Release 3.9.0

* Force use of Ubuntu 12 builds on Travis CI until we can migrate to 14

* Fix Travis Dockerfile

* Add bash command logging to Travis scripts, since Travis removed its own logging

* curl should follow redirects when grabbing Ubuntu packages

* Update Travis cache directories to newer version of Python, as seen in Travis logs

* Use ::1 instead of ip6-localhost since Travis 12.04 changes broke it

.github/ISSUE_TEMPLATE.md

@@ -4,6 +4,11 @@ Thanks for contributing to Pwntools!
 
 When reporting an issue, be sure that you are running the latest released version of pwntools (`pip install --upgrade pwntools`).
 
-Please verify that your issue occurs on 64-bit Ubuntu 14.04.  You can use the Dockerfile in `extra/docker/Dockerfile` to save time.
+Please verify that your issue occurs on 64-bit Ubuntu 14.04.  You can use the Dockerfile on `docker.io` for quick testing.
+
+```
+$ docker pull pwntools/pwntools:stable
+$ docker run -it pwntools/pwntools:stable
+```
 
 If possible, provide a proof-of-concept which demonstrates the problem.  Include any binaries or scripts necessary to reproduce the issue, and please include the full debug output via setting the environment variable `PWNLIB_DEBUG=1`.

.travis.yml

@@ -1,10 +1,9 @@
-sudo: false
+dist: precise
 language: python
 addons:
   apt:
     packages:
     - gcc-multilib
-    - gcc-4.6-arm-linux-gnueabihf
     - lib32stdc++6
     - ash
     - bash
@@ -18,8 +17,8 @@ cache:
     - pip
     - directories:
         - usr
-        - /home/travis/virtualenv/python2.7.9/lib/python2.7/site-packages/
-        - /home/travis/virtualenv/python2.7.9/bin/
+        - /home/travis/virtualenv/python2.7.13/lib/python2.7/site-packages/
+        - /home/travis/virtualenv/python2.7.13/bin/
 python:
   - "2.7"
 before_install:

CHANGELOG.md

@@ -9,9 +9,14 @@ The table below shows which release corresponds to each branch, and what date th
 
 | Version          | Branch   | Release Date           |
 | ---------------- | -------- | ---------------------- |
-| [3.8.0](#380)    | `dev`    | Jul 28, 2017 (planned)
-| [3.7.0](#370)    | `beta`   | Jun 17, 2017 (planned)
-| [3.6.0](#360)    | `stable` | May 8, 2017
+| [3.11.0](#3110)  | `dev`    | Dec 2, 2017 (planned)
+| [3.10.0](#3100)  | `beta`   | Oct 21, 2017 (planned)
+| [3.9.0](#390)    | `stable` | Sep 11, 2017
+| [3.8.0](#380)    |          | Jul 29, 2017
+| [3.7.1](#371)    |          | Jul 14, 2017
+| [3.7.0](#370)    |          | Jun 19, 2017
+| [3.6.1](#361)    |          | May 12, 2017
+| [3.6.0](#360)    |          | May 8, 2017
 | [3.5.1](#351)    |          | Apr 15, 2017
 | [3.5.0](#350)    |          | Mar 26, 2017
 | [3.4.1](#341)    |          | Feb 17, 2017
@@ -32,17 +37,59 @@ The table below shows which release corresponds to each branch, and what date th
 | [3.0.0](#300)    |          | Aug 20, 2016
 | [2.2.0](#220)    |          | Jan 5, 2015
 
+## 3.11.0
+
+To be released on Dec 2, 2017.
+
+## 3.10.0
+
+To be released on Oct 21, 2017.
+
+## 3.9.0
+
+- [#1003][1003] Make `concat_all` faster while also simplifying it's logic
+- [#1014][1014] Fix for overwritten env when parsing core file
+- [#1023][1023] Fixes to Travis CI
+
+[1003]: https://github.com/Gallopsled/pwntools/pull/1003
+[1014]: https://github.com/Gallopsled/pwntools/pull/1014
+[1023]: https://github.com/Gallopsled/pwntools/pull/1023
+
 ## 3.8.0
 
-To be on Jul 28, 2017.
+- [#981][981] Fixed RELRO detection logic
+- [#986][986] Enhancements to DynELF for controlling usage of LibcDB
+- A few documentation fixes
+- A few fixes for the Docker image
+
+[981]: https://github.com/Gallopsled/pwntools/pull/981
+[986]: https://github.com/Gallopsled/pwntools/pull/986
+
+## 3.7.1
+
+- [#998][998] Fix a bug where integer values could not be set in `.pwn.conf`.
+
+[998]: https://github.com/Gallopsled/pwntools/pull/998
 
 ## 3.7.0
 
-To be on Jun 17, 2017.
+- [#933][933] DynELF works better with different base addresses
+- [#952][952] A few small fixes were made to `pwn template`, and the CRC database was updated.
+- [5c72d62c][5c72d62c] Updated the CRC database
 
-As of May 4, 2017, there have been no new features or major notable changes since 3.6.0.
+[933]: https://github.com/Gallopsled/pwntools/pull/933
+[952]: https://github.com/Gallopsled/pwntools/pull/952
+[5c72d62c]: https://github.com/Gallopsled/pwntools/commit/5c72d62c
 
-A few typos were fixed, a few Linux kernel configuration flags were added, and a few error messages were enhanced.
+## 3.6.1
+
+- [#979][979]+[1a4a1e1][1a4a1e1] Fixed [#974][974], a bug related to the terminal handling and numlock.
+- [#980][980] Fixed the `pwn template` command.
+
+[974]: https://github.com/Gallopsled/pwntools/issues/974
+[979]: https://github.com/Gallopsled/pwntools/pull/979
+[980]: https://github.com/Gallopsled/pwntools/pull/980
+[1a4a1e1]: https://github.com/Gallopsled/pwntools/commit/1a4a1e1
 
 ## 3.6.0
 

MANIFEST.in

@@ -2,6 +2,6 @@ graft examples
 graft extra
 include *.md *.txt *.sh *.yml MANIFEST.in
 recursive-include docs   *.rst *.png Makefile *.py *.txt
-recursive-include pwnlib *.py *.asm *.rst *.md *.txt *.sh __doc__
+recursive-include pwnlib *.py *.asm *.rst *.md *.txt *.sh __doc__ *.mako
 recursive-include pwn    *.py *.asm *.rst *.md *.txt *.sh
 recursive-exclude *.pyc

README.md

@@ -2,13 +2,13 @@
 ![pwntools logo](https://github.com/Gallopsled/pwntools/blob/stable/docs/source/logo.png?raw=true)
 
 [![Docs](https://readthedocs.org/projects/pwntools/badge/?version=stable)](https://docs.pwntools.com/)
-[![PyPI](https://img.shields.io/badge/pypi-v3.6.0-green.svg?style=flat)](https://pypi.python.org/pypi/pwntools/)
+[![PyPI](https://img.shields.io/badge/pypi-v3.9.0-green.svg?style=flat)](https://pypi.python.org/pypi/pwntools/)
 [![Travis](https://travis-ci.org/Gallopsled/pwntools.svg)](https://travis-ci.org/Gallopsled/pwntools)
 [![Coveralls](https://img.shields.io/coveralls/Gallopsled/pwntools/dev.svg)](https://coveralls.io/github/Gallopsled/pwntools?branch=dev)
 [![Twitter](https://img.shields.io/badge/twitter-pwntools-4099FF.svg?style=flat)](https://twitter.com/pwntools)
 [![MIT License](https://img.shields.io/badge/license-MIT-blue.svg?style=flat)](http://choosealicense.com/licenses/mit/)
 
-pwntools is a CTF framework and exploit development library. Written in Python, it is designed for rapid prototyping and development, and intended to make exploit writing as simple as possible.
+Pwntools is a CTF framework and exploit development library. Written in Python, it is designed for rapid prototyping and development, and intended to make exploit writing as simple as possible.
 
 ```python
 from pwn import *
@@ -32,7 +32,7 @@ To get you started, we've provided some example solutions for past CTF challenge
 
 # Installation
 
-pwntools is best supported on 64-bit Ubuntu 12.04 and 14.04, but most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).  Python 2.7 is required.
+Pwntools is best supported on 64-bit Ubuntu LTE releases (12.04, 14.04, and 16.04).  Most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).  Python 2.7 is required.
 
 Most of the functionality of pwntools is self-contained and Python-only.  You should be able to get running quickly with
 

docs/source/asm.rst

@@ -15,7 +15,7 @@
    :members:
 
 Internal Functions
-=========================================
+-----------------------------------------
 
 These are only included so that their tests are run.
 

docs/source/index.rst

@@ -57,6 +57,7 @@ Each of the ``pwntools`` modules is documented here.
    flag
    fmtstr
    gdb
+   libcdb
    log
    memleak
    protocols

docs/source/intro.rst

@@ -72,7 +72,7 @@ a ``process`` tube.
 
 ::
 
-    >>> shell = ssh('bandit0', 'bandit.labs.overthewire.org', password='bandit0')
+    >>> shell = ssh('bandit0', 'bandit.labs.overthewire.org', password='bandit0', port=2220)
     >>> shell['whoami']
     'bandit0'
     >>> shell.download_file('/etc/motd')

docs/source/libcdb.rst

@@ -0,0 +1,10 @@
+.. testsetup:: *
+
+   from pwn import *
+   from pwnlib.libcdb import *
+
+:mod:`pwnlib.libcdb` --- Libc Database
+===========================================
+
+.. automodule:: pwnlib.libcdb
+   :members:

examples/ssh.py

@@ -4,7 +4,7 @@ Example showing how to use the ssh class.
 
 from pwn import *
 
-shell = ssh(host='bandit.labs.overthewire.org',user='bandit0',password='bandit0')
+shell = ssh(host='bandit.labs.overthewire.org',user='bandit0',password='bandit0', port=2220)
 
 # Show basic command syntax
 log.info("username: %s" % shell.whoami())

extra/docker/Makefile

@@ -1,6 +1,6 @@
 subdirs=xenial stable $(wildcard */)
 makefiles=$(wildcard */Makefile)
-tags=stable beta dev
+tags=base stable beta dev
 
 all: $(makefiles) $(subdirs)
 

extra/docker/base

@@ -0,0 +1 @@
+xenial

extra/docker/kali/Makefile

@@ -1,6 +1,6 @@
 all: Dockerfile
 
-Dockerfile: ../stable/Dockerfile FORCE
+Dockerfile: ../xenial/Dockerfile FORCE
 	sed "s|ubuntu:xenial|kalilinux/kali-linux-docker|" < "$<" > "$@"
 
 FORCE:

extra/docker/stable/Dockerfile

@@ -1,26 +1,6 @@
-############################################################
-# Dockerfile to build Pwntools container
-# Based on Ubuntu
-############################################################
+FROM pwntools/pwntools:base
 
-FROM ubuntu:xenial
-MAINTAINER Maintainer Gallopsled et al.
-
-RUN apt-get update
-RUN apt-get install -y build-essential
-RUN apt-get install -y git
-RUN apt-get install -y libssl-dev
-RUN apt-get install -y libffi-dev
-RUN apt-get install -y python2.7
-RUN apt-get install -y python-pip
-RUN apt-get install -y python-dev
-RUN pip install --upgrade pip
-RUN python -m pip install --upgrade pwntools
+USER root
+RUN pip install --upgrade git+https://github.com/Gallopsled/pwntools@stable
 RUN PWNLIB_NOTERM=1 pwn update
-
-RUN apt-get install -y sudo
-RUN useradd -m pwntools
-RUN passwd --delete --unlock pwntools
-RUN echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
 USER pwntools
-WORKDIR /home/pwntools

extra/docker/stable/Makefile

@@ -1,8 +0,0 @@
-all: Dockerfile
-
-Dockerfile: ../xenial/Dockerfile FORCE
-	cp "$<" "$@"
-
-FORCE:
-
-.PHONY: all

pwnlib/adb/adb.py

@@ -328,7 +328,7 @@ class AdbDevice(Device):
             kwargs['port'] = 'emulator'
 
         for field in fields[2:]:
-            k,v = field.split(':')
+            k,v = field.split(':', 1)
             kwargs[k] = v
 
         return AdbDevice(serial, type, **kwargs)

pwnlib/args.py

@@ -37,8 +37,18 @@ not specified evaluate to an empty string.
     else:
         io = process('./pwnable')
 
+Arguments can also be accessed directly with the dot operator, e.g.:
+
+.. code-block:: python
+
+    if args.REMOTE:
+        ...
+
+Any undefined arguments evaluate to an empty string, ``''``.
+
 The full list of supported "magic arguments" and their effects are listed
 below.
+
 """
 from __future__ import absolute_import
 

pwnlib/commandline/template.py

@@ -15,7 +15,7 @@ parser = common.parser_commands.add_parser(
 
 parser.add_argument('exe', nargs='?', help='Target binary')
 parser.add_argument('--host', help='Remote host / SSH server')
-parser.add_argument('--port', help='Remote port / SSH port')
+parser.add_argument('--port', help='Remote port / SSH port', type=int)
 parser.add_argument('--user', help='SSH Username')
 parser.add_argument('--pass', help='SSH Password', dest='password')
 parser.add_argument('--path', help='Remote path of file on SSH server')
@@ -34,7 +34,7 @@ def main(args):
     # For the SSH scenario, check that the binary is at the
     # same path on the remote host.
     if args.user:
-        if not args.path or args.exe:
+        if not (args.path or args.exe):
             log.error("Must specify --path or a exe")
 
         s = ssh(args.user, args.host, args.port or 22, args.password or None)

pwnlib/context/__init__.py

@@ -1359,9 +1359,14 @@ def update_context_defaults(section):
         if key not in ContextType.defaults:
             log.warn("Unknown configuration option %r in section %r" % (key, 'context'))
             continue
-        if isinstance(ContextType.defaults[key], (str, unicode, tuple)):
-            value = safeeval.expr(value)
 
-        ContextType.defaults[key] = value
+        default = ContextType.defaults[key]
+
+        if isinstance(default, (str, unicode, tuple, int, long, list, dict)):
+            value = safeeval.expr(value)
+        else:
+            log.warn("Unsupported configuration option %r in section %r" % (key, 'context'))
+
+        ContextType.defaults[key] = type(default)(value)
 
 register_config('context', update_context_defaults)

pwnlib/data/crcsums.txt

@@ -4,75 +4,102 @@
 # At the time of download, that page was available under the GPLv3 license, which can found here:
 # https://www.gnu.org/licenses/gpl.html
 #
-crc.cat-bits.3 width=3  poly=0x3  init=0x7  refin=true  refout=true  xorout=0x0  check=0x6  name="CRC-3/ROHC"
-crc.cat-bits.4 width=4  poly=0x3  init=0x0  refin=true  refout=true  xorout=0x0  check=0x7  name="CRC-4/ITU"
-crc.cat-bits.5 width=5  poly=0x09  init=0x09  refin=false  refout=false  xorout=0x00  check=0x00  name="CRC-5/EPC"
-crc.cat.crc-5-itu width=5  poly=0x15  init=0x00  refin=true  refout=true  xorout=0x00  check=0x07  name="CRC-5/ITU"
-crc.cat.crc-5-usb width=5  poly=0x05  init=0x1f  refin=true  refout=true  xorout=0x1f  check=0x19  name="CRC-5/USB"
-crc.cat-bits.6 width=6  poly=0x27  init=0x3f  refin=false  refout=false  xorout=0x00  check=0x0d  name="CRC-6/CDMA2000-A"
-crc.cat.crc-6-cdma2000-b width=6  poly=0x07  init=0x3f  refin=false  refout=false  xorout=0x00  check=0x3b  name="CRC-6/CDMA2000-B"
-crc.cat.crc-6-darc width=6  poly=0x19  init=0x00  refin=true  refout=true  xorout=0x00  check=0x26  name="CRC-6/DARC"
-crc.cat.crc-6-itu width=6  poly=0x03  init=0x00  refin=true  refout=true  xorout=0x00  check=0x06  name="CRC-6/ITU"
-crc.cat-bits.7 width=7  poly=0x09  init=0x00  refin=false  refout=false  xorout=0x00  check=0x75  name="CRC-7"
-crc.cat.crc-7-rohc width=7  poly=0x4f  init=0x7f  refin=true  refout=true  xorout=0x00  check=0x53  name="CRC-7/ROHC"
-crc.cat-bits.8 width=8  poly=0x07  init=0x00  refin=false  refout=false  xorout=0x00  check=0xf4  name="CRC-8"
-crc.cat.crc-8-cdma2000 width=8  poly=0x9b  init=0xff  refin=false  refout=false  xorout=0x00  check=0xda  name="CRC-8/CDMA2000"
-crc.cat.crc-8-darc width=8  poly=0x39  init=0x00  refin=true  refout=true  xorout=0x00  check=0x15  name="CRC-8/DARC"
-crc.cat.crc-8-dvb-s2 width=8  poly=0xd5  init=0x00  refin=false  refout=false  xorout=0x00  check=0xbc  name="CRC-8/DVB-S2"
-crc.cat.crc-8-ebu width=8  poly=0x1d  init=0xff  refin=true  refout=true  xorout=0x00  check=0x97  name="CRC-8/EBU"
-crc.cat.crc-8-i-code width=8  poly=0x1d  init=0xfd  refin=false  refout=false  xorout=0x00  check=0x7e  name="CRC-8/I-CODE"
-crc.cat.crc-8-itu width=8  poly=0x07  init=0x00  refin=false  refout=false  xorout=0x55  check=0xa1  name="CRC-8/ITU"
-crc.cat.crc-8-maxim width=8  poly=0x31  init=0x00  refin=true  refout=true  xorout=0x00  check=0xa1  name="CRC-8/MAXIM"
-crc.cat.crc-8-rohc width=8  poly=0x07  init=0xff  refin=true  refout=true  xorout=0x00  check=0xd0  name="CRC-8/ROHC"
-crc.cat.crc-8-wdcma width=8  poly=0x9b  init=0x00  refin=true  refout=true  xorout=0x00  check=0x25  name="CRC-8/WCDMA"
-crc.cat-bits.10 width=10  poly=0x233  init=0x000  refin=false  refout=false  xorout=0x000  check=0x199  name="CRC-10"
-crc.cat.crc-10-cdma2000 width=10  poly=0x3d9  init=0x3ff  refin=false  refout=false  xorout=0x000  check=0x233  name="CRC-10/CDMA2000"
-crc.cat-bits.11 width=11  poly=0x385  init=0x01a  refin=false  refout=false  xorout=0x000  check=0x5a3  name="CRC-11"
-crc.cat-bits.12 width=12  poly=0x80f  init=0x000  refin=false  refout=true  xorout=0x000  check=0xdaf  name="CRC-12/3GPP"
-crc.cat.crc-12-cdma2000 width=12  poly=0xf13  init=0xfff  refin=false  refout=false  xorout=0x000  check=0xd4d  name="CRC-12/CDMA2000"
-crc.cat.crc-12-dect width=12  poly=0x80f  init=0x000  refin=false  refout=false  xorout=0x000  check=0xf5b  name="CRC-12/DECT"
-crc.cat-bits.13 width=13  poly=0x1cf5  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x04fa  name="CRC-13/BBC"
-crc.cat-bits.14 width=14  poly=0x0805  init=0x0000  refin=true  refout=true  xorout=0x0000  check=0x082d  name="CRC-14/DARC"
-crc.cat-bits.15 width=15  poly=0x4599  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x059e  name="CRC-15"
-crc.cat.crc-15-mpt1327 width=15  poly=0x6815  init=0x0000  refin=false  refout=false  xorout=0x0001  check=0x2566  name="CRC-15/MPT1327"
-crc.cat-bits.16 width=16  poly=0x8005  init=0x0000  refin=true  refout=true  xorout=0x0000  check=0xbb3d  name="ARC"
-crc.cat.crc-16-aug-ccitt width=16  poly=0x1021  init=0x1d0f  refin=false  refout=false  xorout=0x0000  check=0xe5cc  name="CRC-16/AUG-CCITT"
-crc.cat.crc-16-buypass width=16  poly=0x8005  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0xfee8  name="CRC-16/BUYPASS"
-crc.cat.crc-16-ccitt-false width=16  poly=0x1021  init=0xffff  refin=false  refout=false  xorout=0x0000  check=0x29b1  name="CRC-16/CCITT-FALSE"
-crc.cat.crc-16-cdma2000 width=16  poly=0xc867  init=0xffff  refin=false  refout=false  xorout=0x0000  check=0x4c06  name="CRC-16/CDMA2000"
-crc.cat.crc-16-dds-110 width=16  poly=0x8005  init=0x800d  refin=false  refout=false  xorout=0x0000  check=0x9ecf  name="CRC-16/DDS-110"
-crc.cat.crc-16-dect-r width=16  poly=0x0589  init=0x0000  refin=false  refout=false  xorout=0x0001  check=0x007e  name="CRC-16/DECT-R"
-crc.cat.crc-16-dect-x width=16  poly=0x0589  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x007f  name="CRC-16/DECT-X"
-crc.cat.crc-16-dnp width=16  poly=0x3d65  init=0x0000  refin=true  refout=true  xorout=0xffff  check=0xea82  name="CRC-16/DNP"
-crc.cat.crc-16-en-13757 width=16  poly=0x3d65  init=0x0000  refin=false  refout=false  xorout=0xffff  check=0xc2b7  name="CRC-16/EN-13757"
-crc.cat.crc-16-genibus width=16  poly=0x1021  init=0xffff  refin=false  refout=false  xorout=0xffff  check=0xd64e  name="CRC-16/GENIBUS"
-crc.cat.crc-16-maxim width=16  poly=0x8005  init=0x0000  refin=true  refout=true  xorout=0xffff  check=0x44c2  name="CRC-16/MAXIM"
-crc.cat.crc-16-mcrf4xx width=16  poly=0x1021  init=0xffff  refin=true  refout=true  xorout=0x0000  check=0x6f91  name="CRC-16/MCRF4XX"
-crc.cat.crc-16-riello width=16  poly=0x1021  init=0xb2aa  refin=true  refout=true  xorout=0x0000  check=0x63d0  name="CRC-16/RIELLO"
-crc.cat.crc-16-t10-dif width=16  poly=0x8bb7  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0xd0db  name="CRC-16/T10-DIF"
-crc.cat.crc-16-teledisk width=16  poly=0xa097  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x0fb3  name="CRC-16/TELEDISK"
-crc.cat.crc-16-tms37157 width=16  poly=0x1021  init=0x89ec  refin=true  refout=true  xorout=0x0000  check=0x26b1  name="CRC-16/TMS37157"
-crc.cat.crc-16-usb width=16  poly=0x8005  init=0xffff  refin=true  refout=true  xorout=0xffff  check=0xb4c8  name="CRC-16/USB"
-crc.cat.crc-a width=16  poly=0x1021  init=0xc6c6  refin=true  refout=true  xorout=0x0000  check=0xbf05  name="CRC-A"
-crc.cat.kermit width=16  poly=0x1021  init=0x0000  refin=true  refout=true  xorout=0x0000  check=0x2189  name="KERMIT"
-crc.cat.modbus width=16  poly=0x8005  init=0xffff  refin=true  refout=true  xorout=0x0000  check=0x4b37  name="MODBUS"
-crc.cat.x-25 width=16  poly=0x1021  init=0xffff  refin=true  refout=true  xorout=0xffff  check=0x906e  name="X-25"
-crc.cat.xmodem width=16  poly=0x1021  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x31c3  name="XMODEM"
-crc.cat-bits.24 width=24  poly=0x864cfb  init=0xb704ce  refin=false  refout=false  xorout=0x000000  check=0x21cf02  name="CRC-24"
-crc.cat.crc-24-flexray-a width=24  poly=0x5d6dcb  init=0xfedcba  refin=false  refout=false  xorout=0x000000  check=0x7979bd  name="CRC-24/FLEXRAY-A"
-crc.cat.crc-24-flexray-b width=24  poly=0x5d6dcb  init=0xabcdef  refin=false  refout=false  xorout=0x000000  check=0x1f23b8  name="CRC-24/FLEXRAY-B"
-crc.cat-bits.31 width=31  poly=0x04c11db7  init=0x7fffffff  refin=false  refout=false  xorout=0x7fffffff  check=0x0ce9e46c  name="CRC-31/PHILIPS"
-crc.cat-bits.32 width=32  poly=0x04c11db7  init=0xffffffff  refin=true  refout=true  xorout=0xffffffff  check=0xcbf43926  name="CRC-32"
-crc.cat.crc-32-bzip2 width=32  poly=0x04c11db7  init=0xffffffff  refin=false  refout=false  xorout=0xffffffff  check=0xfc891918  name="CRC-32/BZIP2"
-crc.cat.crc-32c width=32  poly=0x1edc6f41  init=0xffffffff  refin=true  refout=true  xorout=0xffffffff  check=0xe3069283  name="CRC-32C"
-crc.cat.crc-32d width=32  poly=0xa833982b  init=0xffffffff  refin=true  refout=true  xorout=0xffffffff  check=0x87315576  name="CRC-32D"
-crc.cat.crc-32-mpeg-2 width=32  poly=0x04c11db7  init=0xffffffff  refin=false  refout=false  xorout=0x00000000  check=0x0376e6e7  name="CRC-32/MPEG-2"
-crc.cat.crc-32-posix width=32  poly=0x04c11db7  init=0x00000000  refin=false  refout=false  xorout=0xffffffff  check=0x765e7680  name="CRC-32/POSIX"
-crc.cat.crc-32q width=32  poly=0x814141ab  init=0x00000000  refin=false  refout=false  xorout=0x00000000  check=0x3010bf7f  name="CRC-32Q"
-crc.cat.jamcrc width=32  poly=0x04c11db7  init=0xffffffff  refin=true  refout=true  xorout=0x00000000  check=0x340bc6d9  name="JAMCRC"
-crc.cat.xfer width=32  poly=0x000000af  init=0x00000000  refin=false  refout=false  xorout=0x00000000  check=0xbd0be338  name="XFER"
-crc.cat-bits.40 width=40  poly=0x0004820009  init=0x0000000000  refin=false  refout=false  xorout=0xffffffffff  check=0xd4164fc646  name="CRC-40/GSM"
-crc.cat-bits.64 width=64  poly=0x42f0e1eba9ea3693  init=0x0000000000000000  refin=false  refout=false  xorout=0x0000000000000000  check=0x6c40df5f0b497347  name="CRC-64"
-crc.cat.crc-64-we width=64  poly=0x42f0e1eba9ea3693  init=0xffffffffffffffff  refin=false  refout=false  xorout=0xffffffffffffffff  check=0x62ec59e3f1a4f00a  name="CRC-64/WE"
-crc.cat.crc-64-xz width=64  poly=0x42f0e1eba9ea3693  init=0xffffffffffffffff  refin=true  refout=true  xorout=0xffffffffffffffff  check=0x995dc9bbdf1939fa  name="CRC-64/XZ"
-crc.cat-bits.82 width=82  poly=0x0308c0111011401440411  init=0x000000000000000000000  refin=true  refout=true  xorout=0x000000000000000000000  check=0x09ea83f625023801fd612  name="CRC-82/DARC"
+crc.cat.crc-3-rohc width=3  poly=0x3  init=0x7  refin=true  refout=true  xorout=0x0  check=0x6  residue=0x0  name="CRC-3/ROHC"
+crc.cat-bits.3 width=3  poly=0x3  init=0x0  refin=false  refout=false  xorout=0x7  check=0x4  residue=0x2  name="CRC-3/GSM"
+crc.cat-bits.4 width=4  poly=0x3  init=0xf  refin=false  refout=false  xorout=0xf  check=0xb  residue=0x2  name="CRC-4/INTERLAKEN"
+crc.cat.crc-4-itu width=4  poly=0x3  init=0x0  refin=true  refout=true  xorout=0x0  check=0x7  residue=0x0  name="CRC-4/ITU"
+crc.cat-bits.5 width=5  poly=0x09  init=0x09  refin=false  refout=false  xorout=0x00  check=0x00  residue=0x00  name="CRC-5/EPC"
+crc.cat.crc-5-itu width=5  poly=0x15  init=0x00  refin=true  refout=true  xorout=0x00  check=0x07  residue=0x00  name="CRC-5/ITU"
+crc.cat.crc-5-usb width=5  poly=0x05  init=0x1f  refin=true  refout=true  xorout=0x1f  check=0x19  residue=0x06  name="CRC-5/USB"
+crc.cat-bits.6 width=6  poly=0x27  init=0x3f  refin=false  refout=false  xorout=0x00  check=0x0d  residue=0x00  name="CRC-6/CDMA2000-A"
+crc.cat.crc-6-cdma2000-b width=6  poly=0x07  init=0x3f  refin=false  refout=false  xorout=0x00  check=0x3b  residue=0x00  name="CRC-6/CDMA2000-B"
+crc.cat.crc-6-darc width=6  poly=0x19  init=0x00  refin=true  refout=true  xorout=0x00  check=0x26  residue=0x00  name="CRC-6/DARC"
+crc.cat.crc-6-gsm width=6  poly=0x2f  init=0x00  refin=false  refout=false  xorout=0x3f  check=0x13  residue=0x3a  name="CRC-6/GSM"
+crc.cat.crc-6-itu width=6  poly=0x03  init=0x00  refin=true  refout=true  xorout=0x00  check=0x06  residue=0x00  name="CRC-6/ITU"
+crc.cat-bits.7 width=7  poly=0x09  init=0x00  refin=false  refout=false  xorout=0x00  check=0x75  residue=0x00  name="CRC-7"
+crc.cat.crc-7-rohc width=7  poly=0x4f  init=0x7f  refin=true  refout=true  xorout=0x00  check=0x53  residue=0x00  name="CRC-7/ROHC"
+crc.cat.crc-7-umts width=7  poly=0x45  init=0x00  refin=false  refout=false  xorout=0x00  check=0x61  residue=0x00  name="CRC-7/UMTS"
+crc.cat-bits.8 width=8  poly=0x07  init=0x00  refin=false  refout=false  xorout=0x00  check=0xf4  residue=0x00  name="CRC-8"
+crc.cat.crc-8-autosar width=8  poly=0x2f  init=0xff  refin=false  refout=false  xorout=0xff  check=0xdf  residue=0x42  name="CRC-8/AUTOSAR"
+crc.cat.crc-8-cdma2000 width=8  poly=0x9b  init=0xff  refin=false  refout=false  xorout=0x00  check=0xda  residue=0x00  name="CRC-8/CDMA2000"
+crc.cat.crc-8-darc width=8  poly=0x39  init=0x00  refin=true  refout=true  xorout=0x00  check=0x15  residue=0x00  name="CRC-8/DARC"
+crc.cat.crc-8-dvb-s2 width=8  poly=0xd5  init=0x00  refin=false  refout=false  xorout=0x00  check=0xbc  residue=0x00  name="CRC-8/DVB-S2"
+crc.cat.crc-8-ebu width=8  poly=0x1d  init=0xff  refin=true  refout=true  xorout=0x00  check=0x97  residue=0x00  name="CRC-8/EBU"
+crc.cat.crc-8-gsm-a width=8  poly=0x1d  init=0x00  refin=false  refout=false  xorout=0x00  check=0x37  residue=0x00  name="CRC-8/GSM-A"
+crc.cat.crc-8-gsm-b width=8  poly=0x49  init=0x00  refin=false  refout=false  xorout=0xff  check=0x94  residue=0x53  name="CRC-8/GSM-B"
+crc.cat.crc-8-i-code width=8  poly=0x1d  init=0xfd  refin=false  refout=false  xorout=0x00  check=0x7e  residue=0x00  name="CRC-8/I-CODE"
+crc.cat.crc-8-itu width=8  poly=0x07  init=0x00  refin=false  refout=false  xorout=0x55  check=0xa1  residue=0xac  name="CRC-8/ITU"
+crc.cat.crc-8-lte width=8  poly=0x9b  init=0x00  refin=false  refout=false  xorout=0x00  check=0xea  residue=0x00  name="CRC-8/LTE"
+crc.cat.crc-8-maxim width=8  poly=0x31  init=0x00  refin=true  refout=true  xorout=0x00  check=0xa1  residue=0x00  name="CRC-8/MAXIM"
+crc.cat.crc-8-opensafety width=8  poly=0x2f  init=0x00  refin=false  refout=false  xorout=0x00  check=0x3e  residue=0x00  name="CRC-8/OPENSAFETY"
+crc.cat.crc-8-rohc width=8  poly=0x07  init=0xff  refin=true  refout=true  xorout=0x00  check=0xd0  residue=0x00  name="CRC-8/ROHC"
+crc.cat.crc-8-sae-j1850 width=8  poly=0x1d  init=0xff  refin=false  refout=false  xorout=0xff  check=0x4b  residue=0xc4  name="CRC-8/SAE-J1850"
+crc.cat.crc-8-wdcma width=8  poly=0x9b  init=0x00  refin=true  refout=true  xorout=0x00  check=0x25  residue=0x00  name="CRC-8/WCDMA"
+crc.cat-bits.10 width=10  poly=0x233  init=0x000  refin=false  refout=false  xorout=0x000  check=0x199  residue=0x000  name="CRC-10"
+crc.cat.crc-10-cdma2000 width=10  poly=0x3d9  init=0x3ff  refin=false  refout=false  xorout=0x000  check=0x233  residue=0x000  name="CRC-10/CDMA2000"
+crc.cat.crc-10-gsm width=10  poly=0x175  init=0x000  refin=false  refout=false  xorout=0x3ff  check=0x12a  residue=0x0c6  name="CRC-10/GSM"
+crc.cat-bits.11 width=11  poly=0x385  init=0x01a  refin=false  refout=false  xorout=0x000  check=0x5a3  residue=0x000  name="CRC-11"
+crc.cat.crc-11-umts width=11  poly=0x307  init=0x000  refin=false  refout=false  xorout=0x000  check=0x061  residue=0x000  name="CRC-11/UMTS"
+crc.cat-bits.12 width=12  poly=0xf13  init=0xfff  refin=false  refout=false  xorout=0x000  check=0xd4d  residue=0x000  name="CRC-12/CDMA2000"
+crc.cat.crc-12-dect width=12  poly=0x80f  init=0x000  refin=false  refout=false  xorout=0x000  check=0xf5b  residue=0x000  name="CRC-12/DECT"
+crc.cat.crc-12-gsm width=12  poly=0xd31  init=0x000  refin=false  refout=false  xorout=0xfff  check=0xb34  residue=0x178  name="CRC-12/GSM"
+crc.cat.crc-12-umts width=12  poly=0x80f  init=0x000  refin=false  refout=true  xorout=0x000  check=0xdaf  residue=0x000  name="CRC-12/UMTS"
+crc.cat-bits.13 width=13  poly=0x1cf5  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x04fa  residue=0x0000  name="CRC-13/BBC"
+crc.cat-bits.14 width=14  poly=0x0805  init=0x0000  refin=true  refout=true  xorout=0x0000  check=0x082d  residue=0x0000  name="CRC-14/DARC"
+crc.cat.crc-14-gsm width=14  poly=0x202d  init=0x0000  refin=false  refout=false  xorout=0x3fff  check=0x30ae  residue=0x031e  name="CRC-14/GSM"
+crc.cat-bits.15 width=15  poly=0x4599  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x059e  residue=0x0000  name="CRC-15"
+crc.cat.crc-15-mpt1327 width=15  poly=0x6815  init=0x0000  refin=false  refout=false  xorout=0x0001  check=0x2566  residue=0x6815  name="CRC-15/MPT1327"
+crc.cat-bits.16 width=16  poly=0x8005  init=0x0000  refin=true  refout=true  xorout=0x0000  check=0xbb3d  residue=0x0000  name="ARC"
+crc.cat.crc-16-aug-ccitt width=16  poly=0x1021  init=0x1d0f  refin=false  refout=false  xorout=0x0000  check=0xe5cc  residue=0x0000  name="CRC-16/AUG-CCITT"
+crc.cat.crc-16-buypass width=16  poly=0x8005  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0xfee8  residue=0x0000  name="CRC-16/BUYPASS"
+crc.cat.crc-16-ccitt-false width=16  poly=0x1021  init=0xffff  refin=false  refout=false  xorout=0x0000  check=0x29b1  residue=0x0000  name="CRC-16/CCITT-FALSE"
+crc.cat.crc-16-cdma2000 width=16  poly=0xc867  init=0xffff  refin=false  refout=false  xorout=0x0000  check=0x4c06  residue=0x0000  name="CRC-16/CDMA2000"
+crc.cat.crc-16-cms width=16  poly=0x8005  init=0xffff  refin=false  refout=false  xorout=0x0000  check=0xaee7  residue=0x0000  name="CRC-16/CMS"
+crc.cat.crc-16-dds-110 width=16  poly=0x8005  init=0x800d  refin=false  refout=false  xorout=0x0000  check=0x9ecf  residue=0x0000  name="CRC-16/DDS-110"
+crc.cat.crc-16-dect-r width=16  poly=0x0589  init=0x0000  refin=false  refout=false  xorout=0x0001  check=0x007e  residue=0x0589  name="CRC-16/DECT-R"
+crc.cat.crc-16-dect-x width=16  poly=0x0589  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x007f  residue=0x0000  name="CRC-16/DECT-X"
+crc.cat.crc-16-dnp width=16  poly=0x3d65  init=0x0000  refin=true  refout=true  xorout=0xffff  check=0xea82  residue=0x66c5  name="CRC-16/DNP"
+crc.cat.crc-16-en-13757 width=16  poly=0x3d65  init=0x0000  refin=false  refout=false  xorout=0xffff  check=0xc2b7  residue=0xa366  name="CRC-16/EN-13757"
+crc.cat.crc-16-genibus width=16  poly=0x1021  init=0xffff  refin=false  refout=false  xorout=0xffff  check=0xd64e  residue=0x1d0f  name="CRC-16/GENIBUS"
+crc.cat.crc-16-gsm width=16  poly=0x1021  init=0x0000  refin=false  refout=false  xorout=0xffff  check=0xce3c  residue=0x1d0f  name="CRC-16/GSM"
+crc.cat.crc-16-lj1200 width=16  poly=0x6f63  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0xbdf4  residue=0x0000  name="CRC-16/LJ1200"
+crc.cat.crc-16-maxim width=16  poly=0x8005  init=0x0000  refin=true  refout=true  xorout=0xffff  check=0x44c2  residue=0xb001  name="CRC-16/MAXIM"
+crc.cat.crc-16-mcrf4xx width=16  poly=0x1021  init=0xffff  refin=true  refout=true  xorout=0x0000  check=0x6f91  residue=0x0000  name="CRC-16/MCRF4XX"
+crc.cat.crc-16-opensafety-a width=16  poly=0x5935  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x5d38  residue=0x0000  name="CRC-16/OPENSAFETY-A"
+crc.cat.crc-16-opensafety-a width=16  poly=0x755b  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x20fe  residue=0x0000  name="CRC-16/OPENSAFETY-B"
+crc.cat.crc-16-profibus width=16  poly=0x1dcf  init=0xffff  refin=false  refout=false  xorout=0xffff  check=0xa819  residue=0xe394  name="CRC-16/PROFIBUS"
+crc.cat.crc-16-riello width=16  poly=0x1021  init=0xb2aa  refin=true  refout=true  xorout=0x0000  check=0x63d0  residue=0x0000  name="CRC-16/RIELLO"
+crc.cat.crc-16-t10-dif width=16  poly=0x8bb7  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0xd0db  residue=0x0000  name="CRC-16/T10-DIF"
+crc.cat.crc-16-teledisk width=16  poly=0xa097  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x0fb3  residue=0x0000  name="CRC-16/TELEDISK"
+crc.cat.crc-16-tms37157 width=16  poly=0x1021  init=0x89ec  refin=true  refout=true  xorout=0x0000  check=0x26b1  residue=0x0000  name="CRC-16/TMS37157"
+crc.cat.crc-16-usb width=16  poly=0x8005  init=0xffff  refin=true  refout=true  xorout=0xffff  check=0xb4c8  residue=0xb001  name="CRC-16/USB"
+crc.cat.crc-a width=16  poly=0x1021  init=0xc6c6  refin=true  refout=true  xorout=0x0000  check=0xbf05  residue=0x0000  name="CRC-A"
+crc.cat.kermit width=16  poly=0x1021  init=0x0000  refin=true  refout=true  xorout=0x0000  check=0x2189  residue=0x0000  name="KERMIT"
+crc.cat.modbus width=16  poly=0x8005  init=0xffff  refin=true  refout=true  xorout=0x0000  check=0x4b37  residue=0x0000  name="MODBUS"
+crc.cat.x-25 width=16  poly=0x1021  init=0xffff  refin=true  refout=true  xorout=0xffff  check=0x906e  residue=0xf0b8  name="X-25"
+crc.cat.xmodem width=16  poly=0x1021  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x31c3  residue=0x0000  name="XMODEM"
+crc.cat-bits.24 width=24  poly=0x864cfb  init=0xb704ce  refin=false  refout=false  xorout=0x000000  check=0x21cf02  residue=0x000000  name="CRC-24"
+crc.cat.crc-24-ble width=24  poly=0x00065b  init=0x555555  refin=true  refout=true  xorout=0x000000  check=0xc25a56  residue=0x000000  name="CRC-24/BLE"
+crc.cat.crc-24-flexray-a width=24  poly=0x5d6dcb  init=0xfedcba  refin=false  refout=false  xorout=0x000000  check=0x7979bd  residue=0x000000  name="CRC-24/FLEXRAY-A"
+crc.cat.crc-24-flexray-b width=24  poly=0x5d6dcb  init=0xabcdef  refin=false  refout=false  xorout=0x000000  check=0x1f23b8  residue=0x000000  name="CRC-24/FLEXRAY-B"
+crc.cat.crc-24-interlaken width=24  poly=0x328b63  init=0xffffff  refin=false  refout=false  xorout=0xffffff  check=0xb4f3e6  residue=0x144e63  name="CRC-24/INTERLAKEN"
+crc.cat.crc-24-lte-a width=24  poly=0x864cfb  init=0x000000  refin=false  refout=false  xorout=0x000000  check=0xcde703  residue=0x000000  name="CRC-24/LTE-A"
+crc.cat.crc-24-lte-b width=24  poly=0x800063  init=0x000000  refin=false  refout=false  xorout=0x000000  check=0x23ef52  residue=0x000000  name="CRC-24/LTE-B"
+crc.cat-bits.30 width=30  poly=0x2030b9c7  init=0x3fffffff  refin=false  refout=false  xorout=0x3fffffff  check=0x04c34abf  residue=0x34efa55a  name="CRC-30/CDMA"
+crc.cat-bits.31 width=31  poly=0x04c11db7  init=0x7fffffff  refin=false  refout=false  xorout=0x7fffffff  check=0x0ce9e46c  residue=0x4eaf26f1  name="CRC-31/PHILIPS"
+crc.cat-bits.32 width=32  poly=0x04c11db7  init=0xffffffff  refin=true  refout=true  xorout=0xffffffff  check=0xcbf43926  residue=0xdebb20e3  name="CRC-32"
+crc.cat.crc-32-autosar width=32  poly=0xf4acfb13  init=0xffffffff  refin=true  refout=true  xorout=0xffffffff  check=0x1697d06a  residue=0x904cddbf  name="CRC-32/AUTOSAR"
+crc.cat.crc-32-bzip2 width=32  poly=0x04c11db7  init=0xffffffff  refin=false  refout=false  xorout=0xffffffff  check=0xfc891918  residue=0xc704dd7b  name="CRC-32/BZIP2"
+crc.cat.crc-32c width=32  poly=0x1edc6f41  init=0xffffffff  refin=true  refout=true  xorout=0xffffffff  check=0xe3069283  residue=0xb798b438  name="CRC-32C"
+crc.cat.crc-32d width=32  poly=0xa833982b  init=0xffffffff  refin=true  refout=true  xorout=0xffffffff  check=0x87315576  residue=0x45270551  name="CRC-32D"
+crc.cat.crc-32-mpeg-2 width=32  poly=0x04c11db7  init=0xffffffff  refin=false  refout=false  xorout=0x00000000  check=0x0376e6e7  residue=0x00000000  name="CRC-32/MPEG-2"
+crc.cat.crc-32-posix width=32  poly=0x04c11db7  init=0x00000000  refin=false  refout=false  xorout=0xffffffff  check=0x765e7680  residue=0xc704dd7b  name="CRC-32/POSIX"
+crc.cat.crc-32q width=32  poly=0x814141ab  init=0x00000000  refin=false  refout=false  xorout=0x00000000  check=0x3010bf7f  residue=0x00000000  name="CRC-32Q"
+crc.cat.jamcrc width=32  poly=0x04c11db7  init=0xffffffff  refin=true  refout=true  xorout=0x00000000  check=0x340bc6d9  residue=0x00000000  name="JAMCRC"
+crc.cat.xfer width=32  poly=0x000000af  init=0x00000000  refin=false  refout=false  xorout=0x00000000  check=0xbd0be338  residue=0x00000000  name="XFER"
+crc.cat-bits.40 width=40  poly=0x0004820009  init=0x0000000000  refin=false  refout=false  xorout=0xffffffffff  check=0xd4164fc646  residue=0xc4ff8071ff  name="CRC-40/GSM"
+crc.cat-bits.64 width=64  poly=0x42f0e1eba9ea3693  init=0x0000000000000000  refin=false  refout=false  xorout=0x0000000000000000  check=0x6c40df5f0b497347  residue=0x0000000000000000  name="CRC-64"
+crc.cat.crc-64-go-iso width=64  poly=0x000000000000001b  init=0xffffffffffffffff  refin=true  refout=true  xorout=0xffffffffffffffff  check=0xb90956c775a41001  residue=0x5300000000000000  name="CRC-64/GO-ISO"
+crc.cat.crc-64-we width=64  poly=0x42f0e1eba9ea3693  init=0xffffffffffffffff  refin=false  refout=false  xorout=0xffffffffffffffff  check=0x62ec59e3f1a4f00a  residue=0xfcacbebd5931a992  name="CRC-64/WE"
+crc.cat.crc-64-xz width=64  poly=0x42f0e1eba9ea3693  init=0xffffffffffffffff  refin=true  refout=true  xorout=0xffffffffffffffff  check=0x995dc9bbdf1939fa  residue=0x49958c9abd7d353f  name="CRC-64/XZ"
+crc.cat-bits.82 width=82  poly=0x0308c0111011401440411  init=0x000000000000000000000  refin=true  refout=true  xorout=0x000000000000000000000  check=0x09ea83f625023801fd612  residue=0x000000000000000000000  name="CRC-82/DARC"

pwnlib/data/elf/__init__.py

@@ -1,3 +1,6 @@
+from __future__ import absolute_import
+from pwnlib.data.elf import relro
+
 import os
 path = os.path.dirname(__file__)
 

pwnlib/data/elf/relro/__init__.py

@@ -0,0 +1,5 @@
+import os
+path = os.path.dirname(__file__)
+
+def get(x):
+    return os.path.join(path, x)

pwnlib/data/templates/pwnup.mako

@@ -117,9 +117,9 @@ start = local if args.LOCAL else remote
 %else:
 def start(argv=[], *a, **kw):
     if args.GDB:
-        io = gdb.debug([${binary_repr}] + argv, gdbscript=gdbscript, *a, **kw)
+        return gdb.debug([${binary_repr}] + argv, gdbscript=gdbscript, *a, **kw)
     else:
-        io = process([${binary_repr}] + argv, *a, **kw)
+        return process([${binary_repr}] + argv, *a, **kw)
 %endif
 
 #===========================================================

pwnlib/dynelf.py

@@ -145,7 +145,7 @@ class DynELF(object):
     .. _DT_PLTGOT: http://refspecs.linuxfoundation.org/ELF/zSeries/lzsabi0_zSeries/x2251.html
     '''
 
-    def __init__(self, leak, pointer=None, elf=None):
+    def __init__(self, leak, pointer=None, elf=None, libcdb=True):
         '''
         Instantiates an object which can resolve symbols in a running binary
         given a :class:`pwnlib.memleak.MemLeak` leaker and a pointer inside
@@ -155,8 +155,11 @@ class DynELF(object):
             leak(MemLeak): Instance of pwnlib.memleak.MemLeak for leaking memory
             pointer(int):  A pointer into a loaded ELF file
             elf(str,ELF):  Path to the ELF file on disk, or a loaded :class:`pwnlib.elf.ELF`.
+            libcdb(bool):  Attempt to use libcdb to speed up libc lookups
         '''
+        self.libcdb    = libcdb
         self._elfclass = None
+        self._elftype  = None
         self._link_map = None
         self._waitfor  = None
         self._bases    = {}
@@ -204,6 +207,22 @@ class DynELF(object):
                               constants.ELFCLASS64: 64}[elfclass]
         return self._elfclass
 
+    @property
+    def elftype(self):
+        """e_type from the elf header. In practice the value will almost always
+        be 'EXEC' or 'DYN'. If the value is architecture-specific (between
+        ET_LOPROC and ET_HIPROC) or invalid, KeyError is raised.
+        """
+        if not self._elftype:
+            Ehdr  = {32: elf.Elf32_Ehdr, 64: elf.Elf64_Ehdr}[self.elfclass]
+            elftype = self.leak.field(self.libbase, Ehdr.e_type)
+            self._elftype = {constants.ET_NONE: 'NONE',
+                             constants.ET_REL: 'REL',
+                             constants.ET_EXEC: 'EXEC',
+                             constants.ET_DYN: 'DYN',
+                             constants.ET_CORE: 'CORE'}[elftype]
+        return self._elftype
+
     @property
     def link_map(self):
         """Pointer to the runtime link_map object"""
@@ -356,9 +375,7 @@ class DynELF(object):
         dynamic = leak.field(phead, Phdr.p_vaddr)
         self.status("PT_DYNAMIC @ %#x" % dynamic)
 
-        #Sometimes this is an offset instead of an address
-        if 0 < dynamic < 0x400000:
-            dynamic += base
+        dynamic = self._make_absolute_ptr(dynamic)
 
         return dynamic
 
@@ -392,9 +409,7 @@ class DynELF(object):
         self.status("Found %s at %#x" % (name, dynamic))
         ptr = leak.field(dynamic, Dyn.d_ptr)
 
-        # Sometimes this is an offset rather than an actual pointer.
-        if 0 < ptr < 0x400000:
-            ptr += self.libbase
+        ptr = self._make_absolute_ptr(ptr)
 
         return ptr
 
@@ -438,8 +453,7 @@ class DynELF(object):
             w.failure("Could not find DT_PLTGOT or DT_DEBUG")
             return None
 
-        if 0 < result < 0x400000:
-            result += self.libbase
+        result = self._make_absolute_ptr(result)
 
         w.success('%#x' % result)
         return result
@@ -548,7 +562,7 @@ class DynELF(object):
         #
         # If we are resolving a symbol in the library, find it.
         #
-        if symb:
+        if symb and self.libcdb:
             # Try a quick lookup by build ID
             self.status("Trying lookup based on Build ID")
             build_id = dynlib._lookup_build_id(lib=lib)
@@ -672,11 +686,9 @@ class DynELF(object):
         if not all([strtab, symtab, hshtab]):
             self.failure("Could not find all tables")
 
-        # glibc pointers are relocated but uclibc are not
-        if 0 < strtab < 0x400000:
-            strtab  += self.libbase
-            symtab  += self.libbase
-            hshtab  += self.libbase
+        strtab = self._make_absolute_ptr(strtab)
+        symtab = self._make_absolute_ptr(symtab)
+        hshtab = self._make_absolute_ptr(hshtab)
 
         #
         # Perform the hash lookup
@@ -843,6 +855,29 @@ class DynELF(object):
                 self.status("Magic did not match")
                 pass
 
+    def _make_absolute_ptr(self, ptr_or_offset):
+        """For shared libraries (or PIE executables), many ELF fields may
+        contain offsets rather than actual pointers. If the ELF type is 'DYN',
+        the argument may be an offset. It will not necessarily be an offset,
+        because the run-time linker may have fixed it up to be a real pointer
+        already. In this case an educated guess is made, and the ELF base
+        address is added to the value if it is determined to be an offset.
+        """
+        if_ptr = ptr_or_offset
+        if_offset = ptr_or_offset + self.libbase
+
+        # if the ELF type is not DYN, the value is a pointer
+
+        if self.elftype != 'DYN':
+            return if_ptr
+
+        # if the ELF type may be DYN, guess
+
+        if 0 < ptr_or_offset < self.libbase:
+            return if_offset
+        else:
+            return if_ptr
+
     def stack(self):
         """Finds a pointer to the stack via __environ, which is an exported
         symbol in libc, which points to the environment block.

pwnlib/elf/config.py

@@ -127,6 +127,7 @@ kernel_configuration = [
     Enabled('SECURITY_DMESG_RESTRICT'),
     Enabled('SECURITY_NETWORK'),
     Enabled('SECURITY_SELINUX'),
+    Enabled('ARCH_HAS_ELF_RANDOMIZE'),
     EnabledIfPresent('MSM_KERNEL_PROTECT'),
 
 # Not really security relevant, but come on guys
@@ -182,6 +183,8 @@ kernel_configuration = [
     Enabled('CPU_SW_DOMAIN_PAN', requires=['ARM'], minver=4.3),
     Enabled('CONFIG_ARM64_PAN', requires=['ARM64'], minver=4.3),
     Disabled('OABI_COMPAT'),
+    Disabled('CP_ACCESS', requires=['ARM']),
+    Disabled('CP_ACCESS64', requires=['ARM64']),
 
 # Only relevant of MODULES are enabled
     Enabled('MODULE_SIG', requires=['MODULES']),

pwnlib/elf/corefile.py

@@ -102,9 +102,9 @@ prstatus_types = {
     'aarch64': elf_prstatus_aarch64
 }
 
-prspinfo_types = {
-    32: elf_prspinfo_32,
-    64: elf_prspinfo_64,
+prpsinfo_types = {
+    32: elf_prpsinfo_32,
+    64: elf_prpsinfo_64,
 }
 
 siginfo_types = {
@@ -437,8 +437,8 @@ class Corefile(ELF):
         #: The NT_PRSTATUS object.
         self.prstatus = None
 
-        #: The NT_PRSPINFO object
-        self.prspinfo = None
+        #: The NT_PRPSINFO object
+        self.prpsinfo = None
 
         #: The NT_SIGINFO object
         self.siginfo = None
@@ -484,7 +484,7 @@ class Corefile(ELF):
             log.warn_once("%s does not use a supported corefile architecture, registers are unavailable" % self.file.name)
 
         prstatus_type = prstatus_types.get(self.arch, None)
-        prspinfo_type = prspinfo_types.get(self.bits, None)
+        prpsinfo_type = prpsinfo_types.get(self.bits, None)
         siginfo_type = siginfo_types.get(self.bits, None)
 
         with log.waitfor("Parsing corefile...") as w:
@@ -505,10 +505,10 @@ class Corefile(ELF):
                     # Try to find NT_PRPSINFO
                     # Note that pyelftools currently mis-identifies the enum name
                     # as 'NT_GNU_BUILD_ID'
-                    if note.n_descsz == ctypes.sizeof(prspinfo_type) and \
+                    if note.n_descsz == ctypes.sizeof(prpsinfo_type) and \
                        note.n_type == 'NT_GNU_BUILD_ID':
-                        self.NT_PRSPINFO = note
-                        self.prspinfo = prspinfo_type.from_buffer_copy(note.n_desc)
+                        self.NT_PRPSINFO = note
+                        self.prpsinfo = prpsinfo_type.from_buffer_copy(note.n_desc)
 
                     # Try to find NT_SIGINFO so we can see the fault
                     if note.n_type == 0x53494749:
@@ -545,7 +545,7 @@ class Corefile(ELF):
                         log.warn('Could not find the stack!')
                         self.stack = None
 
-            with context.local(bytes=self.bytes, log_level='error'):
+            with context.local(bytes=self.bytes, log_level='warn'):
                 try:
                     self._parse_stack()
                 except ValueError:
@@ -826,6 +826,10 @@ class Corefile(ELF):
         # find a pointer to this address, followed by a NULL.
         last_env_addr = address + 1
         p_last_env_addr = stack.find(pack(last_env_addr), None, last_env_addr)
+        if p_last_env_addr < 0:
+            # Something weird is happening.  Just don't touch it.
+            log.warn_once("Found bad environment at %#x", last_env_addr)
+            return
 
         # Sanity check that we did correctly find the envp NULL terminator.
         envp_nullterm = p_last_env_addr+context.bytes

pwnlib/elf/datatypes.py

@@ -252,6 +252,40 @@ class constants:
     AT_L2_CACHESHAPE        = 36
     AT_L3_CACHESHAPE        = 37
 
+    # Legal flags used in the d_val field of the DT_FLAGS dynamic entry.
+    DF_ORIGIN               = 0x01
+    DF_SYMBOLIC             = 0x02
+    DF_TEXTREL              = 0x04
+    DF_BIND_NOW             = 0x08
+    DF_STATIC_TLS           = 0x10
+
+    # Legal flags used in the d_val field of the DT_FLAGS_1 dynamic entry.
+    DF_1_NOW                = 0x00000001
+    DF_1_GLOBAL             = 0x00000002
+    DF_1_GROUP              = 0x00000004
+    DF_1_NODELETE           = 0x00000008
+    DF_1_LOADFLTR           = 0x00000010
+    DF_1_INITFIRST          = 0x00000020
+    DF_1_NOOPEN             = 0x00000040
+    DF_1_ORIGIN             = 0x00000080
+    DF_1_DIRECT             = 0x00000100
+    DF_1_TRANS              = 0x00000200
+    DF_1_INTERPOSE          = 0x00000400
+    DF_1_NODEFLIB           = 0x00000800
+    DF_1_NODUMP             = 0x00001000
+    DF_1_CONFALT            = 0x00002000
+    DF_1_ENDFILTEE          = 0x00004000
+    DF_1_DISPRELDNE         = 0x00008000
+    DF_1_DISPRELPND         = 0x00010000
+    DF_1_NODIRECT           = 0x00020000
+    DF_1_IGNMULDEF          = 0x00040000
+    DF_1_NOKSYMS            = 0x00080000
+    DF_1_NOHDR              = 0x00100000
+    DF_1_EDITED             = 0x00200000
+    DF_1_NORELOC            = 0x00400000
+    DF_1_SYMINTPOSE         = 0x00800000
+    DF_1_GLOBAUDIT          = 0x01000000
+    DF_1_SINGLETON          = 0x02000000
 
 
 class Elf32_Ehdr(ctypes.Structure):
@@ -595,7 +629,7 @@ class Elf64_auxv_t(ctypes.Structure):
     _fields_ = [('a_type', ctypes.c_uint64),
                 ('a_val', ctypes.c_uint64),]
 
-def generate_prspinfo(long):
+def generate_prpsinfo(long):
     return [
         ('pr_state', byte),
         ('pr_sname', char),
@@ -612,11 +646,11 @@ def generate_prspinfo(long):
         ('pr_psargs', char * 80)
     ]
 
-class elf_prspinfo_32(ctypes.Structure):
-    _fields_ = generate_prspinfo(Elf32_Addr)
+class elf_prpsinfo_32(ctypes.Structure):
+    _fields_ = generate_prpsinfo(Elf32_Addr)
 
-class elf_prspinfo_64(ctypes.Structure):
-    _fields_ = generate_prspinfo(Elf64_Addr)
+class elf_prpsinfo_64(ctypes.Structure):
+    _fields_ = generate_prpsinfo(Elf64_Addr)
 
 def generate_siginfo(int_t, long_t):
     class siginfo_t(ctypes.Structure):

pwnlib/elf/elf.py

@@ -64,6 +64,7 @@ from pwnlib.context import LocalContext
 from pwnlib.context import context
 from pwnlib.elf.config import kernel_configuration
 from pwnlib.elf.config import parse_kconfig
+from pwnlib.elf.datatypes import constants
 from pwnlib.elf.plt import emulate_plt_instructions
 from pwnlib.log import getLogger
 from pwnlib.qemu import get_qemu_arch
@@ -1327,14 +1328,28 @@ class ELF(ELFFile):
         .. _PT_GNU_RELRO: https://refspecs.linuxbase.org/LSB_3.1.1/LSB-Core-generic/LSB-Core-generic.html#PROGHEADER
         .. _DF_BIND_NOW: http://refspecs.linuxbase.org/elf/gabi4+/ch5.dynamic.html#df_bind_now
 
+        >>> path = pwnlib.data.elf.relro.path
+        >>> for test in glob(os.path.join(path, 'test-*')):
+        ...     e = ELF(test)
+        ...     expected = os.path.basename(test).split('-')[2]
+        ...     actual = str(e.relro).lower()
+        ...     assert actual == expected
         """
+        if not any('GNU_RELRO' in str(s.header.p_type) for s in self.segments):
+            return None
+
         if self.dynamic_by_tag('DT_BIND_NOW'):
             return "Full"
 
-        if any('GNU_RELRO' in str(s.header.p_type) for s in self.segments):
-            return "Partial"
+        flags = self.dynamic_value_by_tag('DT_FLAGS')
+        if flags and flags & constants.DF_BIND_NOW:
+            return "Full"
 
-        return None
+        flags_1 = self.dynamic_value_by_tag('DT_FLAGS_1')
+        if flags_1 and flags_1 & constants.DF_1_NOW:
+            return "Full"
+
+        return "Partial"
 
     @property
     def nx(self):

pwnlib/gdb.py

@@ -524,7 +524,7 @@ def attach(target, gdbscript = None, exe = None, need_ptrace_scope = True, gdb_a
         .. code-block:: python
 
             # Connect to the SSH server
-            shell = ssh('bandit0', 'bandit.labs.overthewire.org', password='bandit0')
+            shell = ssh('bandit0', 'bandit.labs.overthewire.org', password='bandit0', port=2220)
 
             # Start a process on the server
             cat = shell.process(['cat'])
@@ -596,7 +596,7 @@ def attach(target, gdbscript = None, exe = None, need_ptrace_scope = True, gdb_a
             cmd = ['sshpass', '-p', shell.password] + cmd
         if shell.keyfile:
             cmd += ['-i', shell.keyfile]
-        cmd += ['gdb %r %s -x "%s"' % (target.executable,
+        cmd += ['gdb -q %r %s -x "%s"' % (target.executable,
                                        target.pid,
                                        tmpfile)]
 
@@ -763,7 +763,7 @@ def find_module_addresses(binary, ssh=None, ulimit=False):
     Example:
 
     >>> with context.local(log_level=9999): # doctest: +SKIP
-    ...     shell = ssh(host='bandit.labs.overthewire.org',user='bandit0',password='bandit0')
+    ...     shell = ssh(host='bandit.labs.overthewire.org',user='bandit0',password='bandit0', port=2220)
     ...     bash_libs = gdb.find_module_addresses('/bin/bash', shell)
     >>> os.path.basename(bash_libs[0].path) # doctest: +SKIP
     'libc.so.6'
@@ -790,7 +790,7 @@ def find_module_addresses(binary, ssh=None, ulimit=False):
     # Get the addresses from GDB
     #
     libs = {}
-    cmd  = "gdb --args %s" % (binary)
+    cmd  = "gdb -q --args %s" % (binary)
     expr = re.compile(r'(0x\S+)[^/]+(.*)')
 
     if ulimit:

pwnlib/libcdb.py

@@ -21,14 +21,63 @@ from pwnlib.util.web import wget
 
 log = getLogger(__name__)
 
-cache_dir = os.path.join(tempfile.gettempdir(), 'pwn')
+HASHES = ['build_id', 'sha1', 'sha256', 'md5']
+
+def search_by_hash(hex_encoded_id, hash_type='build_id'):
+    assert hash_type in HASHES, hash_type
+
+    # Ensure that the libcdb cache directory exists
+    cache_dir = os.path.join(context.cache_dir, 'libcdb', hash_type)
+
+    if not os.path.isdir(cache_dir):
+        os.makedirs(cache_dir)
+
+    # If we already downloaded the file, and it looks even passingly like
+    # a valid ELF file, return it.
+    cache = os.path.join(cache_dir, hex_encoded_id)
+
+    if os.path.exists(cache):
+        log.debug("Found existing cached libc at %r", cache)
+
+        data = read(cache)
+        if data.startswith('\x7FELF'):
+            log.info_once("Using cached data from %r", cache)
+            return cache
+        else:
+            log.info_once("Skipping unavialable libc %s", hex_encoded_id)
+            return None
+
+    # Build the URL using the requested hash type
+    url_base = "https://gitlab.com/libcdb/libcdb/raw/master/hashes/%s/" % hash_type
+    url      = urlparse.urljoin(url_base, hex_encoded_id)
+
+    data   = ""
+    while not data.startswith('\x7fELF'):
+        log.debug("Downloading data from LibcDB: %s", url)
+        data = wget(url)
+
+        if not data:
+            log.warn_once("Could not fetch libc for build_id %s", hex_encoded_id)
+            break
+
+        # GitLab serves up symlinks with
+        if data.startswith('..'):
+            url = os.path.dirname(url) + '/'
+            url = urlparse.urljoin(url, data)
+
+    # Save whatever we got to the cache
+    write(cache, data or '')
+
+    # Return ``None`` if we did not get a valid ELF file
+    if not data or not data.startswith('\x7FELF'):
+        return None
+
+    return cache
+
 
 def search_by_build_id(hex_encoded_id):
     """
-    Given a hex-encoded Build ID, return the path to an ELF with that Build ID
-    only the local system.
-
-    If it can't be found, return None.
+    Given a hex-encoded Build ID, attempt to download a matching libc from libcdb.
 
     Arguments:
         hex_encoded_id(str):
@@ -36,31 +85,79 @@ def search_by_build_id(hex_encoded_id):
 
     Returns:
         Path to the downloaded library on disk, or :const:`None`.
+
+    Examples:
+        >>> filename = search_by_build_id('fe136e485814fee2268cf19e5c124ed0f73f4400')
+        >>> hex(ELF(filename).symbols.read)
+        '0xda260'
+        >>> None == search_by_build_id('XX')
+        True
     """
-    cache = cache_dir + '-libc.so.' + hex_encoded_id
+    return search_by_hash(hex_encoded_id, 'build_id')
 
-    if os.path.exists(cache) and read(cache).startswith('\x7FELF'):
-        log.info_once("Using cached data from %r" % cache)
-        return cache
+def search_by_md5(hex_encoded_id):
+    """
+    Given a hex-encoded md5sum, attempt to download a matching libc from libcdb.
 
-    log.info("Downloading data from GitHub")
+    Arguments:
+        hex_encoded_id(str):
+            Hex-encoded Build ID (e.g. 'ABCDEF...') of the library
 
-    url_base = "https://gitlab.com/libcdb/libcdb/raw/master/hashes/build_id/"
-    url      = urlparse.urljoin(url_base, hex_encoded_id)
+    Returns:
+        Path to the downloaded library on disk, or :const:`None`.
 
-    data   = ""
-    while not data.startswith('\x7fELF'):
-        data = wget(url)
+    Examples:
+        >>> filename = search_by_md5('7a71dafb87606f360043dcd638e411bd')
+        >>> hex(ELF(filename).symbols.read)
+        '0xda260'
+        >>> None == search_by_build_id('XX')
+        True
+    """
+    return search_by_hash(hex_encoded_id, 'md5')
+
+def search_by_sha1(hex_encoded_id):
+    """
+    Given a hex-encoded sha1, attempt to download a matching libc from libcdb.
+
+    Arguments:
+        hex_encoded_id(str):
+            Hex-encoded Build ID (e.g. 'ABCDEF...') of the library
+
+    Returns:
+        Path to the downloaded library on disk, or :const:`None`.
+
+    Examples:
+        >>> filename = search_by_sha1('34471e355a5e71400b9d65e78d2cd6ce7fc49de5')
+        >>> hex(ELF(filename).symbols.read)
+        '0xda260'
+        >>> None == search_by_sha1('XX')
+        True
+    """
+    return search_by_hash(hex_encoded_id, 'sha1')
+
+
+def search_by_sha256(hex_encoded_id):
+    """
+    Given a hex-encoded sha256, attempt to download a matching libc from libcdb.
+
+    Arguments:
+        hex_encoded_id(str):
+            Hex-encoded Build ID (e.g. 'ABCDEF...') of the library
+
+    Returns:
+        Path to the downloaded library on disk, or :const:`None`.
+
+    Examples:
+        >>> filename = search_by_sha256('5e877a8272da934812d2d1f9ee94f73c77c790cbc5d8251f5322389fc9667f21')
+        >>> hex(ELF(filename).symbols.read)
+        '0xda260'
+        >>> None == search_by_sha256('XX')
+        True
+    """
+    return search_by_hash(hex_encoded_id, 'sha256')
 
-        if not data:
-            return None
 
-        if data.startswith('..'):
-            url = os.path.dirname(url) + '/'
-            url = urlparse.urljoin(url, data)
 
-    write(cache, data)
-    return cache
 
 def get_build_id_offsets():
     """
@@ -114,4 +211,4 @@ def get_build_id_offsets():
     }.get(context.arch, [])
 
 
-__all__ = ['get_build_id_offsets', 'search_by_build_id']
+__all__ = ['get_build_id_offsets', 'search_by_build_id', 'search_by_sha1', 'search_by_sha256', 'search_by_md5']

pwnlib/shellcraft/templates/i386/linux/connect.asm

@@ -24,7 +24,7 @@ Examples:
     'Hello'
 
     >>> l = listen(fam='ipv6', timeout=5)
-    >>> assembly   = shellcraft.i386.linux.connect('ip6-localhost', l.lport, 'ipv6')
+    >>> assembly = shellcraft.i386.linux.connect('::1', l.lport, 'ipv6')
     >>> p = run_assembly(assembly)
     >>> assert l.wait_for_connection()
 

pwnlib/term/key.py

@@ -11,7 +11,9 @@ from pwnlib.term import termcap
 
 __all__ = ['getch', 'getraw', 'get', 'unget']
 
-
+# When set, convert keypad codes into regular key presses, e.g. "+" instead of
+# `<kp plus>`
+FLAG_CONVERTKP = True
 
 try:    _fd = sys.stdin.fileno()
 except Exception: _fd = file('/dev/null', 'r').fileno()
@@ -310,7 +312,24 @@ _csi_ss3s = {
 }
 
 _csi_ss3kp = {
-
+    'M': (kc.TYPE_KEYSYM, kc.KEY_KPENTER , None),
+    'X': (kc.TYPE_KEYSYM, kc.KEY_KPEQUALS, '='),
+    'j': (kc.TYPE_KEYSYM, kc.KEY_KPMULT  , '*'),
+    'k': (kc.TYPE_KEYSYM, kc.KEY_KPPLUS  , '+'),
+    'l': (kc.TYPE_KEYSYM, kc.KEY_KPCOMMA , ','),
+    'm': (kc.TYPE_KEYSYM, kc.KEY_KPMINUS , '-'),
+    'n': (kc.TYPE_KEYSYM, kc.KEY_KPPERIOD, '.'),
+    'o': (kc.TYPE_KEYSYM, kc.KEY_KPDIV   , '/'),
+    'p': (kc.TYPE_KEYSYM, kc.KEY_KP0     , '0'),
+    'q': (kc.TYPE_KEYSYM, kc.KEY_KP1     , '1'),
+    'r': (kc.TYPE_KEYSYM, kc.KEY_KP2     , '2'),
+    's': (kc.TYPE_KEYSYM, kc.KEY_KP3     , '3'),
+    't': (kc.TYPE_KEYSYM, kc.KEY_KP4     , '4'),
+    'u': (kc.TYPE_KEYSYM, kc.KEY_KP5     , '5'),
+    'v': (kc.TYPE_KEYSYM, kc.KEY_KP6     , '6'),
+    'w': (kc.TYPE_KEYSYM, kc.KEY_KP7     , '7'),
+    'x': (kc.TYPE_KEYSYM, kc.KEY_KP8     , '8'),
+    'y': (kc.TYPE_KEYSYM, kc.KEY_KP9     , '9'),
 }
 
 _csi_funcs = {
@@ -373,14 +392,14 @@ def _peekkey_ss3(offset):
     cmd = _cbuf[offset]
     if cmd < 0x40 or cmd >= 0x80:
         return
-    _cbuf = _cbuf[numb:] # XXX: numb is not defined
+    _cbuf = _cbuf[offset:]
 
     if chr(cmd) in _csi_ss3s:
         return Key(*_csi_ss3s[chr(cmd)])
 
     if chr(cmd) in _csi_ss3kp:
         t, c, a = _csi_ss3kp[chr(cmd)]
-        if CONVERTKP and a: # XXX: CONVERTKP is not defined
+        if FLAG_CONVERTKP and a:
             return Key(kc.TYPE_UNICODE, a)
         else:
             return Key(t, c)

pwnlib/tubes/process.py

@@ -11,6 +11,7 @@ import pty
 import resource
 import select
 import signal
+import stat
 import subprocess
 import time
 import tty
@@ -551,7 +552,7 @@ class process(tube):
         elif os.path.sep not in executable:
             tmp = executable
             executable = os.path.join(cwd, executable)
-            log.warn_once("Could not find executable %r in $PATH, using %r instead" % (tmp, executable))
+            self.warn_once("Could not find executable %r in $PATH, using %r instead" % (tmp, executable))
 
         if not os.path.exists(executable):
             self.error("%r does not exist"  % executable)

pwnlib/tubes/remote.py

@@ -73,7 +73,7 @@ class remote(sock):
             except socket.gaierror as e:
                 if e.errno != socket.EAI_NONAME:
                     raise
-                log.error('Could not resolve hostname: %r' % host)
+                self.error('Could not resolve hostname: %r' % host)
         if self.sock:
             self.settimeout(self.timeout)
             self.lhost, self.lport = self.sock.getsockname()[:2]

pwnlib/tubes/ssh.py

@@ -1908,7 +1908,7 @@ from ctypes import *; libc = CDLL('libc.so.6'); print(libc.getenv(%r))
 
         Example:
 
-            >>> s = ssh("esoteric3", "wargame.w3challs.com", 20202, "esoteric3")
+            >>> s = ssh("travis", "example.pwnme")
             >>> s.aslr
             True
         """

pwnlib/tubes/tube.py

@@ -622,7 +622,7 @@ class tube(Timeout, Logger):
         return self.recvline_pred(pred, keepends = keepends, timeout = timeout)
 
     def recvrepeat(self, timeout = default):
-        """recvrepeat()
+        """recvrepeat(timeout = default) -> str
 
         Receives data until a timeout or EOF is reached.
 

pwnlib/util/lists.py

@@ -114,17 +114,15 @@ def concat_all(*args):
        [0, 1, 2, 3, 4, 5, 6]
     """
 
-    if len(args) != 1:
-        return concat_all(list(args))
+    def go(arg, output):
+        if isinstance(arg, (tuple, list)):
+            for e in arg:
+                go(e, output)
+        else:
+            output.append(arg)
+        return output
 
-    if not isinstance(args[0], (tuple, list)):
-        return [args[0]]
-
-    res = []
-    for k in args[0]:
-        res.extend(concat_all(k))
-
-    return res
+    return go(args, [])
 
 def ordlist(s):
     """ordlist(s) -> list

pwnlib/util/misc.py

@@ -213,25 +213,22 @@ def run_in_new_terminal(command, terminal = None, args = None):
         elif 'TERM_PROGRAM' in os.environ:
             terminal = os.environ['TERM_PROGRAM']
             args     = []
-        elif 'DISPLAY' in os.environ:
+        elif 'DISPLAY' in os.environ and which('x-terminal-emulator'):
             terminal = 'x-terminal-emulator'
             args     = ['-e']
-        elif 'TMUX' in os.environ:
+        elif 'TMUX' in os.environ and which('tmux'):
             terminal = 'tmux'
             args     = ['splitw']
 
     if not terminal:
-        log.error('Argument `terminal` is not set, and could not determine a default')
-
-    terminal_path = which(terminal)
-
-    if not terminal_path:
-        log.error('Could not find terminal: %s' % terminal)
+        log.error('Could not find a terminal binary to use. Set context.terminal to your terminal.')
+    elif not which(terminal):
+        log.error('Could not find terminal binary %r. Set context.terminal to your terminal.' % terminal)
 
     if isinstance(args, tuple):
         args = list(args)
 
-    argv = [terminal_path] + args
+    argv = [which(terminal)] + args
 
     if isinstance(command, str):
         if ';' in command:

pwnlib/util/packing.py

@@ -697,36 +697,33 @@ def dd(dst, src, count = 0, skip = 0, seek = 0, truncate = False):
     The seek offset of file objects will be preserved.
 
     Arguments:
-      dst: Supported types are `:class:file`, `:class:list`, `:class:tuple`,
-           `:class:str`, `:class:bytearray` and `:class:unicode`.
-      src: An iterable of byte values (characters or integers), a unicode
-           string or a file object.
-      count (int): How many bytes to copy.  If `count` is 0 or larger than
-                   ``len(src[seek:])``, all bytes until the end of `src` are
-                   copied.
-      skip (int): Offset in `dst` to copy to.
-      seek (int): Offset in `src` to copy from.
-      truncate (bool): If `:const:True`, `dst` is truncated at the last copied
-                       byte.
+        dst: Supported types are `:class:file`, `:class:list`, `:class:tuple`,
+             `:class:str`, `:class:bytearray` and `:class:unicode`.
+        src: An iterable of byte values (characters or integers), a unicode
+             string or a file object.
+        count (int): How many bytes to copy.  If `count` is 0 or larger than
+                     ``len(src[seek:])``, all bytes until the end of `src` are
+                     copied.
+        skip (int): Offset in `dst` to copy to.
+        seek (int): Offset in `src` to copy from.
+        truncate (bool): If `:const:True`, `dst` is truncated at the last copied
+                         byte.
 
     Returns:
-      A modified version of `dst`.  If `dst` is a mutable type it will be
-      modified in-place.
+        A modified version of `dst`.  If `dst` is a mutable type it will be
+        modified in-place.
 
     Examples:
-    >>> dd(tuple('Hello!'), '?', skip = 5)
-    ('H', 'e', 'l', 'l', 'o', '?')
-    >>> dd(list('Hello!'), (63,), skip = 5)
-    ['H', 'e', 'l', 'l', 'o', '?']
-    >>> write('/tmp/foo', 'A' * 10)
-    ... dd(file('/tmp/foo'), file('/dev/zero'), skip = 3, count = 4)
-    ... read('/tmp/foo')
-    'AAA\x00\x00\x00\x00AAA'
-    >>> write('/tmp/foo', 'A' * 10)
-    ... dd(file('/tmp/foo'), file('/dev/zero'), skip = 3, count = 4, truncate = True)
-    ... read('/tmp/foo')
-    'AAA\x00\x00\x00\x00'
-
+        >>> dd(tuple('Hello!'), '?', skip = 5)
+        ('H', 'e', 'l', 'l', 'o', '?')
+        >>> dd(list('Hello!'), (63,), skip = 5)
+        ['H', 'e', 'l', 'l', 'o', '?']
+        >>> file('/tmp/foo', 'w').write('A' * 10)
+        >>> dd(file('/tmp/foo'), file('/dev/zero'), skip = 3, count = 4).read()
+        'AAA\\x00\\x00\\x00\\x00AAA'
+        >>> file('/tmp/foo', 'w').write('A' * 10)
+        >>> dd(file('/tmp/foo'), file('/dev/zero'), skip = 3, count = 4, truncate = True).read()
+        'AAA\\x00\\x00\\x00\\x00'
     """
 
     # Re-open file objects to make sure we have the mode right

pwnlib/version.py

@@ -1 +1 @@
-__version__ = '3.6.0'
+__version__ = '3.9.0'

setup.py

@@ -86,7 +86,7 @@ except Exception as e:
 setup(
     name                 = 'pwntools',
     packages             = find_packages(),
-    version              = '3.6.0',
+    version              = '3.9.0',
     data_files           = [('',
                              glob.glob('*.md') + glob.glob('*.txt')),
                             ],
@@ -97,6 +97,7 @@ setup(
             'data/binutils/*',
             'data/includes/*.h',
             'data/includes/*/*.h',
+            'data/templates/*.mako',
         ] + templates,
     },
     entry_points = {'console_scripts': console_scripts},
@@ -104,7 +105,7 @@ setup(
     description          = "Pwntools CTF framework and exploit development library.",
     long_description     = long_description,
     author               = "Gallopsled et al.",
-    author_email         = "#pwntools @ freenode.net",
+    author_email         = "pwntools[email protected]",
     url                  = 'https://pwntools.com',
     download_url         = "https://github.com/Gallopsled/pwntools/releases",
     install_requires     = install_requires,

travis/docker/Dockerfile

@@ -8,7 +8,10 @@ MAINTAINER Maintainer Gallopsled et al.
 
 USER root
 
+RUN apt-get update
+
 # Use UTF-8
+RUN apt-get install -y locales
 RUN locale-gen en_US.UTF-8
 ENV LANG en_US.UTF-8
 ENV LANGUAGE en_US:en

travis/install.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash -e
-set -e
+set -ex
 
 local_deb_extract()
 {
@@ -15,7 +15,7 @@ install_deb()
     package=$1
     echo "Installing $package"
     INDEX="http://packages.ubuntu.com/en/$version/amd64/$package/download"
-    URL=$(curl "$INDEX" | grep -Eo "https?://.*$package.*\.deb" | head -1)
+    URL=$(curl -L "$INDEX" | grep -Eo "https?://.*$package.*\.deb" | head -1)
     local_deb_extract "$URL"
 }
 
@@ -65,9 +65,14 @@ setup_travis()
 setup_linux()
 {
     sudo apt-get install -y software-properties-common openssh-server libncurses5-dev libncursesw5-dev openjdk-8-jre-headless
-    sudo apt-add-repository --yes ppa:pwntools/binutils
-    sudo apt-get update
-    sudo apt-get install binutils-arm-linux-gnu binutils-mips-linux-gnu binutils-powerpc-linux-gnu
+    RELEASE="$(lsb-release -sr)"
+    if [[ "$RELEASE" < "16.04" ]]; then
+        sudo apt-add-repository --yes ppa:pwntools/binutils
+        sudo apt-get update
+        sudo apt-get install -y binutils-arm-linux-gnu binutils-mips-linux-gnu binutils-powerpc-linux-gnu
+    else
+        sudo apt-get install -y binutils-arm-linux-gnueabihf binutils-mips-linux-gnu binutils-powerpc-linux-gnu
+    fi
 }
 
 setup_android_emulator()
@@ -193,4 +198,4 @@ elif [[ "$(uname)" == "Linux" ]]; then
     setup_android_emulator
 fi
 
-set +e
+set +ex

travis/ssh_setup.sh

@@ -4,7 +4,7 @@
 #
 # All of the "conditional sudo" is to do container-based builds on
 # Travis which are much, much faster.
-set -e
+set -ex
 
 U=travis
 H=/home/$U
@@ -55,4 +55,4 @@ EOF
 
 ssh -o "StrictHostKeyChecking no" -vvvv [email protected] id
 
-set +e
+set +ex