-
-        The server is automatically re-started on the next request,
-        if the default host/port are used.
-
-        >>> c.version() > (4,0)
-        True
-        """
-        try:
-            self.send('host:kill')
-        except EOFError:
-            pass
-
-    @_autoclose
-    def version(self):
-        """
-        Returns:
-            Tuple containing the ``(major, minor)`` version from the ADB server
-
-        Example:
-
-            >>> adb.protocol.Client().version() # doctest: +SKIP
-            (4, 36)
-        """
-        response = self.send('host:version')
-        if response == OKAY:
-            return (self.c.adb_unpack(), self.c.adb_unpack())
-        self.error("Could not fetch version")
-
-    @_autoclose
-    def devices(self, long=False):
-        """
-        Arguments:
-            long(bool): If ``True``, fetch the long-format listing.
-        Returns:
-            String representation of all available devices.
-        """
-        msg = 'host:devices'
-        if long:
-            msg += '-l'
-        response = self.send(msg)
-        if response == 'OKAY':
-            return self.recvl()
-        self.error("Could not enumerate devices")
-
-    @_autoclose
-    def track_devices(self):
-        """
-        Returns:
-            Generator which returns a short-format listing of available
-            devices each time a device state changes.
-        """
-        self.send('host:track-devices')
-        while True:
-            yield self.recvl()
-
-    def transport(self, serial=None):
-        """Sets the Transport on the rmeote device.
-
-        Examples:
-
-            >>> adb.protocol.Client().transport()
-        """
-        msg = 'host:transport:%s' % (serial or context.device)
-        if self.send(msg) == FAIL:
-            self.error("Could not set transport to %r" % serial)
-
-    @_autoclose
-    @_with_transport
-    def execute(self, argv):
-        r"""Executes a program on the device.
-
-        Returns:
-            A ``tube`` which is connected to the process.
-
-        Examples:
-
-            >>> adb.protocol.Client().execute(['echo','hello']).recvall()
-            'hello\n'
-        """
-        self.transport(context.device)
-        if isinstance(argv, str):
-            argv = [argv]
-        argv = list(map(sh_string, argv))
-        cmd = 'exec:%s' % (' '.join(argv))
-        if OKAY == self.send(cmd):
-            rv = self._c
-            self._c = None
-            return rv
-
-    def _basic_wrapper(string):
-        @_autoclose
-        @_with_transport
-        def wrapper(self):
-            self.send(string)
-            return self.c.recvall()
-        return wrapper
-
-    @_autoclose
-    @_with_transport
-    def remount(self):
-        self.send('remount:')
-        return self.c.recvall()
-
-    @_autoclose
-    @_with_transport
-    def root(self):
-        self.send('root:')
-        return self.c.recvall()
-
-    @_autoclose
-    @_with_transport
-    def unroot(self):
-        self.send('unroot:')
-        return self.c.recvall()
-
-    @_autoclose
-    @_with_transport
-    def disable_verity(self):
-        self.send('disable-verity:')
-        return self.c.recvall()
-
-    @_autoclose
-    @_with_transport
-    def enable_verity(self):
-        self.send('enable-verity:')
-        return self.c.recvall()
-
-    @_autoclose
-    @_with_transport
-    def reconnect(self):
-        self.send('reconnect:')
-        return self.c.recvall()
-
-    @_autoclose
-    @_with_transport
-    def reboot(self):
-        self.send('reboot:')
-        return self.c.recvall()
-
-    @_autoclose
-    @_with_transport
-    def reboot_bootloader(self):
-        self.send('reboot:bootloader')
-        return self.c.recvall()
-
-    @_autoclose
-    def wait_for_device(self, serial=''):
-        response = self.send('host-serial:%s:wait-for-any-device' % serial)
-
-        # The first OKAY is that the command was understood
-        if response != 'OKAY':
-            self.error("An error occurred while waiting for device with serial %r" % serial)
-
-        # The second OKAY is that the device is available
-        response = self.c.recvn(4)
-        if response != 'OKAY':
-            self.error("An error occurred while waiting for device with serial %r" % serial)
-
-    def _sync(fn):
-        """Decorator which enters 'sync:' mode to the selected transport,
-        then invokes the decorated funciton."""
-        @functools.wraps(fn)
-        def wrapper(self, *a, **kw):
-            rv = None
-            if FAIL != self.send('sync:'):
-                rv = fn(self, *a, **kw)
-            return rv
-        return wrapper
-
-    def list(self, path):
-        """Execute the ``LIST`` command of the ``SYNC`` API.
-
-        Arguments:
-            path(str): Path of the directory to list.
-
-        Return:
-            A dictionary, where the keys are relative filenames,
-            and the values are a dictionary containing the same
-            values as ``stat()`` supplies.
-
-        Note:
-            In recent releases of Android (e.g. 7.0), the domain that
-            adbd executes from does not have access to everything that
-            the shell user does.
-
-            Because of this, while the shell user can get listings of
-            e.g. the root directory ('/'), adbd cannot.
-
-            The SYNC APIs are executed within the adbd context, not the
-            shell user context.
-
-            This issue is not a problem if the phone is rooted via
-            'adb root', since adbd then runs in the ``su`` domain.
-
-        Examples:
-
-            >>> pprint(adb.Client().list('/data/user'))
-            {'0': {'mode': 41471, 'size': 11, 'time': ...}}
-            >>> adb.Client().list('/does/not/exist')
-            Traceback (most recent call last):
-            ...
-            PwnlibException: Cannot list directory '/does/not/exist': Does not exist
-        """
-        st = self.stat(path)
-
-        if not st:
-            log.error("Cannot list directory %r: Does not exist" % path)
-
-        if not stat.S_ISDIR(st['mode']):
-            log.error("Cannot list directory %r: Path is not a directory" % path)
-
-        return self._list(path)
-
-    @_with_transport
-    @_sync
-    def _list(self, path):
-        self.c.flat('LIST', len(path), path)
-        files = {}
-        while True:
-            response = self.c.recvn(4)
-
-            if response == 'DONE':
-                break
-
-            if response != 'DENT':
-                self.error('Unexpected response: %r' % response)
-
-            mode = self.c.u32()
-            size = self.c.u32()
-            time = self.c.u32()
-            name = self.c.recvn(self.c.u32())
-
-            # Ignore the current directory and parent
-            if name in ('', '.', '..'):
-                continue
-
-            files[name] = {'mode': mode,
-                           'size': size,
-                           'time': time}
-
-        return files
-
-    @_with_transport
-    @_sync
-    def stat(self, path):
-        """Execute the ``STAT`` command of the ``SYNC`` API.
-
-        Arguments:
-            path(str): Path to the file to stat.
-
-        Return:
-            On success, a dictionary mapping the values returned.
-            If the file cannot be ``stat()``ed, None is returned.
-
-        Example:
-
-            >>> expected = {'mode': 16749, 'size': 0, 'time': 0}
-            >>> adb.protocol.Client().stat('/proc')           == expected
-            True
-            >>> adb.protocol.Client().stat('/does/not/exist') == None
-            True
-        """
-        self.c.flat('STAT', len(path), path)
-        if self.c.recvn(4) != 'STAT':
-            self.error("An error occured while attempting to STAT a file.")
-
-        mode = self.c.u32()
-        size = self.c.u32()
-        time = self.c.u32()
-
-        if (mode,size,time) == (0,0,0):
-            return None
-
-        return {'mode': mode, 'size': size, 'time': time}
-
-    def write(self, path, data, mode=0o755, timestamp=None, callback=None):
-        """Execute the ``WRITE`` command of the ``SYNC`` API.
-
-        Arguments:
-            path(str): Path to the file to write
-            data(str): Data to write to the file
-            mode(int): File mode to set (e.g. ``0o755``)
-            timestamp(int): Unix timestamp to set the file date to
-            callback(callable): Callback function invoked as data
-                is written.  Arguments provided are:
-
-                - File path
-                - All data
-                - Expected size of all data
-                - Current chunk
-                - Expected size of chunk
-        """
-        # We must ensure that 'path' is not a directory
-        # Writing to a directory is supported, but creates a temporary file
-        st = self.stat(path)
-
-        if st and stat.S_ISDIR(st['mode']):
-            log.error("Cannot write to %r: Path is a directory" % path)
-
-        return self._write(path, data, mode=0o755, timestamp=None, callback=None)
-
-    @_with_transport
-    @_sync
-    def _write(self, path, data, mode=0o755, timestamp=None, callback=None):
-        path += ',' + str(mode)
-        self.c.flat('SEND', len(path), path)
-
-        sent = 0
-
-        # Data needs to be broken up into chunks!
-        for chunk in group(0x10000, data):
-            self.c.flat('DATA', len(chunk), chunk)
-            if callback:
-                callback(path, data[:sent], len(data), chunk, len(chunk))
-            sent += len(chunk)
-
-        # Send completion notification and timestamp
-        if timestamp is None:
-            timestamp = int(time.time())
-        self.c.flat('DONE', timestamp)
-
-        result = self.c.recvn(4)
-        if result != 'OKAY':
-            log.error("Sync write failed: %r (expected OKAY)" % result)
-
-        return
-
-    @_with_transport
-    @_sync
-    def read(self, path, filesize=0, callback=lambda *a: True):
-        """Execute the ``READ`` command of the ``SYNC`` API.
-
-        Arguments:
-            path(str): Path to the file to read
-            filesize(int): Size of the file, in bytes.  Optional.
-            callback(callable): Callback function invoked as data
-                becomes available.  Arguments provided are:
-
-                - File path
-                - All data
-                - Expected size of all data
-                - Current chunk
-                - Expected size of chunk
-
-        Return:
-            The data received as a string.
-        """
-        self.c.send('RECV' + p32(len(path)) + path)
-
-        # Accumulate all data here
-        all_data = ''
-
-        while True:
-            magic = self.c.recvn(4)
-
-            # adbd says there is no more data to send
-            if magic == 'DONE':
-                break
-
-            if magic == 'FAIL':
-                self.error('Could not read file %r: Got FAIL.' % path)
-
-            # did we expect to be done?
-            if magic != 'DATA':
-                self.error('Error after file read: %r (expected DATA)' % magic)
-
-            # receive all of the data in the chunk
-            chunk_size = self.c.u32()
-            chunk_data  = ''
-            while len(chunk_data) != chunk_size:
-                chunk_data += self.c.recv(chunk_size - len(chunk_data))
-
-                if callback:
-                    callback(path,
-                             all_data,
-                             filesize,
-                             chunk_data,
-                             chunk_size)
-
-            # add the chunk onto what we have
-            all_data += chunk_data
-
-        zero = self.c.u32()
-        if zero != 0:
-            self.error('Error after file read: %r (expected ZERO)' % zero)
-
-        return all_data
-
-    @_with_transport
-    def forward(self, device, host_proto, host_port, device_proto, device_port):
-        self.send('host:forward:%s:%s;%s:%s' % (host_proto, host_port, device_proto, device_port))
-        self.c.recvall()
-
-    def __enter__(self, *a, **kw):
-        return self
-
-    @_autoclose
-    def __exit__(self, *a, **kw): pass
-
-def proxy(port=9999):
-    """Starts an ADB proxy on the specified port, for debugging purposes."""
-    l = listen(port)
-    l.wait_for_connection()
-    r = remote(context.adb_host, context.adb_port, level='debug')
-    l <> r
+from pwnlib.protocols.adb import AdbClient
+Client = AdbClient

pwnlib/args.py

@@ -1,3 +1,4 @@
+
 #!/usr/bin/env python2
 """
 Pwntools exposes several magic command-line arguments and environment
@@ -16,8 +17,8 @@ The easiest example is to enable more verbose debugging.  Just set ``DEBUG``.
     $ python exploit.py DEBUG
 
 These arguments are automatically extracted, regardless of their name, and
-exposed via ``pwnlib.args.args``, which is exposed as the global variable
-``args``.  Arguments which ``pwntools`` reserves internally are not exposed
+exposed via :mod:`pwnlib.args.args`, which is exposed as the global variable
+:data:`args`.  Arguments which ``pwntools`` reserves internally are not exposed
 this way.
 
 .. code-block:: bash
@@ -36,21 +37,48 @@ not specified evaluate to an empty string.
     else:
         io = process('./pwnable')
 
+Arguments can also be accessed directly with the dot operator, e.g.:
+
+.. code-block:: python
+
+    if args.REMOTE:
+        ...
+
+Any undefined arguments evaluate to an empty string, ``''``.
+
 The full list of supported "magic arguments" and their effects are listed
 below.
+
 """
+from __future__ import absolute_import
+
 import collections
 import logging
 import os
 import string
 import sys
 
-from . import term
-from .context import context
+from pwnlib import term
+from pwnlib.context import context
 
+class PwnlibArgs(collections.defaultdict):
+    def __getattr__(self, attr):
+        return self[attr]
+
+args = PwnlibArgs(str)
 term_mode  = True
-args       = collections.defaultdict(str)
 env_prefix = 'PWNLIB_'
+free_form  = True
+
+# Check to see if we were invoked as one of the 'pwn xxx' scripts.
+# If so, we don't want to remove e.g. "SYS_" from the end of the command
+# line, as this breaks things like constgrep.
+import pwnlib.commandline
+basename = os.path.basename(sys.argv[0])
+
+if basename == 'pwn' or basename in pwnlib.commandline.__all__:
+    free_form = False
+
 
 def isident(s):
     """
@@ -172,7 +200,7 @@ def initialize():
             sys.argv.remove(orig)
             hooks[arg](value)
 
-        elif isident(arg):
+        elif free_form and isident(arg):
             sys.argv.remove(orig)
             args[arg] = value
 

pwnlib/asm.py

@@ -39,6 +39,8 @@ Disassembly
     '   0:   b8 0b 00 00 00          mov    eax,0xb'
 
 """
+from __future__ import absolute_import
+
 import errno
 import os
 import platform
@@ -53,11 +55,11 @@ from glob import glob
 from os import environ
 from os import path
 
-from . import atexit
-from . import shellcraft
-from .context import LocalContext
-from .context import context
-from .log import getLogger
+from pwnlib import atexit
+from pwnlib import shellcraft
+from pwnlib.context import LocalContext
+from pwnlib.context import context
+from pwnlib.log import getLogger
 
 log = getLogger(__name__)
 
@@ -71,6 +73,11 @@ def dpkg_search_for_binutils(arch, util):
 
     Returns:
         A list of candidate package names.
+
+    ::
+
+        >>> pwnlib.asm.dpkg_search_for_binutils('aarch64', 'as')
+        ['binutils-aarch64-linux-gnu']
     """
 
     # Example output:
@@ -97,6 +104,16 @@ def dpkg_search_for_binutils(arch, util):
 def print_binutils_instructions(util, context):
     """On failure to find a binutils utility, inform the user of a way
     they can get it easily.
+
+    Doctest:
+
+        >>> context.clear(arch = 'amd64')
+        >>> pwnlib.asm.print_binutils_instructions('as', context)
+        Traceback (most recent call last):
+        ...
+        PwnlibException: Could not find 'as' installed for ContextType(arch = 'amd64', bits = 64, endian = 'little')
+        Try installing binutils for this architecture:
+        $ sudo apt-get install binutils
     """
     # This links to our instructions on how to manually install binutils
     # for several architectures.
@@ -129,8 +146,9 @@ def which_binutils(util):
     Examples:
 
         >>> import platform
+        >>> which_binutils = pwnlib.asm.which_binutils
         >>> which_binutils('as', arch=platform.machine())
-        '.../bin/as'
+        '.../bin/...as'
         >>> which_binutils('as', arch='arm') #doctest: +ELLIPSIS
         '.../bin/arm-...-as'
         >>> which_binutils('as', arch='powerpc') #doctest: +ELLIPSIS
@@ -173,10 +191,12 @@ def which_binutils(util):
     for arch in arches:
         for gutil in utils:
             # e.g. objdump
-            if arch is None: pattern = gutil
+            if arch is None:
+                pattern = gutil
 
             # e.g. aarch64-linux-gnu-objdump
-            else:       pattern = '%s*linux*-%s' % (arch,gutil)
+            else:
+                pattern = '%s*linux*-%s' % (arch,gutil)
 
             for dir in environ['PATH'].split(':'):
                 res = sorted(glob(path.join(dir, pattern)))
@@ -380,16 +400,14 @@ def cpp(shellcode):
 
     Examples:
 
-        .. doctest::
-
-            >>> cpp("mov al, SYS_setresuid", arch = "i386", os = "linux")
-            'mov al, 164\n'
-            >>> cpp("weee SYS_setresuid", arch = "arm", os = "linux")
-            'weee (0+164)\n'
-            >>> cpp("SYS_setresuid", arch = "thumb", os = "linux")
-            '(0+164)\n'
-            >>> cpp("SYS_setresuid", os = "freebsd")
-            '311\n'
+        >>> cpp("mov al, SYS_setresuid", arch = "i386", os = "linux")
+        'mov al, 164\n'
+        >>> cpp("weee SYS_setresuid", arch = "arm", os = "linux")
+        'weee (0+164)\n'
+        >>> cpp("SYS_setresuid", arch = "thumb", os = "linux")
+        '(0+164)\n'
+        >>> cpp("SYS_setresuid", os = "freebsd")
+        '311\n'
     """
     arch = context.arch
     os   = context.os
@@ -406,17 +424,39 @@ def cpp(shellcode):
     return _run(cmd, code).strip('\n').rstrip() + '\n'
 
 @LocalContext
-def make_elf_from_assembly(assembly, vma = None, extract=False, shared = False):
-    r"""
-    Builds an ELF file with the specified assembly as its
-    executable code.
+def make_elf_from_assembly(assembly,
+                           vma=None,
+                           extract=False,
+                           shared=False,
+                           strip=False,
+                           **kwargs):
+    r"""make_elf_from_assembly(assembly, vma=None, extract=None, shared=False, strip=False, **kwargs) -> str
+
+    Builds an ELF file with the specified assembly as its executable code.
+
+    This differs from :func:`.make_elf` in that all ELF symbols are preserved,
+    such as labels and local variables.  Use :func:`.make_elf` if size matters.
+    Additionally, the default value for ``extract`` in :func:`.make_elf` is
+    different.
+
+    Note:
+        This is effectively a wrapper around :func:`.asm`. with setting
+        ``extract=False``, ``vma=0x10000000``, and marking the resulting
+        file as executable (``chmod +x``).
+
+    Note:
+        ELF files created with `arch=thumb` will prepend an ARM stub
+        which switches to Thumb mode.
 
     Arguments:
-
-        assembly(str): Assembly
+        assembly(str): Assembly code to build into an ELF
         vma(int): Load address of the binary
-        extract(bool): Whether to return the data extracted from the file created,
-                       or the path to it.
+            (Default: ``0x10000000``, or ``0`` if ``shared=True``)
+        extract(bool): Extract the full ELF data from the file.
+            (Default: ``False``)
+        shared(bool): Create a shared library
+            (Default: ``False``)
+        kwargs(dict): Arguments to pass to :func:`.asm`.
 
     Returns:
 
@@ -425,6 +465,9 @@ def make_elf_from_assembly(assembly, vma = None, extract=False, shared = False):
 
     Example:
 
+        This example shows how to create a shared library, and load it via
+        ``LD_PRELOAD``.
+
         >>> context.clear()
         >>> context.arch = 'amd64'
         >>> sc = 'push rbp; mov rbp, rsp;'
@@ -433,6 +476,18 @@ def make_elf_from_assembly(assembly, vma = None, extract=False, shared = False):
         >>> solib = make_elf_from_assembly(sc, shared=1)
         >>> subprocess.check_output(['echo', 'World'], env={'LD_PRELOAD': solib})
         'Hello\nWorld\n'
+
+        The same thing can be done with :func:`.make_elf`, though the sizes
+        are different.  They both
+
+        >>> file_a = make_elf(asm('nop'), extract=True)
+        >>> file_b = make_elf_from_assembly('nop', extract=True)
+        >>> file_a[:4] == file_b[:4]
+        True
+        >>> len(file_a) < 0x200
+        True
+        >>> len(file_b) > 0x1000
+        True
     """
     if shared and vma:
         log.error("Cannot specify a VMA for a shared library.")
@@ -449,38 +504,44 @@ def make_elf_from_assembly(assembly, vma = None, extract=False, shared = False):
         if not assembly.startswith(to_thumb):
             assembly = to_thumb + assembly
 
-    path = asm(assembly, vma = vma, extract = extract, shared = shared)
+    result = asm(assembly, vma = vma, shared = shared, extract = False, **kwargs)
 
     if not extract:
-        os.chmod(path, 0755)
+        os.chmod(result, 0755)
+    else:
+        with open(result, 'rb') as io:
+            result = io.read()
 
-    return path
+    return result
 
 @LocalContext
-def make_elf(data, vma = None, strip=True, extract=True, shared=False):
-    r"""
-    Builds an ELF file with the specified binary data as its
-    executable code.
+def make_elf(data,
+             vma=None,
+             strip=True,
+             extract=True,
+             shared=False):
+    r"""make_elf(data, vma=None, strip=True, extract=True, shared=False, **kwargs) -> str
+
+    Builds an ELF file with the specified binary data as its executable code.
 
     Arguments:
         data(str): Assembled code
         vma(int):  Load address for the ELF file
+        strip(bool): Strip the resulting ELF file. Only matters if ``extract=False``.
+            (Default: ``True``)
+        extract(bool): Extract the assembly from the ELF file.
+            If ``False``, the path of the ELF file is returned.
+            (Default: ``True``)
+        shared(bool): Create a Dynamic Shared Object (DSO, i.e. a ``.so``)
+            which can be loaded via ``dlopen`` or ``LD_PRELOAD``.
 
     Examples:
-
         This example creates an i386 ELF that just does
         execve('/bin/sh',...).
 
-        >>> context.clear()
-        >>> context.arch = 'i386'
-        >>> context.bits = 32
-        >>> filename = tempfile.mktemp()
+        >>> context.clear(arch='i386')
         >>> bin_sh = '6a68682f2f2f73682f62696e89e331c96a0b5899cd80'.decode('hex')
-        >>> data = make_elf(bin_sh)
-        >>> with open(filename,'wb+') as f:
-        ...     f.write(data)
-        ...     f.flush()
-        >>> os.chmod(filename,0777)
+        >>> filename = make_elf(bin_sh, extract=False)
         >>> p = process(filename)
         >>> p.sendline('echo Hello; exit')
         >>> p.recvline()
@@ -548,38 +609,37 @@ def make_elf(data, vma = None, strip=True, extract=True, shared=False):
 
 @LocalContext
 def asm(shellcode, vma = 0, extract = True, shared = False):
-    r"""asm(code, vma = 0, extract = True, ...) -> str
+    r"""asm(code, vma = 0, extract = True, shared = False, ...) -> str
 
     Runs :func:`cpp` over a given shellcode and then assembles it into bytes.
 
     To see which architectures or operating systems are supported,
     look in :mod:`pwnlib.contex`.
 
-    To support all these architecture, we bundle the GNU assembler
-    and objcopy with pwntools.
+    Assembling shellcode requires that the GNU assembler is installed
+    for the target architecture.
+    See :doc:`Installing Binutils </install/binutils>` for more information.
 
     Arguments:
-      shellcode(str): Assembler code to assemble.
-      vma(int):       Virtual memory address of the beginning of assembly
-      extract(bool):  Extract the raw assembly bytes from the assembled
-                      file.  If ``False``, returns the path to an ELF file
-                      with the assembly embedded.
-
-    Kwargs:
-        Any arguments/properties that can be set on ``context``
+        shellcode(str): Assembler code to assemble.
+        vma(int):       Virtual memory address of the beginning of assembly
+        extract(bool):  Extract the raw assembly bytes from the assembled
+                        file.  If :const:`False`, returns the path to an ELF file
+                        with the assembly embedded.
+        shared(bool):   Create a shared object.
+        kwargs(dict):   Any attributes on :data:`.context` can be set, e.g.set
+                        ``arch='arm'``.
 
     Examples:
 
-        .. doctest::
-
-            >>> asm("mov eax, SYS_select", arch = 'i386', os = 'freebsd')
-            '\xb8]\x00\x00\x00'
-            >>> asm("mov eax, SYS_select", arch = 'amd64', os = 'linux')
-            '\xb8\x17\x00\x00\x00'
-            >>> asm("mov rax, SYS_select", arch = 'amd64', os = 'linux')
-            'H\xc7\xc0\x17\x00\x00\x00'
-            >>> asm("mov r0, #SYS_select", arch = 'arm', os = 'linux', bits=32)
-            'R\x00\xa0\xe3'
+        >>> asm("mov eax, SYS_select", arch = 'i386', os = 'freebsd')
+        '\xb8]\x00\x00\x00'
+        >>> asm("mov eax, SYS_select", arch = 'amd64', os = 'linux')
+        '\xb8\x17\x00\x00\x00'
+        >>> asm("mov rax, SYS_select", arch = 'amd64', os = 'linux')
+        'H\xc7\xc0\x17\x00\x00\x00'
+        >>> asm("mov r0, #SYS_select", arch = 'arm', os = 'linux', bits=32)
+        'R\x00\xa0\xe3'
     """
     result = ''
 
@@ -611,11 +671,20 @@ def asm(shellcode, vma = 0, extract = True, shared = False):
             ldflags = ['-z', 'execstack', '-o', step3, step2]
             if vma:
                 ldflags += ['--section-start=.shellcode=%#x' % vma,
-                            '--entry=%#x' % vma,
-                            '-z', 'max-page-size=4096',
-                            '-z', 'common-page-size=4096']
+                            '--entry=%#x' % vma]
             elif shared:
                 ldflags += ['-shared', '-init=_start']
+
+            # In order to ensure that we generate ELF files with 4k pages,
+            # and not e.g. 65KB pages (AArch64), force the page size.
+            # This is a result of GNU Gold being silly.
+            #
+            # Introduced in commit dd58f409 without supporting evidence,
+            # this shouldn't do anything except keep consistent page granularity
+            # across architectures.
+            ldflags += ['-z', 'max-page-size=4096',
+                        '-z', 'common-page-size=4096']
+
             _run(linker + ldflags)
 
         elif file(step2,'rb').read(4) == '\x7fELF':
@@ -667,24 +736,21 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):
 
     Examples:
 
-        .. doctest::
-
-          >>> print disasm('b85d000000'.decode('hex'), arch = 'i386')
-             0:   b8 5d 00 00 00          mov    eax,0x5d
-          >>> print disasm('b85d000000'.decode('hex'), arch = 'i386', byte = 0)
-             0:   mov    eax,0x5d
-          >>> print disasm('b85d000000'.decode('hex'), arch = 'i386', byte = 0, offset = 0)
-          mov    eax,0x5d
-          >>> print disasm('b817000000'.decode('hex'), arch = 'amd64')
-             0:   b8 17 00 00 00          mov    eax,0x17
-          >>> print disasm('48c7c017000000'.decode('hex'), arch = 'amd64')
-             0:   48 c7 c0 17 00 00 00    mov    rax,0x17
-          >>> print disasm('04001fe552009000'.decode('hex'), arch = 'arm')
-             0:   e51f0004        ldr     r0, [pc, #-4]   ; 0x4
-             4:   00900052        addseq  r0, r0, r2, asr r0
-          >>> print disasm('4ff00500'.decode('hex'), arch = 'thumb', bits=32)
-             0:   f04f 0005       mov.w   r0, #5
-          >>>
+        >>> print disasm('b85d000000'.decode('hex'), arch = 'i386')
+           0:   b8 5d 00 00 00          mov    eax,0x5d
+        >>> print disasm('b85d000000'.decode('hex'), arch = 'i386', byte = 0)
+           0:   mov    eax,0x5d
+        >>> print disasm('b85d000000'.decode('hex'), arch = 'i386', byte = 0, offset = 0)
+        mov    eax,0x5d
+        >>> print disasm('b817000000'.decode('hex'), arch = 'amd64')
+           0:   b8 17 00 00 00          mov    eax,0x17
+        >>> print disasm('48c7c017000000'.decode('hex'), arch = 'amd64')
+           0:   48 c7 c0 17 00 00 00    mov    rax,0x17
+        >>> print disasm('04001fe552009000'.decode('hex'), arch = 'arm')
+           0:   e51f0004        ldr     r0, [pc, #-4]   ; 0x4
+           4:   00900052        addseq  r0, r0, r2, asr r0
+        >>> print disasm('4ff00500'.decode('hex'), arch = 'thumb', bits=32)
+           0:   f04f 0005       mov.w   r0, #5
     """
     result = ''
 
@@ -718,7 +784,7 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):
 
         res = _run(objcopy + [step1, step2])
 
-        output0 = subprocess.check_output(objdump + [step2])
+        output0 = _run(objdump + [step2])
         output1 = output0.split('<.text>:\n')
 
         if len(output1) != 2:

pwnlib/atexception.py

@@ -2,12 +2,13 @@
 Analogous to atexit, this module allows the programmer to register functions to
 be run if an unhandled exception occurs.
 """
+from __future__ import absolute_import
 
 import sys
 import threading
 import traceback
 
-from .context import context
+from pwnlib.context import context
 
 __all__ = ['register', 'unregister']
 

pwnlib/atexit.py

@@ -7,12 +7,13 @@ this replacement module also defines :func:`unregister`.
 This module also fixes a the issue that exceptions raised by an exit handler is
 printed twice when the standard :mod:`atexit` is used.
 """
+from __future__ import absolute_import
 
 import sys
 import threading
 import traceback
 
-from .context import context
+from pwnlib.context import context
 
 __all__ = ['register', 'unregister']
 

pwnlib/commandline/__init__.py

@@ -1 +1,22 @@
 #!/usr/bin/env python2
+__all__ = [
+    'asm',
+    'checksec',
+    'common',
+    'constgrep',
+    'cyclic',
+    'debug',
+    'disasm',
+    'disablenx',
+    'elfdiff',
+    'elfpatch',
+    'errno',
+    'hex',
+    'main',
+    'phd',
+    'pwnstrip',
+    'scramble',
+    'shellcraft',
+    'unhex',
+    'update'
+]

pwnlib/commandline/asm.py

@@ -1,10 +1,11 @@
 #!/usr/bin/env python2
+from __future__ import absolute_import
+
 import argparse
 import sys
 
 from pwn import *
-
-from . import common
+from pwnlib.commandline import common
 
 parser = common.parser_commands.add_parser(
     'asm',
@@ -95,6 +96,10 @@ parser.add_argument(
 def main(args):
     tty    = args.output.isatty()
 
+    if args.infile.isatty() and not args.lines:
+        parser.print_usage()
+        sys.exit(1)
+
     data   = '\n'.join(args.lines) or args.infile.read()
     output = asm(data.replace(';', '\n'))
     fmt    = args.format or ('hex' if tty else 'raw')
@@ -124,4 +129,4 @@ def main(args):
         args.output.write('\n')
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/checksec.py

@@ -1,10 +1,11 @@
 #!/usr/bin/env python2
+from __future__ import absolute_import
+
 import argparse
 import sys
 
 from pwn import *
-
-from . import common
+from pwnlib.commandline import common
 
 parser = common.parser_commands.add_parser(
     'checksec',
@@ -36,4 +37,4 @@ def main(args):
         e = ELF(f.name)
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/constgrep.py

@@ -1,12 +1,15 @@
 #!/usr/bin/env python2
+from __future__ import absolute_import
 
 import argparse
 import os
 import re
 
-from pwn import *
+import pwnlib
+pwnlib.args.free_form = False
 
-from . import common
+from pwn import *
+from pwnlib.commandline import common
 
 p = common.parser_commands.add_parser(
     'constgrep',
@@ -75,6 +78,7 @@ def main(args):
         else:
             matcher = re.compile(args.regex)
 
+
         # Evaluate the given constant
         if args.constant:
             try:
@@ -135,4 +139,4 @@ def main(args):
                 print '(%s) == %s' % (' | '.join(k for v, k in good), args.constant)
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/cyclic.py

@@ -1,11 +1,15 @@
 #!/usr/bin/env python2
+from __future__ import absolute_import
+
 import argparse
 import string
 import sys
 
-from pwn import *
+import pwnlib
+pwnlib.args.free_form = False
 
-from . import common
+from pwn import *
+from pwnlib.commandline import common
 
 parser = common.parser_commands.add_parser(
     'cyclic',
@@ -91,4 +95,4 @@ def main(args):
             sys.stdout.write('\n')
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/debug.py

@@ -0,0 +1,69 @@
+#!/usr/bin/env python2
+from __future__ import absolute_import
+
+import argparse
+import sys
+
+from pwn import *
+from pwnlib.commandline import common
+
+parser = common.parser_commands.add_parser(
+    'debug',
+    help = 'Debug a binary in GDB'
+)
+parser.add_argument(
+    '-x', metavar='GDBSCRIPT',
+    type=file,
+    help='Execute GDB commands from this file.'
+)
+parser.add_argument(
+    '--pid',
+    type=int,
+    help="PID to attach to"
+)
+parser.add_argument(
+    '-c', '--context',
+    metavar = 'context',
+    action = 'append',
+    type   = common.context_arg,
+    choices = common.choices,
+    help = 'The os/architecture/endianness/bits the shellcode will run in (default: linux/i386), choose from: %s' % common.choices,
+)
+parser.add_argument(
+    '--exec', type=file, dest='executable',
+    help='File to debug'
+)
+parser.add_argument(
+    '--process', metavar='PROCESS_NAME',
+    help='Name of the process to attach to (e.g. "bash")'
+)
+
+def main(args):
+    gdbscript = ''
+    if args.x:
+        gdbscript = args.x.read()
+
+    if context.os == 'android':
+        context.device = adb.wait_for_device()
+
+    if args.executable:
+        context.binary = ELF(args.executable.name)
+        target = context.binary.path
+    elif args.pid:
+        target = int(args.pid)
+    elif args.process:
+        if context.os == 'android':
+            target = adb.pidof(process)
+        else:
+            target = pidof(process)
+    else:
+        parser.print_usage()
+        return 1
+
+    if args.pid or args.process:
+        gdb.attach(target, gdbscript=gdbscript)
+    else:
+        gdb.debug(target, gdbscript=gdbscript).interactive()
+
+if __name__ == '__main__':
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/disablenx.py

@@ -0,0 +1,25 @@
+#!/usr/bin/env python2
+from __future__ import absolute_import
+
+from pwn import *
+from pwnlib.commandline import common
+
+parser = common.parser_commands.add_parser(
+    'disablenx',
+    help = 'Disable NX for an ELF binary'
+)
+parser.add_argument(
+    'elf',
+    nargs='+',
+    type=file,
+    help='Files to check'
+)
+
+def main(args):
+    for f in args.elf:
+        e = ELF(f.name)
+        e.disable_nx()
+        ELF(e.path)
+
+if __name__ == '__main__':
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/disasm.py

@@ -1,11 +1,15 @@
 #!/usr/bin/env python2
+from __future__ import absolute_import
+
 import argparse
 import string
 import sys
 
-from pwn import *
+import pwnlib
+pwnlib.args.free_form = False
 
-from . import common
+from pwn import *
+from pwnlib.commandline import common
 
 parser = common.parser_commands.add_parser(
     'disasm',
@@ -88,4 +92,4 @@ def main(args):
     print disasm(dat, vma=safeeval.const(args.address))
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/elfdiff.py

@@ -1,13 +1,17 @@
 #!/usr/bin/env python2
+from __future__ import absolute_import
+
 import shutil
 from argparse import ArgumentParser
 from subprocess import CalledProcessError
 from subprocess import check_output
 from tempfile import NamedTemporaryFile
 
-from pwn import *
+import pwnlib
+pwnlib.args.free_form = False
 
-from . import common
+from pwn import *
+from pwnlib.commandline import common
 
 
 def dump(objdump, path):
@@ -54,4 +58,4 @@ def main(a):
     print diff(x, y)
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/elfpatch.py

@@ -1,10 +1,14 @@
 #!/usr/bin/env python2
+from __future__ import absolute_import
+
 import argparse
 import sys
 
-from pwn import *
+import pwnlib
+pwnlib.args.free_form = False
 
-from . import common
+from pwn import *
+from pwnlib.commandline import common
 
 p = common.parser_commands.add_parser(
     'elfpatch',
@@ -31,4 +35,4 @@ def main(a):
     sys.stdout.write(elf.get_data())
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/errno.py

@@ -1,7 +1,9 @@
+from __future__ import absolute_import
+
 import argparse
 import os
 
-from . import common
+from pwnlib.commandline import common
 
 parser = common.parser_commands.add_parser(
     'errno',
@@ -42,4 +44,4 @@ def main(args):
   print os.strerror(value)
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/hex.py

@@ -1,8 +1,10 @@
 #!/usr/bin/env python2
+from __future__ import absolute_import
+
 import argparse
 import sys
 
-from . import common
+from pwnlib.commandline import common
 
 parser = common.parser_commands.add_parser(
     'hex',
@@ -19,4 +21,4 @@ def main(args):
         print ' '.join(args.data).encode('hex')
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/main.py

@@ -1,30 +1,37 @@
+from __future__ import absolute_import
+
 import sys
 
-from . import asm
-from . import checksec
-from . import common
-from . import constgrep
-from . import cyclic
-from . import disasm
-from . import elfdiff
-from . import elfpatch
-from . import errno
-from . import hex
-from . import phd
-from . import pwnstrip
-from . import scramble
-from . import shellcraft
-from . import unhex
-from . import update
-from ..context import context
-from .common import parser
+from pwnlib.commandline import asm
+from pwnlib.commandline import checksec
+from pwnlib.commandline import common
+from pwnlib.commandline import constgrep
+from pwnlib.commandline import cyclic
+from pwnlib.commandline import debug
+from pwnlib.commandline import disasm
+from pwnlib.commandline import disablenx
+from pwnlib.commandline import elfdiff
+from pwnlib.commandline import elfpatch
+from pwnlib.commandline import errno
+from pwnlib.commandline import hex
+from pwnlib.commandline import phd
+from pwnlib.commandline import pwnstrip
+from pwnlib.commandline import scramble
+from pwnlib.commandline import shellcraft
+from pwnlib.commandline import template
+from pwnlib.commandline import unhex
+from pwnlib.commandline import update
+from pwnlib.commandline.common import parser
+from pwnlib.context import context
 
 commands = {
     'asm': asm.main,
     'checksec': checksec.main,
     'constgrep': constgrep.main,
     'cyclic': cyclic.main,
+    'debug': debug.main,
     'disasm': disasm.main,
+    'disablenx': disablenx.main,
     'elfdiff': elfdiff.main,
     'elfpatch': elfpatch.main,
     'errno': errno.main,
@@ -33,6 +40,7 @@ commands = {
     'pwnstrip': pwnstrip.main,
     'scramble': scramble.main,
     'shellcraft': shellcraft.main,
+    'template': template.main,
     'unhex': unhex.main,
     'update': update.main,
 }

pwnlib/commandline/phd.py

@@ -1,11 +1,15 @@
 #!/usr/bin/env python2
+from __future__ import absolute_import
+
 import argparse
 import os
 import sys
 
-from pwn import *
+import pwnlib
+pwnlib.args.free_form = False
 
-from . import common
+from pwn import *
+from pwnlib.commandline import common
 
 parser = common.parser_commands.add_parser(
     'phd',
@@ -97,4 +101,4 @@ def main(args):
         pass
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/pwnstrip.py

@@ -1,8 +1,12 @@
+from __future__ import absolute_import
+
 import argparse
 
-from pwn import *
+import pwnlib
+pwnlib.args.free_form = False
 
-from . import common
+from pwn import *
+from pwnlib.commandline import common
 
 p = common.parser_commands.add_parser(
     'pwnstrip',
@@ -47,4 +51,4 @@ def main(args):
     args.output.write(result)
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/scramble.py

@@ -1,9 +1,13 @@
+from __future__ import absolute_import
+
 import argparse
 import sys
 
-from pwn import *
+import pwnlib
+pwnlib.args.free_form = False
 
-from . import common
+from pwn import *
+from pwnlib.commandline import common
 
 parser = common.parser_commands.add_parser(
     'scramble',
@@ -101,4 +105,4 @@ def main(args):
 
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/shellcraft.py

@@ -1,12 +1,16 @@
 #!/usr/bin/env python2
+from __future__ import absolute_import
+
 import argparse
 import os
 import sys
 import types
 
-from pwn import *
+import pwnlib
+pwnlib.args.free_form = False
 
-from . import common
+from pwn import *
+from pwnlib.commandline import common
 
 
 #  ____  _          _ _                 __ _
@@ -168,7 +172,7 @@ def get_template(name):
 
 def is_not_a_syscall_template(name):
     template_src = shellcraft._get_source(name)
-    return 'man 2' not in read(template_src)
+    return '/syscalls' not in template_src
 
 def main(args):
     if args.list:
@@ -338,4 +342,4 @@ def main(args):
     args.out.write(code)
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/template.py

@@ -0,0 +1,64 @@
+#!/usr/bin/env python2
+from __future__ import absolute_import
+
+import re
+
+from pwn import *
+from pwnlib.commandline import common
+
+from mako.lookup import TemplateLookup
+
+parser = common.parser_commands.add_parser(
+    'template',
+    help = 'Generate an exploit template'
+)
+
+parser.add_argument('exe', nargs='?', help='Target binary')
+parser.add_argument('--host', help='Remote host / SSH server')
+parser.add_argument('--port', help='Remote port / SSH port', type=int)
+parser.add_argument('--user', help='SSH Username')
+parser.add_argument('--pass', help='SSH Password', dest='password')
+parser.add_argument('--path', help='Remote path of file on SSH server')
+
+def main(args):
+    cache = None
+
+    if cache:
+        cache = os.path.join(context.cache_dir, 'mako')
+
+    lookup = TemplateLookup(
+        directories      = [os.path.join(pwnlib.data.path, 'templates')],
+        module_directory = cache
+    )
+
+    # For the SSH scenario, check that the binary is at the
+    # same path on the remote host.
+    if args.user:
+        if not (args.path or args.exe):
+            log.error("Must specify --path or a exe")
+
+        s = ssh(args.user, args.host, args.port or 22, args.password or None)
+        s.download(args.path or args.exe)
+
+        if not args.exe:
+            args.exe = os.path.basename(args.path)
+
+    template = lookup.get_template('pwnup.mako')
+    output = template.render(args.exe,
+                             args.host,
+                             args.port,
+                             args.user,
+                             args.password,
+                             args.path)
+
+    # Fix Mako formatting bs
+    output = re.sub('\n\n\n', '\n\n', output)
+
+    print output
+
+    if not sys.stdout.isatty():
+        try: os.fchmod(sys.stdout.fileno(), 0700)
+        except OSError: pass
+
+if __name__ == '__main__':
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/unhex.py

@@ -1,9 +1,11 @@
 #!/usr/bin/env python2
+from __future__ import absolute_import
+
 import argparse
 import sys
 from string import whitespace
 
-from . import common
+from pwnlib.commandline import common
 
 parser = common.parser_commands.add_parser(
     'unhex',
@@ -25,4 +27,4 @@ def main(args):
         sys.stderr.write(str(e) + '\n')
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/update.py

@@ -1,9 +1,13 @@
 #!/usr/bin/env python2
+from __future__ import absolute_import
+
 import subprocess
 
-from pwn import *
+import pwnlib
+pwnlib.args.free_form = False
 
-from . import common
+from pwn import *
+from pwnlib.commandline import common
 
 p = common.parser_commands.add_parser(
     'update',
@@ -24,4 +28,4 @@ def main(a):
         subprocess.check_call(result, shell=False)
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/config.py

@@ -0,0 +1,60 @@
+# -*- coding: utf-8 -*-
+"""Allows per-user and per-host configuration of Pwntools settings.
+
+The list of configurable options includes all of the logging symbols
+and colors, as well as all of the default values on the global context
+object.
+
+The configuration file is read from ``~/.pwn.conf`` and ``/etc/pwn.conf``.
+
+The configuration file is only read in ``from pwn import *`` mode, and not
+when used in library mode (``import pwnlib``).  To read the configuration
+file in library mode, invoke :func:`.config.initialize`.
+
+The ``context`` section supports complex types, at least as far as is
+supported by ``pwnlib.util.safeeval.expr``.
+
+::
+
+    [log]
+    success.symbol=😎
+    error.symbol=☠
+    info.color=blue
+
+    [context]
+    adb_port=4141
+    randomize=1
+    timeout=60
+    terminal=['x-terminal-emulator', '-e']
+"""
+from __future__ import absolute_import
+
+import ConfigParser
+import os
+
+registered_configs = {}
+
+def register_config(section, function):
+    """Registers a configuration section.
+
+    Arguments:
+        section(str): Named configuration section
+        function(callable): Function invoked with a dictionary of
+            ``{option: value}`` for the entries in the section.
+    """
+    registered_configs[section] = function
+
+def initialize():
+    """Read the configuration files."""
+    from pwnlib.log import getLogger
+    log = getLogger(__name__)
+
+    c = ConfigParser.ConfigParser()
+    c.read(['/etc/pwn.conf', os.path.expanduser('~/.pwn.conf')])
+
+    for section in c.sections():
+        if section not in registered_configs:
+            log.warn("Unknown configuration section %r" % section)
+            continue
+        settings = dict(c.items(section))
+        registered_configs[section](settings)

pwnlib/constants/__init__.py

@@ -39,14 +39,26 @@ Example:
     ...     print int(constants.SYS_stat)
     4
 
+    >>> with context.local(arch = 'i386', os = 'linux'):
+    ...    print constants.SYS_execve + constants.PROT_WRITE
+    13
+    >>> with context.local(arch = 'amd64', os = 'linux'):
+    ...    print constants.SYS_execve + constants.PROT_WRITE
+    61
+    >>> with context.local(arch = 'amd64', os = 'linux'):
+    ...    print constants.SYS_execve + constants.PROT_WRITE
+    61
+
 """
+from __future__ import absolute_import
+
 import importlib
 import sys
 from types import ModuleType
 
-from ..context import context
-from ..util import safeeval
-from .constant import Constant
+from pwnlib.constants.constant import Constant
+from pwnlib.context import context
+from pwnlib.util import safeeval
 
 
 class ConstantsModule(ModuleType):
@@ -54,19 +66,6 @@ class ConstantsModule(ModuleType):
     ModuleType specialization in order to automatically
     route queries down to the correct module based on the
     current context arch / os.
-
-        >>> with context.local(arch = 'i386', os = 'linux'):
-        ...    print constants.SYS_execve + constants.PROT_WRITE
-        13
-        >>> with context.local(arch = 'amd64', os = 'linux'):
-        ...    print constants.SYS_execve + constants.PROT_WRITE
-        61
-        >>> with context.local(arch = 'amd64', os = 'linux'):
-        ...    print constants.SYS_execve + constants.PROT_WRITE
-        61
-        >>> False
-        True
-
     """
     Constant = Constant
 
@@ -137,6 +136,11 @@ class ConstantsModule(ModuleType):
         if not isinstance(string, str):
             return string
 
+        simple = getattr(self, string, None)
+
+        if simple is not None:
+            return simple
+
         key = context.os, context.arch
         if key not in self._env_store:
             self._env_store[key] = {key: getattr(self, key) for key in dir(self) if not key.endswith('__')}

pwnlib/constants/linux/aarch64.py

@@ -1,5 +1,4 @@
 from pwnlib.constants.constant import Constant
-
 __NR_io_setup = Constant('__NR_io_setup',0)
 __NR_io_destroy = Constant('__NR_io_destroy',1)
 __NR_io_submit = Constant('__NR_io_submit',2)
@@ -259,63 +258,6 @@ __NR_process_vm_readv = Constant('__NR_process_vm_readv',270)
 __NR_process_vm_writev = Constant('__NR_process_vm_writev',271)
 __NR_kcmp = Constant('__NR_kcmp',272)
 __NR_finit_module = Constant('__NR_finit_module',273)
-__NR_open = Constant('__NR_open',1024)
-__NR_link = Constant('__NR_link',1025)
-__NR_unlink = Constant('__NR_unlink',1026)
-__NR_mknod = Constant('__NR_mknod',1027)
-__NR_chmod = Constant('__NR_chmod',1028)
-__NR_chown = Constant('__NR_chown',1029)
-__NR_mkdir = Constant('__NR_mkdir',1030)
-__NR_rmdir = Constant('__NR_rmdir',1031)
-__NR_lchown = Constant('__NR_lchown',1032)
-__NR_access = Constant('__NR_access',1033)
-__NR_rename = Constant('__NR_rename',1034)
-__NR_readlink = Constant('__NR_readlink',1035)
-__NR_symlink = Constant('__NR_symlink',1036)
-__NR_utimes = Constant('__NR_utimes',1037)
-__NR_stat = Constant('__NR_stat',1038)
-__NR_lstat = Constant('__NR_lstat',1039)
-__NR_pipe = Constant('__NR_pipe',1040)
-__NR_dup2 = Constant('__NR_dup2',1041)
-__NR_epoll_create = Constant('__NR_epoll_create',1042)
-__NR_inotify_init = Constant('__NR_inotify_init',1043)
-__NR_eventfd = Constant('__NR_eventfd',1044)
-__NR_signalfd = Constant('__NR_signalfd',1045)
-__NR_sendfile64 = Constant('__NR_sendfile64',1046)
-__NR_ftruncate64 = Constant('__NR_ftruncate64',1047)
-__NR_truncate64 = Constant('__NR_truncate64',1048)
-__NR_stat64 = Constant('__NR_stat64',1049)
-__NR_lstat64 = Constant('__NR_lstat64',1050)
-__NR_fstat64 = Constant('__NR_fstat64',1051)
-__NR_fcntl64 = Constant('__NR_fcntl64',1052)
-__NR_newfstatat = Constant('__NR_newfstatat',1054)
-__NR_fstatfs64 = Constant('__NR_fstatfs64',1055)
-__NR_statfs64 = Constant('__NR_statfs64',1056)
-__NR_lseek64 = Constant('__NR_lseek64',1057)
-__NR_mmap64 = Constant('__NR_mmap64',1058)
-__NR_alarm = Constant('__NR_alarm',1059)
-__NR_getpgrp = Constant('__NR_getpgrp',1060)
-__NR_pause = Constant('__NR_pause',1061)
-__NR_time = Constant('__NR_time',1062)
-__NR_utime = Constant('__NR_utime',1063)
-__NR_creat = Constant('__NR_creat',1064)
-__NR_getdents = Constant('__NR_getdents',1065)
-__NR_futimesat = Constant('__NR_futimesat',1066)
-__NR_select = Constant('__NR_select',1067)
-__NR_poll = Constant('__NR_poll',1068)
-__NR_epoll_wait = Constant('__NR_epoll_wait',1069)
-__NR_ustat = Constant('__NR_ustat',1070)
-__NR_vfork = Constant('__NR_vfork',1071)
-__NR_oldwait4 = Constant('__NR_oldwait4',1072)
-__NR_recv = Constant('__NR_recv',1073)
-__NR_send = Constant('__NR_send',1074)
-__NR_bdflush = Constant('__NR_bdflush',1075)
-__NR_umount = Constant('__NR_umount',1076)
-__NR_uselib = Constant('__NR_uselib',1077)
-__NR__sysctl = Constant('__NR__sysctl',1078)
-__NR_fork = Constant('__NR_fork',1079)
-__NR_syscalls = Constant('__NR_syscalls',(1079+1))
-__NR_sigreturn = Constant('__NR_sigreturn',1999)
 MAP_32BIT = Constant('MAP_32BIT',0x40)
 INADDR_ANY = Constant('INADDR_ANY',0)
 INADDR_BROADCAST = Constant('INADDR_BROADCAST',0xffffffff)
@@ -944,19 +886,14 @@ CC_N_BIT = Constant('CC_N_BIT',(1 << 31))
 PCMASK = Constant('PCMASK',0)
 SYS_accept = Constant('SYS_accept',202)
 SYS_accept4 = Constant('SYS_accept4',242)
-SYS_access = Constant('SYS_access',1033)
 SYS_acct = Constant('SYS_acct',89)
 SYS_add_key = Constant('SYS_add_key',217)
 SYS_adjtimex = Constant('SYS_adjtimex',171)
-SYS_alarm = Constant('SYS_alarm',1059)
-SYS_bdflush = Constant('SYS_bdflush',1075)
 SYS_bind = Constant('SYS_bind',200)
 SYS_brk = Constant('SYS_brk',214)
 SYS_capget = Constant('SYS_capget',90)
 SYS_capset = Constant('SYS_capset',91)
 SYS_chdir = Constant('SYS_chdir',49)
-SYS_chmod = Constant('SYS_chmod',1028)
-SYS_chown = Constant('SYS_chown',1029)
 SYS_chroot = Constant('SYS_chroot',51)
 SYS_clock_getres = Constant('SYS_clock_getres',114)
 SYS_clock_gettime = Constant('SYS_clock_gettime',113)
@@ -965,17 +902,12 @@ SYS_clock_settime = Constant('SYS_clock_settime',112)
 SYS_clone = Constant('SYS_clone',220)
 SYS_close = Constant('SYS_close',57)
 SYS_connect = Constant('SYS_connect',203)
-SYS_creat = Constant('SYS_creat',1064)
 SYS_delete_module = Constant('SYS_delete_module',106)
 SYS_dup = Constant('SYS_dup',23)
-SYS_dup2 = Constant('SYS_dup2',1041)
 SYS_dup3 = Constant('SYS_dup3',24)
-SYS_epoll_create = Constant('SYS_epoll_create',1042)
 SYS_epoll_create1 = Constant('SYS_epoll_create1',20)
 SYS_epoll_ctl = Constant('SYS_epoll_ctl',21)
 SYS_epoll_pwait = Constant('SYS_epoll_pwait',22)
-SYS_epoll_wait = Constant('SYS_epoll_wait',1069)
-SYS_eventfd = Constant('SYS_eventfd',1044)
 SYS_eventfd2 = Constant('SYS_eventfd2',19)
 SYS_execve = Constant('SYS_execve',221)
 SYS_exit = Constant('SYS_exit',93)
@@ -991,27 +923,20 @@ SYS_fchmodat = Constant('SYS_fchmodat',53)
 SYS_fchown = Constant('SYS_fchown',55)
 SYS_fchownat = Constant('SYS_fchownat',54)
 SYS_fcntl = Constant('SYS_fcntl',25)
-SYS_fcntl64 = Constant('SYS_fcntl64',1052)
 SYS_fdatasync = Constant('SYS_fdatasync',83)
 SYS_fgetxattr = Constant('SYS_fgetxattr',10)
 SYS_flistxattr = Constant('SYS_flistxattr',13)
 SYS_flock = Constant('SYS_flock',32)
-SYS_fork = Constant('SYS_fork',1079)
 SYS_fremovexattr = Constant('SYS_fremovexattr',16)
 SYS_fsetxattr = Constant('SYS_fsetxattr',7)
 SYS_fstat = Constant('SYS_fstat',80)
-SYS_fstat64 = Constant('SYS_fstat64',1051)
 SYS_fstatat64 = Constant('SYS_fstatat64',79)
 SYS_fstatfs = Constant('SYS_fstatfs',44)
-SYS_fstatfs64 = Constant('SYS_fstatfs64',1055)
 SYS_fsync = Constant('SYS_fsync',82)
 SYS_ftruncate = Constant('SYS_ftruncate',46)
-SYS_ftruncate64 = Constant('SYS_ftruncate64',1047)
 SYS_futex = Constant('SYS_futex',98)
-SYS_futimesat = Constant('SYS_futimesat',1066)
 SYS_getcpu = Constant('SYS_getcpu',168)
 SYS_getcwd = Constant('SYS_getcwd',17)
-SYS_getdents = Constant('SYS_getdents',1065)
 SYS_getdents64 = Constant('SYS_getdents64',61)
 SYS_getegid = Constant('SYS_getegid',177)
 SYS_geteuid = Constant('SYS_geteuid',175)
@@ -1021,7 +946,6 @@ SYS_getitimer = Constant('SYS_getitimer',102)
 SYS_get_mempolicy = Constant('SYS_get_mempolicy',236)
 SYS_getpeername = Constant('SYS_getpeername',205)
 SYS_getpgid = Constant('SYS_getpgid',155)
-SYS_getpgrp = Constant('SYS_getpgrp',1060)
 SYS_getpid = Constant('SYS_getpid',172)
 SYS_getppid = Constant('SYS_getppid',173)
 SYS_getpriority = Constant('SYS_getpriority',141)
@@ -1039,7 +963,6 @@ SYS_getuid = Constant('SYS_getuid',174)
 SYS_getxattr = Constant('SYS_getxattr',8)
 SYS_init_module = Constant('SYS_init_module',105)
 SYS_inotify_add_watch = Constant('SYS_inotify_add_watch',27)
-SYS_inotify_init = Constant('SYS_inotify_init',1043)
 SYS_inotify_init1 = Constant('SYS_inotify_init1',26)
 SYS_inotify_rm_watch = Constant('SYS_inotify_rm_watch',28)
 SYS_io_cancel = Constant('SYS_io_cancel',3)
@@ -1053,9 +976,7 @@ SYS_io_submit = Constant('SYS_io_submit',2)
 SYS_kexec_load = Constant('SYS_kexec_load',104)
 SYS_keyctl = Constant('SYS_keyctl',219)
 SYS_kill = Constant('SYS_kill',129)
-SYS_lchown = Constant('SYS_lchown',1032)
 SYS_lgetxattr = Constant('SYS_lgetxattr',9)
-SYS_link = Constant('SYS_link',1025)
 SYS_linkat = Constant('SYS_linkat',37)
 SYS_listen = Constant('SYS_listen',201)
 SYS_listxattr = Constant('SYS_listxattr',11)
@@ -1064,15 +985,11 @@ SYS_lookup_dcookie = Constant('SYS_lookup_dcookie',18)
 SYS_lremovexattr = Constant('SYS_lremovexattr',15)
 SYS_lseek = Constant('SYS_lseek',62)
 SYS_lsetxattr = Constant('SYS_lsetxattr',6)
-SYS_lstat = Constant('SYS_lstat',1039)
-SYS_lstat64 = Constant('SYS_lstat64',1050)
 SYS_madvise = Constant('SYS_madvise',233)
 SYS_mbind = Constant('SYS_mbind',235)
 SYS_migrate_pages = Constant('SYS_migrate_pages',238)
 SYS_mincore = Constant('SYS_mincore',232)
-SYS_mkdir = Constant('SYS_mkdir',1030)
 SYS_mkdirat = Constant('SYS_mkdirat',34)
-SYS_mknod = Constant('SYS_mknod',1027)
 SYS_mknodat = Constant('SYS_mknodat',33)
 SYS_mlock = Constant('SYS_mlock',228)
 SYS_mlockall = Constant('SYS_mlockall',230)
@@ -1096,17 +1013,12 @@ SYS_munlock = Constant('SYS_munlock',229)
 SYS_munlockall = Constant('SYS_munlockall',231)
 SYS_munmap = Constant('SYS_munmap',215)
 SYS_nanosleep = Constant('SYS_nanosleep',101)
-SYS_newfstatat = Constant('SYS_newfstatat',1054)
 SYS_nfsservctl = Constant('SYS_nfsservctl',42)
-SYS_open = Constant('SYS_open',1024)
 SYS_openat = Constant('SYS_openat',56)
-SYS_pause = Constant('SYS_pause',1061)
 SYS_perf_event_open = Constant('SYS_perf_event_open',241)
 SYS_personality = Constant('SYS_personality',92)
-SYS_pipe = Constant('SYS_pipe',1040)
 SYS_pipe2 = Constant('SYS_pipe2',59)
 SYS_pivot_root = Constant('SYS_pivot_root',41)
-SYS_poll = Constant('SYS_poll',1068)
 SYS_ppoll = Constant('SYS_ppoll',73)
 SYS_prctl = Constant('SYS_prctl',167)
 SYS_pread64 = Constant('SYS_pread64',67)
@@ -1119,21 +1031,17 @@ SYS_pwritev = Constant('SYS_pwritev',70)
 SYS_quotactl = Constant('SYS_quotactl',60)
 SYS_read = Constant('SYS_read',63)
 SYS_readahead = Constant('SYS_readahead',213)
-SYS_readlink = Constant('SYS_readlink',1035)
 SYS_readlinkat = Constant('SYS_readlinkat',78)
 SYS_readv = Constant('SYS_readv',65)
 SYS_reboot = Constant('SYS_reboot',142)
-SYS_recv = Constant('SYS_recv',1073)
 SYS_recvfrom = Constant('SYS_recvfrom',207)
 SYS_recvmmsg = Constant('SYS_recvmmsg',243)
 SYS_recvmsg = Constant('SYS_recvmsg',212)
 SYS_remap_file_pages = Constant('SYS_remap_file_pages',234)
 SYS_removexattr = Constant('SYS_removexattr',14)
-SYS_rename = Constant('SYS_rename',1034)
 SYS_renameat = Constant('SYS_renameat',38)
 SYS_request_key = Constant('SYS_request_key',218)
 SYS_restart_syscall = Constant('SYS_restart_syscall',128)
-SYS_rmdir = Constant('SYS_rmdir',1031)
 SYS_rt_sigaction = Constant('SYS_rt_sigaction',134)
 SYS_rt_sigpending = Constant('SYS_rt_sigpending',136)
 SYS_rt_sigprocmask = Constant('SYS_rt_sigprocmask',135)
@@ -1152,14 +1060,11 @@ SYS_sched_setaffinity = Constant('SYS_sched_setaffinity',122)
 SYS_sched_setparam = Constant('SYS_sched_setparam',118)
 SYS_sched_setscheduler = Constant('SYS_sched_setscheduler',119)
 SYS_sched_yield = Constant('SYS_sched_yield',124)
-SYS_select = Constant('SYS_select',1067)
 SYS_semctl = Constant('SYS_semctl',191)
 SYS_semget = Constant('SYS_semget',190)
 SYS_semop = Constant('SYS_semop',193)
 SYS_semtimedop = Constant('SYS_semtimedop',192)
-SYS_send = Constant('SYS_send',1074)
 SYS_sendfile = Constant('SYS_sendfile',71)
-SYS_sendfile64 = Constant('SYS_sendfile64',1046)
 SYS_sendmsg = Constant('SYS_sendmsg',211)
 SYS_sendto = Constant('SYS_sendto',206)
 SYS_setdomainname = Constant('SYS_setdomainname',162)
@@ -1190,28 +1095,20 @@ SYS_shmdt = Constant('SYS_shmdt',197)
 SYS_shmget = Constant('SYS_shmget',194)
 SYS_shutdown = Constant('SYS_shutdown',210)
 SYS_sigaltstack = Constant('SYS_sigaltstack',132)
-SYS_signalfd = Constant('SYS_signalfd',1045)
 SYS_signalfd4 = Constant('SYS_signalfd4',74)
-SYS_sigreturn = Constant('SYS_sigreturn',1999)
 SYS_socket = Constant('SYS_socket',198)
 SYS_socketpair = Constant('SYS_socketpair',199)
 SYS_splice = Constant('SYS_splice',76)
-SYS_stat = Constant('SYS_stat',1038)
-SYS_stat64 = Constant('SYS_stat64',1049)
 SYS_statfs = Constant('SYS_statfs',43)
-SYS_statfs64 = Constant('SYS_statfs64',1056)
 SYS_swapoff = Constant('SYS_swapoff',225)
 SYS_swapon = Constant('SYS_swapon',224)
-SYS_symlink = Constant('SYS_symlink',1036)
 SYS_symlinkat = Constant('SYS_symlinkat',36)
 SYS_sync = Constant('SYS_sync',81)
 SYS_sync_file_range2 = Constant('SYS_sync_file_range2',84)
-SYS__sysctl = Constant('SYS__sysctl',1078)
 SYS_sysinfo = Constant('SYS_sysinfo',179)
 SYS_syslog = Constant('SYS_syslog',116)
 SYS_tee = Constant('SYS_tee',77)
 SYS_tgkill = Constant('SYS_tgkill',131)
-SYS_time = Constant('SYS_time',1062)
 SYS_timer_create = Constant('SYS_timer_create',107)
 SYS_timer_delete = Constant('SYS_timer_delete',111)
 SYS_timerfd_create = Constant('SYS_timerfd_create',85)
@@ -1223,20 +1120,12 @@ SYS_timer_settime = Constant('SYS_timer_settime',110)
 SYS_times = Constant('SYS_times',153)
 SYS_tkill = Constant('SYS_tkill',130)
 SYS_truncate = Constant('SYS_truncate',45)
-SYS_truncate64 = Constant('SYS_truncate64',1048)
 SYS_umask = Constant('SYS_umask',166)
-SYS_umount = Constant('SYS_umount',1076)
 SYS_umount2 = Constant('SYS_umount2',39)
 SYS_uname = Constant('SYS_uname',160)
-SYS_unlink = Constant('SYS_unlink',1026)
 SYS_unlinkat = Constant('SYS_unlinkat',35)
 SYS_unshare = Constant('SYS_unshare',97)
-SYS_uselib = Constant('SYS_uselib',1077)
-SYS_ustat = Constant('SYS_ustat',1070)
-SYS_utime = Constant('SYS_utime',1063)
 SYS_utimensat = Constant('SYS_utimensat',88)
-SYS_utimes = Constant('SYS_utimes',1037)
-SYS_vfork = Constant('SYS_vfork',1071)
 SYS_vhangup = Constant('SYS_vhangup',58)
 SYS_vmsplice = Constant('SYS_vmsplice',75)
 SYS_wait4 = Constant('SYS_wait4',260)

pwnlib/context/__init__.py

@@ -4,6 +4,8 @@
 Implements context management so that nested/scoped contexts and threaded
 contexts work properly and as expected.
 """
+from __future__ import absolute_import
+
 import collections
 import functools
 import logging
@@ -19,8 +21,11 @@ import time
 
 import socks
 
-from ..device import Device
-from ..timeout import Timeout
+from pwnlib.config import register_config
+from pwnlib.device import Device
+from pwnlib.timeout import Timeout
+
+__all__ = ['context', 'ContextType', 'Thread']
 
 _original_socket = socket.socket
 
@@ -244,9 +249,10 @@ def _longest(d):
     as it ensures the most complete match will be found.
 
     >>> data = {'a': 1, 'bb': 2, 'ccc': 3}
-    >>> _longest(data) == data
+    >>> pwnlib.context._longest(data) == data
     True
-    >>> for i in _longest(data): print i
+    >>> for i in pwnlib.context._longest(data):
+    ...     print i
     ccc
     bb
     a
@@ -261,7 +267,7 @@ class ContextType(object):
     r"""
     Class for specifying information about the target machine.
     Intended for use as a pseudo-singleton through the global
-    variable ``pwnlib.context.context``, available via
+    variable :data:`.context`, available via
     ``from pwn import *`` as ``context``.
 
     The context is usually specified at the top of the Python file for clarity. ::
@@ -331,6 +337,7 @@ class ContextType(object):
         'binary': None,
         'bits': 32,
         'buffer_size': 4096,
+        'delete_corefiles': False,
         'device': os.getenv('ANDROID_SERIAL', None) or None,
         'endian': 'little',
         'kernel': None,
@@ -338,12 +345,13 @@ class ContextType(object):
         'log_file': _devnull(),
         'log_console': sys.stdout,
         'randomize': False,
+        'rename_corefiles': True,
         'newline': '\n',
         'noptrace': False,
         'os': 'linux',
         'proxy': None,
         'signed': False,
-        'terminal': None,
+        'terminal': tuple(),
         'timeout': Timeout.maximum,
     }
 
@@ -528,12 +536,13 @@ class ContextType(object):
     def quiet(self, function=None):
         """Disables all non-error logging within the enclosed scope,
         *unless* the debugging level is set to 'debug' or lower."""
-        if not function:
-            level = 'error'
-            if context.log_level <= logging.DEBUG:
-                level = None
-            return self.local(function, log_level=level)
+        level = 'error'
+        if context.log_level <= logging.DEBUG:
+            level = None
+        return self.local(function, log_level=level)
 
+    def quietfunc(self, function):
+        """Similar to :attr:`quiet`, but wraps a whole function."""
         @functools.wraps(function)
         def wrapper(*a, **kw):
             level = 'error'
@@ -563,6 +572,7 @@ class ContextType(object):
         Examples:
 
             >>> # Default value
+            >>> context.clear()
             >>> context.arch == 'i386'
             True
             >>> context.arch = 'arm'
@@ -689,7 +699,7 @@ class ContextType(object):
         """
         ASLR settings for new processes.
 
-        If ``False``, attempt to disable ASLR in all processes which are
+        If :const:`False`, attempt to disable ASLR in all processes which are
         created via ``personality`` (``setarch -R``) and ``setrlimit``
         (``ulimit -s unlimited``).
 
@@ -756,7 +766,7 @@ class ContextType(object):
 
         """
         # Cyclic imports... sorry Idolf.
-        from ..elf     import ELF
+        from pwnlib.elf     import ELF
 
         if not isinstance(binary, ELF):
             binary = ELF(binary)
@@ -985,7 +995,7 @@ class ContextType(object):
 
         Can be set to any non-string truthy value, or the specific string
         values ``'signed'`` or ``'unsigned'`` which are converted into
-        ``True`` and ``False`` correspondingly.
+        :const:`True` and :const:`False` correspondingly.
 
         Examples:
 
@@ -1121,7 +1131,7 @@ class ContextType(object):
             self.os = device.os or self.os
         elif isinstance(device, str):
             device = Device(device)
-        else:
+        elif device is not None:
             raise AttributeError("device must be either a Device object or a serial number as a string")
 
         return device
@@ -1149,7 +1159,7 @@ class ContextType(object):
 
     @_validator
     def buffer_size(self, size):
-        """Internal buffer size to use for ``tube`` objects.
+        """Internal buffer size to use for :class:`pwnlib.tubes.tube.tube` objects.
 
         This is not the maximum size of the buffer, but this is the amount of data
         which is passed to each raw ``read`` syscall (or equivalent).
@@ -1161,7 +1171,7 @@ class ContextType(object):
         """Directory used for caching data.
 
         Note:
-            May be either a path string, or ``None``.
+            May be either a path string, or :const:`None`.
 
         Example:
 
@@ -1195,6 +1205,32 @@ class ContextType(object):
 
         return cache
 
+    @_validator
+    def delete_corefiles(self, v):
+        """Whether pwntools automatically deletes corefiles after exiting.
+        This only affects corefiles accessed via :attr:`.process.corefile`.
+
+        Default value is ``False``.
+        """
+        return bool(v)
+
+    @_validator
+    def rename_corefiles(self, v):
+        """Whether pwntools automatically renames corefiles.
+
+        This is useful for two things:
+
+        - Prevent corefiles from being overwritten, if ``kernel.core_pattern``
+          is something simple like ``"core"``.
+        - Ensure corefiles are generated, if ``kernel.core_pattern`` uses ``apport``,
+          which refuses to overwrite any existing files.
+
+        This only affects corefiles accessed via :attr:`.process.corefile`.
+
+        Default value is ``True``.
+        """
+        return bool(v)
+
     #*************************************************************************
     #                               ALIASES
     #*************************************************************************
@@ -1269,11 +1305,14 @@ class ContextType(object):
     Thread = Thread
 
 
-#: Global ``context`` object, used to store commonly-used pwntools settings.
+#: Global :class:`.ContextType` object, used to store commonly-used pwntools settings.
+#:
 #: In most cases, the context is used to infer default variables values.
-#: For example, :meth:`pwnlib.asm.asm` can take an ``os`` parameter as a
-#: keyword argument.  If it is not supplied, the ``os`` specified by
-#: ``context`` is used instead.
+#: For example, :func:`.asm` can take an ``arch`` parameter as a
+#: keyword argument.
+#:
+#: If it is not supplied, the ``arch`` specified by ``context`` is used instead.
+#:
 #: Consider it a shorthand to passing ``os=`` and ``arch=`` to every single
 #: function call.
 context = ContextType()
@@ -1291,6 +1330,7 @@ def LocalContext(function):
 
     Example:
 
+        >>> context.clear()
         >>> @LocalContext
         ... def printArch():
         ...     print(context.arch)
@@ -1308,3 +1348,25 @@ def LocalContext(function):
         with context.local(**{k:kw.pop(k) for k,v in kw.items() if isinstance(getattr(ContextType, k, None), property)}):
             return function(*a, **kw)
     return setter
+
+# Read configuration options from the context section
+def update_context_defaults(section):
+    # Circular imports FTW!
+    from pwnlib.util import safeeval
+    from pwnlib.log import getLogger
+    log = getLogger(__name__)
+    for key, value in section.items():
+        if key not in ContextType.defaults:
+            log.warn("Unknown configuration option %r in section %r" % (key, 'context'))
+            continue
+
+        default = ContextType.defaults[key]
+
+        if isinstance(default, (str, unicode, tuple, int, long, list, dict)):
+            value = safeeval.expr(value)
+        else:
+            log.warn("Unsupported configuration option %r in section %r" % (key, 'context'))
+
+        ContextType.defaults[key] = type(default)(value)
+
+register_config('context', update_context_defaults)

pwnlib/data/__init__.py

@@ -0,0 +1,12 @@
+from __future__ import absolute_import
+
+try:
+    # These files are not distributed with Pwntools, but
+    # are in the source tree and used for testing.
+    from pwnlib.data import elf
+except ImportError:
+    pass
+
+import os
+path = os.path.dirname(__file__)
+

pwnlib/data/crcsums.txt

@@ -4,75 +4,102 @@
 # At the time of download, that page was available under the GPLv3 license, which can found here:
 # https://www.gnu.org/licenses/gpl.html
 #
-crc.cat-bits.3 width=3  poly=0x3  init=0x7  refin=true  refout=true  xorout=0x0  check=0x6  name="CRC-3/ROHC"
-crc.cat-bits.4 width=4  poly=0x3  init=0x0  refin=true  refout=true  xorout=0x0  check=0x7  name="CRC-4/ITU"
-crc.cat-bits.5 width=5  poly=0x09  init=0x09  refin=false  refout=false  xorout=0x00  check=0x00  name="CRC-5/EPC"
-crc.cat.crc-5-itu width=5  poly=0x15  init=0x00  refin=true  refout=true  xorout=0x00  check=0x07  name="CRC-5/ITU"
-crc.cat.crc-5-usb width=5  poly=0x05  init=0x1f  refin=true  refout=true  xorout=0x1f  check=0x19  name="CRC-5/USB"
-crc.cat-bits.6 width=6  poly=0x27  init=0x3f  refin=false  refout=false  xorout=0x00  check=0x0d  name="CRC-6/CDMA2000-A"
-crc.cat.crc-6-cdma2000-b width=6  poly=0x07  init=0x3f  refin=false  refout=false  xorout=0x00  check=0x3b  name="CRC-6/CDMA2000-B"
-crc.cat.crc-6-darc width=6  poly=0x19  init=0x00  refin=true  refout=true  xorout=0x00  check=0x26  name="CRC-6/DARC"
-crc.cat.crc-6-itu width=6  poly=0x03  init=0x00  refin=true  refout=true  xorout=0x00  check=0x06  name="CRC-6/ITU"
-crc.cat-bits.7 width=7  poly=0x09  init=0x00  refin=false  refout=false  xorout=0x00  check=0x75  name="CRC-7"
-crc.cat.crc-7-rohc width=7  poly=0x4f  init=0x7f  refin=true  refout=true  xorout=0x00  check=0x53  name="CRC-7/ROHC"
-crc.cat-bits.8 width=8  poly=0x07  init=0x00  refin=false  refout=false  xorout=0x00  check=0xf4  name="CRC-8"
-crc.cat.crc-8-cdma2000 width=8  poly=0x9b  init=0xff  refin=false  refout=false  xorout=0x00  check=0xda  name="CRC-8/CDMA2000"
-crc.cat.crc-8-darc width=8  poly=0x39  init=0x00  refin=true  refout=true  xorout=0x00  check=0x15  name="CRC-8/DARC"
-crc.cat.crc-8-dvb-s2 width=8  poly=0xd5  init=0x00  refin=false  refout=false  xorout=0x00  check=0xbc  name="CRC-8/DVB-S2"
-crc.cat.crc-8-ebu width=8  poly=0x1d  init=0xff  refin=true  refout=true  xorout=0x00  check=0x97  name="CRC-8/EBU"
-crc.cat.crc-8-i-code width=8  poly=0x1d  init=0xfd  refin=false  refout=false  xorout=0x00  check=0x7e  name="CRC-8/I-CODE"
-crc.cat.crc-8-itu width=8  poly=0x07  init=0x00  refin=false  refout=false  xorout=0x55  check=0xa1  name="CRC-8/ITU"
-crc.cat.crc-8-maxim width=8  poly=0x31  init=0x00  refin=true  refout=true  xorout=0x00  check=0xa1  name="CRC-8/MAXIM"
-crc.cat.crc-8-rohc width=8  poly=0x07  init=0xff  refin=true  refout=true  xorout=0x00  check=0xd0  name="CRC-8/ROHC"
-crc.cat.crc-8-wdcma width=8  poly=0x9b  init=0x00  refin=true  refout=true  xorout=0x00  check=0x25  name="CRC-8/WCDMA"
-crc.cat-bits.10 width=10  poly=0x233  init=0x000  refin=false  refout=false  xorout=0x000  check=0x199  name="CRC-10"
-crc.cat.crc-10-cdma2000 width=10  poly=0x3d9  init=0x3ff  refin=false  refout=false  xorout=0x000  check=0x233  name="CRC-10/CDMA2000"
-crc.cat-bits.11 width=11  poly=0x385  init=0x01a  refin=false  refout=false  xorout=0x000  check=0x5a3  name="CRC-11"
-crc.cat-bits.12 width=12  poly=0x80f  init=0x000  refin=false  refout=true  xorout=0x000  check=0xdaf  name="CRC-12/3GPP"
-crc.cat.crc-12-cdma2000 width=12  poly=0xf13  init=0xfff  refin=false  refout=false  xorout=0x000  check=0xd4d  name="CRC-12/CDMA2000"
-crc.cat.crc-12-dect width=12  poly=0x80f  init=0x000  refin=false  refout=false  xorout=0x000  check=0xf5b  name="CRC-12/DECT"
-crc.cat-bits.13 width=13  poly=0x1cf5  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x04fa  name="CRC-13/BBC"
-crc.cat-bits.14 width=14  poly=0x0805  init=0x0000  refin=true  refout=true  xorout=0x0000  check=0x082d  name="CRC-14/DARC"
-crc.cat-bits.15 width=15  poly=0x4599  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x059e  name="CRC-15"
-crc.cat.crc-15-mpt1327 width=15  poly=0x6815  init=0x0000  refin=false  refout=false  xorout=0x0001  check=0x2566  name="CRC-15/MPT1327"
-crc.cat-bits.16 width=16  poly=0x8005  init=0x0000  refin=true  refout=true  xorout=0x0000  check=0xbb3d  name="ARC"
-crc.cat.crc-16-aug-ccitt width=16  poly=0x1021  init=0x1d0f  refin=false  refout=false  xorout=0x0000  check=0xe5cc  name="CRC-16/AUG-CCITT"
-crc.cat.crc-16-buypass width=16  poly=0x8005  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0xfee8  name="CRC-16/BUYPASS"
-crc.cat.crc-16-ccitt-false width=16  poly=0x1021  init=0xffff  refin=false  refout=false  xorout=0x0000  check=0x29b1  name="CRC-16/CCITT-FALSE"
-crc.cat.crc-16-cdma2000 width=16  poly=0xc867  init=0xffff  refin=false  refout=false  xorout=0x0000  check=0x4c06  name="CRC-16/CDMA2000"
-crc.cat.crc-16-dds-110 width=16  poly=0x8005  init=0x800d  refin=false  refout=false  xorout=0x0000  check=0x9ecf  name="CRC-16/DDS-110"
-crc.cat.crc-16-dect-r width=16  poly=0x0589  init=0x0000  refin=false  refout=false  xorout=0x0001  check=0x007e  name="CRC-16/DECT-R"
-crc.cat.crc-16-dect-x width=16  poly=0x0589  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x007f  name="CRC-16/DECT-X"
-crc.cat.crc-16-dnp width=16  poly=0x3d65  init=0x0000  refin=true  refout=true  xorout=0xffff  check=0xea82  name="CRC-16/DNP"
-crc.cat.crc-16-en-13757 width=16  poly=0x3d65  init=0x0000  refin=false  refout=false  xorout=0xffff  check=0xc2b7  name="CRC-16/EN-13757"
-crc.cat.crc-16-genibus width=16  poly=0x1021  init=0xffff  refin=false  refout=false  xorout=0xffff  check=0xd64e  name="CRC-16/GENIBUS"
-crc.cat.crc-16-maxim width=16  poly=0x8005  init=0x0000  refin=true  refout=true  xorout=0xffff  check=0x44c2  name="CRC-16/MAXIM"
-crc.cat.crc-16-mcrf4xx width=16  poly=0x1021  init=0xffff  refin=true  refout=true  xorout=0x0000  check=0x6f91  name="CRC-16/MCRF4XX"
-crc.cat.crc-16-riello width=16  poly=0x1021  init=0xb2aa  refin=true  refout=true  xorout=0x0000  check=0x63d0  name="CRC-16/RIELLO"
-crc.cat.crc-16-t10-dif width=16  poly=0x8bb7  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0xd0db  name="CRC-16/T10-DIF"
-crc.cat.crc-16-teledisk width=16  poly=0xa097  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x0fb3  name="CRC-16/TELEDISK"
-crc.cat.crc-16-tms37157 width=16  poly=0x1021  init=0x89ec  refin=true  refout=true  xorout=0x0000  check=0x26b1  name="CRC-16/TMS37157"
-crc.cat.crc-16-usb width=16  poly=0x8005  init=0xffff  refin=true  refout=true  xorout=0xffff  check=0xb4c8  name="CRC-16/USB"
-crc.cat.crc-a width=16  poly=0x1021  init=0xc6c6  refin=true  refout=true  xorout=0x0000  check=0xbf05  name="CRC-A"
-crc.cat.kermit width=16  poly=0x1021  init=0x0000  refin=true  refout=true  xorout=0x0000  check=0x2189  name="KERMIT"
-crc.cat.modbus width=16  poly=0x8005  init=0xffff  refin=true  refout=true  xorout=0x0000  check=0x4b37  name="MODBUS"
-crc.cat.x-25 width=16  poly=0x1021  init=0xffff  refin=true  refout=true  xorout=0xffff  check=0x906e  name="X-25"
-crc.cat.xmodem width=16  poly=0x1021  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x31c3  name="XMODEM"
-crc.cat-bits.24 width=24  poly=0x864cfb  init=0xb704ce  refin=false  refout=false  xorout=0x000000  check=0x21cf02  name="CRC-24"
-crc.cat.crc-24-flexray-a width=24  poly=0x5d6dcb  init=0xfedcba  refin=false  refout=false  xorout=0x000000  check=0x7979bd  name="CRC-24/FLEXRAY-A"
-crc.cat.crc-24-flexray-b width=24  poly=0x5d6dcb  init=0xabcdef  refin=false  refout=false  xorout=0x000000  check=0x1f23b8  name="CRC-24/FLEXRAY-B"
-crc.cat-bits.31 width=31  poly=0x04c11db7  init=0x7fffffff  refin=false  refout=false  xorout=0x7fffffff  check=0x0ce9e46c  name="CRC-31/PHILIPS"
-crc.cat-bits.32 width=32  poly=0x04c11db7  init=0xffffffff  refin=true  refout=true  xorout=0xffffffff  check=0xcbf43926  name="CRC-32"
-crc.cat.crc-32-bzip2 width=32  poly=0x04c11db7  init=0xffffffff  refin=false  refout=false  xorout=0xffffffff  check=0xfc891918  name="CRC-32/BZIP2"
-crc.cat.crc-32c width=32  poly=0x1edc6f41  init=0xffffffff  refin=true  refout=true  xorout=0xffffffff  check=0xe3069283  name="CRC-32C"
-crc.cat.crc-32d width=32  poly=0xa833982b  init=0xffffffff  refin=true  refout=true  xorout=0xffffffff  check=0x87315576  name="CRC-32D"
-crc.cat.crc-32-mpeg-2 width=32  poly=0x04c11db7  init=0xffffffff  refin=false  refout=false  xorout=0x00000000  check=0x0376e6e7  name="CRC-32/MPEG-2"
-crc.cat.crc-32-posix width=32  poly=0x04c11db7  init=0x00000000  refin=false  refout=false  xorout=0xffffffff  check=0x765e7680  name="CRC-32/POSIX"
-crc.cat.crc-32q width=32  poly=0x814141ab  init=0x00000000  refin=false  refout=false  xorout=0x00000000  check=0x3010bf7f  name="CRC-32Q"
-crc.cat.jamcrc width=32  poly=0x04c11db7  init=0xffffffff  refin=true  refout=true  xorout=0x00000000  check=0x340bc6d9  name="JAMCRC"
-crc.cat.xfer width=32  poly=0x000000af  init=0x00000000  refin=false  refout=false  xorout=0x00000000  check=0xbd0be338  name="XFER"
-crc.cat-bits.40 width=40  poly=0x0004820009  init=0x0000000000  refin=false  refout=false  xorout=0xffffffffff  check=0xd4164fc646  name="CRC-40/GSM"
-crc.cat-bits.64 width=64  poly=0x42f0e1eba9ea3693  init=0x0000000000000000  refin=false  refout=false  xorout=0x0000000000000000  check=0x6c40df5f0b497347  name="CRC-64"
-crc.cat.crc-64-we width=64  poly=0x42f0e1eba9ea3693  init=0xffffffffffffffff  refin=false  refout=false  xorout=0xffffffffffffffff  check=0x62ec59e3f1a4f00a  name="CRC-64/WE"
-crc.cat.crc-64-xz width=64  poly=0x42f0e1eba9ea3693  init=0xffffffffffffffff  refin=true  refout=true  xorout=0xffffffffffffffff  check=0x995dc9bbdf1939fa  name="CRC-64/XZ"
-crc.cat-bits.82 width=82  poly=0x0308c0111011401440411  init=0x000000000000000000000  refin=true  refout=true  xorout=0x000000000000000000000  check=0x09ea83f625023801fd612  name="CRC-82/DARC"
+crc.cat.crc-3-rohc width=3  poly=0x3  init=0x7  refin=true  refout=true  xorout=0x0  check=0x6  residue=0x0  name="CRC-3/ROHC"
+crc.cat-bits.3 width=3  poly=0x3  init=0x0  refin=false  refout=false  xorout=0x7  check=0x4  residue=0x2  name="CRC-3/GSM"
+crc.cat-bits.4 width=4  poly=0x3  init=0xf  refin=false  refout=false  xorout=0xf  check=0xb  residue=0x2  name="CRC-4/INTERLAKEN"
+crc.cat.crc-4-itu width=4  poly=0x3  init=0x0  refin=true  refout=true  xorout=0x0  check=0x7  residue=0x0  name="CRC-4/ITU"
+crc.cat-bits.5 width=5  poly=0x09  init=0x09  refin=false  refout=false  xorout=0x00  check=0x00  residue=0x00  name="CRC-5/EPC"
+crc.cat.crc-5-itu width=5  poly=0x15  init=0x00  refin=true  refout=true  xorout=0x00  check=0x07  residue=0x00  name="CRC-5/ITU"
+crc.cat.crc-5-usb width=5  poly=0x05  init=0x1f  refin=true  refout=true  xorout=0x1f  check=0x19  residue=0x06  name="CRC-5/USB"
+crc.cat-bits.6 width=6  poly=0x27  init=0x3f  refin=false  refout=false  xorout=0x00  check=0x0d  residue=0x00  name="CRC-6/CDMA2000-A"
+crc.cat.crc-6-cdma2000-b width=6  poly=0x07  init=0x3f  refin=false  refout=false  xorout=0x00  check=0x3b  residue=0x00  name="CRC-6/CDMA2000-B"
+crc.cat.crc-6-darc width=6  poly=0x19  init=0x00  refin=true  refout=true  xorout=0x00  check=0x26  residue=0x00  name="CRC-6/DARC"
+crc.cat.crc-6-gsm width=6  poly=0x2f  init=0x00  refin=false  refout=false  xorout=0x3f  check=0x13  residue=0x3a  name="CRC-6/GSM"
+crc.cat.crc-6-itu width=6  poly=0x03  init=0x00  refin=true  refout=true  xorout=0x00  check=0x06  residue=0x00  name="CRC-6/ITU"
+crc.cat-bits.7 width=7  poly=0x09  init=0x00  refin=false  refout=false  xorout=0x00  check=0x75  residue=0x00  name="CRC-7"
+crc.cat.crc-7-rohc width=7  poly=0x4f  init=0x7f  refin=true  refout=true  xorout=0x00  check=0x53  residue=0x00  name="CRC-7/ROHC"
+crc.cat.crc-7-umts width=7  poly=0x45  init=0x00  refin=false  refout=false  xorout=0x00  check=0x61  residue=0x00  name="CRC-7/UMTS"
+crc.cat-bits.8 width=8  poly=0x07  init=0x00  refin=false  refout=false  xorout=0x00  check=0xf4  residue=0x00  name="CRC-8"
+crc.cat.crc-8-autosar width=8  poly=0x2f  init=0xff  refin=false  refout=false  xorout=0xff  check=0xdf  residue=0x42  name="CRC-8/AUTOSAR"
+crc.cat.crc-8-cdma2000 width=8  poly=0x9b  init=0xff  refin=false  refout=false  xorout=0x00  check=0xda  residue=0x00  name="CRC-8/CDMA2000"
+crc.cat.crc-8-darc width=8  poly=0x39  init=0x00  refin=true  refout=true  xorout=0x00  check=0x15  residue=0x00  name="CRC-8/DARC"
+crc.cat.crc-8-dvb-s2 width=8  poly=0xd5  init=0x00  refin=false  refout=false  xorout=0x00  check=0xbc  residue=0x00  name="CRC-8/DVB-S2"
+crc.cat.crc-8-ebu width=8  poly=0x1d  init=0xff  refin=true  refout=true  xorout=0x00  check=0x97  residue=0x00  name="CRC-8/EBU"
+crc.cat.crc-8-gsm-a width=8  poly=0x1d  init=0x00  refin=false  refout=false  xorout=0x00  check=0x37  residue=0x00  name="CRC-8/GSM-A"
+crc.cat.crc-8-gsm-b width=8  poly=0x49  init=0x00  refin=false  refout=false  xorout=0xff  check=0x94  residue=0x53  name="CRC-8/GSM-B"
+crc.cat.crc-8-i-code width=8  poly=0x1d  init=0xfd  refin=false  refout=false  xorout=0x00  check=0x7e  residue=0x00  name="CRC-8/I-CODE"
+crc.cat.crc-8-itu width=8  poly=0x07  init=0x00  refin=false  refout=false  xorout=0x55  check=0xa1  residue=0xac  name="CRC-8/ITU"
+crc.cat.crc-8-lte width=8  poly=0x9b  init=0x00  refin=false  refout=false  xorout=0x00  check=0xea  residue=0x00  name="CRC-8/LTE"
+crc.cat.crc-8-maxim width=8  poly=0x31  init=0x00  refin=true  refout=true  xorout=0x00  check=0xa1  residue=0x00  name="CRC-8/MAXIM"
+crc.cat.crc-8-opensafety width=8  poly=0x2f  init=0x00  refin=false  refout=false  xorout=0x00  check=0x3e  residue=0x00  name="CRC-8/OPENSAFETY"
+crc.cat.crc-8-rohc width=8  poly=0x07  init=0xff  refin=true  refout=true  xorout=0x00  check=0xd0  residue=0x00  name="CRC-8/ROHC"
+crc.cat.crc-8-sae-j1850 width=8  poly=0x1d  init=0xff  refin=false  refout=false  xorout=0xff  check=0x4b  residue=0xc4  name="CRC-8/SAE-J1850"
+crc.cat.crc-8-wdcma width=8  poly=0x9b  init=0x00  refin=true  refout=true  xorout=0x00  check=0x25  residue=0x00  name="CRC-8/WCDMA"
+crc.cat-bits.10 width=10  poly=0x233  init=0x000  refin=false  refout=false  xorout=0x000  check=0x199  residue=0x000  name="CRC-10"
+crc.cat.crc-10-cdma2000 width=10  poly=0x3d9  init=0x3ff  refin=false  refout=false  xorout=0x000  check=0x233  residue=0x000  name="CRC-10/CDMA2000"
+crc.cat.crc-10-gsm width=10  poly=0x175  init=0x000  refin=false  refout=false  xorout=0x3ff  check=0x12a  residue=0x0c6  name="CRC-10/GSM"
+crc.cat-bits.11 width=11  poly=0x385  init=0x01a  refin=false  refout=false  xorout=0x000  check=0x5a3  residue=0x000  name="CRC-11"
+crc.cat.crc-11-umts width=11  poly=0x307  init=0x000  refin=false  refout=false  xorout=0x000  check=0x061  residue=0x000  name="CRC-11/UMTS"
+crc.cat-bits.12 width=12  poly=0xf13  init=0xfff  refin=false  refout=false  xorout=0x000  check=0xd4d  residue=0x000  name="CRC-12/CDMA2000"
+crc.cat.crc-12-dect width=12  poly=0x80f  init=0x000  refin=false  refout=false  xorout=0x000  check=0xf5b  residue=0x000  name="CRC-12/DECT"
+crc.cat.crc-12-gsm width=12  poly=0xd31  init=0x000  refin=false  refout=false  xorout=0xfff  check=0xb34  residue=0x178  name="CRC-12/GSM"
+crc.cat.crc-12-umts width=12  poly=0x80f  init=0x000  refin=false  refout=true  xorout=0x000  check=0xdaf  residue=0x000  name="CRC-12/UMTS"
+crc.cat-bits.13 width=13  poly=0x1cf5  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x04fa  residue=0x0000  name="CRC-13/BBC"
+crc.cat-bits.14 width=14  poly=0x0805  init=0x0000  refin=true  refout=true  xorout=0x0000  check=0x082d  residue=0x0000  name="CRC-14/DARC"
+crc.cat.crc-14-gsm width=14  poly=0x202d  init=0x0000  refin=false  refout=false  xorout=0x3fff  check=0x30ae  residue=0x031e  name="CRC-14/GSM"
+crc.cat-bits.15 width=15  poly=0x4599  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x059e  residue=0x0000  name="CRC-15"
+crc.cat.crc-15-mpt1327 width=15  poly=0x6815  init=0x0000  refin=false  refout=false  xorout=0x0001  check=0x2566  residue=0x6815  name="CRC-15/MPT1327"
+crc.cat-bits.16 width=16  poly=0x8005  init=0x0000  refin=true  refout=true  xorout=0x0000  check=0xbb3d  residue=0x0000  name="ARC"
+crc.cat.crc-16-aug-ccitt width=16  poly=0x1021  init=0x1d0f  refin=false  refout=false  xorout=0x0000  check=0xe5cc  residue=0x0000  name="CRC-16/AUG-CCITT"
+crc.cat.crc-16-buypass width=16  poly=0x8005  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0xfee8  residue=0x0000  name="CRC-16/BUYPASS"
+crc.cat.crc-16-ccitt-false width=16  poly=0x1021  init=0xffff  refin=false  refout=false  xorout=0x0000  check=0x29b1  residue=0x0000  name="CRC-16/CCITT-FALSE"
+crc.cat.crc-16-cdma2000 width=16  poly=0xc867  init=0xffff  refin=false  refout=false  xorout=0x0000  check=0x4c06  residue=0x0000  name="CRC-16/CDMA2000"
+crc.cat.crc-16-cms width=16  poly=0x8005  init=0xffff  refin=false  refout=false  xorout=0x0000  check=0xaee7  residue=0x0000  name="CRC-16/CMS"
+crc.cat.crc-16-dds-110 width=16  poly=0x8005  init=0x800d  refin=false  refout=false  xorout=0x0000  check=0x9ecf  residue=0x0000  name="CRC-16/DDS-110"
+crc.cat.crc-16-dect-r width=16  poly=0x0589  init=0x0000  refin=false  refout=false  xorout=0x0001  check=0x007e  residue=0x0589  name="CRC-16/DECT-R"
+crc.cat.crc-16-dect-x width=16  poly=0x0589  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x007f  residue=0x0000  name="CRC-16/DECT-X"
+crc.cat.crc-16-dnp width=16  poly=0x3d65  init=0x0000  refin=true  refout=true  xorout=0xffff  check=0xea82  residue=0x66c5  name="CRC-16/DNP"
+crc.cat.crc-16-en-13757 width=16  poly=0x3d65  init=0x0000  refin=false  refout=false  xorout=0xffff  check=0xc2b7  residue=0xa366  name="CRC-16/EN-13757"
+crc.cat.crc-16-genibus width=16  poly=0x1021  init=0xffff  refin=false  refout=false  xorout=0xffff  check=0xd64e  residue=0x1d0f  name="CRC-16/GENIBUS"
+crc.cat.crc-16-gsm width=16  poly=0x1021  init=0x0000  refin=false  refout=false  xorout=0xffff  check=0xce3c  residue=0x1d0f  name="CRC-16/GSM"
+crc.cat.crc-16-lj1200 width=16  poly=0x6f63  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0xbdf4  residue=0x0000  name="CRC-16/LJ1200"
+crc.cat.crc-16-maxim width=16  poly=0x8005  init=0x0000  refin=true  refout=true  xorout=0xffff  check=0x44c2  residue=0xb001  name="CRC-16/MAXIM"
+crc.cat.crc-16-mcrf4xx width=16  poly=0x1021  init=0xffff  refin=true  refout=true  xorout=0x0000  check=0x6f91  residue=0x0000  name="CRC-16/MCRF4XX"
+crc.cat.crc-16-opensafety-a width=16  poly=0x5935  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x5d38  residue=0x0000  name="CRC-16/OPENSAFETY-A"
+crc.cat.crc-16-opensafety-a width=16  poly=0x755b  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x20fe  residue=0x0000  name="CRC-16/OPENSAFETY-B"
+crc.cat.crc-16-profibus width=16  poly=0x1dcf  init=0xffff  refin=false  refout=false  xorout=0xffff  check=0xa819  residue=0xe394  name="CRC-16/PROFIBUS"
+crc.cat.crc-16-riello width=16  poly=0x1021  init=0xb2aa  refin=true  refout=true  xorout=0x0000  check=0x63d0  residue=0x0000  name="CRC-16/RIELLO"
+crc.cat.crc-16-t10-dif width=16  poly=0x8bb7  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0xd0db  residue=0x0000  name="CRC-16/T10-DIF"
+crc.cat.crc-16-teledisk width=16  poly=0xa097  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x0fb3  residue=0x0000  name="CRC-16/TELEDISK"
+crc.cat.crc-16-tms37157 width=16  poly=0x1021  init=0x89ec  refin=true  refout=true  xorout=0x0000  check=0x26b1  residue=0x0000  name="CRC-16/TMS37157"
+crc.cat.crc-16-usb width=16  poly=0x8005  init=0xffff  refin=true  refout=true  xorout=0xffff  check=0xb4c8  residue=0xb001  name="CRC-16/USB"
+crc.cat.crc-a width=16  poly=0x1021  init=0xc6c6  refin=true  refout=true  xorout=0x0000  check=0xbf05  residue=0x0000  name="CRC-A"
+crc.cat.kermit width=16  poly=0x1021  init=0x0000  refin=true  refout=true  xorout=0x0000  check=0x2189  residue=0x0000  name="KERMIT"
+crc.cat.modbus width=16  poly=0x8005  init=0xffff  refin=true  refout=true  xorout=0x0000  check=0x4b37  residue=0x0000  name="MODBUS"
+crc.cat.x-25 width=16  poly=0x1021  init=0xffff  refin=true  refout=true  xorout=0xffff  check=0x906e  residue=0xf0b8  name="X-25"
+crc.cat.xmodem width=16  poly=0x1021  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x31c3  residue=0x0000  name="XMODEM"
+crc.cat-bits.24 width=24  poly=0x864cfb  init=0xb704ce  refin=false  refout=false  xorout=0x000000  check=0x21cf02  residue=0x000000  name="CRC-24"
+crc.cat.crc-24-ble width=24  poly=0x00065b  init=0x555555  refin=true  refout=true  xorout=0x000000  check=0xc25a56  residue=0x000000  name="CRC-24/BLE"
+crc.cat.crc-24-flexray-a width=24  poly=0x5d6dcb  init=0xfedcba  refin=false  refout=false  xorout=0x000000  check=0x7979bd  residue=0x000000  name="CRC-24/FLEXRAY-A"
+crc.cat.crc-24-flexray-b width=24  poly=0x5d6dcb  init=0xabcdef  refin=false  refout=false  xorout=0x000000  check=0x1f23b8  residue=0x000000  name="CRC-24/FLEXRAY-B"
+crc.cat.crc-24-interlaken width=24  poly=0x328b63  init=0xffffff  refin=false  refout=false  xorout=0xffffff  check=0xb4f3e6  residue=0x144e63  name="CRC-24/INTERLAKEN"
+crc.cat.crc-24-lte-a width=24  poly=0x864cfb  init=0x000000  refin=false  refout=false  xorout=0x000000  check=0xcde703  residue=0x000000  name="CRC-24/LTE-A"
+crc.cat.crc-24-lte-b width=24  poly=0x800063  init=0x000000  refin=false  refout=false  xorout=0x000000  check=0x23ef52  residue=0x000000  name="CRC-24/LTE-B"
+crc.cat-bits.30 width=30  poly=0x2030b9c7  init=0x3fffffff  refin=false  refout=false  xorout=0x3fffffff  check=0x04c34abf  residue=0x34efa55a  name="CRC-30/CDMA"
+crc.cat-bits.31 width=31  poly=0x04c11db7  init=0x7fffffff  refin=false  refout=false  xorout=0x7fffffff  check=0x0ce9e46c  residue=0x4eaf26f1  name="CRC-31/PHILIPS"
+crc.cat-bits.32 width=32  poly=0x04c11db7  init=0xffffffff  refin=true  refout=true  xorout=0xffffffff  check=0xcbf43926  residue=0xdebb20e3  name="CRC-32"
+crc.cat.crc-32-autosar width=32  poly=0xf4acfb13  init=0xffffffff  refin=true  refout=true  xorout=0xffffffff  check=0x1697d06a  residue=0x904cddbf  name="CRC-32/AUTOSAR"
+crc.cat.crc-32-bzip2 width=32  poly=0x04c11db7  init=0xffffffff  refin=false  refout=false  xorout=0xffffffff  check=0xfc891918  residue=0xc704dd7b  name="CRC-32/BZIP2"
+crc.cat.crc-32c width=32  poly=0x1edc6f41  init=0xffffffff  refin=true  refout=true  xorout=0xffffffff  check=0xe3069283  residue=0xb798b438  name="CRC-32C"
+crc.cat.crc-32d width=32  poly=0xa833982b  init=0xffffffff  refin=true  refout=true  xorout=0xffffffff  check=0x87315576  residue=0x45270551  name="CRC-32D"
+crc.cat.crc-32-mpeg-2 width=32  poly=0x04c11db7  init=0xffffffff  refin=false  refout=false  xorout=0x00000000  check=0x0376e6e7  residue=0x00000000  name="CRC-32/MPEG-2"
+crc.cat.crc-32-posix width=32  poly=0x04c11db7  init=0x00000000  refin=false  refout=false  xorout=0xffffffff  check=0x765e7680  residue=0xc704dd7b  name="CRC-32/POSIX"
+crc.cat.crc-32q width=32  poly=0x814141ab  init=0x00000000  refin=false  refout=false  xorout=0x00000000  check=0x3010bf7f  residue=0x00000000  name="CRC-32Q"
+crc.cat.jamcrc width=32  poly=0x04c11db7  init=0xffffffff  refin=true  refout=true  xorout=0x00000000  check=0x340bc6d9  residue=0x00000000  name="JAMCRC"
+crc.cat.xfer width=32  poly=0x000000af  init=0x00000000  refin=false  refout=false  xorout=0x00000000  check=0xbd0be338  residue=0x00000000  name="XFER"
+crc.cat-bits.40 width=40  poly=0x0004820009  init=0x0000000000  refin=false  refout=false  xorout=0xffffffffff  check=0xd4164fc646  residue=0xc4ff8071ff  name="CRC-40/GSM"
+crc.cat-bits.64 width=64  poly=0x42f0e1eba9ea3693  init=0x0000000000000000  refin=false  refout=false  xorout=0x0000000000000000  check=0x6c40df5f0b497347  residue=0x0000000000000000  name="CRC-64"
+crc.cat.crc-64-go-iso width=64  poly=0x000000000000001b  init=0xffffffffffffffff  refin=true  refout=true  xorout=0xffffffffffffffff  check=0xb90956c775a41001  residue=0x5300000000000000  name="CRC-64/GO-ISO"
+crc.cat.crc-64-we width=64  poly=0x42f0e1eba9ea3693  init=0xffffffffffffffff  refin=false  refout=false  xorout=0xffffffffffffffff  check=0x62ec59e3f1a4f00a  residue=0xfcacbebd5931a992  name="CRC-64/WE"
+crc.cat.crc-64-xz width=64  poly=0x42f0e1eba9ea3693  init=0xffffffffffffffff  refin=true  refout=true  xorout=0xffffffffffffffff  check=0x995dc9bbdf1939fa  residue=0x49958c9abd7d353f  name="CRC-64/XZ"
+crc.cat-bits.82 width=82  poly=0x0308c0111011401440411  init=0x000000000000000000000  refin=true  refout=true  xorout=0x000000000000000000000  check=0x09ea83f625023801fd612  residue=0x000000000000000000000  name="CRC-82/DARC"

pwnlib/data/elf/__init__.py

@@ -0,0 +1,8 @@
+from __future__ import absolute_import
+from pwnlib.data.elf import relro
+
+import os
+path = os.path.dirname(__file__)
+
+def get(x):
+    return os.path.join(path, x)

pwnlib/data/elf/relro/__init__.py

@@ -0,0 +1,5 @@
+import os
+path = os.path.dirname(__file__)
+
+def get(x):
+    return os.path.join(path, x)