Release 3.9.2

This causes a background instance to be spawned, which is not intended.

.github/ISSUE_TEMPLATE.md

@@ -4,6 +4,11 @@ Thanks for contributing to Pwntools!
 
 When reporting an issue, be sure that you are running the latest released version of pwntools (`pip install --upgrade pwntools`).
 
-Please verify that your issue occurs on 64-bit Ubuntu 14.04.  You can use the Dockerfile in `extra/docker/Dockerfile` to save time.
+Please verify that your issue occurs on 64-bit Ubuntu 14.04.  You can use the Dockerfile on `docker.io` for quick testing.
+
+```
+$ docker pull pwntools/pwntools:stable
+$ docker run -it pwntools/pwntools:stable
+```
 
 If possible, provide a proof-of-concept which demonstrates the problem.  Include any binaries or scripts necessary to reproduce the issue, and please include the full debug output via setting the environment variable `PWNLIB_DEBUG=1`.

.travis.yml

@@ -1,10 +1,9 @@
-sudo: false
+dist: precise
 language: python
 addons:
   apt:
     packages:
     - gcc-multilib
-    - gcc-4.6-arm-linux-gnueabihf
     - lib32stdc++6
     - ash
     - bash
@@ -18,8 +17,8 @@ cache:
     - pip
     - directories:
         - usr
-        - /home/travis/virtualenv/python2.7.9/lib/python2.7/site-packages/
-        - /home/travis/virtualenv/python2.7.9/bin/
+        - /home/travis/virtualenv/python2.7.13/lib/python2.7/site-packages/
+        - /home/travis/virtualenv/python2.7.13/bin/
 python:
   - "2.7"
 before_install:

CHANGELOG.md

@@ -9,9 +9,17 @@ The table below shows which release corresponds to each branch, and what date th
 
 | Version          | Branch   | Release Date           |
 | ---------------- | -------- | ---------------------- |
-| [3.7.0](#350)    | `dev`    | Jun 17, 2017 (planned)
-| [3.6.0](#350)    | `beta`   | May 6, 2017 (planned)
-| [3.5.1](#351)    | `stable` | Apr 15, 2017
+| [3.11.0](#3110)  | `dev`    | Dec 2, 2017 (planned)
+| [3.10.0](#3100)  | `beta`   | Oct 21, 2017 (planned)
+| [3.9.2](#392)    | `stable` | Oct 5, 2017
+| [3.9.1](#391)    |          | Sep 28, 2017
+| [3.9.0](#390)    |          | Sep 11, 2017
+| [3.8.0](#380)    |          | Jul 29, 2017
+| [3.7.1](#371)    |          | Jul 14, 2017
+| [3.7.0](#370)    |          | Jun 19, 2017
+| [3.6.1](#361)    |          | May 12, 2017
+| [3.6.0](#360)    |          | May 8, 2017
+| [3.5.1](#351)    |          | Apr 15, 2017
 | [3.5.0](#350)    |          | Mar 26, 2017
 | [3.4.1](#341)    |          | Feb 17, 2017
 | [3.4.0](#340)    |          | Feb 13, 2017
@@ -31,14 +39,78 @@ The table below shows which release corresponds to each branch, and what date th
 | [3.0.0](#300)    |          | Aug 20, 2016
 | [2.2.0](#220)    |          | Jan 5, 2015
 
+## 3.11.0
+
+To be released on Dec 2, 2017.
+
+## 3.10.0
+
+To be released on Oct 21, 2017.
+
+## 3.9.2
+
+- [#1043][1043] Do not attempt to populate the libraries used by statically-linked binaries
+
+[1043]: https://github.com/Gallopsled/pwntools/pull/1043
+
+## 3.9.1
+
+- [#1038][1038] Fix an issue with `process()` where glibc would buffer data internally, causing a hang on `select()`
+- [#1036][1036] Fix Travis CI logging verbosity
+- [#1029][1029] Fix some `unicode` issues when using the `readline` command history in `tube.interactive()`
+
+[1038]: https://github.com/Gallopsled/pwntools/pull/1038
+[1036]: https://github.com/Gallopsled/pwntools/pull/1036
+[1029]: https://github.com/Gallopsled/pwntools/pull/1029
+
+## 3.9.0
+
+- [#1003][1003] Make `concat_all` faster while also simplifying it's logic
+- [#1014][1014] Fix for overwritten env when parsing core file
+- [#1023][1023] Fixes to Travis CI
+
+[1003]: https://github.com/Gallopsled/pwntools/pull/1003
+[1014]: https://github.com/Gallopsled/pwntools/pull/1014
+[1023]: https://github.com/Gallopsled/pwntools/pull/1023
+
+## 3.8.0
+
+- [#981][981] Fixed RELRO detection logic
+- [#986][986] Enhancements to DynELF for controlling usage of LibcDB
+- A few documentation fixes
+- A few fixes for the Docker image
+
+[981]: https://github.com/Gallopsled/pwntools/pull/981
+[986]: https://github.com/Gallopsled/pwntools/pull/986
+
+## 3.7.1
+
+- [#998][998] Fix a bug where integer values could not be set in `.pwn.conf`.
+
+[998]: https://github.com/Gallopsled/pwntools/pull/998
+
 ## 3.7.0
 
-To be on Jun 17, 2017.
+- [#933][933] DynELF works better with different base addresses
+- [#952][952] A few small fixes were made to `pwn template`, and the CRC database was updated.
+- [5c72d62c][5c72d62c] Updated the CRC database
+
+[933]: https://github.com/Gallopsled/pwntools/pull/933
+[952]: https://github.com/Gallopsled/pwntools/pull/952
+[5c72d62c]: https://github.com/Gallopsled/pwntools/commit/5c72d62c
+
+## 3.6.1
+
+- [#979][979]+[1a4a1e1][1a4a1e1] Fixed [#974][974], a bug related to the terminal handling and numlock.
+- [#980][980] Fixed the `pwn template` command.
+
+[974]: https://github.com/Gallopsled/pwntools/issues/974
+[979]: https://github.com/Gallopsled/pwntools/pull/979
+[980]: https://github.com/Gallopsled/pwntools/pull/980
+[1a4a1e1]: https://github.com/Gallopsled/pwntools/commit/1a4a1e1
 
 ## 3.6.0
 
-To be released on May 6, 2017.
-
 - [#895][895] Added a Dockerfile to simplify testing setup and allow testing on OSX
 - [#897][897] Fixed some incorrect AArch64 syscals
 - [#893][893] Added the `pwnlib.config` module
@@ -51,6 +123,18 @@ To be released on May 6, 2017.
     + More information is available in the documentation [here](http://docs.pwntools.com/en/dev/commandline.html#pwn-debug)
 - [#919][919] Added a `pwn template` command-line utility to simplify the process of bootstrapping a new exploit.
     + More information is available in the documentation [here](http://docs.pwntools.com/en/dev/commandline.html#pwn-template).
+- [#948][948] Fix unnecessary warning for Core files
+- [#954][954] Fix list processing in `~/.pwn.conf`
+- [#967][967] Respect `TERM_PROGRAM` for `run_in_new_terminal`
+- [#970][970] Fix overly-aggressive corefile caching
+
+[947]: https://github.com/Gallopsled/pwntools/pull/947
+[948]: https://github.com/Gallopsled/pwntools/pull/948
+[954]: https://github.com/Gallopsled/pwntools/pull/954
+[960]: https://github.com/Gallopsled/pwntools/pull/960
+[967]: https://github.com/Gallopsled/pwntools/pull/967
+[968]: https://github.com/Gallopsled/pwntools/pull/968
+[970]: https://github.com/Gallopsled/pwntools/pull/970
 
 [895]: https://github.com/Gallopsled/pwntools/pull/895
 [897]: https://github.com/Gallopsled/pwntools/pull/897

MANIFEST.in

@@ -2,6 +2,6 @@ graft examples
 graft extra
 include *.md *.txt *.sh *.yml MANIFEST.in
 recursive-include docs   *.rst *.png Makefile *.py *.txt
-recursive-include pwnlib *.py *.asm *.rst *.md *.txt *.sh __doc__
+recursive-include pwnlib *.py *.asm *.rst *.md *.txt *.sh __doc__ *.mako
 recursive-include pwn    *.py *.asm *.rst *.md *.txt *.sh
 recursive-exclude *.pyc

README.md

@@ -2,13 +2,13 @@
 ![pwntools logo](https://github.com/Gallopsled/pwntools/blob/stable/docs/source/logo.png?raw=true)
 
 [![Docs](https://readthedocs.org/projects/pwntools/badge/?version=stable)](https://docs.pwntools.com/)
-[![PyPI](https://img.shields.io/badge/pypi-v3.5.1-green.svg?style=flat)](https://pypi.python.org/pypi/pwntools/)
+[![PyPI](https://img.shields.io/badge/pypi-v3.9.2-green.svg?style=flat)](https://pypi.python.org/pypi/pwntools/)
 [![Travis](https://travis-ci.org/Gallopsled/pwntools.svg)](https://travis-ci.org/Gallopsled/pwntools)
 [![Coveralls](https://img.shields.io/coveralls/Gallopsled/pwntools/dev.svg)](https://coveralls.io/github/Gallopsled/pwntools?branch=dev)
 [![Twitter](https://img.shields.io/badge/twitter-pwntools-4099FF.svg?style=flat)](https://twitter.com/pwntools)
 [![MIT License](https://img.shields.io/badge/license-MIT-blue.svg?style=flat)](http://choosealicense.com/licenses/mit/)
 
-pwntools is a CTF framework and exploit development library. Written in Python, it is designed for rapid prototyping and development, and intended to make exploit writing as simple as possible.
+Pwntools is a CTF framework and exploit development library. Written in Python, it is designed for rapid prototyping and development, and intended to make exploit writing as simple as possible.
 
 ```python
 from pwn import *
@@ -32,7 +32,7 @@ To get you started, we've provided some example solutions for past CTF challenge
 
 # Installation
 
-pwntools is best supported on 64-bit Ubuntu 12.04 and 14.04, but most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).  Python 2.7 is required.
+Pwntools is best supported on 64-bit Ubuntu LTE releases (12.04, 14.04, and 16.04).  Most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).  Python 2.7 is required.
 
 Most of the functionality of pwntools is self-contained and Python-only.  You should be able to get running quickly with
 

TESTING.md

@@ -4,7 +4,6 @@ Pwntools makes extensive use of unit tests and integration tests to ensure every
 
 ## Test Suite
 
-
 To run the test suite, it is best to use Ubuntu 12.04 or 14.04, and run the following commands.  **Be aware** that this will add a user to the machine, and create a public key for SSH login!
 
 ```sh
@@ -14,6 +13,12 @@ pip install --upgrade --editable .
 PWNLIB_NOTERM=1 make -C docs doctest
 ```
 
+## Testing in Docker
+
+A `Dockerfile` has been provided which has a clean testing environment with Ubuntu Xenial.  It is very similar to the online Travis CI testing environment, but uses a more modern version of Ubuntu.
+
+See `travis/docker/README.md` for more information.
+
 ## New Tests
 
 To add a new test to an existing module, just add an inline doctest.  If the test needs access to an external module, add the import statement to the `testsetup` block in the corresponding file in `docs/source/<module>.rst`.

docs/source/asm.rst

@@ -15,7 +15,7 @@
    :members:
 
 Internal Functions
-=========================================
+-----------------------------------------
 
 These are only included so that their tests are run.
 

docs/source/conf.py

@@ -44,6 +44,23 @@ extensions = [
     'sphinxcontrib.napoleon'
 ]
 
+# Disable "info" logging directly to stdout by Sphinx
+import logging
+
+class SphinxPwnlibFilter(logging.Filter):
+    def filter(self, record):
+        if record.name.startswith('pwn'):
+            return False
+        if record.name.startswith('paramiko'):
+            return False
+        return True
+
+log_filter = SphinxPwnlibFilter()
+
+for i, handler in enumerate(logging.root.handlers):
+    print("Filtering Sphinx handler", handler)
+    handler.addFilter(log_filter)
+
 # Napoleon settings
 napoleon_use_ivar = True
 napoleon_use_rtype = False
@@ -357,5 +374,46 @@ if build_dash:
 
 # -- Customization to Sphinx autodoc generation --------------------------------------------
 import sphinx.ext.autodoc
+from sphinx.util.inspect import safe_getmembers, safe_getattr
 
-sphinx.ext.autodoc
+# Test hidden members (e.g. def _foo(...))
+def dont_skip_any_doctests(app, what, name, obj, skip, options):
+    return False
+
+# Test non-exported members
+class ModuleDocumenter(sphinx.ext.autodoc.ModuleDocumenter):
+    def get_object_members(self, want_all):
+        if want_all:
+            # if not hasattr(self.object, '__all__'):
+            #     for implicit module members, check __module__ to avoid
+            #     documenting imported objects
+                return True, safe_getmembers(self.object)
+            # else:
+            #     memberlist = self.object.__all__
+            #     # Sometimes __all__ is broken...
+            #     if not isinstance(memberlist, (list, tuple)) or not \
+            #        all(isinstance(entry, string_types) for entry in memberlist):
+            #         self.directive.warn(
+            #             '__all__ should be a list of strings, not %r '
+            #             '(in module %s) -- ignoring __all__' %
+            #             (memberlist, self.fullname))
+            #         # fall back to all members
+            #         return True, safe_getmembers(self.object)
+        else:
+            memberlist = self.options.members or []
+        ret = []
+        for mname in memberlist:
+            try:
+                ret.append((mname, safe_getattr(self.object, mname)))
+            except AttributeError:
+                self.directive.warn(
+                    'missing attribute mentioned in :members: or __all__: '
+                    'module %s, attribute %s' % (
+                        safe_getattr(self.object, '__name__', '???'), mname))
+        return False, ret
+
+if 'doctest' in sys.argv:
+    def setup(app):
+        app.connect('autodoc-skip-member', dont_skip_any_doctests)
+
+    sphinx.ext.autodoc.ModuleDocumenter = ModuleDocumenter

docs/source/config.rst

@@ -0,0 +1,4 @@
+:mod:`pwnlib.config` --- Pwntools Configuration File
+====================================================
+
+.. automodule:: pwnlib.config

docs/source/context.rst

@@ -27,11 +27,7 @@ The recommended method is to use ``context.binary``  to automagically set all of
     context.binary = './challenge-binary'
 
 Module Members
-=====================================================
+----------------------------------------------------
 
-.. autodata:: pwnlib.context.context
-
-.. autoclass:: pwnlib.context.ContextType
-    :members:
-
-.. autoclass:: pwnlib.context.Thread
+.. automodule:: pwnlib.context
+   :members:

docs/source/elf/elf.rst

@@ -1,6 +1,7 @@
 .. testsetup:: *
 
    from pwn import *
+   from glob import glob
 
 :mod:`pwnlib.elf.elf` --- ELF Files
 ===========================================================

docs/source/index.rst

@@ -48,6 +48,7 @@ Each of the ``pwntools`` modules is documented here.
    atexception
    atexit
    constants
+   config
    context
    dynelf
    encoders
@@ -56,6 +57,7 @@ Each of the ``pwntools`` modules is documented here.
    flag
    fmtstr
    gdb
+   libcdb
    log
    memleak
    protocols

docs/source/intro.rst

@@ -72,7 +72,7 @@ a ``process`` tube.
 
 ::
 
-    >>> shell = ssh('bandit0', 'bandit.labs.overthewire.org', password='bandit0')
+    >>> shell = ssh('bandit0', 'bandit.labs.overthewire.org', password='bandit0', port=2220)
     >>> shell['whoami']
     'bandit0'
     >>> shell.download_file('/etc/motd')

docs/source/libcdb.rst

@@ -0,0 +1,10 @@
+.. testsetup:: *
+
+   from pwn import *
+   from pwnlib.libcdb import *
+
+:mod:`pwnlib.libcdb` --- Libc Database
+===========================================
+
+.. automodule:: pwnlib.libcdb
+   :members:

docs/source/memleak.rst

@@ -1,11 +1,9 @@
 .. testsetup:: *
 
-   from pwnlib.memleak import *
+    from pwn import *
 
 :mod:`pwnlib.memleak` --- Helper class for leaking memory
 =========================================================
 
-.. module:: pwnlib.memleak
-
-.. autoclass:: MemLeak
-   :members:
+.. automodule:: pwnlib.memleak
+    :members:

docs/source/util/safeeval.rst

@@ -1,6 +1,7 @@
 .. testsetup:: *
 
    from pwnlib.util.safeeval import *
+   _get_opcodes = pwnlib.util.safeeval._get_opcodes
 
 
 :mod:`pwnlib.util.safeeval` --- Safe evaluation of python code

examples/ssh.py

@@ -4,7 +4,7 @@ Example showing how to use the ssh class.
 
 from pwn import *
 
-shell = ssh(host='bandit.labs.overthewire.org',user='bandit0',password='bandit0')
+shell = ssh(host='bandit.labs.overthewire.org',user='bandit0',password='bandit0', port=2220)
 
 # Show basic command syntax
 log.info("username: %s" % shell.whoami())

extra/docker/Makefile

@@ -1,6 +1,6 @@
 subdirs=xenial stable $(wildcard */)
 makefiles=$(wildcard */Makefile)
-tags=stable beta dev
+tags=base stable beta dev
 
 all: $(makefiles) $(subdirs)
 

extra/docker/base

@@ -0,0 +1 @@
+xenial

extra/docker/kali/Makefile

@@ -1,6 +1,6 @@
 all: Dockerfile
 
-Dockerfile: ../stable/Dockerfile FORCE
+Dockerfile: ../xenial/Dockerfile FORCE
 	sed "s|ubuntu:xenial|kalilinux/kali-linux-docker|" < "$<" > "$@"
 
 FORCE:

extra/docker/stable/Dockerfile

@@ -1,26 +1,6 @@
-############################################################
-# Dockerfile to build Pwntools container
-# Based on Ubuntu
-############################################################
+FROM pwntools/pwntools:base
 
-FROM ubuntu:xenial
-MAINTAINER Maintainer Gallopsled et al.
-
-RUN apt-get update
-RUN apt-get install -y build-essential
-RUN apt-get install -y git
-RUN apt-get install -y libssl-dev
-RUN apt-get install -y libffi-dev
-RUN apt-get install -y python2.7
-RUN apt-get install -y python-pip
-RUN apt-get install -y python-dev
-RUN pip install --upgrade pip
-RUN python -m pip install --upgrade pwntools
+USER root
+RUN pip install --upgrade git+https://github.com/Gallopsled/pwntools@stable
 RUN PWNLIB_NOTERM=1 pwn update
-
-RUN apt-get install -y sudo
-RUN useradd -m pwntools
-RUN passwd --delete --unlock pwntools
-RUN echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
 USER pwntools
-WORKDIR /home/pwntools

extra/docker/stable/Makefile

@@ -1,8 +0,0 @@
-all: Dockerfile
-
-Dockerfile: ../xenial/Dockerfile FORCE
-	cp "$<" "$@"
-
-FORCE:
-
-.PHONY: all

pwn/__init__.py

@@ -5,6 +5,7 @@ from pwn.toplevel import *
 
 pwnlib.args.initialize()
 pwnlib.log.install_default_handler()
+pwnlib.config.initialize()
 
 log = pwnlib.log.getLogger('pwnlib.exploit')
 args = pwnlib.args.args

pwnlib/__init__.py

@@ -14,6 +14,7 @@ __all__ = [
     'commandline',
     'constants',
     'context',
+    'data',
     'dynelf',
     'encoders',
     'elf',

pwnlib/adb/adb.py

@@ -328,7 +328,7 @@ class AdbDevice(Device):
             kwargs['port'] = 'emulator'
 
         for field in fields[2:]:
-            k,v = field.split(':')
+            k,v = field.split(':', 1)
             kwargs[k] = v
 
         return AdbDevice(serial, type, **kwargs)
@@ -346,7 +346,7 @@ class AdbDevice(Device):
         of this device.
 
         >>> property = 'ro.build.fingerprint'
-        >>> device = adb.current_device()
+        >>> device = adb.wait_for_device()
         >>> adb.getprop(property) == device.getprop(property)
         True
         """

pwnlib/args.py

@@ -37,8 +37,18 @@ not specified evaluate to an empty string.
     else:
         io = process('./pwnable')
 
+Arguments can also be accessed directly with the dot operator, e.g.:
+
+.. code-block:: python
+
+    if args.REMOTE:
+        ...
+
+Any undefined arguments evaluate to an empty string, ``''``.
+
 The full list of supported "magic arguments" and their effects are listed
 below.
+
 """
 from __future__ import absolute_import
 
@@ -51,8 +61,12 @@ import sys
 from pwnlib import term
 from pwnlib.context import context
 
+class PwnlibArgs(collections.defaultdict):
+    def __getattr__(self, attr):
+        return self[attr]
+
+args = PwnlibArgs(str)
 term_mode  = True
-args       = collections.defaultdict(str)
 env_prefix = 'PWNLIB_'
 free_form  = True
 

pwnlib/asm.py

@@ -146,8 +146,9 @@ def which_binutils(util):
     Examples:
 
         >>> import platform
+        >>> which_binutils = pwnlib.asm.which_binutils
         >>> which_binutils('as', arch=platform.machine())
-        '.../bin/as'
+        '.../bin/...as'
         >>> which_binutils('as', arch='arm') #doctest: +ELLIPSIS
         '.../bin/arm-...-as'
         >>> which_binutils('as', arch='powerpc') #doctest: +ELLIPSIS
@@ -783,7 +784,7 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):
 
         res = _run(objcopy + [step1, step2])
 
-        output0 = subprocess.check_output(objdump + [step2])
+        output0 = _run(objdump + [step2])
         output1 = output0.split('<.text>:\n')
 
         if len(output1) != 2:

pwnlib/commandline/__init__.py

@@ -5,7 +5,9 @@ __all__ = [
     'common',
     'constgrep',
     'cyclic',
+    'debug',
     'disasm',
+    'disablenx',
     'elfdiff',
     'elfpatch',
     'errno',

pwnlib/commandline/asm.py

@@ -96,6 +96,10 @@ parser.add_argument(
 def main(args):
     tty    = args.output.isatty()
 
+    if args.infile.isatty() and not args.lines:
+        parser.print_usage()
+        sys.exit(1)
+
     data   = '\n'.join(args.lines) or args.infile.read()
     output = asm(data.replace(';', '\n'))
     fmt    = args.format or ('hex' if tty else 'raw')
@@ -125,4 +129,4 @@ def main(args):
         args.output.write('\n')
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/checksec.py

@@ -37,4 +37,4 @@ def main(args):
         e = ELF(f.name)
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/constgrep.py

@@ -139,4 +139,4 @@ def main(args):
                 print '(%s) == %s' % (' | '.join(k for v, k in good), args.constant)
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/cyclic.py

@@ -95,4 +95,4 @@ def main(args):
             sys.stdout.write('\n')
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/debug.py

@@ -0,0 +1,69 @@
+#!/usr/bin/env python2
+from __future__ import absolute_import
+
+import argparse
+import sys
+
+from pwn import *
+from pwnlib.commandline import common
+
+parser = common.parser_commands.add_parser(
+    'debug',
+    help = 'Debug a binary in GDB'
+)
+parser.add_argument(
+    '-x', metavar='GDBSCRIPT',
+    type=file,
+    help='Execute GDB commands from this file.'
+)
+parser.add_argument(
+    '--pid',
+    type=int,
+    help="PID to attach to"
+)
+parser.add_argument(
+    '-c', '--context',
+    metavar = 'context',
+    action = 'append',
+    type   = common.context_arg,
+    choices = common.choices,
+    help = 'The os/architecture/endianness/bits the shellcode will run in (default: linux/i386), choose from: %s' % common.choices,
+)
+parser.add_argument(
+    '--exec', type=file, dest='executable',
+    help='File to debug'
+)
+parser.add_argument(
+    '--process', metavar='PROCESS_NAME',
+    help='Name of the process to attach to (e.g. "bash")'
+)
+
+def main(args):
+    gdbscript = ''
+    if args.x:
+        gdbscript = args.x.read()
+
+    if context.os == 'android':
+        context.device = adb.wait_for_device()
+
+    if args.executable:
+        context.binary = ELF(args.executable.name)
+        target = context.binary.path
+    elif args.pid:
+        target = int(args.pid)
+    elif args.process:
+        if context.os == 'android':
+            target = adb.pidof(process)
+        else:
+            target = pidof(process)
+    else:
+        parser.print_usage()
+        return 1
+
+    if args.pid or args.process:
+        gdb.attach(target, gdbscript=gdbscript)
+    else:
+        gdb.debug(target, gdbscript=gdbscript).interactive()
+
+if __name__ == '__main__':
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/disablenx.py

@@ -0,0 +1,25 @@
+#!/usr/bin/env python2
+from __future__ import absolute_import
+
+from pwn import *
+from pwnlib.commandline import common
+
+parser = common.parser_commands.add_parser(
+    'disablenx',
+    help = 'Disable NX for an ELF binary'
+)
+parser.add_argument(
+    'elf',
+    nargs='+',
+    type=file,
+    help='Files to check'
+)
+
+def main(args):
+    for f in args.elf:
+        e = ELF(f.name)
+        e.disable_nx()
+        ELF(e.path)
+
+if __name__ == '__main__':
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/disasm.py

@@ -92,4 +92,4 @@ def main(args):
     print disasm(dat, vma=safeeval.const(args.address))
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/elfdiff.py

@@ -58,4 +58,4 @@ def main(a):
     print diff(x, y)
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/elfpatch.py

@@ -35,4 +35,4 @@ def main(a):
     sys.stdout.write(elf.get_data())
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/errno.py

@@ -44,4 +44,4 @@ def main(args):
   print os.strerror(value)
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/hex.py

@@ -21,4 +21,4 @@ def main(args):
         print ' '.join(args.data).encode('hex')
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/main.py

@@ -7,7 +7,9 @@ from pwnlib.commandline import checksec
 from pwnlib.commandline import common
 from pwnlib.commandline import constgrep
 from pwnlib.commandline import cyclic
+from pwnlib.commandline import debug
 from pwnlib.commandline import disasm
+from pwnlib.commandline import disablenx
 from pwnlib.commandline import elfdiff
 from pwnlib.commandline import elfpatch
 from pwnlib.commandline import errno
@@ -16,6 +18,7 @@ from pwnlib.commandline import phd
 from pwnlib.commandline import pwnstrip
 from pwnlib.commandline import scramble
 from pwnlib.commandline import shellcraft
+from pwnlib.commandline import template
 from pwnlib.commandline import unhex
 from pwnlib.commandline import update
 from pwnlib.commandline.common import parser
@@ -26,7 +29,9 @@ commands = {
     'checksec': checksec.main,
     'constgrep': constgrep.main,
     'cyclic': cyclic.main,
+    'debug': debug.main,
     'disasm': disasm.main,
+    'disablenx': disablenx.main,
     'elfdiff': elfdiff.main,
     'elfpatch': elfpatch.main,
     'errno': errno.main,
@@ -35,6 +40,7 @@ commands = {
     'pwnstrip': pwnstrip.main,
     'scramble': scramble.main,
     'shellcraft': shellcraft.main,
+    'template': template.main,
     'unhex': unhex.main,
     'update': update.main,
 }

pwnlib/commandline/phd.py

@@ -101,4 +101,4 @@ def main(args):
         pass
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/pwnstrip.py

@@ -51,4 +51,4 @@ def main(args):
     args.output.write(result)
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/scramble.py

@@ -105,4 +105,4 @@ def main(args):
 
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/shellcraft.py

@@ -342,4 +342,4 @@ def main(args):
     args.out.write(code)
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/template.py

@@ -0,0 +1,64 @@
+#!/usr/bin/env python2
+from __future__ import absolute_import
+
+import re
+
+from pwn import *
+from pwnlib.commandline import common
+
+from mako.lookup import TemplateLookup
+
+parser = common.parser_commands.add_parser(
+    'template',
+    help = 'Generate an exploit template'
+)
+
+parser.add_argument('exe', nargs='?', help='Target binary')
+parser.add_argument('--host', help='Remote host / SSH server')
+parser.add_argument('--port', help='Remote port / SSH port', type=int)
+parser.add_argument('--user', help='SSH Username')
+parser.add_argument('--pass', help='SSH Password', dest='password')
+parser.add_argument('--path', help='Remote path of file on SSH server')
+
+def main(args):
+    cache = None
+
+    if cache:
+        cache = os.path.join(context.cache_dir, 'mako')
+
+    lookup = TemplateLookup(
+        directories      = [os.path.join(pwnlib.data.path, 'templates')],
+        module_directory = cache
+    )
+
+    # For the SSH scenario, check that the binary is at the
+    # same path on the remote host.
+    if args.user:
+        if not (args.path or args.exe):
+            log.error("Must specify --path or a exe")
+
+        s = ssh(args.user, args.host, args.port or 22, args.password or None)
+        s.download(args.path or args.exe)
+
+        if not args.exe:
+            args.exe = os.path.basename(args.path)
+
+    template = lookup.get_template('pwnup.mako')
+    output = template.render(args.exe,
+                             args.host,
+                             args.port,
+                             args.user,
+                             args.password,
+                             args.path)
+
+    # Fix Mako formatting bs
+    output = re.sub('\n\n\n', '\n\n', output)
+
+    print output
+
+    if not sys.stdout.isatty():
+        try: os.fchmod(sys.stdout.fileno(), 0700)
+        except OSError: pass
+
+if __name__ == '__main__':
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/unhex.py

@@ -27,4 +27,4 @@ def main(args):
         sys.stderr.write(str(e) + '\n')
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/commandline/update.py

@@ -28,4 +28,4 @@ def main(a):
         subprocess.check_call(result, shell=False)
 
 if __name__ == '__main__':
-    pwnlib.common.main(__file__)
+    pwnlib.commandline.common.main(__file__)

pwnlib/config.py

@@ -0,0 +1,60 @@
+# -*- coding: utf-8 -*-
+"""Allows per-user and per-host configuration of Pwntools settings.
+
+The list of configurable options includes all of the logging symbols
+and colors, as well as all of the default values on the global context
+object.
+
+The configuration file is read from ``~/.pwn.conf`` and ``/etc/pwn.conf``.
+
+The configuration file is only read in ``from pwn import *`` mode, and not
+when used in library mode (``import pwnlib``).  To read the configuration
+file in library mode, invoke :func:`.config.initialize`.
+
+The ``context`` section supports complex types, at least as far as is
+supported by ``pwnlib.util.safeeval.expr``.
+
+::
+
+    [log]
+    success.symbol=😎
+    error.symbol=☠
+    info.color=blue
+
+    [context]
+    adb_port=4141
+    randomize=1
+    timeout=60
+    terminal=['x-terminal-emulator', '-e']
+"""
+from __future__ import absolute_import
+
+import ConfigParser
+import os
+
+registered_configs = {}
+
+def register_config(section, function):
+    """Registers a configuration section.
+
+    Arguments:
+        section(str): Named configuration section
+        function(callable): Function invoked with a dictionary of
+            ``{option: value}`` for the entries in the section.
+    """
+    registered_configs[section] = function
+
+def initialize():
+    """Read the configuration files."""
+    from pwnlib.log import getLogger
+    log = getLogger(__name__)
+
+    c = ConfigParser.ConfigParser()
+    c.read(['/etc/pwn.conf', os.path.expanduser('~/.pwn.conf')])
+
+    for section in c.sections():
+        if section not in registered_configs:
+            log.warn("Unknown configuration section %r" % section)
+            continue
+        settings = dict(c.items(section))
+        registered_configs[section](settings)

pwnlib/constants/__init__.py

@@ -39,6 +39,16 @@ Example:
     ...     print int(constants.SYS_stat)
     4
 
+    >>> with context.local(arch = 'i386', os = 'linux'):
+    ...    print constants.SYS_execve + constants.PROT_WRITE
+    13
+    >>> with context.local(arch = 'amd64', os = 'linux'):
+    ...    print constants.SYS_execve + constants.PROT_WRITE
+    61
+    >>> with context.local(arch = 'amd64', os = 'linux'):
+    ...    print constants.SYS_execve + constants.PROT_WRITE
+    61
+
 """
 from __future__ import absolute_import
 
@@ -56,19 +66,6 @@ class ConstantsModule(ModuleType):
     ModuleType specialization in order to automatically
     route queries down to the correct module based on the
     current context arch / os.
-
-        >>> with context.local(arch = 'i386', os = 'linux'):
-        ...    print constants.SYS_execve + constants.PROT_WRITE
-        13
-        >>> with context.local(arch = 'amd64', os = 'linux'):
-        ...    print constants.SYS_execve + constants.PROT_WRITE
-        61
-        >>> with context.local(arch = 'amd64', os = 'linux'):
-        ...    print constants.SYS_execve + constants.PROT_WRITE
-        61
-        >>> False
-        True
-
     """
     Constant = Constant
 

pwnlib/constants/linux/aarch64.py

@@ -1,5 +1,4 @@
 from pwnlib.constants.constant import Constant
-
 __NR_io_setup = Constant('__NR_io_setup',0)
 __NR_io_destroy = Constant('__NR_io_destroy',1)
 __NR_io_submit = Constant('__NR_io_submit',2)
@@ -259,63 +258,6 @@ __NR_process_vm_readv = Constant('__NR_process_vm_readv',270)
 __NR_process_vm_writev = Constant('__NR_process_vm_writev',271)
 __NR_kcmp = Constant('__NR_kcmp',272)
 __NR_finit_module = Constant('__NR_finit_module',273)
-__NR_open = Constant('__NR_open',1024)
-__NR_link = Constant('__NR_link',1025)
-__NR_unlink = Constant('__NR_unlink',1026)
-__NR_mknod = Constant('__NR_mknod',1027)
-__NR_chmod = Constant('__NR_chmod',1028)
-__NR_chown = Constant('__NR_chown',1029)
-__NR_mkdir = Constant('__NR_mkdir',1030)
-__NR_rmdir = Constant('__NR_rmdir',1031)
-__NR_lchown = Constant('__NR_lchown',1032)
-__NR_access = Constant('__NR_access',1033)
-__NR_rename = Constant('__NR_rename',1034)
-__NR_readlink = Constant('__NR_readlink',1035)
-__NR_symlink = Constant('__NR_symlink',1036)
-__NR_utimes = Constant('__NR_utimes',1037)
-__NR_stat = Constant('__NR_stat',1038)
-__NR_lstat = Constant('__NR_lstat',1039)
-__NR_pipe = Constant('__NR_pipe',1040)
-__NR_dup2 = Constant('__NR_dup2',1041)
-__NR_epoll_create = Constant('__NR_epoll_create',1042)
-__NR_inotify_init = Constant('__NR_inotify_init',1043)
-__NR_eventfd = Constant('__NR_eventfd',1044)
-__NR_signalfd = Constant('__NR_signalfd',1045)
-__NR_sendfile64 = Constant('__NR_sendfile64',1046)
-__NR_ftruncate64 = Constant('__NR_ftruncate64',1047)
-__NR_truncate64 = Constant('__NR_truncate64',1048)
-__NR_stat64 = Constant('__NR_stat64',1049)
-__NR_lstat64 = Constant('__NR_lstat64',1050)
-__NR_fstat64 = Constant('__NR_fstat64',1051)
-__NR_fcntl64 = Constant('__NR_fcntl64',1052)
-__NR_newfstatat = Constant('__NR_newfstatat',1054)
-__NR_fstatfs64 = Constant('__NR_fstatfs64',1055)
-__NR_statfs64 = Constant('__NR_statfs64',1056)
-__NR_lseek64 = Constant('__NR_lseek64',1057)
-__NR_mmap64 = Constant('__NR_mmap64',1058)
-__NR_alarm = Constant('__NR_alarm',1059)
-__NR_getpgrp = Constant('__NR_getpgrp',1060)
-__NR_pause = Constant('__NR_pause',1061)
-__NR_time = Constant('__NR_time',1062)
-__NR_utime = Constant('__NR_utime',1063)
-__NR_creat = Constant('__NR_creat',1064)
-__NR_getdents = Constant('__NR_getdents',1065)
-__NR_futimesat = Constant('__NR_futimesat',1066)
-__NR_select = Constant('__NR_select',1067)
-__NR_poll = Constant('__NR_poll',1068)
-__NR_epoll_wait = Constant('__NR_epoll_wait',1069)
-__NR_ustat = Constant('__NR_ustat',1070)
-__NR_vfork = Constant('__NR_vfork',1071)
-__NR_oldwait4 = Constant('__NR_oldwait4',1072)
-__NR_recv = Constant('__NR_recv',1073)
-__NR_send = Constant('__NR_send',1074)
-__NR_bdflush = Constant('__NR_bdflush',1075)
-__NR_umount = Constant('__NR_umount',1076)
-__NR_uselib = Constant('__NR_uselib',1077)
-__NR__sysctl = Constant('__NR__sysctl',1078)
-__NR_fork = Constant('__NR_fork',1079)
-__NR_syscalls = Constant('__NR_syscalls',(1079+1))
-__NR_sigreturn = Constant('__NR_sigreturn',1999)
 MAP_32BIT = Constant('MAP_32BIT',0x40)
 INADDR_ANY = Constant('INADDR_ANY',0)
 INADDR_BROADCAST = Constant('INADDR_BROADCAST',0xffffffff)
@@ -944,19 +886,14 @@ CC_N_BIT = Constant('CC_N_BIT',(1 << 31))
 PCMASK = Constant('PCMASK',0)
 SYS_accept = Constant('SYS_accept',202)
 SYS_accept4 = Constant('SYS_accept4',242)
-SYS_access = Constant('SYS_access',1033)
 SYS_acct = Constant('SYS_acct',89)
 SYS_add_key = Constant('SYS_add_key',217)
 SYS_adjtimex = Constant('SYS_adjtimex',171)
-SYS_alarm = Constant('SYS_alarm',1059)
-SYS_bdflush = Constant('SYS_bdflush',1075)
 SYS_bind = Constant('SYS_bind',200)
 SYS_brk = Constant('SYS_brk',214)
 SYS_capget = Constant('SYS_capget',90)
 SYS_capset = Constant('SYS_capset',91)
 SYS_chdir = Constant('SYS_chdir',49)
-SYS_chmod = Constant('SYS_chmod',1028)
-SYS_chown = Constant('SYS_chown',1029)
 SYS_chroot = Constant('SYS_chroot',51)
 SYS_clock_getres = Constant('SYS_clock_getres',114)
 SYS_clock_gettime = Constant('SYS_clock_gettime',113)
@@ -965,17 +902,12 @@ SYS_clock_settime = Constant('SYS_clock_settime',112)
 SYS_clone = Constant('SYS_clone',220)
 SYS_close = Constant('SYS_close',57)
 SYS_connect = Constant('SYS_connect',203)
-SYS_creat = Constant('SYS_creat',1064)
 SYS_delete_module = Constant('SYS_delete_module',106)
 SYS_dup = Constant('SYS_dup',23)
-SYS_dup2 = Constant('SYS_dup2',1041)
 SYS_dup3 = Constant('SYS_dup3',24)
-SYS_epoll_create = Constant('SYS_epoll_create',1042)
 SYS_epoll_create1 = Constant('SYS_epoll_create1',20)
 SYS_epoll_ctl = Constant('SYS_epoll_ctl',21)
 SYS_epoll_pwait = Constant('SYS_epoll_pwait',22)
-SYS_epoll_wait = Constant('SYS_epoll_wait',1069)
-SYS_eventfd = Constant('SYS_eventfd',1044)
 SYS_eventfd2 = Constant('SYS_eventfd2',19)
 SYS_execve = Constant('SYS_execve',221)
 SYS_exit = Constant('SYS_exit',93)
@@ -991,27 +923,20 @@ SYS_fchmodat = Constant('SYS_fchmodat',53)
 SYS_fchown = Constant('SYS_fchown',55)
 SYS_fchownat = Constant('SYS_fchownat',54)
 SYS_fcntl = Constant('SYS_fcntl',25)
-SYS_fcntl64 = Constant('SYS_fcntl64',1052)
 SYS_fdatasync = Constant('SYS_fdatasync',83)
 SYS_fgetxattr = Constant('SYS_fgetxattr',10)
 SYS_flistxattr = Constant('SYS_flistxattr',13)
 SYS_flock = Constant('SYS_flock',32)
-SYS_fork = Constant('SYS_fork',1079)
 SYS_fremovexattr = Constant('SYS_fremovexattr',16)
 SYS_fsetxattr = Constant('SYS_fsetxattr',7)
 SYS_fstat = Constant('SYS_fstat',80)
-SYS_fstat64 = Constant('SYS_fstat64',1051)
 SYS_fstatat64 = Constant('SYS_fstatat64',79)
 SYS_fstatfs = Constant('SYS_fstatfs',44)
-SYS_fstatfs64 = Constant('SYS_fstatfs64',1055)
 SYS_fsync = Constant('SYS_fsync',82)
 SYS_ftruncate = Constant('SYS_ftruncate',46)
-SYS_ftruncate64 = Constant('SYS_ftruncate64',1047)
 SYS_futex = Constant('SYS_futex',98)
-SYS_futimesat = Constant('SYS_futimesat',1066)
 SYS_getcpu = Constant('SYS_getcpu',168)
 SYS_getcwd = Constant('SYS_getcwd',17)
-SYS_getdents = Constant('SYS_getdents',1065)
 SYS_getdents64 = Constant('SYS_getdents64',61)
 SYS_getegid = Constant('SYS_getegid',177)
 SYS_geteuid = Constant('SYS_geteuid',175)
@@ -1021,7 +946,6 @@ SYS_getitimer = Constant('SYS_getitimer',102)
 SYS_get_mempolicy = Constant('SYS_get_mempolicy',236)
 SYS_getpeername = Constant('SYS_getpeername',205)
 SYS_getpgid = Constant('SYS_getpgid',155)
-SYS_getpgrp = Constant('SYS_getpgrp',1060)
 SYS_getpid = Constant('SYS_getpid',172)
 SYS_getppid = Constant('SYS_getppid',173)
 SYS_getpriority = Constant('SYS_getpriority',141)
@@ -1039,7 +963,6 @@ SYS_getuid = Constant('SYS_getuid',174)
 SYS_getxattr = Constant('SYS_getxattr',8)
 SYS_init_module = Constant('SYS_init_module',105)
 SYS_inotify_add_watch = Constant('SYS_inotify_add_watch',27)
-SYS_inotify_init = Constant('SYS_inotify_init',1043)
 SYS_inotify_init1 = Constant('SYS_inotify_init1',26)
 SYS_inotify_rm_watch = Constant('SYS_inotify_rm_watch',28)
 SYS_io_cancel = Constant('SYS_io_cancel',3)
@@ -1053,9 +976,7 @@ SYS_io_submit = Constant('SYS_io_submit',2)
 SYS_kexec_load = Constant('SYS_kexec_load',104)
 SYS_keyctl = Constant('SYS_keyctl',219)
 SYS_kill = Constant('SYS_kill',129)
-SYS_lchown = Constant('SYS_lchown',1032)
 SYS_lgetxattr = Constant('SYS_lgetxattr',9)
-SYS_link = Constant('SYS_link',1025)
 SYS_linkat = Constant('SYS_linkat',37)
 SYS_listen = Constant('SYS_listen',201)
 SYS_listxattr = Constant('SYS_listxattr',11)
@@ -1064,15 +985,11 @@ SYS_lookup_dcookie = Constant('SYS_lookup_dcookie',18)
 SYS_lremovexattr = Constant('SYS_lremovexattr',15)
 SYS_lseek = Constant('SYS_lseek',62)
 SYS_lsetxattr = Constant('SYS_lsetxattr',6)
-SYS_lstat = Constant('SYS_lstat',1039)
-SYS_lstat64 = Constant('SYS_lstat64',1050)
 SYS_madvise = Constant('SYS_madvise',233)
 SYS_mbind = Constant('SYS_mbind',235)
 SYS_migrate_pages = Constant('SYS_migrate_pages',238)
 SYS_mincore = Constant('SYS_mincore',232)
-SYS_mkdir = Constant('SYS_mkdir',1030)
 SYS_mkdirat = Constant('SYS_mkdirat',34)
-SYS_mknod = Constant('SYS_mknod',1027)
 SYS_mknodat = Constant('SYS_mknodat',33)
 SYS_mlock = Constant('SYS_mlock',228)
 SYS_mlockall = Constant('SYS_mlockall',230)
@@ -1096,17 +1013,12 @@ SYS_munlock = Constant('SYS_munlock',229)
 SYS_munlockall = Constant('SYS_munlockall',231)
 SYS_munmap = Constant('SYS_munmap',215)
 SYS_nanosleep = Constant('SYS_nanosleep',101)
-SYS_newfstatat = Constant('SYS_newfstatat',1054)
 SYS_nfsservctl = Constant('SYS_nfsservctl',42)
-SYS_open = Constant('SYS_open',1024)
 SYS_openat = Constant('SYS_openat',56)
-SYS_pause = Constant('SYS_pause',1061)
 SYS_perf_event_open = Constant('SYS_perf_event_open',241)
 SYS_personality = Constant('SYS_personality',92)
-SYS_pipe = Constant('SYS_pipe',1040)
 SYS_pipe2 = Constant('SYS_pipe2',59)
 SYS_pivot_root = Constant('SYS_pivot_root',41)
-SYS_poll = Constant('SYS_poll',1068)
 SYS_ppoll = Constant('SYS_ppoll',73)
 SYS_prctl = Constant('SYS_prctl',167)
 SYS_pread64 = Constant('SYS_pread64',67)
@@ -1119,21 +1031,17 @@ SYS_pwritev = Constant('SYS_pwritev',70)
 SYS_quotactl = Constant('SYS_quotactl',60)
 SYS_read = Constant('SYS_read',63)
 SYS_readahead = Constant('SYS_readahead',213)
-SYS_readlink = Constant('SYS_readlink',1035)
 SYS_readlinkat = Constant('SYS_readlinkat',78)
 SYS_readv = Constant('SYS_readv',65)
 SYS_reboot = Constant('SYS_reboot',142)
-SYS_recv = Constant('SYS_recv',1073)
 SYS_recvfrom = Constant('SYS_recvfrom',207)
 SYS_recvmmsg = Constant('SYS_recvmmsg',243)
 SYS_recvmsg = Constant('SYS_recvmsg',212)
 SYS_remap_file_pages = Constant('SYS_remap_file_pages',234)
 SYS_removexattr = Constant('SYS_removexattr',14)
-SYS_rename = Constant('SYS_rename',1034)
 SYS_renameat = Constant('SYS_renameat',38)
 SYS_request_key = Constant('SYS_request_key',218)
 SYS_restart_syscall = Constant('SYS_restart_syscall',128)
-SYS_rmdir = Constant('SYS_rmdir',1031)
 SYS_rt_sigaction = Constant('SYS_rt_sigaction',134)
 SYS_rt_sigpending = Constant('SYS_rt_sigpending',136)
 SYS_rt_sigprocmask = Constant('SYS_rt_sigprocmask',135)
@@ -1152,14 +1060,11 @@ SYS_sched_setaffinity = Constant('SYS_sched_setaffinity',122)
 SYS_sched_setparam = Constant('SYS_sched_setparam',118)
 SYS_sched_setscheduler = Constant('SYS_sched_setscheduler',119)
 SYS_sched_yield = Constant('SYS_sched_yield',124)
-SYS_select = Constant('SYS_select',1067)
 SYS_semctl = Constant('SYS_semctl',191)
 SYS_semget = Constant('SYS_semget',190)
 SYS_semop = Constant('SYS_semop',193)
 SYS_semtimedop = Constant('SYS_semtimedop',192)
-SYS_send = Constant('SYS_send',1074)
 SYS_sendfile = Constant('SYS_sendfile',71)
-SYS_sendfile64 = Constant('SYS_sendfile64',1046)
 SYS_sendmsg = Constant('SYS_sendmsg',211)
 SYS_sendto = Constant('SYS_sendto',206)
 SYS_setdomainname = Constant('SYS_setdomainname',162)
@@ -1190,28 +1095,20 @@ SYS_shmdt = Constant('SYS_shmdt',197)
 SYS_shmget = Constant('SYS_shmget',194)
 SYS_shutdown = Constant('SYS_shutdown',210)
 SYS_sigaltstack = Constant('SYS_sigaltstack',132)
-SYS_signalfd = Constant('SYS_signalfd',1045)
 SYS_signalfd4 = Constant('SYS_signalfd4',74)
-SYS_sigreturn = Constant('SYS_sigreturn',1999)
 SYS_socket = Constant('SYS_socket',198)
 SYS_socketpair = Constant('SYS_socketpair',199)
 SYS_splice = Constant('SYS_splice',76)
-SYS_stat = Constant('SYS_stat',1038)
-SYS_stat64 = Constant('SYS_stat64',1049)
 SYS_statfs = Constant('SYS_statfs',43)
-SYS_statfs64 = Constant('SYS_statfs64',1056)
 SYS_swapoff = Constant('SYS_swapoff',225)
 SYS_swapon = Constant('SYS_swapon',224)
-SYS_symlink = Constant('SYS_symlink',1036)
 SYS_symlinkat = Constant('SYS_symlinkat',36)
 SYS_sync = Constant('SYS_sync',81)
 SYS_sync_file_range2 = Constant('SYS_sync_file_range2',84)
-SYS__sysctl = Constant('SYS__sysctl',1078)
 SYS_sysinfo = Constant('SYS_sysinfo',179)
 SYS_syslog = Constant('SYS_syslog',116)
 SYS_tee = Constant('SYS_tee',77)
 SYS_tgkill = Constant('SYS_tgkill',131)
-SYS_time = Constant('SYS_time',1062)
 SYS_timer_create = Constant('SYS_timer_create',107)
 SYS_timer_delete = Constant('SYS_timer_delete',111)
 SYS_timerfd_create = Constant('SYS_timerfd_create',85)
@@ -1223,20 +1120,12 @@ SYS_timer_settime = Constant('SYS_timer_settime',110)
 SYS_times = Constant('SYS_times',153)
 SYS_tkill = Constant('SYS_tkill',130)
 SYS_truncate = Constant('SYS_truncate',45)
-SYS_truncate64 = Constant('SYS_truncate64',1048)
 SYS_umask = Constant('SYS_umask',166)
-SYS_umount = Constant('SYS_umount',1076)
 SYS_umount2 = Constant('SYS_umount2',39)
 SYS_uname = Constant('SYS_uname',160)
-SYS_unlink = Constant('SYS_unlink',1026)
 SYS_unlinkat = Constant('SYS_unlinkat',35)
 SYS_unshare = Constant('SYS_unshare',97)
-SYS_uselib = Constant('SYS_uselib',1077)
-SYS_ustat = Constant('SYS_ustat',1070)
-SYS_utime = Constant('SYS_utime',1063)
 SYS_utimensat = Constant('SYS_utimensat',88)
-SYS_utimes = Constant('SYS_utimes',1037)
-SYS_vfork = Constant('SYS_vfork',1071)
 SYS_vhangup = Constant('SYS_vhangup',58)
 SYS_vmsplice = Constant('SYS_vmsplice',75)
 SYS_wait4 = Constant('SYS_wait4',260)

pwnlib/context/__init__.py

@@ -21,9 +21,12 @@ import time
 
 import socks
 
+from pwnlib.config import register_config
 from pwnlib.device import Device
 from pwnlib.timeout import Timeout
 
+__all__ = ['context', 'ContextType', 'Thread']
+
 _original_socket = socket.socket
 
 class _devnull(object):
@@ -246,9 +249,10 @@ def _longest(d):
     as it ensures the most complete match will be found.
 
     >>> data = {'a': 1, 'bb': 2, 'ccc': 3}
-    >>> _longest(data) == data
+    >>> pwnlib.context._longest(data) == data
     True
-    >>> for i in _longest(data): print i
+    >>> for i in pwnlib.context._longest(data):
+    ...     print i
     ccc
     bb
     a
@@ -347,7 +351,7 @@ class ContextType(object):
         'os': 'linux',
         'proxy': None,
         'signed': False,
-        'terminal': None,
+        'terminal': tuple(),
         'timeout': Timeout.maximum,
     }
 
@@ -1326,6 +1330,7 @@ def LocalContext(function):
 
     Example:
 
+        >>> context.clear()
         >>> @LocalContext
         ... def printArch():
         ...     print(context.arch)
@@ -1343,3 +1348,25 @@ def LocalContext(function):
         with context.local(**{k:kw.pop(k) for k,v in kw.items() if isinstance(getattr(ContextType, k, None), property)}):
             return function(*a, **kw)
     return setter
+
+# Read configuration options from the context section
+def update_context_defaults(section):
+    # Circular imports FTW!
+    from pwnlib.util import safeeval
+    from pwnlib.log import getLogger
+    log = getLogger(__name__)
+    for key, value in section.items():
+        if key not in ContextType.defaults:
+            log.warn("Unknown configuration option %r in section %r" % (key, 'context'))
+            continue
+
+        default = ContextType.defaults[key]
+
+        if isinstance(default, (str, unicode, tuple, int, long, list, dict)):
+            value = safeeval.expr(value)
+        else:
+            log.warn("Unsupported configuration option %r in section %r" % (key, 'context'))
+
+        ContextType.defaults[key] = type(default)(value)
+
+register_config('context', update_context_defaults)

pwnlib/data/__init__.py

@@ -0,0 +1,12 @@
+from __future__ import absolute_import
+
+try:
+    # These files are not distributed with Pwntools, but
+    # are in the source tree and used for testing.
+    from pwnlib.data import elf
+except ImportError:
+    pass
+
+import os
+path = os.path.dirname(__file__)
+

pwnlib/data/crcsums.txt

@@ -4,75 +4,102 @@
 # At the time of download, that page was available under the GPLv3 license, which can found here:
 # https://www.gnu.org/licenses/gpl.html
 #
-crc.cat-bits.3 width=3  poly=0x3  init=0x7  refin=true  refout=true  xorout=0x0  check=0x6  name="CRC-3/ROHC"
-crc.cat-bits.4 width=4  poly=0x3  init=0x0  refin=true  refout=true  xorout=0x0  check=0x7  name="CRC-4/ITU"
-crc.cat-bits.5 width=5  poly=0x09  init=0x09  refin=false  refout=false  xorout=0x00  check=0x00  name="CRC-5/EPC"
-crc.cat.crc-5-itu width=5  poly=0x15  init=0x00  refin=true  refout=true  xorout=0x00  check=0x07  name="CRC-5/ITU"
-crc.cat.crc-5-usb width=5  poly=0x05  init=0x1f  refin=true  refout=true  xorout=0x1f  check=0x19  name="CRC-5/USB"
-crc.cat-bits.6 width=6  poly=0x27  init=0x3f  refin=false  refout=false  xorout=0x00  check=0x0d  name="CRC-6/CDMA2000-A"
-crc.cat.crc-6-cdma2000-b width=6  poly=0x07  init=0x3f  refin=false  refout=false  xorout=0x00  check=0x3b  name="CRC-6/CDMA2000-B"
-crc.cat.crc-6-darc width=6  poly=0x19  init=0x00  refin=true  refout=true  xorout=0x00  check=0x26  name="CRC-6/DARC"
-crc.cat.crc-6-itu width=6  poly=0x03  init=0x00  refin=true  refout=true  xorout=0x00  check=0x06  name="CRC-6/ITU"
-crc.cat-bits.7 width=7  poly=0x09  init=0x00  refin=false  refout=false  xorout=0x00  check=0x75  name="CRC-7"
-crc.cat.crc-7-rohc width=7  poly=0x4f  init=0x7f  refin=true  refout=true  xorout=0x00  check=0x53  name="CRC-7/ROHC"
-crc.cat-bits.8 width=8  poly=0x07  init=0x00  refin=false  refout=false  xorout=0x00  check=0xf4  name="CRC-8"
-crc.cat.crc-8-cdma2000 width=8  poly=0x9b  init=0xff  refin=false  refout=false  xorout=0x00  check=0xda  name="CRC-8/CDMA2000"
-crc.cat.crc-8-darc width=8  poly=0x39  init=0x00  refin=true  refout=true  xorout=0x00  check=0x15  name="CRC-8/DARC"
-crc.cat.crc-8-dvb-s2 width=8  poly=0xd5  init=0x00  refin=false  refout=false  xorout=0x00  check=0xbc  name="CRC-8/DVB-S2"
-crc.cat.crc-8-ebu width=8  poly=0x1d  init=0xff  refin=true  refout=true  xorout=0x00  check=0x97  name="CRC-8/EBU"
-crc.cat.crc-8-i-code width=8  poly=0x1d  init=0xfd  refin=false  refout=false  xorout=0x00  check=0x7e  name="CRC-8/I-CODE"
-crc.cat.crc-8-itu width=8  poly=0x07  init=0x00  refin=false  refout=false  xorout=0x55  check=0xa1  name="CRC-8/ITU"
-crc.cat.crc-8-maxim width=8  poly=0x31  init=0x00  refin=true  refout=true  xorout=0x00  check=0xa1  name="CRC-8/MAXIM"
-crc.cat.crc-8-rohc width=8  poly=0x07  init=0xff  refin=true  refout=true  xorout=0x00  check=0xd0  name="CRC-8/ROHC"
-crc.cat.crc-8-wdcma width=8  poly=0x9b  init=0x00  refin=true  refout=true  xorout=0x00  check=0x25  name="CRC-8/WCDMA"
-crc.cat-bits.10 width=10  poly=0x233  init=0x000  refin=false  refout=false  xorout=0x000  check=0x199  name="CRC-10"
-crc.cat.crc-10-cdma2000 width=10  poly=0x3d9  init=0x3ff  refin=false  refout=false  xorout=0x000  check=0x233  name="CRC-10/CDMA2000"
-crc.cat-bits.11 width=11  poly=0x385  init=0x01a  refin=false  refout=false  xorout=0x000  check=0x5a3  name="CRC-11"
-crc.cat-bits.12 width=12  poly=0x80f  init=0x000  refin=false  refout=true  xorout=0x000  check=0xdaf  name="CRC-12/3GPP"
-crc.cat.crc-12-cdma2000 width=12  poly=0xf13  init=0xfff  refin=false  refout=false  xorout=0x000  check=0xd4d  name="CRC-12/CDMA2000"
-crc.cat.crc-12-dect width=12  poly=0x80f  init=0x000  refin=false  refout=false  xorout=0x000  check=0xf5b  name="CRC-12/DECT"
-crc.cat-bits.13 width=13  poly=0x1cf5  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x04fa  name="CRC-13/BBC"
-crc.cat-bits.14 width=14  poly=0x0805  init=0x0000  refin=true  refout=true  xorout=0x0000  check=0x082d  name="CRC-14/DARC"
-crc.cat-bits.15 width=15  poly=0x4599  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x059e  name="CRC-15"
-crc.cat.crc-15-mpt1327 width=15  poly=0x6815  init=0x0000  refin=false  refout=false  xorout=0x0001  check=0x2566  name="CRC-15/MPT1327"
-crc.cat-bits.16 width=16  poly=0x8005  init=0x0000  refin=true  refout=true  xorout=0x0000  check=0xbb3d  name="ARC"
-crc.cat.crc-16-aug-ccitt width=16  poly=0x1021  init=0x1d0f  refin=false  refout=false  xorout=0x0000  check=0xe5cc  name="CRC-16/AUG-CCITT"
-crc.cat.crc-16-buypass width=16  poly=0x8005  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0xfee8  name="CRC-16/BUYPASS"
-crc.cat.crc-16-ccitt-false width=16  poly=0x1021  init=0xffff  refin=false  refout=false  xorout=0x0000  check=0x29b1  name="CRC-16/CCITT-FALSE"
-crc.cat.crc-16-cdma2000 width=16  poly=0xc867  init=0xffff  refin=false  refout=false  xorout=0x0000  check=0x4c06  name="CRC-16/CDMA2000"
-crc.cat.crc-16-dds-110 width=16  poly=0x8005  init=0x800d  refin=false  refout=false  xorout=0x0000  check=0x9ecf  name="CRC-16/DDS-110"
-crc.cat.crc-16-dect-r width=16  poly=0x0589  init=0x0000  refin=false  refout=false  xorout=0x0001  check=0x007e  name="CRC-16/DECT-R"
-crc.cat.crc-16-dect-x width=16  poly=0x0589  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x007f  name="CRC-16/DECT-X"
-crc.cat.crc-16-dnp width=16  poly=0x3d65  init=0x0000  refin=true  refout=true  xorout=0xffff  check=0xea82  name="CRC-16/DNP"
-crc.cat.crc-16-en-13757 width=16  poly=0x3d65  init=0x0000  refin=false  refout=false  xorout=0xffff  check=0xc2b7  name="CRC-16/EN-13757"
-crc.cat.crc-16-genibus width=16  poly=0x1021  init=0xffff  refin=false  refout=false  xorout=0xffff  check=0xd64e  name="CRC-16/GENIBUS"
-crc.cat.crc-16-maxim width=16  poly=0x8005  init=0x0000  refin=true  refout=true  xorout=0xffff  check=0x44c2  name="CRC-16/MAXIM"
-crc.cat.crc-16-mcrf4xx width=16  poly=0x1021  init=0xffff  refin=true  refout=true  xorout=0x0000  check=0x6f91  name="CRC-16/MCRF4XX"
-crc.cat.crc-16-riello width=16  poly=0x1021  init=0xb2aa  refin=true  refout=true  xorout=0x0000  check=0x63d0  name="CRC-16/RIELLO"
-crc.cat.crc-16-t10-dif width=16  poly=0x8bb7  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0xd0db  name="CRC-16/T10-DIF"
-crc.cat.crc-16-teledisk width=16  poly=0xa097  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x0fb3  name="CRC-16/TELEDISK"
-crc.cat.crc-16-tms37157 width=16  poly=0x1021  init=0x89ec  refin=true  refout=true  xorout=0x0000  check=0x26b1  name="CRC-16/TMS37157"
-crc.cat.crc-16-usb width=16  poly=0x8005  init=0xffff  refin=true  refout=true  xorout=0xffff  check=0xb4c8  name="CRC-16/USB"
-crc.cat.crc-a width=16  poly=0x1021  init=0xc6c6  refin=true  refout=true  xorout=0x0000  check=0xbf05  name="CRC-A"
-crc.cat.kermit width=16  poly=0x1021  init=0x0000  refin=true  refout=true  xorout=0x0000  check=0x2189  name="KERMIT"
-crc.cat.modbus width=16  poly=0x8005  init=0xffff  refin=true  refout=true  xorout=0x0000  check=0x4b37  name="MODBUS"
-crc.cat.x-25 width=16  poly=0x1021  init=0xffff  refin=true  refout=true  xorout=0xffff  check=0x906e  name="X-25"
-crc.cat.xmodem width=16  poly=0x1021  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x31c3  name="XMODEM"
-crc.cat-bits.24 width=24  poly=0x864cfb  init=0xb704ce  refin=false  refout=false  xorout=0x000000  check=0x21cf02  name="CRC-24"
-crc.cat.crc-24-flexray-a width=24  poly=0x5d6dcb  init=0xfedcba  refin=false  refout=false  xorout=0x000000  check=0x7979bd  name="CRC-24/FLEXRAY-A"
-crc.cat.crc-24-flexray-b width=24  poly=0x5d6dcb  init=0xabcdef  refin=false  refout=false  xorout=0x000000  check=0x1f23b8  name="CRC-24/FLEXRAY-B"
-crc.cat-bits.31 width=31  poly=0x04c11db7  init=0x7fffffff  refin=false  refout=false  xorout=0x7fffffff  check=0x0ce9e46c  name="CRC-31/PHILIPS"
-crc.cat-bits.32 width=32  poly=0x04c11db7  init=0xffffffff  refin=true  refout=true  xorout=0xffffffff  check=0xcbf43926  name="CRC-32"
-crc.cat.crc-32-bzip2 width=32  poly=0x04c11db7  init=0xffffffff  refin=false  refout=false  xorout=0xffffffff  check=0xfc891918  name="CRC-32/BZIP2"
-crc.cat.crc-32c width=32  poly=0x1edc6f41  init=0xffffffff  refin=true  refout=true  xorout=0xffffffff  check=0xe3069283  name="CRC-32C"
-crc.cat.crc-32d width=32  poly=0xa833982b  init=0xffffffff  refin=true  refout=true  xorout=0xffffffff  check=0x87315576  name="CRC-32D"
-crc.cat.crc-32-mpeg-2 width=32  poly=0x04c11db7  init=0xffffffff  refin=false  refout=false  xorout=0x00000000  check=0x0376e6e7  name="CRC-32/MPEG-2"
-crc.cat.crc-32-posix width=32  poly=0x04c11db7  init=0x00000000  refin=false  refout=false  xorout=0xffffffff  check=0x765e7680  name="CRC-32/POSIX"
-crc.cat.crc-32q width=32  poly=0x814141ab  init=0x00000000  refin=false  refout=false  xorout=0x00000000  check=0x3010bf7f  name="CRC-32Q"
-crc.cat.jamcrc width=32  poly=0x04c11db7  init=0xffffffff  refin=true  refout=true  xorout=0x00000000  check=0x340bc6d9  name="JAMCRC"
-crc.cat.xfer width=32  poly=0x000000af  init=0x00000000  refin=false  refout=false  xorout=0x00000000  check=0xbd0be338  name="XFER"
-crc.cat-bits.40 width=40  poly=0x0004820009  init=0x0000000000  refin=false  refout=false  xorout=0xffffffffff  check=0xd4164fc646  name="CRC-40/GSM"
-crc.cat-bits.64 width=64  poly=0x42f0e1eba9ea3693  init=0x0000000000000000  refin=false  refout=false  xorout=0x0000000000000000  check=0x6c40df5f0b497347  name="CRC-64"
-crc.cat.crc-64-we width=64  poly=0x42f0e1eba9ea3693  init=0xffffffffffffffff  refin=false  refout=false  xorout=0xffffffffffffffff  check=0x62ec59e3f1a4f00a  name="CRC-64/WE"
-crc.cat.crc-64-xz width=64  poly=0x42f0e1eba9ea3693  init=0xffffffffffffffff  refin=true  refout=true  xorout=0xffffffffffffffff  check=0x995dc9bbdf1939fa  name="CRC-64/XZ"
-crc.cat-bits.82 width=82  poly=0x0308c0111011401440411  init=0x000000000000000000000  refin=true  refout=true  xorout=0x000000000000000000000  check=0x09ea83f625023801fd612  name="CRC-82/DARC"
+crc.cat.crc-3-rohc width=3  poly=0x3  init=0x7  refin=true  refout=true  xorout=0x0  check=0x6  residue=0x0  name="CRC-3/ROHC"
+crc.cat-bits.3 width=3  poly=0x3  init=0x0  refin=false  refout=false  xorout=0x7  check=0x4  residue=0x2  name="CRC-3/GSM"
+crc.cat-bits.4 width=4  poly=0x3  init=0xf  refin=false  refout=false  xorout=0xf  check=0xb  residue=0x2  name="CRC-4/INTERLAKEN"
+crc.cat.crc-4-itu width=4  poly=0x3  init=0x0  refin=true  refout=true  xorout=0x0  check=0x7  residue=0x0  name="CRC-4/ITU"
+crc.cat-bits.5 width=5  poly=0x09  init=0x09  refin=false  refout=false  xorout=0x00  check=0x00  residue=0x00  name="CRC-5/EPC"
+crc.cat.crc-5-itu width=5  poly=0x15  init=0x00  refin=true  refout=true  xorout=0x00  check=0x07  residue=0x00  name="CRC-5/ITU"
+crc.cat.crc-5-usb width=5  poly=0x05  init=0x1f  refin=true  refout=true  xorout=0x1f  check=0x19  residue=0x06  name="CRC-5/USB"
+crc.cat-bits.6 width=6  poly=0x27  init=0x3f  refin=false  refout=false  xorout=0x00  check=0x0d  residue=0x00  name="CRC-6/CDMA2000-A"
+crc.cat.crc-6-cdma2000-b width=6  poly=0x07  init=0x3f  refin=false  refout=false  xorout=0x00  check=0x3b  residue=0x00  name="CRC-6/CDMA2000-B"
+crc.cat.crc-6-darc width=6  poly=0x19  init=0x00  refin=true  refout=true  xorout=0x00  check=0x26  residue=0x00  name="CRC-6/DARC"
+crc.cat.crc-6-gsm width=6  poly=0x2f  init=0x00  refin=false  refout=false  xorout=0x3f  check=0x13  residue=0x3a  name="CRC-6/GSM"
+crc.cat.crc-6-itu width=6  poly=0x03  init=0x00  refin=true  refout=true  xorout=0x00  check=0x06  residue=0x00  name="CRC-6/ITU"
+crc.cat-bits.7 width=7  poly=0x09  init=0x00  refin=false  refout=false  xorout=0x00  check=0x75  residue=0x00  name="CRC-7"
+crc.cat.crc-7-rohc width=7  poly=0x4f  init=0x7f  refin=true  refout=true  xorout=0x00  check=0x53  residue=0x00  name="CRC-7/ROHC"
+crc.cat.crc-7-umts width=7  poly=0x45  init=0x00  refin=false  refout=false  xorout=0x00  check=0x61  residue=0x00  name="CRC-7/UMTS"
+crc.cat-bits.8 width=8  poly=0x07  init=0x00  refin=false  refout=false  xorout=0x00  check=0xf4  residue=0x00  name="CRC-8"
+crc.cat.crc-8-autosar width=8  poly=0x2f  init=0xff  refin=false  refout=false  xorout=0xff  check=0xdf  residue=0x42  name="CRC-8/AUTOSAR"
+crc.cat.crc-8-cdma2000 width=8  poly=0x9b  init=0xff  refin=false  refout=false  xorout=0x00  check=0xda  residue=0x00  name="CRC-8/CDMA2000"
+crc.cat.crc-8-darc width=8  poly=0x39  init=0x00  refin=true  refout=true  xorout=0x00  check=0x15  residue=0x00  name="CRC-8/DARC"
+crc.cat.crc-8-dvb-s2 width=8  poly=0xd5  init=0x00  refin=false  refout=false  xorout=0x00  check=0xbc  residue=0x00  name="CRC-8/DVB-S2"
+crc.cat.crc-8-ebu width=8  poly=0x1d  init=0xff  refin=true  refout=true  xorout=0x00  check=0x97  residue=0x00  name="CRC-8/EBU"
+crc.cat.crc-8-gsm-a width=8  poly=0x1d  init=0x00  refin=false  refout=false  xorout=0x00  check=0x37  residue=0x00  name="CRC-8/GSM-A"
+crc.cat.crc-8-gsm-b width=8  poly=0x49  init=0x00  refin=false  refout=false  xorout=0xff  check=0x94  residue=0x53  name="CRC-8/GSM-B"
+crc.cat.crc-8-i-code width=8  poly=0x1d  init=0xfd  refin=false  refout=false  xorout=0x00  check=0x7e  residue=0x00  name="CRC-8/I-CODE"
+crc.cat.crc-8-itu width=8  poly=0x07  init=0x00  refin=false  refout=false  xorout=0x55  check=0xa1  residue=0xac  name="CRC-8/ITU"
+crc.cat.crc-8-lte width=8  poly=0x9b  init=0x00  refin=false  refout=false  xorout=0x00  check=0xea  residue=0x00  name="CRC-8/LTE"
+crc.cat.crc-8-maxim width=8  poly=0x31  init=0x00  refin=true  refout=true  xorout=0x00  check=0xa1  residue=0x00  name="CRC-8/MAXIM"
+crc.cat.crc-8-opensafety width=8  poly=0x2f  init=0x00  refin=false  refout=false  xorout=0x00  check=0x3e  residue=0x00  name="CRC-8/OPENSAFETY"
+crc.cat.crc-8-rohc width=8  poly=0x07  init=0xff  refin=true  refout=true  xorout=0x00  check=0xd0  residue=0x00  name="CRC-8/ROHC"
+crc.cat.crc-8-sae-j1850 width=8  poly=0x1d  init=0xff  refin=false  refout=false  xorout=0xff  check=0x4b  residue=0xc4  name="CRC-8/SAE-J1850"
+crc.cat.crc-8-wdcma width=8  poly=0x9b  init=0x00  refin=true  refout=true  xorout=0x00  check=0x25  residue=0x00  name="CRC-8/WCDMA"
+crc.cat-bits.10 width=10  poly=0x233  init=0x000  refin=false  refout=false  xorout=0x000  check=0x199  residue=0x000  name="CRC-10"
+crc.cat.crc-10-cdma2000 width=10  poly=0x3d9  init=0x3ff  refin=false  refout=false  xorout=0x000  check=0x233  residue=0x000  name="CRC-10/CDMA2000"
+crc.cat.crc-10-gsm width=10  poly=0x175  init=0x000  refin=false  refout=false  xorout=0x3ff  check=0x12a  residue=0x0c6  name="CRC-10/GSM"
+crc.cat-bits.11 width=11  poly=0x385  init=0x01a  refin=false  refout=false  xorout=0x000  check=0x5a3  residue=0x000  name="CRC-11"
+crc.cat.crc-11-umts width=11  poly=0x307  init=0x000  refin=false  refout=false  xorout=0x000  check=0x061  residue=0x000  name="CRC-11/UMTS"
+crc.cat-bits.12 width=12  poly=0xf13  init=0xfff  refin=false  refout=false  xorout=0x000  check=0xd4d  residue=0x000  name="CRC-12/CDMA2000"
+crc.cat.crc-12-dect width=12  poly=0x80f  init=0x000  refin=false  refout=false  xorout=0x000  check=0xf5b  residue=0x000  name="CRC-12/DECT"
+crc.cat.crc-12-gsm width=12  poly=0xd31  init=0x000  refin=false  refout=false  xorout=0xfff  check=0xb34  residue=0x178  name="CRC-12/GSM"
+crc.cat.crc-12-umts width=12  poly=0x80f  init=0x000  refin=false  refout=true  xorout=0x000  check=0xdaf  residue=0x000  name="CRC-12/UMTS"
+crc.cat-bits.13 width=13  poly=0x1cf5  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x04fa  residue=0x0000  name="CRC-13/BBC"
+crc.cat-bits.14 width=14  poly=0x0805  init=0x0000  refin=true  refout=true  xorout=0x0000  check=0x082d  residue=0x0000  name="CRC-14/DARC"
+crc.cat.crc-14-gsm width=14  poly=0x202d  init=0x0000  refin=false  refout=false  xorout=0x3fff  check=0x30ae  residue=0x031e  name="CRC-14/GSM"
+crc.cat-bits.15 width=15  poly=0x4599  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x059e  residue=0x0000  name="CRC-15"
+crc.cat.crc-15-mpt1327 width=15  poly=0x6815  init=0x0000  refin=false  refout=false  xorout=0x0001  check=0x2566  residue=0x6815  name="CRC-15/MPT1327"
+crc.cat-bits.16 width=16  poly=0x8005  init=0x0000  refin=true  refout=true  xorout=0x0000  check=0xbb3d  residue=0x0000  name="ARC"
+crc.cat.crc-16-aug-ccitt width=16  poly=0x1021  init=0x1d0f  refin=false  refout=false  xorout=0x0000  check=0xe5cc  residue=0x0000  name="CRC-16/AUG-CCITT"
+crc.cat.crc-16-buypass width=16  poly=0x8005  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0xfee8  residue=0x0000  name="CRC-16/BUYPASS"
+crc.cat.crc-16-ccitt-false width=16  poly=0x1021  init=0xffff  refin=false  refout=false  xorout=0x0000  check=0x29b1  residue=0x0000  name="CRC-16/CCITT-FALSE"
+crc.cat.crc-16-cdma2000 width=16  poly=0xc867  init=0xffff  refin=false  refout=false  xorout=0x0000  check=0x4c06  residue=0x0000  name="CRC-16/CDMA2000"
+crc.cat.crc-16-cms width=16  poly=0x8005  init=0xffff  refin=false  refout=false  xorout=0x0000  check=0xaee7  residue=0x0000  name="CRC-16/CMS"
+crc.cat.crc-16-dds-110 width=16  poly=0x8005  init=0x800d  refin=false  refout=false  xorout=0x0000  check=0x9ecf  residue=0x0000  name="CRC-16/DDS-110"
+crc.cat.crc-16-dect-r width=16  poly=0x0589  init=0x0000  refin=false  refout=false  xorout=0x0001  check=0x007e  residue=0x0589  name="CRC-16/DECT-R"
+crc.cat.crc-16-dect-x width=16  poly=0x0589  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x007f  residue=0x0000  name="CRC-16/DECT-X"
+crc.cat.crc-16-dnp width=16  poly=0x3d65  init=0x0000  refin=true  refout=true  xorout=0xffff  check=0xea82  residue=0x66c5  name="CRC-16/DNP"
+crc.cat.crc-16-en-13757 width=16  poly=0x3d65  init=0x0000  refin=false  refout=false  xorout=0xffff  check=0xc2b7  residue=0xa366  name="CRC-16/EN-13757"
+crc.cat.crc-16-genibus width=16  poly=0x1021  init=0xffff  refin=false  refout=false  xorout=0xffff  check=0xd64e  residue=0x1d0f  name="CRC-16/GENIBUS"
+crc.cat.crc-16-gsm width=16  poly=0x1021  init=0x0000  refin=false  refout=false  xorout=0xffff  check=0xce3c  residue=0x1d0f  name="CRC-16/GSM"
+crc.cat.crc-16-lj1200 width=16  poly=0x6f63  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0xbdf4  residue=0x0000  name="CRC-16/LJ1200"
+crc.cat.crc-16-maxim width=16  poly=0x8005  init=0x0000  refin=true  refout=true  xorout=0xffff  check=0x44c2  residue=0xb001  name="CRC-16/MAXIM"
+crc.cat.crc-16-mcrf4xx width=16  poly=0x1021  init=0xffff  refin=true  refout=true  xorout=0x0000  check=0x6f91  residue=0x0000  name="CRC-16/MCRF4XX"
+crc.cat.crc-16-opensafety-a width=16  poly=0x5935  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x5d38  residue=0x0000  name="CRC-16/OPENSAFETY-A"
+crc.cat.crc-16-opensafety-a width=16  poly=0x755b  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x20fe  residue=0x0000  name="CRC-16/OPENSAFETY-B"
+crc.cat.crc-16-profibus width=16  poly=0x1dcf  init=0xffff  refin=false  refout=false  xorout=0xffff  check=0xa819  residue=0xe394  name="CRC-16/PROFIBUS"
+crc.cat.crc-16-riello width=16  poly=0x1021  init=0xb2aa  refin=true  refout=true  xorout=0x0000  check=0x63d0  residue=0x0000  name="CRC-16/RIELLO"
+crc.cat.crc-16-t10-dif width=16  poly=0x8bb7  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0xd0db  residue=0x0000  name="CRC-16/T10-DIF"
+crc.cat.crc-16-teledisk width=16  poly=0xa097  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x0fb3  residue=0x0000  name="CRC-16/TELEDISK"
+crc.cat.crc-16-tms37157 width=16  poly=0x1021  init=0x89ec  refin=true  refout=true  xorout=0x0000  check=0x26b1  residue=0x0000  name="CRC-16/TMS37157"
+crc.cat.crc-16-usb width=16  poly=0x8005  init=0xffff  refin=true  refout=true  xorout=0xffff  check=0xb4c8  residue=0xb001  name="CRC-16/USB"
+crc.cat.crc-a width=16  poly=0x1021  init=0xc6c6  refin=true  refout=true  xorout=0x0000  check=0xbf05  residue=0x0000  name="CRC-A"
+crc.cat.kermit width=16  poly=0x1021  init=0x0000  refin=true  refout=true  xorout=0x0000  check=0x2189  residue=0x0000  name="KERMIT"
+crc.cat.modbus width=16  poly=0x8005  init=0xffff  refin=true  refout=true  xorout=0x0000  check=0x4b37  residue=0x0000  name="MODBUS"
+crc.cat.x-25 width=16  poly=0x1021  init=0xffff  refin=true  refout=true  xorout=0xffff  check=0x906e  residue=0xf0b8  name="X-25"
+crc.cat.xmodem width=16  poly=0x1021  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x31c3  residue=0x0000  name="XMODEM"
+crc.cat-bits.24 width=24  poly=0x864cfb  init=0xb704ce  refin=false  refout=false  xorout=0x000000  check=0x21cf02  residue=0x000000  name="CRC-24"
+crc.cat.crc-24-ble width=24  poly=0x00065b  init=0x555555  refin=true  refout=true  xorout=0x000000  check=0xc25a56  residue=0x000000  name="CRC-24/BLE"
+crc.cat.crc-24-flexray-a width=24  poly=0x5d6dcb  init=0xfedcba  refin=false  refout=false  xorout=0x000000  check=0x7979bd  residue=0x000000  name="CRC-24/FLEXRAY-A"
+crc.cat.crc-24-flexray-b width=24  poly=0x5d6dcb  init=0xabcdef  refin=false  refout=false  xorout=0x000000  check=0x1f23b8  residue=0x000000  name="CRC-24/FLEXRAY-B"
+crc.cat.crc-24-interlaken width=24  poly=0x328b63  init=0xffffff  refin=false  refout=false  xorout=0xffffff  check=0xb4f3e6  residue=0x144e63  name="CRC-24/INTERLAKEN"
+crc.cat.crc-24-lte-a width=24  poly=0x864cfb  init=0x000000  refin=false  refout=false  xorout=0x000000  check=0xcde703  residue=0x000000  name="CRC-24/LTE-A"
+crc.cat.crc-24-lte-b width=24  poly=0x800063  init=0x000000  refin=false  refout=false  xorout=0x000000  check=0x23ef52  residue=0x000000  name="CRC-24/LTE-B"
+crc.cat-bits.30 width=30  poly=0x2030b9c7  init=0x3fffffff  refin=false  refout=false  xorout=0x3fffffff  check=0x04c34abf  residue=0x34efa55a  name="CRC-30/CDMA"
+crc.cat-bits.31 width=31  poly=0x04c11db7  init=0x7fffffff  refin=false  refout=false  xorout=0x7fffffff  check=0x0ce9e46c  residue=0x4eaf26f1  name="CRC-31/PHILIPS"
+crc.cat-bits.32 width=32  poly=0x04c11db7  init=0xffffffff  refin=true  refout=true  xorout=0xffffffff  check=0xcbf43926  residue=0xdebb20e3  name="CRC-32"
+crc.cat.crc-32-autosar width=32  poly=0xf4acfb13  init=0xffffffff  refin=true  refout=true  xorout=0xffffffff  check=0x1697d06a  residue=0x904cddbf  name="CRC-32/AUTOSAR"
+crc.cat.crc-32-bzip2 width=32  poly=0x04c11db7  init=0xffffffff  refin=false  refout=false  xorout=0xffffffff  check=0xfc891918  residue=0xc704dd7b  name="CRC-32/BZIP2"
+crc.cat.crc-32c width=32  poly=0x1edc6f41  init=0xffffffff  refin=true  refout=true  xorout=0xffffffff  check=0xe3069283  residue=0xb798b438  name="CRC-32C"
+crc.cat.crc-32d width=32  poly=0xa833982b  init=0xffffffff  refin=true  refout=true  xorout=0xffffffff  check=0x87315576  residue=0x45270551  name="CRC-32D"
+crc.cat.crc-32-mpeg-2 width=32  poly=0x04c11db7  init=0xffffffff  refin=false  refout=false  xorout=0x00000000  check=0x0376e6e7  residue=0x00000000  name="CRC-32/MPEG-2"
+crc.cat.crc-32-posix width=32  poly=0x04c11db7  init=0x00000000  refin=false  refout=false  xorout=0xffffffff  check=0x765e7680  residue=0xc704dd7b  name="CRC-32/POSIX"
+crc.cat.crc-32q width=32  poly=0x814141ab  init=0x00000000  refin=false  refout=false  xorout=0x00000000  check=0x3010bf7f  residue=0x00000000  name="CRC-32Q"
+crc.cat.jamcrc width=32  poly=0x04c11db7  init=0xffffffff  refin=true  refout=true  xorout=0x00000000  check=0x340bc6d9  residue=0x00000000  name="JAMCRC"
+crc.cat.xfer width=32  poly=0x000000af  init=0x00000000  refin=false  refout=false  xorout=0x00000000  check=0xbd0be338  residue=0x00000000  name="XFER"
+crc.cat-bits.40 width=40  poly=0x0004820009  init=0x0000000000  refin=false  refout=false  xorout=0xffffffffff  check=0xd4164fc646  residue=0xc4ff8071ff  name="CRC-40/GSM"
+crc.cat-bits.64 width=64  poly=0x42f0e1eba9ea3693  init=0x0000000000000000  refin=false  refout=false  xorout=0x0000000000000000  check=0x6c40df5f0b497347  residue=0x0000000000000000  name="CRC-64"
+crc.cat.crc-64-go-iso width=64  poly=0x000000000000001b  init=0xffffffffffffffff  refin=true  refout=true  xorout=0xffffffffffffffff  check=0xb90956c775a41001  residue=0x5300000000000000  name="CRC-64/GO-ISO"
+crc.cat.crc-64-we width=64  poly=0x42f0e1eba9ea3693  init=0xffffffffffffffff  refin=false  refout=false  xorout=0xffffffffffffffff  check=0x62ec59e3f1a4f00a  residue=0xfcacbebd5931a992  name="CRC-64/WE"
+crc.cat.crc-64-xz width=64  poly=0x42f0e1eba9ea3693  init=0xffffffffffffffff  refin=true  refout=true  xorout=0xffffffffffffffff  check=0x995dc9bbdf1939fa  residue=0x49958c9abd7d353f  name="CRC-64/XZ"
+crc.cat-bits.82 width=82  poly=0x0308c0111011401440411  init=0x000000000000000000000  refin=true  refout=true  xorout=0x000000000000000000000  check=0x09ea83f625023801fd612  residue=0x000000000000000000000  name="CRC-82/DARC"

pwnlib/data/elf/__init__.py

@@ -0,0 +1,8 @@
+from __future__ import absolute_import
+from pwnlib.data.elf import relro
+
+import os
+path = os.path.dirname(__file__)
+
+def get(x):
+    return os.path.join(path, x)

pwnlib/data/elf/relro/__init__.py

@@ -0,0 +1,5 @@
+import os
+path = os.path.dirname(__file__)
+
+def get(x):
+    return os.path.join(path, x)

pwnlib/data/includes/generator/linux/diet/aarch64/syscalls.h

@@ -262,62 +262,3 @@
 #define __NR_process_vm_writev 271
 #define __NR_kcmp 272
 #define __NR_finit_module 273
-#define __NR_open 1024
-#define __NR_link 1025
-#define __NR_unlink 1026
-#define __NR_mknod 1027
-#define __NR_chmod 1028
-#define __NR_chown 1029
-#define __NR_mkdir 1030
-#define __NR_rmdir 1031
-#define __NR_lchown 1032
-#define __NR_access 1033
-#define __NR_rename 1034
-#define __NR_readlink 1035
-#define __NR_symlink 1036
-#define __NR_utimes 1037
-#define __NR_stat 1038
-#define __NR_lstat 1039
-#define __NR_pipe 1040
-#define __NR_dup2 1041
-#define __NR_epoll_create 1042
-#define __NR_inotify_init 1043
-#define __NR_eventfd 1044
-#define __NR_signalfd 1045
-#define __NR_sendfile64 1046
-#define __NR_ftruncate64 1047
-#define __NR_truncate64 1048
-#define __NR_stat64 1049
-#define __NR_lstat64 1050
-#define __NR_fstat64 1051
-#define __NR_fcntl64 1052
-/* #define __NR_fadvise64 1053 */
-#define __NR_newfstatat 1054
-#define __NR_fstatfs64 1055
-#define __NR_statfs64 1056
-#define __NR_lseek64 1057
-#define __NR_mmap64 1058
-#define __NR_alarm 1059
-#define __NR_getpgrp 1060
-#define __NR_pause 1061
-#define __NR_time 1062
-#define __NR_utime 1063
-#define __NR_creat 1064
-#define __NR_getdents 1065
-#define __NR_futimesat 1066
-#define __NR_select 1067
-#define __NR_poll 1068
-#define __NR_epoll_wait 1069
-#define __NR_ustat 1070
-#define __NR_vfork 1071
-#define __NR_oldwait4 1072
-#define __NR_recv 1073
-#define __NR_send 1074
-#define __NR_bdflush 1075
-#define __NR_umount 1076
-#define __NR_uselib 1077
-#define __NR__sysctl 1078
-#define __NR_fork 1079
-#define __NR_syscalls (__NR_fork+1)
-
-#define __NR_sigreturn 1999

pwnlib/data/includes/linux/aarch64.h

@@ -257,63 +257,6 @@
 #define __NR_process_vm_writev 271
 #define __NR_kcmp 272
 #define __NR_finit_module 273
-#define __NR_open 1024
-#define __NR_link 1025
-#define __NR_unlink 1026
-#define __NR_mknod 1027
-#define __NR_chmod 1028
-#define __NR_chown 1029
-#define __NR_mkdir 1030
-#define __NR_rmdir 1031
-#define __NR_lchown 1032
-#define __NR_access 1033
-#define __NR_rename 1034
-#define __NR_readlink 1035
-#define __NR_symlink 1036
-#define __NR_utimes 1037
-#define __NR_stat 1038
-#define __NR_lstat 1039
-#define __NR_pipe 1040
-#define __NR_dup2 1041
-#define __NR_epoll_create 1042
-#define __NR_inotify_init 1043
-#define __NR_eventfd 1044
-#define __NR_signalfd 1045
-#define __NR_sendfile64 1046
-#define __NR_ftruncate64 1047
-#define __NR_truncate64 1048
-#define __NR_stat64 1049
-#define __NR_lstat64 1050
-#define __NR_fstat64 1051
-#define __NR_fcntl64 1052
-#define __NR_newfstatat 1054
-#define __NR_fstatfs64 1055
-#define __NR_statfs64 1056
-#define __NR_lseek64 1057
-#define __NR_mmap64 1058
-#define __NR_alarm 1059
-#define __NR_getpgrp 1060
-#define __NR_pause 1061
-#define __NR_time 1062
-#define __NR_utime 1063
-#define __NR_creat 1064
-#define __NR_getdents 1065
-#define __NR_futimesat 1066
-#define __NR_select 1067
-#define __NR_poll 1068
-#define __NR_epoll_wait 1069
-#define __NR_ustat 1070
-#define __NR_vfork 1071
-#define __NR_oldwait4 1072
-#define __NR_recv 1073
-#define __NR_send 1074
-#define __NR_bdflush 1075
-#define __NR_umount 1076
-#define __NR_uselib 1077
-#define __NR__sysctl 1078
-#define __NR_fork 1079
-#define __NR_syscalls (1079+1)
-#define __NR_sigreturn 1999
 #define MAP_32BIT 0x40
 #define INADDR_ANY 0
 #define INADDR_BROADCAST 0xffffffff
@@ -942,19 +885,14 @@
 #define PCMASK 0
 #define SYS_accept 202
 #define SYS_accept4 242
-#define SYS_access 1033
 #define SYS_acct 89
 #define SYS_add_key 217
 #define SYS_adjtimex 171
-#define SYS_alarm 1059
-#define SYS_bdflush 1075
 #define SYS_bind 200
 #define SYS_brk 214
 #define SYS_capget 90
 #define SYS_capset 91
 #define SYS_chdir 49
-#define SYS_chmod 1028
-#define SYS_chown 1029
 #define SYS_chroot 51
 #define SYS_clock_getres 114
 #define SYS_clock_gettime 113
@@ -963,17 +901,12 @@
 #define SYS_clone 220
 #define SYS_close 57
 #define SYS_connect 203
-#define SYS_creat 1064
 #define SYS_delete_module 106
 #define SYS_dup 23
-#define SYS_dup2 1041
 #define SYS_dup3 24
-#define SYS_epoll_create 1042
 #define SYS_epoll_create1 20
 #define SYS_epoll_ctl 21
 #define SYS_epoll_pwait 22
-#define SYS_epoll_wait 1069
-#define SYS_eventfd 1044
 #define SYS_eventfd2 19
 #define SYS_execve 221
 #define SYS_exit 93
@@ -989,27 +922,20 @@
 #define SYS_fchown 55
 #define SYS_fchownat 54
 #define SYS_fcntl 25
-#define SYS_fcntl64 1052
 #define SYS_fdatasync 83
 #define SYS_fgetxattr 10
 #define SYS_flistxattr 13
 #define SYS_flock 32
-#define SYS_fork 1079
 #define SYS_fremovexattr 16
 #define SYS_fsetxattr 7
 #define SYS_fstat 80
-#define SYS_fstat64 1051
 #define SYS_fstatat64 79
 #define SYS_fstatfs 44
-#define SYS_fstatfs64 1055
 #define SYS_fsync 82
 #define SYS_ftruncate 46
-#define SYS_ftruncate64 1047
 #define SYS_futex 98
-#define SYS_futimesat 1066
 #define SYS_getcpu 168
 #define SYS_getcwd 17
-#define SYS_getdents 1065
 #define SYS_getdents64 61
 #define SYS_getegid 177
 #define SYS_geteuid 175
@@ -1019,7 +945,6 @@
 #define SYS_get_mempolicy 236
 #define SYS_getpeername 205
 #define SYS_getpgid 155
-#define SYS_getpgrp 1060
 #define SYS_getpid 172
 #define SYS_getppid 173
 #define SYS_getpriority 141
@@ -1037,7 +962,6 @@
 #define SYS_getxattr 8
 #define SYS_init_module 105
 #define SYS_inotify_add_watch 27
-#define SYS_inotify_init 1043
 #define SYS_inotify_init1 26
 #define SYS_inotify_rm_watch 28
 #define SYS_io_cancel 3
@@ -1051,9 +975,7 @@
 #define SYS_kexec_load 104
 #define SYS_keyctl 219
 #define SYS_kill 129
-#define SYS_lchown 1032
 #define SYS_lgetxattr 9
-#define SYS_link 1025
 #define SYS_linkat 37
 #define SYS_listen 201
 #define SYS_listxattr 11
@@ -1062,15 +984,11 @@
 #define SYS_lremovexattr 15
 #define SYS_lseek 62
 #define SYS_lsetxattr 6
-#define SYS_lstat 1039
-#define SYS_lstat64 1050
 #define SYS_madvise 233
 #define SYS_mbind 235
 #define SYS_migrate_pages 238
 #define SYS_mincore 232
-#define SYS_mkdir 1030
 #define SYS_mkdirat 34
-#define SYS_mknod 1027
 #define SYS_mknodat 33
 #define SYS_mlock 228
 #define SYS_mlockall 230
@@ -1094,17 +1012,12 @@
 #define SYS_munlockall 231
 #define SYS_munmap 215
 #define SYS_nanosleep 101
-#define SYS_newfstatat 1054
 #define SYS_nfsservctl 42
-#define SYS_open 1024
 #define SYS_openat 56
-#define SYS_pause 1061
 #define SYS_perf_event_open 241
 #define SYS_personality 92
-#define SYS_pipe 1040
 #define SYS_pipe2 59
 #define SYS_pivot_root 41
-#define SYS_poll 1068
 #define SYS_ppoll 73
 #define SYS_prctl 167
 #define SYS_pread64 67
@@ -1117,21 +1030,17 @@
 #define SYS_quotactl 60
 #define SYS_read 63
 #define SYS_readahead 213
-#define SYS_readlink 1035
 #define SYS_readlinkat 78
 #define SYS_readv 65
 #define SYS_reboot 142
-#define SYS_recv 1073
 #define SYS_recvfrom 207
 #define SYS_recvmmsg 243
 #define SYS_recvmsg 212
 #define SYS_remap_file_pages 234
 #define SYS_removexattr 14
-#define SYS_rename 1034
 #define SYS_renameat 38
 #define SYS_request_key 218
 #define SYS_restart_syscall 128
-#define SYS_rmdir 1031
 #define SYS_rt_sigaction 134
 #define SYS_rt_sigpending 136
 #define SYS_rt_sigprocmask 135
@@ -1150,14 +1059,11 @@
 #define SYS_sched_setparam 118
 #define SYS_sched_setscheduler 119
 #define SYS_sched_yield 124
-#define SYS_select 1067
 #define SYS_semctl 191
 #define SYS_semget 190
 #define SYS_semop 193
 #define SYS_semtimedop 192
-#define SYS_send 1074
 #define SYS_sendfile 71
-#define SYS_sendfile64 1046
 #define SYS_sendmsg 211
 #define SYS_sendto 206
 #define SYS_setdomainname 162
@@ -1188,28 +1094,20 @@
 #define SYS_shmget 194
 #define SYS_shutdown 210
 #define SYS_sigaltstack 132
-#define SYS_signalfd 1045
 #define SYS_signalfd4 74
-#define SYS_sigreturn 1999
 #define SYS_socket 198
 #define SYS_socketpair 199
 #define SYS_splice 76
-#define SYS_stat 1038
-#define SYS_stat64 1049
 #define SYS_statfs 43
-#define SYS_statfs64 1056
 #define SYS_swapoff 225
 #define SYS_swapon 224
-#define SYS_symlink 1036
 #define SYS_symlinkat 36
 #define SYS_sync 81
 #define SYS_sync_file_range2 84
-#define SYS__sysctl 1078
 #define SYS_sysinfo 179
 #define SYS_syslog 116
 #define SYS_tee 77
 #define SYS_tgkill 131
-#define SYS_time 1062
 #define SYS_timer_create 107
 #define SYS_timer_delete 111
 #define SYS_timerfd_create 85
@@ -1221,20 +1119,12 @@
 #define SYS_times 153
 #define SYS_tkill 130
 #define SYS_truncate 45
-#define SYS_truncate64 1048
 #define SYS_umask 166
-#define SYS_umount 1076
 #define SYS_umount2 39
 #define SYS_uname 160
-#define SYS_unlink 1026
 #define SYS_unlinkat 35
 #define SYS_unshare 97
-#define SYS_uselib 1077
-#define SYS_ustat 1070
-#define SYS_utime 1063
 #define SYS_utimensat 88
-#define SYS_utimes 1037
-#define SYS_vfork 1071
 #define SYS_vhangup 58
 #define SYS_vmsplice 75
 #define SYS_wait4 260

pwnlib/data/templates/pwnup.mako

@@ -0,0 +1,139 @@
+<%page args="binary, host=None, port=None, user=None, password=None, remote_path=None"/>\
+<%
+from pwnlib.context import context as ctx
+from pwnlib.elf.elf import ELF
+from elftools.common.exceptions import ELFError
+
+import os
+try:
+    if binary:
+        ctx.binary = ELF(binary, checksec=False)
+except ELFError:
+    pass
+
+if not binary:
+    binary = './path/to/binary'
+
+exe = os.path.basename(binary)
+
+ssh = user or password
+if ssh and not port:
+    port = 22
+elif host and not port:
+    port = 4141
+
+remote_path = remote_path or exe
+password = password or 'secret1234'
+binary_repr = repr(binary)
+%>\
+#!/usr/bin/env python2
+# -*- coding: utf-8 -*-
+from pwn import *
+
+# Set up pwntools for the correct architecture
+%if ctx.binary:
+exe = context.binary = ELF(${binary_repr})
+<% binary_repr = 'exe.path' %>
+%else:
+context.update(arch='i386')
+exe = ${binary_repr}
+<% binary_repr = 'exe' %>
+%endif
+
+# Many built-in settings can be controlled on the command-line and show up
+# in "args".  For example, to dump all data sent/received, and disable ASLR
+# for all created processes...
+# ./exploit.py DEBUG NOASLR
+%if host or port or user:
+# ./exploit.py GDB HOST=example.com PORT=4141
+%endif
+%if host:
+host = args.HOST or ${repr(host)}
+%endif
+%if port:
+port = int(args.PORT or ${port})
+%endif
+%if user:
+user = args.USER or ${repr(user)}
+password = args.PASSWORD or ${repr(password)}
+%endif
+%if ssh:
+remote_path = ${repr(remote_path)}
+%endif
+
+%if exe or remote_path:
+# Specify your GDB script here for debugging
+# GDB will be launched if the exploit is run via e.g.
+# ./exploit.py GDB
+gdbscript = '''
+%if ctx.binary:
+  %if 'main' in ctx.binary.symbols:
+break *0x{exe.symbols.main:x}
+  %else:
+break *0x{exe.entry:x}
+  %endif
+%endif
+continue
+'''.format(**locals())
+%endif
+
+%if ssh:
+# Connect to the remote SSH server
+shell = None
+if not args.LOCAL:
+    shell = ssh(user, host, port, password)
+    shell.set_working_directory(symlink=True)
+%endif
+
+%if host:
+# Execute the target binary locally
+def local(argv=[], *a, **kw):
+    if args.GDB:
+        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
+    else:
+        return process([exe.path] + argv, *a, **kw)
+
+%if ssh:
+# Execute the target binary on the remote host
+%else:
+# Connect to the process on the remote host
+%endif
+def remote(argv=[], *a, **kw):
+  %if ssh:
+    if args.GDB:
+        return gdb.debug([remote_path] + argv, gdbscript=gdbscript, ssh=shell, *a, **kw)
+    else:
+        return shell.process([remote_path] + argv, *a, **kw)
+  %else:
+    io = connect(host, port)
+    if args.GDB:
+        gdb.attach(io, gdbscript=gdbscript)
+    return io
+  %endif
+%endif
+
+%if host:
+start = local if args.LOCAL else remote
+%else:
+def start(argv=[], *a, **kw):
+    if args.GDB:
+        return gdb.debug([${binary_repr}] + argv, gdbscript=gdbscript, *a, **kw)
+    else:
+        return process([${binary_repr}] + argv, *a, **kw)
+%endif
+
+#===========================================================
+#                    EXPLOIT GOES HERE
+#===========================================================
+io = start()
+
+# shellcode = asm(shellcraft.sh())
+# payload = fit({
+#     32: 0xdeadbeef,
+#     'iaaa': [1, 2, 'Hello', 3]
+# }, length=128)
+# io.send(payload)
+# flag = io.recv(...)
+# log.success(flag)
+
+io.interactive()