Release 4.0.0

Will investigate later
Apply #1391 with additional doctest
2026-11-09 10:09:36 -10:00 · 2020-01-09 18:54:49 +01:00 · 2019-12-13 23:25:36 +01:00 · 2019-12-13 23:00:34 +01:00 · 2019-12-13 22:56:02 +01:00 · 2019-12-06 10:57:16 +01:00
677 changed files with 9079 additions and 3995 deletions
@@ -11,6 +11,8 @@ docs/build
 build
 MANIFEST
 dist
+venv
+.vscode
 *.egg-info
 *.core
 .coverage
@@ -1,4 +1,4 @@
-dist: precise
+dist: xenial
 language: python
 addons:
  apt:
@@ -13,14 +13,22 @@ addons:
    - zsh
    - pandoc
    - gdb
+    - binutils
+    - qemu-user-static
+    - binutils-multiarch
+    - binutils-aarch64-linux-gnu
+    - binutils-arm-linux-gnueabihf
+    - binutils-mips-linux-gnu
+    - binutils-powerpc-linux-gnu
 cache:
    - pip
    - directories:
        - usr
-        - /home/travis/virtualenv/python2.7.13/lib/python2.7/site-packages/
-        - /home/travis/virtualenv/python2.7.13/bin/
+        - /home/travis/virtualenv/python2.7.15/lib/python2.7/site-packages/
+        - /home/travis/virtualenv/python2.7.15/bin/
 python:
-  - "2.7"
+  - "2.7.15"
+  - "3.6"
 before_install:
  - echo $-
  - source travis/install.sh
@@ -29,13 +37,14 @@ before_install:
 install:
  - pip install --upgrade pip
  - pip install --upgrade appdirs # https://github.com/ActiveState/appdirs/issues/89#issuecomment-282326570
+  - python setup.py egg_info      # pypa/pip#6275
  - pip install --upgrade --editable .
  - pip install --upgrade --requirement docs/requirements.txt
 before_script:
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
 script:
  - PWNLIB_NOTERM=1 coverage run -m sphinx -b doctest docs/source docs/build/doctest
 after_success:
@@ -9,9 +9,15 @@ The table below shows which release corresponds to each branch, and what date th

 | Version          | Branch   | Release Date           |
 | ---------------- | -------- | ---------------------- |
-| [3.11.0](#3110)  | `dev`    | Dec 2, 2017 (planned)
-| [3.10.0](#3100)  | `beta`   | Oct 21, 2017 (planned)
-| [3.9.2](#392)    | `stable` | Oct 5, 2017
+| [4.2.0](#420)    | `dev`    | Feb 10, 2020 (planned)
+| [4.1.0](#410)    | `beta`   | Jan 30, 2020 (planned)
+| [4.0.0](#400)    | `stable` | Jan 09, 2020
+| [3.13.0](#3130)  |          | Nov 5, 2019
+| [3.12.1](#3121)  |          | Sept 17, 2018
+| [3.12.0](#3120)  |          | Feb 22, 2018
+| [3.11.0](#3110)  |          | Jan 3, 2018
+| [3.10.0](#3100)  |          | Oct 25, 2017
+| [3.9.2](#392)    |          | Oct 5, 2017
 | [3.9.1](#391)    |          | Sep 28, 2017
 | [3.9.0](#390)    |          | Sep 11, 2017
 | [3.8.0](#380)    |          | Jul 29, 2017
@@ -39,13 +45,158 @@ The table below shows which release corresponds to each branch, and what date th
 | [3.0.0](#300)    |          | Aug 20, 2016
 | [2.2.0](#220)    |          | Jan 5, 2015

+## 4.2.0 (`dev`)
+
+To be released on Feb 10, 2020.
+
+## 4.1.0 (`beta`)
+
+To be released on Jan 30, 2020.
+
+- [#1316][1316] Fix connect shellcraft in python 3
+- [#1323][1323] Fix issues related with debugging
+- [#1001][1001] Enhance `unlock_bootloader` with better status messages
+- [#1389][1389] remove old dependencies
+- [#1241][1241] Launch QEMU with sysroot if specified
+- [#1218][1218] Support for FileStructure exploitation
+
+[1241]: https://github.com/Gallopsled/pwntools/pulls/1218
+[1218]: https://github.com/Gallopsled/pwntools/pulls/1218
+
+## 4.0.0 (`stable`)
+
+- **Python 3 support! <3**
+- [#1402][1402] Fix serialtube in python 3
+- [#1391][1391] Fix process.libs
+- [#1317][1317] Tubes with `context.encoding`
+- [#1216][1216] Improve format string generator
+- [#1285][1285] Add freebsd generic syscall templates
+- [76413f][76413f] Add pwnlib.adb.bootimg for 'ANDROID!' format boot.img images
+- [#1202][1202] Docker: Kill 14 layers in pwntools base images
+- [#1182][1182] shellcraft.dupio() for mips
+
+[1391]: https://github.com/Gallopsled/pwntools/pulls/1391
+[1317]: https://github.com/Gallopsled/pwntools/pulls/1317
+[1285]: https://github.com/Gallopsled/pwntools/pulls/1285
+[1216]: https://github.com/Gallopsled/pwntools/pulls/1216
+[1202]: https://github.com/Gallopsled/pwntools/pulls/1202
+[1182]: https://github.com/Gallopsled/pwntools/pulls/1182
+[76413f]: https://github.com/Gallopsled/pwntools/commit/76413f
+
+## 3.13.0
+
+- [#1204][1204] Reduce ROP cache filename length
+- [#1175][1175] Fix nested SSH connectors
+- [#1355][1355] Fix 'break' syscall
+- [#1277][1277] Fix timeout parameter passing in sendlineafter and other similar functions
+- [#1292][1292] Provide correct arch name to gdb for sparc64
+
+[1175]: https://github.com/Gallopsled/pwntools/pulls/1175
+[1204]: https://github.com/Gallopsled/pwntools/pulls/1355
+[1277]: https://github.com/Gallopsled/pwntools/pulls/1277
+[1292]: https://github.com/Gallopsled/pwntools/pulls/1292
+[1355]: https://github.com/Gallopsled/pwntools/pulls/1355
+
+## 3.12.1
+
+- [#1104][1104] Add `DynELF.dump()` for dumping remote ELF files
+- [#1101][1101] Set `context.os` via `context.binary`, useful for Android exploitation
+- [5fdc08][5fdc08] Work around broken `pidof` on Android
+- [63dfed][63dfed] Print warning when Corefile deletion fails instead of throwing an exception
+- [#1094][1094] Make hexdump output alignment more consistent
+- [#1096][1096] `flat()` and `fit()` are now the same function
+
+[1104]: https://github.com/Gallopsled/pwntools/pull/1104
+[1101]: https://github.com/Gallopsled/pwntools/pull/1101
+[1094]: https://github.com/Gallopsled/pwntools/pull/1094
+[1096]: https://github.com/Gallopsled/pwntools/pull/1096
+[5fdc08]: https://github.com/Gallopsled/pwntools/commit/5fdc08
+[63dfed]: https://github.com/Gallopsled/pwntools/commit/63dfed
+
+## 3.12.2
+
+- [1242][1242] Use IntervalTree 2.xx, disallow use of 3.xx
+- [1243][1243] Fix a typo that caused an exception when executing a binary with `process()` which returns `-ENOEXEC` and the system does not have `qemu-user` binaries installed.
+
+[1242]: https://github.com/Gallopsled/pwntools/pull/1242
+[1243]: https://github.com/Gallopsled/pwntools/pull/1243
+
+## 3.12.1
+
+- [#1198][1198] More compatibility fixes for pyelftools==0.25, and pin Sphinx<1.8.0 since it causes testing errors
+- [#1191][1191] Fix compatibility with pyelftools==0.25
+- [#1159][1159] Fix check for `/proc/.../status`
+- [#1162][1162] Fix broken package versions
+- [#1150][1150] Fix exception raised when a cache file is missing
+- [#1156][1156] Fix ROP gadget selection logic involving `int` and `syscall` instructions
+- [#1152][1152] Fix QEMU LD_PREFIX calculation (wrong parameter passed)
+- [#1155][1155] Use Ubuntu Trusty for all CI builds
+- [#1131][1131] Add "libc-" to libc prefixes in `process` tubes
+- [#1125][1125] Fix a typo
+- [#1121][1121] Fix tests which were broken by an upstream Sphinx change
+
+[1159]: https://github.com/Gallopsled/pwntools/pull/1159
+[1162]: https://github.com/Gallopsled/pwntools/pull/1162
+[1150]: https://github.com/Gallopsled/pwntools/pull/1150
+[1156]: https://github.com/Gallopsled/pwntools/pull/1156
+[1152]: https://github.com/Gallopsled/pwntools/pull/1152
+[1155]: https://github.com/Gallopsled/pwntools/pull/1155
+[1131]: https://github.com/Gallopsled/pwntools/pull/1131
+[1125]: https://github.com/Gallopsled/pwntools/pull/1125
+[1121]: https://github.com/Gallopsled/pwntools/pull/1121
+
+## 3.12.0
+
+- [#1083][1083] Better error messages for `gdb` when `LD_PRELOAD` is incorrect
+- [#1085][1085] Add support for extracting Android `BOOTLDR!` images
+- [#1075][1075] Add support for detecting GNU Screen for `run_in_new_terminal`
+- [#1074][1074] Add support for running `pwntools-gdb` wrapper script instead of `gdb`
+- [#1068][1068] Work around very old OpenSSL versions which don't have sha256 support *AND* don't exit with an error code when trying to use it
+- [#1067][1067] Add `pwnlib.tubes.server` module, which adds a reusable `server` listener
+- [#1063][1063] Add support for labels in `fit()`, allowing dynamic contents to be injected.  (This feature is really cool, check out the pull request!)
+
+[1083]: https://github.com/Gallopsled/pwntools/pull/1083
+[1085]: https://github.com/Gallopsled/pwntools/pull/1085
+[1075]: https://github.com/Gallopsled/pwntools/pull/1075
+[1074]: https://github.com/Gallopsled/pwntools/pull/1074
+[1068]: https://github.com/Gallopsled/pwntools/pull/1068
+[1067]: https://github.com/Gallopsled/pwntools/pull/1067
+[1063]: https://github.com/Gallopsled/pwntools/pull/1063
+
 ## 3.11.0

-To be released on Dec 2, 2017.
+- [#1044][1044] Enhancements to ROP
+    + Much better support for 64-bit Intel (amd64) ROP
+    + ROP gadget selection is optimized to favor multi-pops instead of multiple single-pop gadgets
+    + Added support for blacklisting byte values in ROP gadget addresses
+- [#1049][1049] Enhancements to `cyclic`
+    + `context` now has two additional attributes, `cyclic_alphabet` and `cyclic_length`, which correspond to the arguments `alphabet` and `n` to `cyclic()` and `cyclic_find()` and related routines.
+    + The motivation for this change is to allow setting the `alphabet` globally, so that any padding / patterns generated internally to pwntools can be controlled.  The specific motivation is blacklisting values in ROP padding.
+- [#1052][1052] Enhancements for detecting `QEMU_LD_PREFIX` used by QEMU user-mode emulation for sysroots
+- [#1035][1035] Minor documentation changes
+- [#1032][1032] Enhancements to `pwn template`
+- [#1031][1031] More accurate `Coredump.fault_addr` on amd64
+- [#1084][1084] Fix broken tests due to `ftp.debian.org` going down
+
+[1044]: https://github.com/Gallopsled/pwntools/pull/1044
+[1049]: https://github.com/Gallopsled/pwntools/pull/1049
+[1052]: https://github.com/Gallopsled/pwntools/pull/1052
+[1035]: https://github.com/Gallopsled/pwntools/pull/1035
+[1032]: https://github.com/Gallopsled/pwntools/pull/1032
+[1031]: https://github.com/Gallopsled/pwntools/pull/1031
+[1084]: https://github.com/Gallopsled/pwntools/pull/1084

 ## 3.10.0

-To be released on Oct 21, 2017.
+- [#1007][1007] Add support for setting a `gdbinit` file in the context
+- [#1055][1055] Fixes for `Corefile` stack parsing, speed up `ELF.string()`
+- [#1057][1057] Fix a variable name typo in `DynELF` logging which results in an exception being thrown
+- [#1058][1058] Fix an edge case in `ssh_process.exe`
+
+[1007]: https://github.com/Gallopsled/pwntools/pull/1007
+[1055]: https://github.com/Gallopsled/pwntools/pull/1055
+[1057]: https://github.com/Gallopsled/pwntools/pull/1057
+[1058]: https://github.com/Gallopsled/pwntools/pull/1058

 ## 3.9.2

@@ -2,7 +2,7 @@
 ![pwntools logo](https://github.com/Gallopsled/pwntools/blob/stable/docs/source/logo.png?raw=true)

 [![Docs](https://readthedocs.org/projects/pwntools/badge/?version=stable)](https://docs.pwntools.com/)
-[![PyPI](https://img.shields.io/badge/pypi-v3.9.2-green.svg?style=flat)](https://pypi.python.org/pypi/pwntools/)
+[![PyPI](https://img.shields.io/badge/pypi-v3.13.0-green.svg?style=flat)](https://pypi.python.org/pypi/pwntools/)
 [![Travis](https://travis-ci.org/Gallopsled/pwntools.svg)](https://travis-ci.org/Gallopsled/pwntools)
 [![Coveralls](https://img.shields.io/coveralls/Gallopsled/pwntools/dev.svg)](https://coveralls.io/github/Gallopsled/pwntools?branch=dev)
 [![Twitter](https://img.shields.io/badge/twitter-pwntools-4099FF.svg?style=flat)](https://twitter.com/pwntools)
@@ -32,15 +32,15 @@ To get you started, we've provided some example solutions for past CTF challenge

 # Installation

-Pwntools is best supported on 64-bit Ubuntu LTE releases (12.04, 14.04, and 16.04).  Most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).  Python 2.7 is required.
+Pwntools is best supported on 64-bit Ubuntu LTE releases (12.04, 14.04, 16.04 and 18.04).  Most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).  Python >= 2.7 is required (Python 3 suggested as best).

 Most of the functionality of pwntools is self-contained and Python-only.  You should be able to get running quickly with

 ```sh
 apt-get update
-apt-get install python2.7 python-pip python-dev git libssl-dev libffi-dev build-essential
-pip install --upgrade pip
-pip install --upgrade pwntools
+apt-get install python3 python3-pip python3-dev git libssl-dev libffi-dev build-essential
+python3 -m pip install --upgrade pip
+python3 -m pip install --upgrade git+https://github.com/Gallopsled/pwntools.git@dev3
 ```

 However, some of the features (assembling/disassembling foreign architectures) require non-Python dependencies.  For more information, see the [complete installation instructions here](https://docs.pwntools.com/en/stable/install.html).
@@ -44,7 +44,7 @@ def main(args):
 		doc2dash.__main__.main.main( \
 			[ os.path.join(dstdir, "html"), "-d", dstdir, "-n", name, \
 					"-f", "-I", "index.html"], "doc2dash", False)
-	except SystemExit,e:
+	except SystemExit as e:
 		pass

 	# Insert a link to the online version.
@@ -1,16 +1,17 @@
-sphinxcontrib-napoleon
-sphinxcontrib-autoprogram==0.1.2
-isort
-paramiko>=1.15.2
-mako>=1.0.0
-pyelftools>=0.2.3
 capstone
-ropgadget>=5.3
+coveralls
+doc2dash
+isort
+mako>=1.0.0
+paramiko>=1.15.2
+pip>=6.0.8
+pyelftools>=0.2.3
+pygments>=2.0
 pyserial>=2.7
 requests>=2.5.1
-pip>=6.0.8
-tox>=1.8.1
-pygments>=2.0
+ropgadget>=5.3
+sphinx
 sphinx_rtd_theme
-doc2dash
-coveralls
+sphinxcontrib-napoleon
+sphinxcontrib-autoprogram
+tox>=1.8.1
@@ -1,5 +1,6 @@
 .. testsetup:: *

+   from pprint import pprint
   from pwn import *
   adb = pwnlib.adb

@@ -6,6 +6,7 @@
   from pwnlib.asm import *
   from pwnlib import shellcraft
   from pwnlib.tubes.process import process
+   from pwnlib.util.fiddling import unhex


 :mod:`pwnlib.asm` --- Assembler functions
@@ -12,6 +12,8 @@
 # serve to show the default.

 import os
+import doctest
+import six
 import subprocess
 import sys

@@ -24,8 +26,6 @@ sys.path.insert(0, os.path.abspath('../..'))

 import pwnlib

-# -- General configuration -----------------------------------------------------
-
 # If your documentation needs a minimal Sphinx version, state it here.
 #needs_sphinx = '1.0'

@@ -69,9 +69,9 @@ doctest_global_setup = '''
 import sys, os
 os.environ['PWNLIB_NOTERM'] = '1'
 os.environ['PWNLIB_RANDOMIZE'] = '0'
-import pwnlib
+import pwnlib, logging
 pwnlib.context.context.reset_local()
-pwnlib.context.ContextType.defaults['log_level'] = 'ERROR'
+pwnlib.context.ContextType.defaults['log_level'] = logging.ERROR
 pwnlib.context.ContextType.defaults['randomize'] = False
 pwnlib.util.fiddling.default_style = {}
 pwnlib.term.text.when = 'never'
@@ -313,13 +313,13 @@ texinfo_documents = [
 branch = release

 try:
-    git_branch = subprocess.check_output('git describe --tags', shell = True)
+    git_branch = subprocess.check_output('git describe --tags', shell = True, universal_newlines = True)
 except subprocess.CalledProcessError:
    git_branch = '-'

 try:
    if '-' in git_branch:
-        branch = subprocess.check_output('git rev-parse HEAD', shell = True).strip()[:10]
+        branch = subprocess.check_output('git rev-parse HEAD', shell = True, universal_newlines = True).strip()[:10]
 except subprocess.CalledProcessError:
    pass

@@ -347,11 +347,11 @@ def linkcode_resolve(domain, info):
    else:
        filename = info['module'].replace('.', '/') + '.py'

-        if isinstance(val, (types.ModuleType, types.ClassType, types.MethodType, types.FunctionType, types.TracebackType, types.FrameType, types.CodeType)):
+        if isinstance(val, (types.ModuleType, types.MethodType, types.FunctionType, types.TracebackType, types.FrameType, types.CodeType) + six.class_types):
            try:
                lines, first = inspect.getsourcelines(val)
                filename += '#L%d-%d' % (first, first + len(lines) - 1)
-            except IOError:
+            except (IOError, TypeError):
                pass

    return "https://github.com/Gallopsled/pwntools/blob/%s/%s" % (branch, filename)
@@ -380,27 +380,25 @@ from sphinx.util.inspect import safe_getmembers, safe_getattr
 def dont_skip_any_doctests(app, what, name, obj, skip, options):
    return False

-# Test non-exported members
-class ModuleDocumenter(sphinx.ext.autodoc.ModuleDocumenter):
-    def get_object_members(self, want_all):
-        if want_all:
-            # if not hasattr(self.object, '__all__'):
-            #     for implicit module members, check __module__ to avoid
-            #     documenting imported objects
-                return True, safe_getmembers(self.object)
-            # else:
-            #     memberlist = self.object.__all__
-            #     # Sometimes __all__ is broken...
-            #     if not isinstance(memberlist, (list, tuple)) or not \
-            #        all(isinstance(entry, string_types) for entry in memberlist):
-            #         self.directive.warn(
-            #             '__all__ should be a list of strings, not %r '
-            #             '(in module %s) -- ignoring __all__' %
-            #             (memberlist, self.fullname))
-            #         # fall back to all members
-            #         return True, safe_getmembers(self.object)
-        else:
-            memberlist = self.options.members or []
+def get_object_members_all(self, want_all):
+    if want_all:
+        # if not hasattr(self.object, '__all__'):
+        #     for implicit module members, check __module__ to avoid
+        #     documenting imported objects
+        return True, safe_getmembers(self.object)
+    # else:
+    #     memberlist = self.object.__all__
+    #     # Sometimes __all__ is broken...
+    #     if not isinstance(memberlist, (list, tuple)) or not \
+        #        all(isinstance(entry, string_types) for entry in memberlist):
+    #         self.directive.warn(
+    #             '__all__ should be a list of strings, not %r '
+    #             '(in module %s) -- ignoring __all__' %
+    #             (memberlist, self.fullname))
+    #         # fall back to all members
+    #         return True, safe_getmembers(self.object)
+    else:
+        memberlist = self.options.members or []
        ret = []
        for mname in memberlist:
            try:
@@ -412,8 +410,38 @@ class ModuleDocumenter(sphinx.ext.autodoc.ModuleDocumenter):
                        safe_getattr(self.object, '__name__', '???'), mname))
        return False, ret

+class _DummyClass(object): pass
+
+class Py2OutputChecker(_DummyClass, doctest.OutputChecker):
+    def check_output(self, want, got, optionflags):
+        sup = super(Py2OutputChecker, self).check_output
+        if sup(want, got, optionflags):
+            return True
+        try:
+            rly_want = pwnlib.util.safeeval.const(want)
+            if sup(repr(rly_want), got, optionflags):
+                return True
+            rly_got = pwnlib.util.safeeval.const(got)
+            if rly_want == rly_got:
+                return True
+        except ValueError:
+            pass
+        rly_want = ' '.join(x[:2].replace('b"','"').replace("b'","'")+x[2:] for x in want.replace('\n','\n ').split(' ')).replace('\n ','\n')
+        if sup(rly_want, got, optionflags):
+            return True
+        rly_want = ' '.join(x[:2].replace('b"',' "').replace("b'"," '")+x[2:] for x in want.replace('\n','\n ').split(' ')).replace('\n ','\n')
+        return sup(rly_want, got, optionflags)
+
+def py2_doctest_init(self, checker=None, verbose=None, optionflags=0):
+    if checker is None:
+        checker = Py2OutputChecker()
+    doctest.DocTestRunner.__init__(self, checker, verbose, optionflags)
+
 if 'doctest' in sys.argv:
    def setup(app):
        app.connect('autodoc-skip-member', dont_skip_any_doctests)

-    sphinx.ext.autodoc.ModuleDocumenter = ModuleDocumenter
+    if sys.version_info[:1] < (3,):
+        import sphinx.ext.doctest
+        sphinx.ext.doctest.SphinxDocTestRunner.__init__ = py2_doctest_init
+    sphinx.ext.autodoc.ModuleDocumenter.get_object_members = get_object_members_all
@@ -8,7 +8,7 @@
 :mod:`pwnlib.context` --- Setting runtime variables
 =====================================================

-Many settings in ``pwntools`` are controlled via the global variable :data:`.context, such as the selected target operating system, architecture, and bit-width.
+Many settings in ``pwntools`` are controlled via the global variable :data:`.context`, such as the selected target operating system, architecture, and bit-width.

 In general, exploits will start with something like:

@@ -1,5 +1,6 @@
 .. testsetup:: *

+   from glob import glob
   from pwn import *

 :mod:`pwnlib.elf.corefile` --- Core Files
@@ -2,6 +2,7 @@

   from pwn import *
   from glob import glob
+   from pwnlib.elf.maps import CAT_PROC_MAPS_EXIT

 :mod:`pwnlib.elf.elf` --- ELF Files
 ===========================================================
@@ -13,7 +13,7 @@ Which imports a bazillion things into the global namespace to make your life eas

 This is a quick list of most of the objects and routines imported, in rough order of importance and frequency of use.

- :obj:`.context`
+- :mod:`pwnlib.context`
    - :data:`pwnlib.context.context`
    - Responsible for most of the pwntools convenience settings
    - Set `context.log_level = 'debug'` when troubleshooting your exploit
@@ -61,6 +61,7 @@ Each of the ``pwntools`` modules is documented here.
   log
   memleak
   protocols
+   qemu
   replacements
   rop
   rop/*
@@ -27,14 +27,14 @@ This exposes a standard interface to talk to processes, sockets, serial ports,
 and all manner of things, along with some nifty helpers for common tasks.
 For example, remote connections via :mod:`pwnlib.tubes.remote`.

-    >>> conn = remote('ftp.debian.org',21)
+    >>> conn = remote('ftp.ubuntu.com',21)
    >>> conn.recvline() # doctest: +ELLIPSIS
-    '220 ...'
-    >>> conn.send('USER anonymous\r\n')
-    >>> conn.recvuntil(' ', drop=True)
-    '331'
+    b'220 ...'
+    >>> conn.send(b'USER anonymous\r\n')
+    >>> conn.recvuntil(b' ', drop=True)
+    b'331'
    >>> conn.recvline()
-    'Please specify the password.\r\n'
+    b'Please specify the password.\r\n'
    >>> conn.close()

 It's also easy to spin up a listener
@@ -42,20 +42,20 @@ It's also easy to spin up a listener
    >>> l = listen()
    >>> r = remote('localhost', l.lport)
    >>> c = l.wait_for_connection()
-    >>> r.send('hello')
+    >>> r.send(b'hello')
    >>> c.recv()
-    'hello'
+    b'hello'

 Interacting with processes is easy thanks to :mod:`pwnlib.tubes.process`.

 ::

    >>> sh = process('/bin/sh')
-    >>> sh.sendline('sleep 3; echo hello world;')
+    >>> sh.sendline(b'sleep 3; echo hello world;')
    >>> sh.recvline(timeout=1)
-    ''
+    b''
    >>> sh.recvline(timeout=5)
-    'hello world\n'
+    b'hello world\n'
    >>> sh.close()

 Not only can you interact with processes programmatically, but you can
@@ -74,14 +74,14 @@ a ``process`` tube.

    >>> shell = ssh('bandit0', 'bandit.labs.overthewire.org', password='bandit0', port=2220)
    >>> shell['whoami']
-    'bandit0'
+    b'bandit0'
    >>> shell.download_file('/etc/motd')
    >>> sh = shell.run('sh')
-    >>> sh.sendline('sleep 3; echo hello world;') # doctest: +SKIP
+    >>> sh.sendline(b'sleep 3; echo hello world;') # doctest: +SKIP
    >>> sh.recvline(timeout=1)
-    ''
+    b''
    >>> sh.recvline(timeout=5)
-    'hello world\n'
+    b'hello world\n'
    >>> shell.close()

 Packing Integers
@@ -97,13 +97,13 @@ unpacking codes, and littering your code with helper routines.
    >>> import struct
    >>> p32(0xdeadbeef) == struct.pack('I', 0xdeadbeef)
    True
-    >>> leet = '37130000'.decode('hex')
-    >>> u32('abcd') == struct.unpack('I', 'abcd')[0]
+    >>> leet = unhex('37130000')
+    >>> u32(b'abcd') == struct.unpack('I', b'abcd')[0]
    True

 The packing/unpacking operations are defined for many common bit-widths.

-    >>> u8('A') == 0x41
+    >>> u8(b'A') == 0x41
    True

 Setting the Target Architecture and OS
@@ -112,9 +112,9 @@ Setting the Target Architecture and OS
 The target architecture can generally be specified as an argument to the routine that requires it.

    >>> asm('nop')
-    '\x90'
+    b'\x90'
    >>> asm('nop', arch='arm')
-    '\x00\xf0 \xe3'
+    b'\x00\xf0 \xe3'

 However, it can also be set once in the global ``context``.  The operating system, word size, and endianness can also be set here.

@@ -126,10 +126,10 @@ However, it can also be set once in the global ``context``.  The operating syste
 Additionally, you can use a shorthand to set all of the values at once.

    >>> asm('nop')
-    '\x90'
+    b'\x90'
    >>> context(arch='arm', os='linux', endian='big', word_size=32)
    >>> asm('nop')
-    '\xe3 \xf0\x00'
+    b'\xe3 \xf0\x00'

 .. doctest::
   :hide:
@@ -158,12 +158,12 @@ Assembly and Disassembly
 Never again will you need to run some already-assembled pile of shellcode
 from the internet!  The :mod:`pwnlib.asm` module is full of awesome.

-    >>> asm('mov eax, 0').encode('hex')
+    >>> enhex(asm('mov eax, 0'))
    'b800000000'

 But if you do, it's easy to suss out!

-    >>> print disasm('6a0258cd80ebf9'.decode('hex'))
+    >>> print(disasm(unhex('6a0258cd80ebf9')))
       0:   6a 02                   push   0x2
       2:   58                      pop    eax
       3:   cd 80                   int    0x80
@@ -176,7 +176,7 @@ loaded with useful time-saving shellcodes.
 Let's say that we want to `setreuid(getuid(), getuid())` followed by `dup`ing
 file descriptor 4 to `stdin`, `stdout`, and `stderr`, and then pop a shell!

-    >>> asm(shellcraft.setreuid() + shellcraft.dupsh(4)).encode('hex') # doctest: +ELLIPSIS
+    >>> enhex(asm(shellcraft.setreuid() + shellcraft.dupsh(4))) # doctest: +ELLIPSIS
    '6a3158cd80...'


@@ -188,10 +188,10 @@ Never write another hexdump, thanks to :mod:`pwnlib.util.fiddling`.

 Find offsets in your buffer that cause a crash, thanks to :mod:`pwnlib.cyclic`.

-    >>> print cyclic(20)
+    >>> print(cyclic(20).decode())
    aaaabaaacaaadaaaeaaa
-    >>> # Assume EIP = 0x62616166 ('faab' which is pack(0x62616166))  at crash time
-    >>> print cyclic_find('faab')
+    >>> # Assume EIP = 0x62616166 (b'faab' which is pack(0x62616166))  at crash time
+    >>> print(cyclic_find(b'faab'))
    120

 ELF Manipulation
@@ -200,22 +200,22 @@ ELF Manipulation
 Stop hard-coding things!  Look them up at runtime with :mod:`pwnlib.elf`.

    >>> e = ELF('/bin/cat')
-    >>> print hex(e.address) #doctest: +SKIP
+    >>> print(hex(e.address)) #doctest: +SKIP
    0x400000
-    >>> print hex(e.symbols['write']) #doctest: +SKIP
+    >>> print(hex(e.symbols['write'])) #doctest: +SKIP
    0x401680
-    >>> print hex(e.got['write']) #doctest: +SKIP
+    >>> print(hex(e.got['write'])) #doctest: +SKIP
    0x60b070
-    >>> print hex(e.plt['write']) #doctest: +SKIP
+    >>> print(hex(e.plt['write'])) #doctest: +SKIP
    0x401680

 You can even patch and save the files.

    >>> e = ELF('/bin/cat')
    >>> e.read(e.address, 4)
-    '\x7fELF'
+    b'\x7fELF'
    >>> e.asm(e.address, 'ret')
    >>> e.save('/tmp/quiet-cat')
-    >>> disasm(file('/tmp/quiet-cat','rb').read(1))
+    >>> disasm(open('/tmp/quiet-cat','rb').read(1))
    '   0:   c3                      ret'

@@ -0,0 +1,10 @@
+.. testsetup:: *
+
+   from pwn import *
+
+
+:mod:`pwnlib.qemu` --- QEMU Utilities
+==========================================
+
+.. automodule:: pwnlib.qemu
+   :members:
@@ -3,3 +3,9 @@

 .. automodule:: pwnlib.term
   :members:
+
+Term Modules
+-------------------
+
+.. toctree::
+    term/readline
@@ -0,0 +1,9 @@
+.. testsetup:: *
+
+   from pwnlib.tubes.buffer import *
+
+:mod:`pwnlib.tubes.buffer` --- buffer implementation for tubes
+==============================================================
+
+.. automodule:: pwnlib.tubes.buffer
+   :members:
@@ -1,6 +1,7 @@
 .. testsetup:: *

   from pwn import *
+   from pwnlib.tubes.server import server

 :mod:`pwnlib.tubes.sock` --- Sockets
 ===========================================================
@@ -23,3 +24,9 @@
   .. autoclass:: pwnlib.tubes.listen.listen
      :members:
      :show-inheritance:
+
+.. automodule:: pwnlib.tubes.server
+
+   .. autoclass:: pwnlib.tubes.server.server
+      :members:
+      :show-inheritance:
@@ -1,5 +1,6 @@
 .. testsetup:: *

+   from pwn import *
   from pwnlib.util.cyclic import *


@@ -0,0 +1,11 @@
+.. testsetup:: *
+
+   from pwnlib.util.getdents import *
+   from pwnlib.util.fiddling import unhex
+
+
+:mod:`pwnlib.util.getdents` --- Linux binary directory listing
+==============================================================
+
+.. automodule:: pwnlib.util.getdents
+   :members:
@@ -1,5 +1,6 @@
 .. testsetup:: *

+   from pprint import pprint
   from pwnlib.util.misc import *
   import os, subprocess
   os.chdir("..")
@@ -1,6 +1,7 @@
 .. testsetup:: *

   from pwnlib.util.proc import *
+   from pwnlib.tubes.process import process
   import os, sys


@@ -0,0 +1,51 @@
+CFLAGS := -Wno-unused-result -Wno-format-security
+TARGETS := printf.mips printf.mips64 printf.mipsel printf.mips64el printf.arm printf.aarch64 \
+	         printf.ppc printf.ppc64 printf.sparc64 printf.native printf.native32
+
+.PHONY: run
+run: all
+	./exploit.py
+
+.PHONY: all
+all: $(TARGETS)
+
+.PHONY: clean
+clean:
+	rm -f $(TARGETS)
+
+# mips variants
+%.mips: %.c
+	mips-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
+%.mipsel: %.c
+	mipsel-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
+%.mips64: %.c
+	mips64-linux-gnuabi64-gcc $(CFLAGS) -static -Os -o "$@" $^
+%.mips64el: %.c
+	mips64el-linux-gnuabi64-gcc $(CFLAGS) -static -Os -o "$@" $^
+
+# arm variants
+%.arm: %.c
+	arm-linux-gnueabi-gcc $(CFLAGS) -static -Os -o "$@" $^
+%.aarch64: %.c
+	aarch64-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
+
+# ppc variants
+%.ppc: %.c
+	powerpc-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
+%.ppc64: %.c
+	powerpc64-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
+
+# sparc variants
+%.sparc64: %.c
+	sparc64-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
+
+# native variants
+%.native: %.c
+	gcc $(CFLAGS) -o "$@" $^
+%.native32: %.c
+	i686-linux-gnu-gcc $(CFLAGS) -o "$@" $^
+
+# install deps on ubuntu xenial
+.PHONY: install-apt
+install-apt:
+	apt-get install -y make gcc-mips64el-linux-gnuabi64 gcc-sparc64-linux-gnu gcc-powerpc64-linux-gnu gcc-powerpc-linux-gnu gcc-arm-linux-gnueabi gcc-aarch64-linux-gnu gcc-mips64-linux-gnuabi64 gcc-mipsel-linux-gnu gcc-mips64el-linux-gnuabi64 gcc-mips-linux-gnu gcc-i686-linux-gnu gcc
@@ -0,0 +1,39 @@
+#!/usr/bin/env python2
+from pwn import *
+
+@context.quiet
+def exec_fmt(payload):
+    p = context.binary.process()
+    p.sendline(payload)
+    return p.recvall()
+
+def exploit(binary):
+    context.binary = ELF(binary)
+    autofmt = FmtStr(exec_fmt)
+    offset = autofmt.offset
+    with context.binary.process() as p:
+        addr = unpack(p.recv(context.bytes))
+        payload = fmtstr_payload(offset, {addr: p32(0x1337babe)})
+        p.sendline(payload)
+        p.recvuntil("DONE")
+        print hex(u32(p.recv(4)))
+
+binaries = [
+    "printf.mips",
+    "printf.mips64",
+    "printf.mipsel",
+    "printf.mips64el",
+    "printf.native",
+    "printf.native32",
+    "printf.ppc",
+    "printf.ppc64",
+    "printf.sparc64",
+    "printf.arm",
+    "printf.aarch64",
+]
+
+if len(sys.argv) > 1:
+    binaries = sys.argv[1:]
+
+for binary in binaries:
+    exploit(binary)
@@ -0,0 +1,29 @@
+#ifdef _FORTIFY_SOURCE
+#undef _FORTIFY_SOURCE
+#endif
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <sys/mman.h>
+#define MEMORY_ADDRESS ((void*)0x11110000)
+#define MEMORY_SIZE 1024
+#define TARGET ((int *) 0x11110100)
+int main(int argc, char const *argv[])
+{
+       char buff[1024];
+       void *ptr = NULL;
+       int *my_var = TARGET;
+       ptr = mmap(MEMORY_ADDRESS, MEMORY_SIZE, PROT_READ|PROT_WRITE, MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE, 0, 0);
+       if(ptr != MEMORY_ADDRESS)
+       {
+               perror("mmap");
+               return EXIT_FAILURE;
+       }
+       *my_var = 0x41414141;
+       write(1, &my_var, sizeof(int *));
+       scanf("%s", buff);
+       dprintf(2, buff);
+       write(1, "DONE", 4);
+       write(1, my_var, sizeof(int));
+       return 0;
+}
@@ -6,21 +6,21 @@
 FROM kalilinux/kali-linux-docker
 MAINTAINER Maintainer Gallopsled et al.

-RUN apt-get update
-RUN apt-get install -y build-essential
-RUN apt-get install -y git
-RUN apt-get install -y libssl-dev
-RUN apt-get install -y libffi-dev
-RUN apt-get install -y python2.7
-RUN apt-get install -y python-pip
-RUN apt-get install -y python-dev
-RUN pip install --upgrade pip
-RUN python -m pip install --upgrade pwntools
-RUN PWNLIB_NOTERM=1 pwn update
-
-RUN apt-get install -y sudo
-RUN useradd -m pwntools
-RUN passwd --delete --unlock pwntools
-RUN echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
+RUN apt-get update \
+    && apt-get install -y \
+        build-essential \
+        git \
+        libssl-dev \
+        libffi-dev \
+        python2.7 \
+        python-pip \
+        python-dev \
+    && pip install --upgrade pip \
+    && python -m pip install --upgrade pwntools \
+    && PWNLIB_NOTERM=1 pwn update \
+    && apt-get install -y sudo \
+    && useradd -m pwntools \
+    && passwd --delete --unlock pwntools \
+    && echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
 USER pwntools
 WORKDIR /home/pwntools
@@ -6,21 +6,21 @@
 FROM ubuntu:precise
 MAINTAINER Maintainer Gallopsled et al.

-RUN apt-get update
-RUN apt-get install -y build-essential
-RUN apt-get install -y git
-RUN apt-get install -y libssl-dev
-RUN apt-get install -y libffi-dev
-RUN apt-get install -y python2.7
-RUN apt-get install -y python-pip
-RUN apt-get install -y python-dev
-RUN pip install --upgrade pip
-RUN python -m pip install --upgrade pwntools
-RUN PWNLIB_NOTERM=1 pwn update
-
-RUN apt-get install -y sudo
-RUN useradd -m pwntools
-RUN passwd --delete --unlock pwntools
-RUN echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
+RUN apt-get update \
+    && apt-get install -y \
+        build-essential \
+        git \
+        libssl-dev \
+        libffi-dev \
+        python2.7 \
+        python-pip \
+        python-dev \
+    && pip install --upgrade pip \
+    && python -m pip install --upgrade pwntools \
+    && PWNLIB_NOTERM=1 pwn update \
+    && apt-get install -y sudo \
+    && useradd -m pwntools \
+    && passwd --delete --unlock pwntools \
+    && echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
 USER pwntools
 WORKDIR /home/pwntools
@@ -6,21 +6,21 @@
 FROM ubuntu:trusty
 MAINTAINER Maintainer Gallopsled et al.

-RUN apt-get update
-RUN apt-get install -y build-essential
-RUN apt-get install -y git
-RUN apt-get install -y libssl-dev
-RUN apt-get install -y libffi-dev
-RUN apt-get install -y python2.7
-RUN apt-get install -y python-pip
-RUN apt-get install -y python-dev
-RUN pip install --upgrade pip
-RUN python -m pip install --upgrade pwntools
-RUN PWNLIB_NOTERM=1 pwn update
-
-RUN apt-get install -y sudo
-RUN useradd -m pwntools
-RUN passwd --delete --unlock pwntools
-RUN echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
+RUN apt-get update \
+    && apt-get install -y \
+        build-essential \
+        git \
+        libssl-dev \
+        libffi-dev \
+        python2.7 \
+        python-pip \
+        python-dev \
+    && pip install --upgrade pip \
+    && python -m pip install --upgrade pwntools \
+    && PWNLIB_NOTERM=1 pwn update \
+    && apt-get install -y sudo \
+    && useradd -m pwntools \
+    && passwd --delete --unlock pwntools \
+    && echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
 USER pwntools
 WORKDIR /home/pwntools
@@ -6,21 +6,21 @@
 FROM ubuntu:xenial
 MAINTAINER Maintainer Gallopsled et al.

-RUN apt-get update
-RUN apt-get install -y build-essential
-RUN apt-get install -y git
-RUN apt-get install -y libssl-dev
-RUN apt-get install -y libffi-dev
-RUN apt-get install -y python2.7
-RUN apt-get install -y python-pip
-RUN apt-get install -y python-dev
-RUN pip install --upgrade pip
-RUN python -m pip install --upgrade pwntools
-RUN PWNLIB_NOTERM=1 pwn update
-
-RUN apt-get install -y sudo
-RUN useradd -m pwntools
-RUN passwd --delete --unlock pwntools
-RUN echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
+RUN apt-get update \
+    && apt-get install -y \
+        build-essential \
+        git \
+        libssl-dev \
+        libffi-dev \
+        python2.7 \
+        python-pip \
+        python-dev \
+    && pip install --upgrade pip \
+    && python -m pip install --upgrade pwntools \
+    && PWNLIB_NOTERM=1 pwn update \
+    && apt-get install -y sudo \
+    && useradd -m pwntools \
+    && passwd --delete --unlock pwntools \
+    && echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
 USER pwntools
 WORKDIR /home/pwntools
@@ -21,7 +21,7 @@ import pwnlib
 from pwnlib import *
 from pwnlib.asm import *
 from pwnlib.context import Thread
-from pwnlib.context import context
+from pwnlib.context import context, LocalContext
 from pwnlib.dynelf import DynELF
 from pwnlib.encoders import *
 from pwnlib.elf.corefile import Core, Corefile, Coredump
@@ -43,6 +43,7 @@ from pwnlib.tubes.listen import listen
 from pwnlib.tubes.process import process, PTY, PIPE, STDOUT
 from pwnlib.tubes.remote import remote, tcp, udp, connect
 from pwnlib.tubes.serialtube import serialtube
+from pwnlib.tubes.server import server
 from pwnlib.tubes.ssh import ssh
 from pwnlib.tubes.tube import tube
 from pwnlib.ui import *
@@ -66,15 +67,8 @@ from pwnlib.util.web import *

 # Promote these modules, so that "from pwn import *" will let you access them

-try:
-    import cPickle as pickle
-except ImportError:
-    import pickle
-
-try:
-    from cStringIO import StringIO
-except ImportError:
-    from StringIO import StringIO
+from six.moves import cPickle as pickle, cStringIO as StringIO
+from six import BytesIO

 error   = log.error
 warning = log.warning
@@ -82,3 +76,5 @@ warn    = log.warning
 info    = log.info
 debug   = log.debug
 success = log.success
+
+__all__ = [x for x in globals().keys() if x != '__name__']
@@ -1,5 +1,6 @@
 # -*- coding: utf-8 -*-
 from __future__ import absolute_import
+from __future__ import division

 from pwnlib.context import LocalContext
 from pwnlib.context import context
@@ -45,10 +46,18 @@ class ABI(object):
        (32, 'arm', 'linux'):   linux_arm,
        (32, 'thumb', 'linux'):   linux_arm,
        (32, 'mips', 'linux'):   linux_mips,
-        (32, 'i386', 'windows'):  windows_i386,
-        (64, 'amd64', 'windows'): windows_amd64,
        (32, 'powerpc', 'linux'): linux_ppc,
        (64, 'powerpc', 'linux'): linux_ppc64,
+        (32, 'i386', 'freebsd'):  freebsd_i386,
+        (64, 'aarch64', 'freebsd'): freebsd_aarch64,
+        (64, 'amd64', 'freebsd'): freebsd_amd64,
+        (32, 'arm', 'freebsd'):   freebsd_arm,
+        (32, 'thumb', 'freebsd'):   freebsd_arm,
+        (32, 'mips', 'freebsd'):   freebsd_mips,
+        (32, 'powerpc', 'freebsd'): freebsd_ppc,
+        (64, 'powerpc', 'freebsd'): freebsd_ppc64,
+        (32, 'i386', 'windows'):  windows_i386,
+        (64, 'amd64', 'windows'): windows_amd64,
        }[(context.bits, context.arch, context.os)]

    @staticmethod
@@ -67,6 +76,15 @@ class ABI(object):
        (64, 'aarch64', 'linux'):   linux_aarch64_syscall,
        (32, 'powerpc', 'linux'): linux_ppc_syscall,
        (64, 'powerpc', 'linux'): linux_ppc64_syscall,
+        (32, 'i386', 'freebsd'):  freebsd_i386_syscall,
+        (64, 'amd64', 'freebsd'): freebsd_amd64_syscall,
+        (64, 'aarch64', 'freebsd'): freebsd_aarch64_syscall,
+        (32, 'arm', 'freebsd'):   freebsd_arm_syscall,
+        (32, 'thumb', 'freebsd'):   freebsd_arm_syscall,
+        (32, 'mips', 'freebsd'):   freebsd_mips_syscall,
+        (64, 'aarch64', 'freebsd'):   freebsd_aarch64_syscall,
+        (32, 'powerpc', 'freebsd'): freebsd_ppc_syscall,
+        (64, 'powerpc', 'freebsd'): freebsd_ppc64_syscall,
        }[(context.bits, context.arch, context.os)]

    @staticmethod
@@ -81,6 +99,11 @@ class ABI(object):
        (32, 'arm', 'linux'):   linux_arm_sigreturn,
        (32, 'thumb', 'linux'):   linux_arm_sigreturn,
        (64, 'aarch64', 'linux'):   linux_aarch64_sigreturn,
+        (32, 'i386', 'freebsd'):  freebsd_i386_sigreturn,
+        (64, 'amd64', 'freebsd'): freebsd_amd64_sigreturn,
+        (32, 'arm', 'freebsd'):   freebsd_arm_sigreturn,
+        (32, 'thumb', 'freebsd'):   freebsd_arm_sigreturn,
+        (64, 'aarch64', 'freebsd'):   freebsd_aarch64_sigreturn,
        }[(context.bits, context.arch, context.os)]

 class SyscallABI(ABI):
@@ -101,6 +124,7 @@ class SigreturnABI(SyscallABI):
    returns = False


+# System V ABI used by many UNIXes
 linux_i386   = ABI('esp', [], 4, 0)
 linux_amd64  = ABI('rsp', ['rdi','rsi','rdx','rcx','r8','r9'], 8, 0)
 linux_arm    = ABI('sp', ['r0', 'r1', 'r2', 'r3'], 8, 0)
@@ -109,6 +133,14 @@ linux_mips  = ABI('$sp', ['$a0','$a1','$a2','$a3'], 4, 0)
 linux_ppc = ABI('sp', ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 4, 0)
 linux_ppc64 = ABI('sp', ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 8, 0)

+sysv_i386 = linux_i386
+sysv_amd64 = linux_amd64
+sysv_arm = linux_arm
+sysv_aarch64 = linux_aarch64
+sysv_mips = linux_mips
+sysv_ppc = linux_ppc
+sysv_ppc64 = linux_ppc64
+
 linux_i386_syscall = SyscallABI('esp', ['eax', 'ebx', 'ecx', 'edx', 'esi', 'edi', 'ebp'], 4, 0)
 linux_amd64_syscall = SyscallABI('rsp', ['rax', 'rdi', 'rsi', 'rdx', 'r10', 'r8', 'r9'],   8, 0)
 linux_arm_syscall   = SyscallABI('sp', ['r7', 'r0', 'r1', 'r2', 'r3', 'r4', 'r5', 'r6'], 4, 0)
@@ -122,10 +154,31 @@ linux_amd64_sigreturn = SigreturnABI('rsp', ['rax'], 4, 0)
 linux_arm_sigreturn = SigreturnABI('sp', ['r7'], 4, 0)
 linux_aarch64_sigreturn = SigreturnABI('sp', ['x8'], 16, 0)

+sysv_i386_sigreturn = linux_i386_sigreturn
+sysv_amd64_sigreturn = linux_amd64_sigreturn
+sysv_arm_sigreturn = linux_arm_sigreturn
+sysv_aarch64_sigreturn = linux_aarch64_sigreturn
+
+freebsd_i386 = sysv_i386
+freebsd_amd64 = sysv_amd64
+freebsd_arm = sysv_arm
+freebsd_aarch64 = sysv_aarch64
+freebsd_mips = sysv_mips
+freebsd_ppc = sysv_ppc
+freebsd_ppc64 = sysv_ppc64
+
+freebsd_i386_syscall   = SyscallABI('esp', ['eax'], 4, 0)
+freebsd_amd64_syscall  = SyscallABI('rsp', ['rax','rdi','rsi','rdx','rcx','r8','r9'], 8, 0)
+freebsd_arm_syscall    = SyscallABI('sp', ['r7', 'r0', 'r1', 'r2', 'r3'], 8, 0)
+freebsd_aarch64_syscall = SyscallABI('sp', ['x8', 'x0', 'x1', 'x2', 'x3'], 16, 0)
+freebsd_mips_syscall  = SyscallABI('$sp', ['$v0','$a0','$a1','$a2','$a3'], 4, 0)
+freebsd_ppc_syscall = SyscallABI('sp', ['r0', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 4, 0)
+freebsd_ppc64_syscall = SyscallABI('sp', ['r0', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 8, 0)
+
+freebsd_i386_sigreturn = sysv_i386_sigreturn
+freebsd_amd64_sigreturn = sysv_amd64_sigreturn
+freebsd_arm_sigreturn = sysv_arm_sigreturn
+freebsd_aarch64_sigreturn = sysv_aarch64_sigreturn
+
 windows_i386  = ABI('esp', [], 4, 0)
 windows_amd64 = ABI('rsp', ['rcx','rdx','r8','r9'], 32, 32)
-
-# Fake ABIs used by SROP
-linux_i386_srop = ABI('esp', ['eax'], 4, 0)
-linux_amd64_srop = ABI('rsp', ['rax'], 4, 0)
-linux_arm_srop = ABI('sp', ['r7'], 4, 0)
@@ -2,3 +2,5 @@ from __future__ import absolute_import

 from pwnlib.adb.adb import *
 from pwnlib.adb.protocol import Client
+from pwnlib.adb.bootimg import BootImage
+from pwnlib.adb.bootloader import BootloaderImage
@@ -35,25 +35,26 @@ the :mod:`pwnlib.adb` module.
 .. code-block:: python

    # Get a process listing
-    print adb.process(['ps']).recvall()
+    print(adb.process(['ps']).recvall())

    # Fetch properties
-    print adb.properties.ro.build.fingerprint
+    print(adb.properties.ro.build.fingerprint)

    # Read and write files
-    print adb.read('/proc/version')
+    print(adb.read('/proc/version'))
    adb.write('/data/local/tmp/foo', 'my data')

 """
 from __future__ import absolute_import
+from __future__ import division

 import functools
 import glob
 import logging
 import os
-import platform
 import re
 import shutil
+import six
 import stat
 import tempfile
 import time
@@ -75,9 +76,9 @@ def adb(argv, *a, **kw):
    r"""Returns the output of an ADB subcommand.

    >>> adb.adb(['get-serialno'])
-    'emulator-5554\n'
+    b'emulator-5554\n'
    """
-    if isinstance(argv, (str, unicode)):
+    if isinstance(argv, (bytes, six.text_type)):
        argv = [argv]

    log.debug("$ " + ' '.join(context.adb + argv))
@@ -355,7 +356,6 @@ class AdbDevice(Device):

            if name not in g:
                raise AttributeError('%r object has no attribute %r' % (type(self).__name__,name))
-
            value = g[name]

        if not hasattr(value, '__call__'):
@@ -415,7 +415,7 @@ def wait_for_device(kick=False):
@with_device
 def disable_verity():
    """Disables dm-verity on the device."""
-    with log.waitfor("Disabling dm-verity on %s" % context.device) as w:
+    with log.waitfor("Disabling dm-verity on %s" % context.device):
        root()

        with AdbClient() as c:
@@ -433,7 +433,7 @@ def disable_verity():
@with_device
 def remount():
    """Remounts the filesystem as writable."""
-    with log.waitfor("Remounting filesystem on %s" % context.device) as w:
+    with log.waitfor("Remounting filesystem on %s" % context.device):
        disable_verity()
        root()

@@ -486,7 +486,7 @@ def pull(remote_path, local_path=None):
    Example:

        >>> _=adb.pull('/proc/version', './proc-version')
-        >>> print read('./proc-version') # doctest: +ELLIPSIS
+        >>> print(read('./proc-version').decode('utf-8')) # doctest: +ELLIPSIS
        Linux version ...
    """
    if local_path is None:
@@ -520,7 +520,7 @@ def push(local_path, remote_path):
        >>> adb.push('./filename', '/data/local/tmp')
        '/data/local/tmp/filename'
        >>> adb.read('/data/local/tmp/filename')
-        'contents'
+        b'contents'
        >>> adb.push('./filename', '/does/not/exist')
        Traceback (most recent call last):
        ...
@@ -573,7 +573,7 @@ def read(path, target=None, callback=None):

    Examples:

-        >>> print adb.read('/proc/version') # doctest: +ELLIPSIS
+        >>> print(adb.read('/proc/version').decode('utf-8')) # doctest: +ELLIPSIS
        Linux version ...
        >>> adb.read('/does/not/exist')
        Traceback (most recent call last):
@@ -593,7 +593,7 @@ def read(path, target=None, callback=None):

@context.quietfunc
@with_device
-def write(path, data=''):
+def write(path, data=b''):
    """Create a file on the device with the provided contents.

    Arguments:
@@ -602,7 +602,7 @@ def write(path, data=''):

    Examples:

-        >>> adb.write('/dev/null', 'data')
+        >>> adb.write('/dev/null', b'data')
        >>> adb.write('/data/local/tmp/')
    """
    with tempfile.NamedTemporaryFile() as temp:
@@ -650,7 +650,7 @@ def mkdir(path):

        # Any output at all is an error
        if result:
-            log.error(result)
+            log.error(result.rstrip().decode('utf-8'))

@context.quietfunc
@with_device
@@ -746,12 +746,12 @@ def unlink(path, recursive=False):
        if isdir(path) and c.list(path) and not recursive:
            log.error("Cannot delete non-empty directory %r without recursive=True" % path)

-        flags = '-rf' if recursive else '-r'
+        flags = '-rf' if recursive else '-f'

        output = c.execute(['rm', flags, path]).recvall()

        if output:
-            log.error(output)
+            log.error(output.decode('utf-8'))

@with_device
 def process(argv, *a, **kw):
@@ -765,10 +765,10 @@ def process(argv, *a, **kw):
    Examples:

        >>> adb.root()
-        >>> print adb.process(['cat','/proc/version']).recvall() # doctest: +ELLIPSIS
+        >>> print(adb.process(['cat','/proc/version']).recvall().decode('utf-8')) # doctest: +ELLIPSIS
        Linux version ...
    """
-    if isinstance(argv, (str, unicode)):
+    if isinstance(argv, (bytes, six.text_type)):
        argv = [argv]

    message = "Starting %s process %r" % ('Android', argv[0])
@@ -820,10 +820,13 @@ echo $PATH | while read -d: directory; do
    [ -x "$directory/{name}" ] || continue;
    echo -n "$directory/{name}\\x00";
 done
+[ -x "{name}" ] && echo -n "$PWD/{name}\\x00"
 '''.format(name=name)

    which_cmd = which_cmd.strip()
    data = process(['sh','-c', which_cmd], *a, **kw).recvall()
+    if not hasattr(data, 'encode'):
+        data = data.decode('utf-8')
    result = []

    for path in data.split('\x00'):
@@ -852,7 +855,7 @@ def whoami():
 def forward(port):
    """Sets up a port to forward to the device."""
    tcp_port = 'tcp:%s' % port
-    start_forwarding = adb(['forward', tcp_port, tcp_port])
+    adb(['forward', tcp_port, tcp_port])
    atexit.register(lambda: adb(['forward', '--remove', tcp_port]))

@context.quietfunc
@@ -880,9 +883,16 @@ def logcat(stream=False):
 def pidof(name):
    """Returns a list of PIDs for the named process."""
    with context.quiet:
-        io = process(['pidof', name])
-        data = io.recvall().split()
-    return list(map(int, data))
+        # Older devices have a broken 'pidof', apparently.
+        # Try pgrep first.
+        io = process(['pgrep', name])
+        data = io.recvall()
+
+        if 'not found' in data:
+            io = process(['pidof', name])
+            data = io.recvall()
+
+    return list(map(int, data.split()))

@with_device
 def proc_exe(pid):
@@ -905,11 +915,17 @@ def getprop(name=None):
    """
    with context.quiet:
        if name:
-            return process(['getprop', name]).recvall().strip()
+            result = process(['getprop', name]).recvall().strip()
+            if not hasattr(result, 'encode'):
+                result = result.decode('utf-8')
+            return result


        result = process(['getprop']).recvall()

+    if not hasattr(result, 'encode'):
+        result = result.decode('utf-8')
+
    expr = r'\[([^\]]+)\]: \[(.*)\]'

    props = {}
@@ -1049,7 +1065,7 @@ class Kernel(object):
            'Nexus 7': 'oem uart-on',
        }

-        with log.waitfor('Enabling kernel UART') as w:
+        with log.waitfor('Enabling kernel UART'):

            if model not in known_commands:
                log.error("Device UART is unsupported.")
@@ -1089,7 +1105,7 @@ class Property(object):
        self.__dict__['_name'] = name

    def __str__(self):
-        return getprop(self._name).strip()
+        return str(getprop(self._name)).strip()

    def __repr__(self):
        return repr(str(self))
@@ -0,0 +1,52 @@
+from __future__ import division
+
+import ctypes
+
+BOOT_MAGIC = b"ANDROID!"
+BOOT_MAGIC_SIZE = 8
+BOOT_NAME_SIZE = 16
+BOOT_ARGS_SIZE = 512
+BOOT_EXTRA_ARGS_SIZE = 1024
+
+
+class boot_img_hdr(ctypes.Structure):
+    _fields_ = [
+        ('magic', ctypes.c_char * BOOT_MAGIC_SIZE),
+
+        ('kernel_size', ctypes.c_uint32),
+        ('kernel_addr', ctypes.c_uint32),
+
+        ('ramdisk_size', ctypes.c_uint32),
+        ('ramdisk_addr', ctypes.c_uint32),
+
+        ('second_size', ctypes.c_uint32),
+        ('second_addr', ctypes.c_uint32),
+
+        ('tags_addr', ctypes.c_uint32),
+        ('page_size', ctypes.c_uint32),
+        ('unused', ctypes.c_uint32),
+
+        ('os_version', ctypes.c_uint32),
+
+        ('name', ctypes.c_char * BOOT_NAME_SIZE),
+        ('cmdline', ctypes.c_char * BOOT_ARGS_SIZE),
+        ('id', ctypes.c_char * 8),
+
+        ('extra_cmdline', ctypes.c_char * BOOT_EXTRA_ARGS_SIZE),
+    ]
+
+class BootImage(object):
+    def __init__(self, data):
+        self.data = data
+        self.header = boot_img_hdr.from_buffer_copy(data)
+
+        PAGE = self.page_size
+
+        # The kernel starts at the beginning of the second page.
+        self.kernel = self.data[PAGE:PAGE+self.kernel_size]
+
+    def __getattr__(self, name):
+        value = getattr(self.header, name, None)
+        if value is not None:
+            return value
+        return getattr(super(BootImage, self), name)
@@ -0,0 +1,124 @@
+from __future__ import unicode_literals
+from __future__ import division
+
+import ctypes
+import io
+import os
+import sys
+
+from pwnlib.log import getLogger
+
+log = getLogger(__name__)
+
+class img_info(ctypes.Structure):
+    _fields_ = [
+        ('name', ctypes.c_char * 64),
+        ('size', ctypes.c_uint32)
+    ]
+
+class bootloader_images_header(ctypes.Structure):
+    _fields_ = [
+        ('magic', ctypes.c_char * 8),
+        ('num_images', ctypes.c_uint32),
+        ('start_offset', ctypes.c_uint32),
+        ('bootldr_size', ctypes.c_uint32),
+    ]
+
+BOOTLDR_MAGIC = b'BOOTLDR!'
+
+class BootloaderImage(object):
+    def __init__(self, data):
+        """Android Bootloader image
+
+        Arguments:
+            data(str): Binary data from the image file.
+        """
+        self.data = data
+        self.header = bootloader_images_header.from_buffer_copy(data)
+
+        if self.magic != BOOTLDR_MAGIC:
+            log.error("Incorrect magic (%r, expected %r)" % (self.magic, BOOTLDR_MAGIC))
+
+        if(self.bootldr_size > len(data)):
+            log.warn_once("Bootloader is supposed to be %#x bytes, only have %#x",
+                          self.bootldr_size,
+                          len(data))
+
+        if(self.num_images >= 0x100):
+            old = self.num_images
+            self.num_images = 1
+            log.warn_once("Bootloader num_images (%#x) appears corrupted, truncating to 1",
+                          old)
+
+        imgarray = ctypes.ARRAY(img_info, self.num_images)
+        self.img_info = imgarray.from_buffer_copy(data, ctypes.sizeof(self.header))
+
+    def extract(self, index_or_name):
+        """extract(index_or_name) -> bytes
+
+        Extract the contents of an image.
+
+        Arguments:
+            index_or_name(str,int): Either an image index or name.
+
+        Returns:
+            Contents of the image.
+        """
+        if isinstance(index_or_name, int):
+            index = index_or_name
+        else:
+            for i in range(len(self.img_info)):
+                if self.img_info[i].name == index_or_name:
+                    index = i
+                    break
+            else:
+                raise ValueError("Invalid img name: %r" % index_or_name)
+
+        if index >= len(self.img_info):
+            raise ValueError("index out of range (%s, max %s)" % (index, len(self.img_info)))
+
+        offset = self.start_offset
+
+        for i in range(index):
+            offset += self.img_info[i].size
+
+        return self.data[offset:offset + self.img_info[index].size]
+
+    def extract_all(self, path):
+        """extract_all(path)
+
+        Extracts all images to the provided path.  The filenames are taken
+        from the image name, with '.img' appended.
+        """
+        if not os.path.isdir(path):
+            raise ValueError("%r does not exist or is not a directory" % path)
+
+        for img in self.img_info:
+            imgpath = os.path.join(path, img.name + '.img')
+            with open(imgpath, 'wb+') as f:
+                data = self.extract(img.name)
+                f.write(data)
+
+    def __str__(self):
+        rv = []
+        rv.append("Bootloader")
+        rv.append("  Magic:  %r" % self.magic)
+        rv.append("  Offset: %#x" % self.start_offset)
+        rv.append("  Size:   %#x" % self.bootldr_size)
+        rv.append("  Images: %s" % self.num_images)
+        for img in self.img_info:
+            rv.append("    Name: %s" % img.name)
+            rv.append("    Size: %#x" % img.size)
+            rv.append("    Data: %r..." % self.extract(img.name)[:32])
+        return '\n'.join(rv)
+
+    def __getattr__(self, name):
+        value = getattr(self.header, name, None)
+        if value is not None:
+            return value
+        return getattr(super(BootImage, self), name)
+
+if __name__ == '__main__':
+    # Easy sanity checking
+    b = BootloaderImage(open(sys.argv[1], 'rb').read())
+    print(b)
@@ -23,7 +23,7 @@ this way.

 .. code-block:: bash

-    $ python -c 'from pwn import *; print args' A=1 B=Hello HOST=1.2.3.4 DEBUG
+    $ python -c 'from pwn import *; print(args)' A=1 B=Hello HOST=1.2.3.4 DEBUG
    defaultdict(<type 'str'>, {'A': '1', 'HOST': '1.2.3.4', 'B': 'Hello'})

 This is very useful for conditional code, for example determining whether to
@@ -51,6 +51,7 @@ below.

 """
 from __future__ import absolute_import
+from __future__ import division

 import collections
 import logging
@@ -85,7 +86,7 @@ def isident(s):
    Helper function to check whether a string is a valid identifier,
    as passed in on the command-line.
    """
-    first = string.uppercase + '_'
+    first = string.ascii_uppercase + '_'
    body = string.digits + first
    if not s:
        return False
@@ -194,7 +195,7 @@ def initialize():
        value = 'True'

        if '=' in arg:
-            arg, value = arg.split('=')
+            arg, value = arg.split('=', 1)

        if arg in hooks:
            sys.argv.remove(orig)
@@ -16,39 +16,38 @@ Assembly
    To assemble code, simply invoke :func:`asm` on the code to assemble.

        >>> asm('mov eax, 0')
-        '\xb8\x00\x00\x00\x00'
+        b'\xb8\x00\x00\x00\x00'

    Additionally, you can use constants as defined in the :mod:`pwnlib.constants`
    module.

        >>> asm('mov eax, SYS_execve')
-        '\xb8\x0b\x00\x00\x00'
+        b'\xb8\x0b\x00\x00\x00'

    Finally, :func:`asm` is used to assemble shellcode provided by ``pwntools``
    in the :mod:`shellcraft` module.

        >>> asm(shellcraft.nop())
-        '\x90'
+        b'\x90'

 Disassembly
 ------------------------

    To disassemble code, simply invoke :func:`disasm` on the bytes to disassemble.

-    >>> disasm('\xb8\x0b\x00\x00\x00')
-    '   0:   b8 0b 00 00 00          mov    eax,0xb'
+    >>> disasm(b'\xb8\x0b\x00\x00\x00')
+    '   0:   b8 0b 00 00 00          mov    eax, 0xb'

 """
 from __future__ import absolute_import
+from __future__ import division

 import errno
 import os
 import platform
 import re
 import shutil
-import string
 import subprocess
-import sys
 import tempfile
 from collections import defaultdict
 from glob import glob
@@ -90,7 +89,7 @@ def dpkg_search_for_binutils(arch, util):

    try:
        filename = 'bin/%s*linux*-%s' % (arch, util)
-        output = subprocess.check_output(['dpkg','-S',filename])
+        output = subprocess.check_output(['dpkg','-S',filename], universal_newlines = True)
        for line in output.strip().splitlines():
            package, path = line.split(':', 1)
            packages.append(package)
@@ -160,7 +159,6 @@ def which_binutils(util):
        Exception: Could not find 'as' installed for ContextType(arch = 'msp430')
    """
    arch = context.arch
-    bits = context.bits

    # Fix up pwntools vs Debian triplet naming, and account
    # for 'thumb' being its own pwntools architecture.
@@ -244,7 +242,7 @@ def _assembler():
    if not checked_assembler_version[gas]:
        checked_assembler_version[gas] = True
        result = subprocess.check_output([gas, '--version','/dev/null'],
-                                         stderr=subprocess.STDOUT)
+                                         stderr=subprocess.STDOUT, universal_newlines=True)
        version = re.search(r' (\d\.\d+)', result).group(1)
        if version < '2.19':
            log.warn_once('Your binutils version is too old and may not work!\n'  + \
@@ -364,7 +362,8 @@ def _run(cmd, stdin = None):
            cmd,
            stdin  = subprocess.PIPE,
            stdout = subprocess.PIPE,
-            stderr = subprocess.PIPE
+            stderr = subprocess.PIPE,
+            universal_newlines = True
        )
        stdout, stderr = proc.communicate(stdin)
        exitcode = proc.wait()
@@ -409,8 +408,6 @@ def cpp(shellcode):
        >>> cpp("SYS_setresuid", os = "freebsd")
        '311\n'
    """
-    arch = context.arch
-    os   = context.os
    code = _include_header() + shellcode
    cmd  = [
        'cpp',
@@ -474,7 +471,7 @@ def make_elf_from_assembly(assembly,
        >>> sc += shellcraft.echo('Hello\n')
        >>> sc += 'mov rsp, rbp; pop rbp; ret'
        >>> solib = make_elf_from_assembly(sc, shared=1)
-        >>> subprocess.check_output(['echo', 'World'], env={'LD_PRELOAD': solib})
+        >>> subprocess.check_output(['echo', 'World'], env={'LD_PRELOAD': solib}, universal_newlines = True)
        'Hello\nWorld\n'

        The same thing can be done with :func:`.make_elf`, though the sizes
@@ -507,7 +504,7 @@ def make_elf_from_assembly(assembly,
    result = asm(assembly, vma = vma, shared = shared, extract = False, **kwargs)

    if not extract:
-        os.chmod(result, 0755)
+        os.chmod(result, 0o755)
    else:
        with open(result, 'rb') as io:
            result = io.read()
@@ -540,12 +537,12 @@ def make_elf(data,
        execve('/bin/sh',...).

        >>> context.clear(arch='i386')
-        >>> bin_sh = '6a68682f2f2f73682f62696e89e331c96a0b5899cd80'.decode('hex')
+        >>> bin_sh = unhex('6a68682f2f2f73682f62696e89e331c96a0b5899cd80')
        >>> filename = make_elf(bin_sh, extract=False)
        >>> p = process(filename)
-        >>> p.sendline('echo Hello; exit')
+        >>> p.sendline(b'echo Hello; exit')
        >>> p.recvline()
-        'Hello\n'
+        b'Hello\n'
    """
    retval = None

@@ -562,7 +559,7 @@ def make_elf(data,
    assembler = _assembler()
    linker    = _linker()
    code      = _arch_header()
-    code      += '.string "%s"' % ''.join('\\x%02x' % ord(c) for c in data)
+    code      += '.string "%s"' % ''.join('\\x%02x' % c for c in bytearray(data))
    code      += '\n'

    log.debug("Building ELF:\n" + code)
@@ -573,7 +570,7 @@ def make_elf(data,
    step3     = path.join(tmpdir, 'step3-elf')

    try:
-        with open(step1, 'wb+') as f:
+        with open(step1, 'w') as f:
            f.write(code)

        _run(assembler + ['-o', step2, step1])
@@ -594,11 +591,11 @@ def make_elf(data,
            _run([which_binutils('strip'), '--strip-unneeded', step3])

        if not extract:
-            os.chmod(step3, 0755)
+            os.chmod(step3, 0o755)
            retval = step3

        else:
-            with open(step3, 'r') as f:
+            with open(step3, 'rb') as f:
                retval = f.read()
    except Exception:
        log.exception("An error occurred while building an ELF:\n%s" % code)
@@ -614,7 +611,7 @@ def asm(shellcode, vma = 0, extract = True, shared = False):
    Runs :func:`cpp` over a given shellcode and then assembles it into bytes.

    To see which architectures or operating systems are supported,
-    look in :mod:`pwnlib.contex`.
+    look in :mod:`pwnlib.context`.

    Assembling shellcode requires that the GNU assembler is installed
    for the target architecture.
@@ -633,13 +630,13 @@ def asm(shellcode, vma = 0, extract = True, shared = False):
    Examples:

        >>> asm("mov eax, SYS_select", arch = 'i386', os = 'freebsd')
-        '\xb8]\x00\x00\x00'
+        b'\xb8]\x00\x00\x00'
        >>> asm("mov eax, SYS_select", arch = 'amd64', os = 'linux')
-        '\xb8\x17\x00\x00\x00'
+        b'\xb8\x17\x00\x00\x00'
        >>> asm("mov rax, SYS_select", arch = 'amd64', os = 'linux')
-        'H\xc7\xc0\x17\x00\x00\x00'
+        b'H\xc7\xc0\x17\x00\x00\x00'
        >>> asm("mov r0, #SYS_select", arch = 'arm', os = 'linux', bits=32)
-        'R\x00\xa0\xe3'
+        b'R\x00\xa0\xe3'
    """
    result = ''

@@ -687,10 +684,11 @@ def asm(shellcode, vma = 0, extract = True, shared = False):

            _run(linker + ldflags)

-        elif file(step2,'rb').read(4) == '\x7fELF':
+        elif open(step2,'rb').read(4) == b'\x7fELF':
            # Sanity check for seeing if the output has relocations
            relocs = subprocess.check_output(
-                [which_binutils('readelf'), '-r', step2]
+                [which_binutils('readelf'), '-r', step2],
+                universal_newlines = True
            ).strip()
            if extract and len(relocs.split('\n')) > 1:
                log.error('Shellcode contains relocations:\n%s' % relocs)
@@ -702,7 +700,7 @@ def asm(shellcode, vma = 0, extract = True, shared = False):

        _run(objcopy + [step3, step4])

-        with open(step4) as fd:
+        with open(step4, 'rb') as fd:
            result = fd.read()

    except Exception:
@@ -722,9 +720,6 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):
    To see which architectures are supported,
    look in :mod:`pwnlib.contex`.

-    To support all these architecture, we bundle the GNU objcopy
-    and objdump with pwntools.
-
    Arguments:
      data(str): Bytestring to disassemble.
      vma(int): Passed through to the --adjust-vma argument of objdump
@@ -736,26 +731,28 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):

    Examples:

-        >>> print disasm('b85d000000'.decode('hex'), arch = 'i386')
-           0:   b8 5d 00 00 00          mov    eax,0x5d
-        >>> print disasm('b85d000000'.decode('hex'), arch = 'i386', byte = 0)
-           0:   mov    eax,0x5d
-        >>> print disasm('b85d000000'.decode('hex'), arch = 'i386', byte = 0, offset = 0)
-        mov    eax,0x5d
-        >>> print disasm('b817000000'.decode('hex'), arch = 'amd64')
-           0:   b8 17 00 00 00          mov    eax,0x17
-        >>> print disasm('48c7c017000000'.decode('hex'), arch = 'amd64')
-           0:   48 c7 c0 17 00 00 00    mov    rax,0x17
-        >>> print disasm('04001fe552009000'.decode('hex'), arch = 'arm')
+        >>> print(disasm(unhex('b85d000000'), arch = 'i386'))
+           0:   b8 5d 00 00 00          mov    eax, 0x5d
+        >>> print(disasm(unhex('b85d000000'), arch = 'i386', byte = 0))
+           0:   mov    eax, 0x5d
+        >>> print(disasm(unhex('b85d000000'), arch = 'i386', byte = 0, offset = 0))
+        mov    eax, 0x5d
+        >>> print(disasm(unhex('b817000000'), arch = 'amd64'))
+           0:   b8 17 00 00 00          mov    eax, 0x17
+        >>> print(disasm(unhex('48c7c017000000'), arch = 'amd64'))
+           0:   48 c7 c0 17 00 00 00    mov    rax, 0x17
+        >>> print(disasm(unhex('04001fe552009000'), arch = 'arm'))
           0:   e51f0004        ldr     r0, [pc, #-4]   ; 0x4
           4:   00900052        addseq  r0, r0, r2, asr r0
-        >>> print disasm('4ff00500'.decode('hex'), arch = 'thumb', bits=32)
+        >>> print(disasm(unhex('4ff00500'), arch = 'thumb', bits=32))
           0:   f04f 0005       mov.w   r0, #5
+        >>> print(disasm(unhex('656664676665400F18A4000000000051'), byte=0, arch='amd64'))
+           0:   gs data16 fs data16 rex nop/reserved BYTE PTR gs:[eax+eax*1+0x0]
+           f:   push   rcx
    """
    result = ''

    arch   = context.arch
-    os     = context.os

    tmpdir = tempfile.mkdtemp(prefix = 'pwn-disasm-')
    step1  = path.join(tmpdir, 'step1')
@@ -772,6 +769,9 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):
        '--rename-section', '.data=.text',
    ]

+    if not byte:
+        objdump += ['--no-show-raw-insn']
+
    if arch == 'thumb':
        objcopy += ['--prefix-symbol=$t.']
    else:
@@ -779,10 +779,10 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):

    try:

-        with open(step1, 'w') as fd:
+        with open(step1, 'wb') as fd:
            fd.write(data)

-        res = _run(objcopy + [step1, step2])
+        _run(objcopy + [step1, step2])

        output0 = _run(objdump + [step2])
        output1 = output0.split('<.text>:\n')
@@ -798,14 +798,22 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):


    lines = []
-    pattern = '^( *[0-9a-f]+: *)((?:[0-9a-f]+ )+ *)(.*)'
+    pattern = '^( *[0-9a-f]+: *)', '((?:[0-9a-f]+ )+ *)', '(.*)'
+    if not byte:
+        pattern = pattern[::2]
+    pattern = ''.join(pattern)
    for line in result.splitlines():
-        try:
-            o, b, i = re.search(pattern, line).groups()
-        except:
+        match = re.search(pattern, line)
+        if not match:
            lines.append(line)
            continue

+        groups = match.groups()
+        if byte:
+            o, b, i = groups
+        else:
+            o, i = groups
+
        line = ''

        if offset:
@@ -816,4 +824,4 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):
            line += i
        lines.append(line)

-    return '\n'.join(lines)
+    return re.sub(',([^ ])', r', \1', '\n'.join(lines))
@@ -3,6 +3,7 @@ Analogous to atexit, this module allows the programmer to register functions to
 be run if an unhandled exception occurs.
 """
 from __future__ import absolute_import
+from __future__ import division

 import sys
 import threading
@@ -8,6 +8,7 @@ This module also fixes a the issue that exceptions raised by an exit handler is
 printed twice when the standard :mod:`atexit` is used.
 """
 from __future__ import absolute_import
+from __future__ import division

 import sys
 import threading
@@ -1,5 +1,6 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division

 import argparse
 import sys
@@ -29,8 +30,8 @@ parser.add_argument(
    "-o","--output",
    metavar='file',
    help="Output file (defaults to stdout)",
-    type=argparse.FileType('w'),
-    default=sys.stdout
+    type=argparse.FileType('wb'),
+    default=getattr(sys.stdout, 'buffer', sys.stdout)
 )

 parser.add_argument(
@@ -45,14 +46,14 @@ parser.add_argument(
 parser.add_argument(
    '-v', '--avoid',
    action='append',
-    help = 'Encode the shellcode to avoid the listed bytes (provided as hex; default: 000a)'
+    help = 'Encode the shellcode to avoid the listed bytes (provided as hex)'
 )

 parser.add_argument(
    '-n', '--newline',
    dest='avoid',
    action='append_const',
-    const='\n',
+    const='0a',
    help = 'Encode the shellcode to avoid newlines'
 )

@@ -60,7 +61,7 @@ parser.add_argument(
    '-z', '--zero',
    dest='avoid',
    action='append_const',
-    const='\x00',
+    const='00',
    help = 'Encode the shellcode to avoid NULL bytes'
 )

@@ -83,7 +84,7 @@ parser.add_argument(
    '--infile',
    help="Specify input file",
    default=sys.stdin,
-    type=file
+    type=argparse.FileType('r')
 )

 parser.add_argument(
@@ -103,10 +104,11 @@ def main(args):
    data   = '\n'.join(args.lines) or args.infile.read()
    output = asm(data.replace(';', '\n'))
    fmt    = args.format or ('hex' if tty else 'raw')
-    formatters = {'r':str, 'h':enhex, 's':repr}
+    formatters = {'r':bytes, 'h':enhex, 's':repr}

    if args.avoid:
-        output = encode(output, args.avoid)
+        avoid = unhex(''.join(args.avoid))
+        output = encode(output, avoid)

    if args.debug:
        proc = gdb.debug_shellcode(output, arch=context.arch)
@@ -120,13 +122,16 @@ def main(args):

    if fmt[0] == 'e':
        args.output.write(make_elf(output))
-        try: os.fchmod(args.output.fileno(), 0700)
+        try: os.fchmod(args.output.fileno(), 0o700)
        except OSError: pass
    else:
-        args.output.write(formatters[fmt[0]](output))
+        output = formatters[fmt[0]](output)
+        if not hasattr(output, 'decode'):
+            output = output.encode('ascii')
+        args.output.write(output)

    if tty and fmt is not 'raw':
-        args.output.write('\n')
+        args.output.write(b'\n')

 if __name__ == '__main__':
    pwnlib.commandline.common.main(__file__)
@@ -1,5 +1,6 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division

 import argparse
 import sys
@@ -14,7 +15,7 @@ parser = common.parser_commands.add_parser(
 parser.add_argument(
    'elf',
    nargs='*',
-    type=file,
+    type=argparse.FileType('rb'),
    help='Files to check'
 )
 parser.add_argument(
@@ -22,7 +23,7 @@ parser.add_argument(
    nargs='*',
    dest='elf2',
    metavar='elf',
-    type=file,
+    type=argparse.FileType('rb'),
    help='File to check (for compatibility with checksec.sh)'
 )

@@ -5,7 +5,7 @@ import sys
 import pwnlib
 from pwnlib.context import context

-choices = map(str, [16,32,64])
+choices = list(map(str, [16,32,64]))
 choices += list(context.oses)
 choices += list(context.architectures)
 choices += list(context.endiannesses)
@@ -1,7 +1,9 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division

 import argparse
+import functools
 import os
 import re

@@ -63,7 +65,7 @@ p.add_argument(
 def main(args):
    if args.exact:
        # This is the simple case
-        print cpp(args.exact).strip()
+        print(cpp(args.exact).strip())
    else:
        # New we search in the right module.
        # But first: We find the right module
@@ -117,7 +119,7 @@ def main(args):

        # Output all matching constants
        for _, k in sorted(out):
-            print '#define %s %s' % (k.ljust(maxlen), cpp(k).strip())
+            print('#define %s %s' % (k.ljust(maxlen), cpp(k).strip()))

        # If we are in match_mode, then try to find a combination of
        # constants that yield the exact given value
@@ -134,9 +136,9 @@ def main(args):

                out = [(v, k) for v, k in out if mask & v == v]

-            if reduce(lambda x, cur: x | cur[0], good, 0) == constant:
-                print
-                print '(%s) == %s' % (' | '.join(k for v, k in good), args.constant)
+            if functools.reduce(lambda x, cur: x | cur[0], good, 0) == constant:
+                print('')
+                print('(%s) == %s' % (' | '.join(k for v, k in good), args.constant))

 if __name__ == '__main__':
    pwnlib.commandline.common.main(__file__)
@@ -1,5 +1,6 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division

 import argparse
 import string
@@ -81,7 +82,7 @@ def main(args):
            log.critical('Given pattern does not exist in cyclic pattern')
            sys.exit(1)
        else:
-            print offset
+            print(offset)
    else:
        want   = args.count
        result = cyclic(want, alphabet, subsize)
@@ -1,5 +1,6 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division

 import argparse
 import sys
@@ -13,7 +14,7 @@ parser = common.parser_commands.add_parser(
 )
 parser.add_argument(
    '-x', metavar='GDBSCRIPT',
-    type=file,
+    type=argparse.FileType('r'),
    help='Execute GDB commands from this file.'
 )
 parser.add_argument(
@@ -30,13 +31,25 @@ parser.add_argument(
    help = 'The os/architecture/endianness/bits the shellcode will run in (default: linux/i386), choose from: %s' % common.choices,
 )
 parser.add_argument(
-    '--exec', type=file, dest='executable',
+    '--exec',
+
+    # NOTE: Type cannot be "file" because we may be referring to a remote
+    #       file, or a file on an Android device.
+    type=str,
+
+    dest='executable',
    help='File to debug'
 )
 parser.add_argument(
    '--process', metavar='PROCESS_NAME',
    help='Name of the process to attach to (e.g. "bash")'
 )
+parser.add_argument(
+    '--sysroot', metavar='SYSROOT',
+    type=str,
+    default='',
+    help="GDB sysroot path"
+)

 def main(args):
    gdbscript = ''
@@ -47,23 +60,46 @@ def main(args):
        context.device = adb.wait_for_device()

    if args.executable:
-        context.binary = ELF(args.executable.name)
-        target = context.binary.path
+        if os.path.exists(args.executable):
+            context.binary = ELF(args.executable)
+            target = context.binary.path
+
+        # This path does nothing, but avoids the "print_usage()"
+        # path below.
+        elif context.os == 'android':
+            target = args.executable
    elif args.pid:
        target = int(args.pid)
    elif args.process:
        if context.os == 'android':
-            target = adb.pidof(process)
+            target = adb.pidof(args.process)
        else:
-            target = pidof(process)
+            target = pidof(args.process)
+
+        # pidof() returns a list
+        if not target:
+            log.error("Could not find a PID for %r", args.process)
+
+        target = target[0]
+
+        # pidof will sometimes return all PIDs, including init
+        if target == 1:
+            log.error("Got PID 1 from pidof.  Check the process name, or use --pid 1 to debug init")
    else:
        parser.print_usage()
        return 1

    if args.pid or args.process:
-        gdb.attach(target, gdbscript=gdbscript)
+        pid = gdb.attach(target, gdbscript=gdbscript, sysroot=args.sysroot)
+
+        # Since we spawned the gdbserver process, and process registers an
+        # atexit handler to close itself, gdbserver will be terminated when
+        # we exit.  This will manifest as a "remote connected ended" or
+        # similar error message.  Hold it open for the user.
+        log.info("GDB connection forwarding will terminate when you press enter")
+        pause()
    else:
-        gdb.debug(target, gdbscript=gdbscript).interactive()
+        gdb.debug(target, gdbscript=gdbscript, sysroot=args.sysroot).interactive()

 if __name__ == '__main__':
    pwnlib.commandline.common.main(__file__)
@@ -1,6 +1,8 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division

+import argparse
 from pwn import *
 from pwnlib.commandline import common

@@ -11,7 +13,7 @@ parser = common.parser_commands.add_parser(
 parser.add_argument(
    'elf',
    nargs='+',
-    type=file,
+    type=argparse.FileType('rb'),
    help='Files to check'
 )

@@ -1,5 +1,7 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function

 import argparse
 import string
@@ -20,7 +22,7 @@ parser.add_argument(
    'hex',
    metavar = 'hex',
    nargs = '*',
-    help = 'Hex-string to disasemble. If none are supplied, then it uses stdin in non-hex mode.'
+    help = 'Hex-string to disassemble. If none are supplied, then it uses stdin in non-hex mode.'
 )

 parser.add_argument(
@@ -59,14 +61,14 @@ parser.add_argument(

 def main(args):
    if len(args.hex) > 0:
-        dat = ''.join(args.hex)
-        dat = dat.translate(None, string.whitespace)
-        if not set(string.hexdigits) >= set(dat):
-            print "This is not a hex string"
+        dat = ''.join(args.hex).encode('utf-8', 'surrogateescape')
+        dat = dat.translate(None, string.whitespace.encode('ascii'))
+        if not set(string.hexdigits.encode('ascii')) >= set(dat):
+            print("This is not a hex string")
            exit(-1)
-        dat = dat.decode('hex')
+        dat = unhex(dat)
    else:
-        dat = sys.stdin.read()
+        dat = getattr(sys.stdin, 'buffer', sys.stdin).read()


    if args.color:
@@ -79,17 +81,16 @@ def main(args):
        instrs  = disasm(dat, vma=safeeval.const(args.address), byte=False, offset=False)
        # instrs  = highlight(instrs, PwntoolsLexer(), TerminalFormatter())

-        split = lambda x: x.splitlines()
-        for o,b,i in zip(*list(map(split, (offsets, bytes, instrs)))):
+        for o,b,i in zip(*map(str.splitlines, (offsets, bytes, instrs))):
            b = b.replace('00', text.red('00'))
            b = b.replace('0a', text.red('0a'))
            i = highlight(i.strip(), PwntoolsLexer(), TerminalFormatter()).strip()
            i = i.replace(',',', ')

-            print o,b,i
+            print(o,b,i)
        return

-    print disasm(dat, vma=safeeval.const(args.address))
+    print(disasm(dat, vma=safeeval.const(args.address)))

 if __name__ == '__main__':
    pwnlib.commandline.common.main(__file__)
@@ -1,5 +1,6 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division

 import shutil
 from argparse import ArgumentParser
@@ -22,7 +23,7 @@ def dump(objdump, path):
    return n.name

 def diff(a,b):
-    try: return check_output(['diff',a,b])
+    try: return check_output(['diff',a,b], universal_newlines=True)
    except CalledProcessError as e:
        return e.output

@@ -55,7 +56,7 @@ def main(a):
    shutil.copy(y.path, name)
    y = dump(objdump, name)

-    print diff(x, y)
+    print(diff(x, y))

 if __name__ == '__main__':
    pwnlib.commandline.common.main(__file__)
@@ -1,7 +1,7 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division

-import argparse
 import sys

 import pwnlib
@@ -15,7 +15,6 @@ p = common.parser_commands.add_parser(
    help = 'Patch an ELF file'
 )

-p = argparse.ArgumentParser()
 p.add_argument('elf',help="File to patch")
 p.add_argument('offset',help="Offset to patch in virtual address (hex encoded)")
 p.add_argument('bytes',help='Bytes to patch (hex encoded)')
@@ -32,7 +31,7 @@ def main(a):
        elf    = ELF(a.elf)

    elf.write(offset, bytes)
-    sys.stdout.write(elf.get_data())
+    getattr(sys.stdout, 'buffer', sys.stdout).write(elf.get_data())

 if __name__ == '__main__':
    pwnlib.commandline.common.main(__file__)
@@ -1,7 +1,8 @@
-from __future__ import absolute_import
+from __future__ import absolute_import, print_function

 import argparse
 import os
+import errno

 from pwnlib.commandline import common

@@ -24,24 +25,24 @@ def main(args):
    if 0x100000000 - value < 0x200:
      value = 0x100000000 - value

-    if value not in os.errno.errorcode:
-      print "No errno for %s" % value
+    if value not in errno.errorcode:
+      print("No errno for %s" % value)
      return

-    name = os.errno.errorcode[value]
+    name = errno.errorcode[value]

  except ValueError:
    name = args.error.upper()

-    if not hasattr(os.errno, name):
-      print "No errno for %s" % name
+    if not hasattr(errno, name):
+      print("No errno for %s" % name)
      return

-    value = getattr(os.errno, name)
+    value = getattr(errno, name)


-  print '#define', name, value
-  print os.strerror(value)
+  print('#define', name, value)
+  print(os.strerror(value))

 if __name__ == '__main__':
    pwnlib.commandline.common.main(__file__)
@@ -1,10 +1,12 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division

 import argparse
 import sys

 from pwnlib.commandline import common
+from pwnlib.util.fiddling import enhex

 parser = common.parser_commands.add_parser(
    'hex',
@@ -16,9 +18,12 @@ parser.add_argument('data', nargs='*',

 def main(args):
    if not args.data:
-        print sys.stdin.read().encode('hex')
+        print(enhex(getattr(sys.stdin, 'buffer', sys.stdin).read()))
    else:
-        print ' '.join(args.data).encode('hex')
+        data = ' '.join(args.data)
+        if not hasattr(data, 'decode'):
+            data = data.encode('utf-8', 'surrogateescape')
+        print(enhex(data))

 if __name__ == '__main__':
    pwnlib.commandline.common.main(__file__)
@@ -46,6 +46,9 @@ commands = {
 }

 def main():
+    if len(sys.argv) < 2:
+        parser.print_usage()
+        sys.exit()
    args = parser.parse_args()
    with context.local(log_console = sys.stderr):
        commands[args.command](args)
@@ -1,9 +1,11 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division

 import argparse
 import os
 import sys
+import io

 import pwnlib
 pwnlib.args.free_form = False
@@ -21,8 +23,8 @@ parser.add_argument(
    metavar='file',
    nargs='?',
    help='File to hexdump.  Reads from stdin if missing.',
-    type=argparse.FileType('r'),
-    default=sys.stdin
+    type=argparse.FileType('rb'),
+    default=getattr(sys.stdin, 'buffer', sys.stdin)
 )

 parser.add_argument(
@@ -88,6 +90,9 @@ def main(args):
        else:
            infile.seek(skip, os.SEEK_CUR)

+    if count:
+        infile = io.BytesIO(infile.read(count))
+
    hl = []
    if args.highlight:
        for hs in args.highlight:
@@ -96,7 +101,7 @@ def main(args):

    try:
        for line in hexdump_iter(infile, width, highlight = hl, begin = offset + skip):
-            print line
+            print(line)
    except (KeyboardInterrupt, IOError):
        pass

@@ -1,4 +1,5 @@
 from __future__ import absolute_import
+from __future__ import division

 import argparse

@@ -16,8 +17,8 @@ p = common.parser_commands.add_parser(
 g = p.add_argument_group("actions")
 g.add_argument('-b', '--build-id', help="Strip build ID", action='store_true')
 g.add_argument('-p', '--patch', metavar='FUNCTION', help="Patch function", action='append')
-p.add_argument('-o', '--output', type=file, default=sys.stdout)
-p.add_argument('file', type=file)
+p.add_argument('-o', '--output', type=argparse.FileType('wb'), default=getattr(sys.stdout, 'buffer', sys.stdout))
+p.add_argument('file', type=argparse.FileType('rb'))

 def main(args):
    if not (args.patch or args.build_id):
@@ -32,7 +33,7 @@ def main(args):
        for offset in pwnlib.libcdb.get_build_id_offsets():
            data = elf.read(elf.address + offset + 0xC, 4)
            if data == 'GNU\x00':
-                elf.write(elf.address + offset + 0x10, read('/dev/urandom', 20))
+                elf.write(elf.address + offset + 0x10, os.urandom(20))

    for function in args.patch:
        if function not in elf.symbols:
@@ -46,7 +47,7 @@ def main(args):
    result = elf.data

    if args.output.isatty():
-        result = enhex(result)
+        result = enhex(result).encode('ascii')

    args.output.write(result)

@@ -1,4 +1,5 @@
 from __future__ import absolute_import
+from __future__ import division

 import argparse
 import sys
@@ -24,8 +25,8 @@ parser.add_argument(
    "-o","--output",
    metavar='file',
    help="Output file (defaults to stdout)",
-    type=argparse.FileType('w'),
-    default=sys.stdout
+    type=argparse.FileType('wb'),
+    default=getattr(sys.stdout, 'buffer', sys.stdout)
 )

 parser.add_argument(
@@ -82,7 +83,7 @@ def main(args):
    data   = sys.stdin.read()
    output = data
    fmt    = args.format or ('hex' if tty else 'raw')
-    formatters = {'r':str, 'h':enhex, 's':repr}
+    formatters = {'r':bytes, 'h':enhex, 's':repr}

    if args.alphanumeric:
        output = alphanumeric(output)
@@ -98,10 +99,13 @@ def main(args):
    if fmt[0] == 'e':
        sys.stdout.write(make_elf(output))
    else:
-        args.output.write(formatters[fmt[0]](output))
+        output = formatters[fmt[0]](output)
+        if not hasattr(output, 'decode'):
+            output = output.encode('ascii')
+        args.output.write(output)

-    if tty and fmt is not 'raw':
-        args.output.write('\n')
+    if tty and fmt != 'raw':
+        args.output.write(b'\n')


 if __name__ == '__main__':
@@ -1,8 +1,10 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division

 import argparse
 import os
+import six
 import sys
 import types

@@ -21,8 +23,8 @@ from pwnlib.commandline import common

 def _string(s):
    out = []
-    for c in s:
-        co = ord(c)
+    for co in bytearray(s):
+        c = chr(co)
        if co >= 0x20 and co <= 0x7e and c not in '/$\'"`':
            out.append(c)
        else:
@@ -45,8 +47,8 @@ p.add_argument(
 p.add_argument(
    '-o', '--out',
    metavar = 'file',
-    type = argparse.FileType('w'),
-    default = sys.stdout,
+    type = argparse.FileType('wb'),
+    default = getattr(sys.stdout, 'buffer', sys.stdout),
    help = 'Output file (default: stdout)',
 )

@@ -164,6 +166,12 @@ p.add_argument(
    help='List available shellcodes, optionally provide a filter'
 )

+p.add_argument(
+    '-s', '--shared',
+    action='store_true',
+    help='Generated ELF is a shared library'
+)
+
 def get_template(name):
    func = shellcraft
    for attr in name.split('.'):
@@ -183,7 +191,7 @@ def main(args):
        elif not args.syscalls:
            templates = filter(is_not_a_syscall_template, templates)

-        print '\n'.join(templates)
+        print('\n'.join(templates))
        exit()

    if not args.shellcode:
@@ -238,11 +246,11 @@ def main(args):
            if not in_doctest:
                doc.append(line)
            i += 1
-        print '\n'.join(doc).rstrip()
+        print('\n'.join(doc).rstrip())
        exit()

-    defargs = len(func.func_defaults or ())
-    reqargs = func.func_code.co_argcount - defargs
+    defargs = len(six.get_function_defaults(func) or ())
+    reqargs = six.get_function_code(func).co_argcount - defargs
    if len(args.args) < reqargs:
        if defargs > 0:
            log.critical('%s takes at least %d arguments' % (args.shellcode, reqargs))
@@ -259,7 +267,7 @@ def main(args):
            pass

    # And he strikes again!
-    map(common.context_arg, args.shellcode.split('.'))
+    list(map(common.context_arg, args.shellcode.split('.')))
    code = func(*args.args)


@@ -277,10 +285,10 @@ def main(args):

            code = highlight(code, PwntoolsLexer(), TerminalFormatter())

-        print code
+        print(code)
        exit()
    if args.format == 'p':
-        print cpp(code)
+        print(cpp(code))
        exit()

    assembly = code
@@ -291,16 +299,16 @@ def main(args):

    if args.format in ['e','elf']:
        args.format = 'default'
-        try: os.fchmod(args.out.fileno(), 0700)
+        try: os.fchmod(args.out.fileno(), 0o700)
        except OSError: pass


        if not args.avoid:
-            code = read(make_elf_from_assembly(assembly, vma=vma))
+            code = read(make_elf_from_assembly(assembly, vma=vma, shared=args.shared))
        else:
            code = asm(assembly)
            code = encode(code, args.avoid)
-            code = make_elf(code, vma=vma)
+            code = make_elf(code, vma=vma, shared=args.shared)
            # code = read(make_elf(encode(asm(code), args.avoid)))
    else:
        code = encode(asm(assembly), args.avoid)
@@ -335,10 +343,12 @@ def main(args):
    elif args.format in ['i', 'hexii']:
        code = hexii(code) + '\n'
    elif args.format in ['d', 'escaped']:
-        code = ''.join('\\x%02x' % ord(c) for c in code) + '\n'
+        code = ''.join('\\x%02x' % c for c in bytearray(code)) + '\n'
    if not sys.stdin.isatty():
-        args.out.write(sys.stdin.read())
+        args.out.write(getattr(sys.stdin, 'buffer', sys.stdin).read())

+    if not hasattr(code, 'decode'):
+        code = code.encode()
    args.out.write(code)

 if __name__ == '__main__':
@@ -1,5 +1,6 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division

 import re

@@ -19,6 +20,7 @@ parser.add_argument('--port', help='Remote port / SSH port', type=int)
 parser.add_argument('--user', help='SSH Username')
 parser.add_argument('--pass', help='SSH Password', dest='password')
 parser.add_argument('--path', help='Remote path of file on SSH server')
+parser.add_argument('--quiet', help='Less verbose template comments', action='store_true')

 def main(args):
    cache = None
@@ -49,15 +51,16 @@ def main(args):
                             args.port,
                             args.user,
                             args.password,
-                             args.path)
+                             args.path,
+                             args.quiet)

    # Fix Mako formatting bs
    output = re.sub('\n\n\n', '\n\n', output)

-    print output
+    print(output)

    if not sys.stdout.isatty():
-        try: os.fchmod(sys.stdout.fileno(), 0700)
+        try: os.fchmod(sys.stdout.fileno(), 0o700)
        except OSError: pass

 if __name__ == '__main__':
@@ -1,11 +1,13 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
+from __future__ import division

 import argparse
 import sys
 from string import whitespace

 from pwnlib.commandline import common
+from pwnlib.util.fiddling import unhex

 parser = common.parser_commands.add_parser(
    'unhex',
@@ -18,12 +20,13 @@ parser.add_argument('hex', nargs='*',

 def main(args):
    try:
+        o = getattr(sys.stdout, 'buffer', sys.stdout)
        if not args.hex:
-            s = sys.stdin.read().translate(None, whitespace)
-            sys.stdout.write(s.decode('hex'))
+            s = getattr(sys.stdin, 'buffer', sys.stdin).read().translate(None, whitespace.encode('ascii'))
+            o.write(unhex(s))
        else:
-            sys.stdout.write(''.join(args.hex).decode('hex'))
-    except TypeError, e:
+            o.write(unhex(''.join(args.hex)))
+    except TypeError as e:
        sys.stderr.write(str(e) + '\n')

 if __name__ == '__main__':
@@ -1,5 +1,6 @@
-#!/usr/bin/env python2
+#!/usr/bin/env python
 from __future__ import absolute_import
+from __future__ import division

 import subprocess

@@ -24,7 +25,7 @@ p.add_argument('--pre', action='store_true', help='''

 def main(a):
    result = pwnlib.update.perform_check(prerelease=a.pre)
-    if a.install:
+    if result and a.install:
        subprocess.check_call(result, shell=False)

 if __name__ == '__main__':
@@ -28,8 +28,9 @@ supported by ``pwnlib.util.safeeval.expr``.
    terminal=['x-terminal-emulator', '-e']
 """
 from __future__ import absolute_import
+from __future__ import division

-import ConfigParser
+from six.moves import configparser
 import os

 registered_configs = {}
@@ -49,7 +50,7 @@ def initialize():
    from pwnlib.log import getLogger
    log = getLogger(__name__)

-    c = ConfigParser.ConfigParser()
+    c = configparser.ConfigParser()
    c.read(['/etc/pwn.conf', os.path.expanduser('~/.pwn.conf')])

    for section in c.sections():
@@ -30,23 +30,23 @@ what happens in :mod:`pwnlib.shellcraft`.
 Example:

    >>> with context.local(os = 'freebsd'):
-    ...     print int(constants.SYS_stat)
+    ...     print(int(constants.SYS_stat))
    188
    >>> with context.local(os = 'linux', arch = 'i386'):
-    ...     print int(constants.SYS_stat)
+    ...     print(int(constants.SYS_stat))
    106
    >>> with context.local(os = 'linux', arch = 'amd64'):
-    ...     print int(constants.SYS_stat)
+    ...     print(int(constants.SYS_stat))
    4

    >>> with context.local(arch = 'i386', os = 'linux'):
-    ...    print constants.SYS_execve + constants.PROT_WRITE
+    ...    print(constants.SYS_execve + constants.PROT_WRITE)
    13
    >>> with context.local(arch = 'amd64', os = 'linux'):
-    ...    print constants.SYS_execve + constants.PROT_WRITE
+    ...    print(constants.SYS_execve + constants.PROT_WRITE)
    61
    >>> with context.local(arch = 'amd64', os = 'linux'):
-    ...    print constants.SYS_execve + constants.PROT_WRITE
+    ...    print(constants.SYS_execve + constants.PROT_WRITE)
    61

 """
@@ -111,7 +111,7 @@ class ConstantsModule(ModuleType):
                pass
        else:
            mod = self.guess()
-            if hasattr(mod, key):
+            if mod is not self and hasattr(mod, key):
                return getattr(mod, key)

        raise AttributeError("'module' object has no attribute '%s'" % key)
@@ -124,13 +124,13 @@ class ConstantsModule(ModuleType):
        Example:

            >>> with context.local(arch = 'i386', os = 'linux'):
-            ...    print 13 == constants.eval('SYS_execve + PROT_WRITE')
+            ...    print(13 == constants.eval('SYS_execve + PROT_WRITE'))
            True
            >>> with context.local(arch = 'amd64', os = 'linux'):
-            ...    print 61 == constants.eval('SYS_execve + PROT_WRITE')
+            ...    print(61 == constants.eval('SYS_execve + PROT_WRITE'))
            True
            >>> with context.local(arch = 'amd64', os = 'linux'):
-            ...    print 61 == constants.eval('SYS_execve + PROT_WRITE')
+            ...    print(61 == constants.eval('SYS_execve + PROT_WRITE'))
            True
        """
        if not isinstance(string, str):
@@ -540,37 +540,37 @@ PRU_FLUSH_RDWR = Constant('PRU_FLUSH_RDWR',2)
 SF_NODISKIO = Constant('SF_NODISKIO',0x00000001)
 SF_MNOWAIT = Constant('SF_MNOWAIT',0x00000002)
 SF_SYNC = Constant('SF_SYNC',0x00000004)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISTXT = Constant('S_ISTXT',0001000)
-S_IRWXU = Constant('S_IRWXU',0000700)
-S_IRUSR = Constant('S_IRUSR',0000400)
-S_IWUSR = Constant('S_IWUSR',0000200)
-S_IXUSR = Constant('S_IXUSR',0000100)
-S_IREAD = Constant('S_IREAD',0000400)
-S_IWRITE = Constant('S_IWRITE',0000200)
-S_IEXEC = Constant('S_IEXEC',0000100)
-S_IRWXG = Constant('S_IRWXG',0000070)
-S_IRGRP = Constant('S_IRGRP',0000040)
-S_IWGRP = Constant('S_IWGRP',0000020)
-S_IXGRP = Constant('S_IXGRP',0000010)
-S_IRWXO = Constant('S_IRWXO',0000007)
-S_IROTH = Constant('S_IROTH',0000004)
-S_IWOTH = Constant('S_IWOTH',0000002)
-S_IXOTH = Constant('S_IXOTH',0000001)
-S_IFMT = Constant('S_IFMT',0170000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IFWHT = Constant('S_IFWHT',0160000)
-ACCESSPERMS = Constant('ACCESSPERMS',(0000700|0000070|0000007))
-ALLPERMS = Constant('ALLPERMS',(0004000|0002000|0001000|0000700|0000070|0000007))
-DEFFILEMODE = Constant('DEFFILEMODE',(0000400|0000200|0000040|0000020|0000004|0000002))
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISTXT = Constant('S_ISTXT',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o000700)
+S_IRUSR = Constant('S_IRUSR',0o000400)
+S_IWUSR = Constant('S_IWUSR',0o000200)
+S_IXUSR = Constant('S_IXUSR',0o000100)
+S_IREAD = Constant('S_IREAD',0o000400)
+S_IWRITE = Constant('S_IWRITE',0o000200)
+S_IEXEC = Constant('S_IEXEC',0o000100)
+S_IRWXG = Constant('S_IRWXG',0o000070)
+S_IRGRP = Constant('S_IRGRP',0o000040)
+S_IWGRP = Constant('S_IWGRP',0o000020)
+S_IXGRP = Constant('S_IXGRP',0o000010)
+S_IRWXO = Constant('S_IRWXO',0o000007)
+S_IROTH = Constant('S_IROTH',0o000004)
+S_IWOTH = Constant('S_IWOTH',0o000002)
+S_IXOTH = Constant('S_IXOTH',0o000001)
+S_IFMT = Constant('S_IFMT',0o170000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IFWHT = Constant('S_IFWHT',0o160000)
+ACCESSPERMS = Constant('ACCESSPERMS',(0o000700|0o000070|0o000007))
+ALLPERMS = Constant('ALLPERMS',(0o004000|0o002000|0o001000|0o000700|0o000070|0o000007))
+DEFFILEMODE = Constant('DEFFILEMODE',(0o000400|0o000200|0o000040|0o000020|0o000004|0o000002))
 S_BLKSIZE = Constant('S_BLKSIZE',512)
 UF_SETTABLE = Constant('UF_SETTABLE',0x0000ffff)
 UF_NODUMP = Constant('UF_NODUMP',0x00000001)
@@ -501,51 +501,51 @@ F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
 STAT64_HAS_BROKEN_ST_INO = Constant('STAT64_HAS_BROKEN_ST_INO',1)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
-O_ACCMODE = Constant('O_ACCMODE',0003)
-O_RDONLY = Constant('O_RDONLY',00)
-O_WRONLY = Constant('O_WRONLY',01)
-O_RDWR = Constant('O_RDWR',02)
-O_CREAT = Constant('O_CREAT',0100)
-O_EXCL = Constant('O_EXCL',0200)
-O_NOCTTY = Constant('O_NOCTTY',0400)
-O_TRUNC = Constant('O_TRUNC',01000)
-O_APPEND = Constant('O_APPEND',02000)
-O_NONBLOCK = Constant('O_NONBLOCK',04000)
-O_NDELAY = Constant('O_NDELAY',04000)
-O_SYNC = Constant('O_SYNC',010000)
-FASYNC = Constant('FASYNC',020000)
-O_DIRECTORY = Constant('O_DIRECTORY',040000)
-O_NOFOLLOW = Constant('O_NOFOLLOW',0100000)
-O_DIRECT = Constant('O_DIRECT',0200000)
-O_LARGEFILE = Constant('O_LARGEFILE',0400000)
-O_NOATIME = Constant('O_NOATIME',01000000)
+O_ACCMODE = Constant('O_ACCMODE',0o003)
+O_RDONLY = Constant('O_RDONLY',0o0)
+O_WRONLY = Constant('O_WRONLY',0o1)
+O_RDWR = Constant('O_RDWR',0o2)
+O_CREAT = Constant('O_CREAT',0o100)
+O_EXCL = Constant('O_EXCL',0o200)
+O_NOCTTY = Constant('O_NOCTTY',0o400)
+O_TRUNC = Constant('O_TRUNC',0o1000)
+O_APPEND = Constant('O_APPEND',0o2000)
+O_NONBLOCK = Constant('O_NONBLOCK',0o4000)
+O_NDELAY = Constant('O_NDELAY',0o4000)
+O_SYNC = Constant('O_SYNC',0o10000)
+FASYNC = Constant('FASYNC',0o20000)
+O_DIRECTORY = Constant('O_DIRECTORY',0o40000)
+O_NOFOLLOW = Constant('O_NOFOLLOW',0o100000)
+O_DIRECT = Constant('O_DIRECT',0o200000)
+O_LARGEFILE = Constant('O_LARGEFILE',0o400000)
+O_NOATIME = Constant('O_NOATIME',0o1000000)
 F_DUPFD = Constant('F_DUPFD',0)
 F_GETFD = Constant('F_GETFD',1)
 F_SETFD = Constant('F_SETFD',2)
@@ -576,7 +576,7 @@ LOCK_MAND = Constant('LOCK_MAND',32)
 LOCK_READ = Constant('LOCK_READ',64)
 LOCK_WRITE = Constant('LOCK_WRITE',128)
 LOCK_RW = Constant('LOCK_RW',192)
-O_ASYNC = Constant('O_ASYNC',020000)
+O_ASYNC = Constant('O_ASYNC',0o20000)
 MREMAP_MAYMOVE = Constant('MREMAP_MAYMOVE',1)
 MREMAP_FIXED = Constant('MREMAP_FIXED',2)
 PROT_READ = Constant('PROT_READ',0x1)
@@ -634,51 +634,51 @@ F_ULOCK = Constant('F_ULOCK',0)
 F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
-O_ACCMODE = Constant('O_ACCMODE',0003)
-O_RDONLY = Constant('O_RDONLY',00)
-O_WRONLY = Constant('O_WRONLY',01)
-O_RDWR = Constant('O_RDWR',02)
-O_CREAT = Constant('O_CREAT',01000)
-O_TRUNC = Constant('O_TRUNC',02000)
-O_EXCL = Constant('O_EXCL',04000)
-O_NOCTTY = Constant('O_NOCTTY',010000)
-O_NONBLOCK = Constant('O_NONBLOCK',00004)
-O_APPEND = Constant('O_APPEND',00010)
-O_NDELAY = Constant('O_NDELAY',00004)
-O_SYNC = Constant('O_SYNC',040000)
-FASYNC = Constant('FASYNC',020000)
-O_DIRECTORY = Constant('O_DIRECTORY',0100000)
-O_NOFOLLOW = Constant('O_NOFOLLOW',0200000)
-O_LARGEFILE = Constant('O_LARGEFILE',0400000)
-O_DIRECT = Constant('O_DIRECT',02000000)
-O_NOATIME = Constant('O_NOATIME',04000000)
+O_ACCMODE = Constant('O_ACCMODE',0o003)
+O_RDONLY = Constant('O_RDONLY',0o0)
+O_WRONLY = Constant('O_WRONLY',0o1)
+O_RDWR = Constant('O_RDWR',0o2)
+O_CREAT = Constant('O_CREAT',0o1000)
+O_TRUNC = Constant('O_TRUNC',0o2000)
+O_EXCL = Constant('O_EXCL',0o4000)
+O_NOCTTY = Constant('O_NOCTTY',0o10000)
+O_NONBLOCK = Constant('O_NONBLOCK',0o0004)
+O_APPEND = Constant('O_APPEND',0o0010)
+O_NDELAY = Constant('O_NDELAY',0o0004)
+O_SYNC = Constant('O_SYNC',0o40000)
+FASYNC = Constant('FASYNC',0o20000)
+O_DIRECTORY = Constant('O_DIRECTORY',0o100000)
+O_NOFOLLOW = Constant('O_NOFOLLOW',0o200000)
+O_LARGEFILE = Constant('O_LARGEFILE',0o400000)
+O_DIRECT = Constant('O_DIRECT',0o2000000)
+O_NOATIME = Constant('O_NOATIME',0o4000000)
 F_DUPFD = Constant('F_DUPFD',0)
 F_GETFD = Constant('F_GETFD',1)
 F_SETFD = Constant('F_SETFD',2)
@@ -706,7 +706,7 @@ LOCK_MAND = Constant('LOCK_MAND',32)
 LOCK_READ = Constant('LOCK_READ',64)
 LOCK_WRITE = Constant('LOCK_WRITE',128)
 LOCK_RW = Constant('LOCK_RW',192)
-O_ASYNC = Constant('O_ASYNC',020000)
+O_ASYNC = Constant('O_ASYNC',0o20000)
 MREMAP_MAYMOVE = Constant('MREMAP_MAYMOVE',1)
 MREMAP_FIXED = Constant('MREMAP_FIXED',2)
 PROT_READ = Constant('PROT_READ',0x1)
@@ -892,51 +892,51 @@ F_ULOCK = Constant('F_ULOCK',0)
 F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
-O_ACCMODE = Constant('O_ACCMODE',0003)
-O_RDONLY = Constant('O_RDONLY',00)
-O_WRONLY = Constant('O_WRONLY',01)
-O_RDWR = Constant('O_RDWR',02)
-O_CREAT = Constant('O_CREAT',0100)
-O_EXCL = Constant('O_EXCL',0200)
-O_NOCTTY = Constant('O_NOCTTY',0400)
-O_TRUNC = Constant('O_TRUNC',01000)
-O_APPEND = Constant('O_APPEND',02000)
-O_NONBLOCK = Constant('O_NONBLOCK',04000)
-O_NDELAY = Constant('O_NDELAY',04000)
-O_SYNC = Constant('O_SYNC',010000)
-FASYNC = Constant('FASYNC',020000)
-O_DIRECT = Constant('O_DIRECT',040000)
-O_LARGEFILE = Constant('O_LARGEFILE',0100000)
-O_DIRECTORY = Constant('O_DIRECTORY',0200000)
-O_NOFOLLOW = Constant('O_NOFOLLOW',0400000)
-O_NOATIME = Constant('O_NOATIME',01000000)
+O_ACCMODE = Constant('O_ACCMODE',0o003)
+O_RDONLY = Constant('O_RDONLY',0o0)
+O_WRONLY = Constant('O_WRONLY',0o1)
+O_RDWR = Constant('O_RDWR',0o2)
+O_CREAT = Constant('O_CREAT',0o100)
+O_EXCL = Constant('O_EXCL',0o200)
+O_NOCTTY = Constant('O_NOCTTY',0o400)
+O_TRUNC = Constant('O_TRUNC',0o1000)
+O_APPEND = Constant('O_APPEND',0o2000)
+O_NONBLOCK = Constant('O_NONBLOCK',0o4000)
+O_NDELAY = Constant('O_NDELAY',0o4000)
+O_SYNC = Constant('O_SYNC',0o10000)
+FASYNC = Constant('FASYNC',0o20000)
+O_DIRECT = Constant('O_DIRECT',0o40000)
+O_LARGEFILE = Constant('O_LARGEFILE',0o100000)
+O_DIRECTORY = Constant('O_DIRECTORY',0o200000)
+O_NOFOLLOW = Constant('O_NOFOLLOW',0o400000)
+O_NOATIME = Constant('O_NOATIME',0o1000000)
 F_DUPFD = Constant('F_DUPFD',0)
 F_GETFD = Constant('F_GETFD',1)
 F_SETFD = Constant('F_SETFD',2)
@@ -967,7 +967,7 @@ LOCK_MAND = Constant('LOCK_MAND',32)
 LOCK_READ = Constant('LOCK_READ',64)
 LOCK_WRITE = Constant('LOCK_WRITE',128)
 LOCK_RW = Constant('LOCK_RW',192)
-O_ASYNC = Constant('O_ASYNC',020000)
+O_ASYNC = Constant('O_ASYNC',0o20000)
 MREMAP_MAYMOVE = Constant('MREMAP_MAYMOVE',1)
 MREMAP_FIXED = Constant('MREMAP_FIXED',2)
 PROT_READ = Constant('PROT_READ',0x1)
@@ -919,51 +919,51 @@ F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
 STAT64_HAS_BROKEN_ST_INO = Constant('STAT64_HAS_BROKEN_ST_INO',1)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
-O_ACCMODE = Constant('O_ACCMODE',0003)
-O_RDONLY = Constant('O_RDONLY',00)
-O_WRONLY = Constant('O_WRONLY',01)
-O_RDWR = Constant('O_RDWR',02)
-O_CREAT = Constant('O_CREAT',0100)
-O_EXCL = Constant('O_EXCL',0200)
-O_NOCTTY = Constant('O_NOCTTY',0400)
-O_TRUNC = Constant('O_TRUNC',01000)
-O_APPEND = Constant('O_APPEND',02000)
-O_NONBLOCK = Constant('O_NONBLOCK',04000)
-O_NDELAY = Constant('O_NDELAY',04000)
-O_SYNC = Constant('O_SYNC',010000)
-FASYNC = Constant('FASYNC',020000)
-O_DIRECTORY = Constant('O_DIRECTORY',040000)
-O_NOFOLLOW = Constant('O_NOFOLLOW',0100000)
-O_DIRECT = Constant('O_DIRECT',0200000)
-O_LARGEFILE = Constant('O_LARGEFILE',0400000)
-O_NOATIME = Constant('O_NOATIME',01000000)
+O_ACCMODE = Constant('O_ACCMODE',0o003)
+O_RDONLY = Constant('O_RDONLY',0o0)
+O_WRONLY = Constant('O_WRONLY',0o1)
+O_RDWR = Constant('O_RDWR',0o2)
+O_CREAT = Constant('O_CREAT',0o100)
+O_EXCL = Constant('O_EXCL',0o200)
+O_NOCTTY = Constant('O_NOCTTY',0o400)
+O_TRUNC = Constant('O_TRUNC',0o1000)
+O_APPEND = Constant('O_APPEND',0o2000)
+O_NONBLOCK = Constant('O_NONBLOCK',0o4000)
+O_NDELAY = Constant('O_NDELAY',0o4000)
+O_SYNC = Constant('O_SYNC',0o10000)
+FASYNC = Constant('FASYNC',0o20000)
+O_DIRECTORY = Constant('O_DIRECTORY',0o40000)
+O_NOFOLLOW = Constant('O_NOFOLLOW',0o100000)
+O_DIRECT = Constant('O_DIRECT',0o200000)
+O_LARGEFILE = Constant('O_LARGEFILE',0o400000)
+O_NOATIME = Constant('O_NOATIME',0o1000000)
 F_DUPFD = Constant('F_DUPFD',0)
 F_GETFD = Constant('F_GETFD',1)
 F_SETFD = Constant('F_SETFD',2)
@@ -994,7 +994,7 @@ LOCK_MAND = Constant('LOCK_MAND',32)
 LOCK_READ = Constant('LOCK_READ',64)
 LOCK_WRITE = Constant('LOCK_WRITE',128)
 LOCK_RW = Constant('LOCK_RW',192)
-O_ASYNC = Constant('O_ASYNC',020000)
+O_ASYNC = Constant('O_ASYNC',0o20000)
 MREMAP_MAYMOVE = Constant('MREMAP_MAYMOVE',1)
 MREMAP_FIXED = Constant('MREMAP_FIXED',2)
 PROT_READ = Constant('PROT_READ',0x1)
@@ -597,51 +597,51 @@ F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
 STAT64_HAS_BROKEN_ST_INO = Constant('STAT64_HAS_BROKEN_ST_INO',1)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
-O_ACCMODE = Constant('O_ACCMODE',0003)
-O_RDONLY = Constant('O_RDONLY',00)
-O_WRONLY = Constant('O_WRONLY',01)
-O_RDWR = Constant('O_RDWR',02)
-O_CREAT = Constant('O_CREAT',0100)
-O_EXCL = Constant('O_EXCL',0200)
-O_NOCTTY = Constant('O_NOCTTY',0400)
-O_TRUNC = Constant('O_TRUNC',01000)
-O_APPEND = Constant('O_APPEND',02000)
-O_NONBLOCK = Constant('O_NONBLOCK',04000)
-O_NDELAY = Constant('O_NDELAY',04000)
-O_SYNC = Constant('O_SYNC',010000)
-FASYNC = Constant('FASYNC',020000)
-O_DIRECT = Constant('O_DIRECT',040000)
-O_LARGEFILE = Constant('O_LARGEFILE',0100000)
-O_DIRECTORY = Constant('O_DIRECTORY',0200000)
-O_NOFOLLOW = Constant('O_NOFOLLOW',0400000)
-O_NOATIME = Constant('O_NOATIME',01000000)
+O_ACCMODE = Constant('O_ACCMODE',0o003)
+O_RDONLY = Constant('O_RDONLY',0o0)
+O_WRONLY = Constant('O_WRONLY',0o1)
+O_RDWR = Constant('O_RDWR',0o2)
+O_CREAT = Constant('O_CREAT',0o100)
+O_EXCL = Constant('O_EXCL',0o200)
+O_NOCTTY = Constant('O_NOCTTY',0o400)
+O_TRUNC = Constant('O_TRUNC',0o1000)
+O_APPEND = Constant('O_APPEND',0o2000)
+O_NONBLOCK = Constant('O_NONBLOCK',0o4000)
+O_NDELAY = Constant('O_NDELAY',0o4000)
+O_SYNC = Constant('O_SYNC',0o10000)
+FASYNC = Constant('FASYNC',0o20000)
+O_DIRECT = Constant('O_DIRECT',0o40000)
+O_LARGEFILE = Constant('O_LARGEFILE',0o100000)
+O_DIRECTORY = Constant('O_DIRECTORY',0o200000)
+O_NOFOLLOW = Constant('O_NOFOLLOW',0o400000)
+O_NOATIME = Constant('O_NOATIME',0o1000000)
 F_DUPFD = Constant('F_DUPFD',0)
 F_GETFD = Constant('F_GETFD',1)
 F_SETFD = Constant('F_SETFD',2)
@@ -672,7 +672,7 @@ LOCK_MAND = Constant('LOCK_MAND',32)
 LOCK_READ = Constant('LOCK_READ',64)
 LOCK_WRITE = Constant('LOCK_WRITE',128)
 LOCK_RW = Constant('LOCK_RW',192)
-O_ASYNC = Constant('O_ASYNC',020000)
+O_ASYNC = Constant('O_ASYNC',0o20000)
 MREMAP_MAYMOVE = Constant('MREMAP_MAYMOVE',1)
 MREMAP_FIXED = Constant('MREMAP_FIXED',2)
 PROT_READ = Constant('PROT_READ',0x1)
@@ -568,51 +568,51 @@ F_ULOCK = Constant('F_ULOCK',0)
 F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
-O_ACCMODE = Constant('O_ACCMODE',0003)
-O_RDONLY = Constant('O_RDONLY',00)
-O_WRONLY = Constant('O_WRONLY',01)
-O_RDWR = Constant('O_RDWR',02)
-O_CREAT = Constant('O_CREAT',0100)
-O_EXCL = Constant('O_EXCL',0200)
-O_NOCTTY = Constant('O_NOCTTY',0400)
-O_TRUNC = Constant('O_TRUNC',01000)
-O_APPEND = Constant('O_APPEND',02000)
-O_NONBLOCK = Constant('O_NONBLOCK',04000)
-O_NDELAY = Constant('O_NDELAY',04000)
-O_SYNC = Constant('O_SYNC',010000)
-FASYNC = Constant('FASYNC',020000)
-O_DIRECT = Constant('O_DIRECT',040000)
-O_LARGEFILE = Constant('O_LARGEFILE',0100000)
-O_DIRECTORY = Constant('O_DIRECTORY',0200000)
-O_NOFOLLOW = Constant('O_NOFOLLOW',0400000)
-O_NOATIME = Constant('O_NOATIME',01000000)
+O_ACCMODE = Constant('O_ACCMODE',0o003)
+O_RDONLY = Constant('O_RDONLY',0o0)
+O_WRONLY = Constant('O_WRONLY',0o1)
+O_RDWR = Constant('O_RDWR',0o2)
+O_CREAT = Constant('O_CREAT',0o100)
+O_EXCL = Constant('O_EXCL',0o200)
+O_NOCTTY = Constant('O_NOCTTY',0o400)
+O_TRUNC = Constant('O_TRUNC',0o1000)
+O_APPEND = Constant('O_APPEND',0o2000)
+O_NONBLOCK = Constant('O_NONBLOCK',0o4000)
+O_NDELAY = Constant('O_NDELAY',0o4000)
+O_SYNC = Constant('O_SYNC',0o10000)
+FASYNC = Constant('FASYNC',0o20000)
+O_DIRECT = Constant('O_DIRECT',0o40000)
+O_LARGEFILE = Constant('O_LARGEFILE',0o100000)
+O_DIRECTORY = Constant('O_DIRECTORY',0o200000)
+O_NOFOLLOW = Constant('O_NOFOLLOW',0o400000)
+O_NOATIME = Constant('O_NOATIME',0o1000000)
 F_DUPFD = Constant('F_DUPFD',0)
 F_GETFD = Constant('F_GETFD',1)
 F_SETFD = Constant('F_SETFD',2)
@@ -643,7 +643,7 @@ LOCK_MAND = Constant('LOCK_MAND',32)
 LOCK_READ = Constant('LOCK_READ',64)
 LOCK_WRITE = Constant('LOCK_WRITE',128)
 LOCK_RW = Constant('LOCK_RW',192)
-O_ASYNC = Constant('O_ASYNC',020000)
+O_ASYNC = Constant('O_ASYNC',0o20000)
 MREMAP_MAYMOVE = Constant('MREMAP_MAYMOVE',1)
 MREMAP_FIXED = Constant('MREMAP_FIXED',2)
 PROT_READ = Constant('PROT_READ',0x1)
@@ -567,32 +567,32 @@ F_ULOCK = Constant('F_ULOCK',0)
 F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
 O_ACCMODE = Constant('O_ACCMODE',0x0003)
 O_RDONLY = Constant('O_RDONLY',0x0000)
@@ -525,32 +525,32 @@ F_ULOCK = Constant('F_ULOCK',0)
 F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
 MREMAP_MAYMOVE = Constant('MREMAP_MAYMOVE',1)
 MREMAP_FIXED = Constant('MREMAP_FIXED',2)
@@ -518,32 +518,32 @@ F_ULOCK = Constant('F_ULOCK',0)
 F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
 MREMAP_MAYMOVE = Constant('MREMAP_MAYMOVE',1)
 MREMAP_FIXED = Constant('MREMAP_FIXED',2)
@@ -541,51 +541,51 @@ F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
 STAT64_HAS_BROKEN_ST_INO = Constant('STAT64_HAS_BROKEN_ST_INO',1)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
-O_ACCMODE = Constant('O_ACCMODE',0003)
-O_RDONLY = Constant('O_RDONLY',00)
-O_WRONLY = Constant('O_WRONLY',01)
-O_RDWR = Constant('O_RDWR',02)
-O_CREAT = Constant('O_CREAT',0100)
-O_EXCL = Constant('O_EXCL',0200)
-O_NOCTTY = Constant('O_NOCTTY',0400)
-O_TRUNC = Constant('O_TRUNC',01000)
-O_APPEND = Constant('O_APPEND',02000)
-O_NONBLOCK = Constant('O_NONBLOCK',04000)
-O_NDELAY = Constant('O_NDELAY',04000)
-O_SYNC = Constant('O_SYNC',010000)
-FASYNC = Constant('FASYNC',020000)
-O_DIRECT = Constant('O_DIRECT',040000)
-O_LARGEFILE = Constant('O_LARGEFILE',0100000)
-O_DIRECTORY = Constant('O_DIRECTORY',0200000)
-O_NOFOLLOW = Constant('O_NOFOLLOW',0400000)
-O_NOATIME = Constant('O_NOATIME',01000000)
+O_ACCMODE = Constant('O_ACCMODE',0o003)
+O_RDONLY = Constant('O_RDONLY',0o0)
+O_WRONLY = Constant('O_WRONLY',0o1)
+O_RDWR = Constant('O_RDWR',0o2)
+O_CREAT = Constant('O_CREAT',0o100)
+O_EXCL = Constant('O_EXCL',0o200)
+O_NOCTTY = Constant('O_NOCTTY',0o400)
+O_TRUNC = Constant('O_TRUNC',0o1000)
+O_APPEND = Constant('O_APPEND',0o2000)
+O_NONBLOCK = Constant('O_NONBLOCK',0o4000)
+O_NDELAY = Constant('O_NDELAY',0o4000)
+O_SYNC = Constant('O_SYNC',0o10000)
+FASYNC = Constant('FASYNC',0o20000)
+O_DIRECT = Constant('O_DIRECT',0o40000)
+O_LARGEFILE = Constant('O_LARGEFILE',0o100000)
+O_DIRECTORY = Constant('O_DIRECTORY',0o200000)
+O_NOFOLLOW = Constant('O_NOFOLLOW',0o400000)
+O_NOATIME = Constant('O_NOATIME',0o1000000)
 F_DUPFD = Constant('F_DUPFD',0)
 F_GETFD = Constant('F_GETFD',1)
 F_SETFD = Constant('F_SETFD',2)
@@ -616,7 +616,7 @@ LOCK_MAND = Constant('LOCK_MAND',32)
 LOCK_READ = Constant('LOCK_READ',64)
 LOCK_WRITE = Constant('LOCK_WRITE',128)
 LOCK_RW = Constant('LOCK_RW',192)
-O_ASYNC = Constant('O_ASYNC',020000)
+O_ASYNC = Constant('O_ASYNC',0o20000)
 MREMAP_MAYMOVE = Constant('MREMAP_MAYMOVE',1)
 MREMAP_FIXED = Constant('MREMAP_FIXED',2)
 PROT_READ = Constant('PROT_READ',0x1)
@@ -533,32 +533,32 @@ F_ULOCK = Constant('F_ULOCK',0)
 F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
 MREMAP_MAYMOVE = Constant('MREMAP_MAYMOVE',1)
 MREMAP_FIXED = Constant('MREMAP_FIXED',2)
@@ -576,32 +576,32 @@ F_ULOCK = Constant('F_ULOCK',0)
 F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
 O_RDONLY = Constant('O_RDONLY',0x0000)
 O_WRONLY = Constant('O_WRONLY',0x0001)
@@ -524,32 +524,32 @@ F_ULOCK = Constant('F_ULOCK',0)
 F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
 MREMAP_MAYMOVE = Constant('MREMAP_MAYMOVE',1)
 MREMAP_FIXED = Constant('MREMAP_FIXED',2)
@@ -917,51 +917,51 @@ F_LOCK = Constant('F_LOCK',1)
 F_TLOCK = Constant('F_TLOCK',2)
 F_TEST = Constant('F_TEST',3)
 STAT64_HAS_BROKEN_ST_INO = Constant('STAT64_HAS_BROKEN_ST_INO',1)
-S_IFMT = Constant('S_IFMT',00170000)
-S_IFSOCK = Constant('S_IFSOCK',0140000)
-S_IFLNK = Constant('S_IFLNK',0120000)
-S_IFREG = Constant('S_IFREG',0100000)
-S_IFBLK = Constant('S_IFBLK',0060000)
-S_IFDIR = Constant('S_IFDIR',0040000)
-S_IFCHR = Constant('S_IFCHR',0020000)
-S_IFIFO = Constant('S_IFIFO',0010000)
-S_ISUID = Constant('S_ISUID',0004000)
-S_ISGID = Constant('S_ISGID',0002000)
-S_ISVTX = Constant('S_ISVTX',0001000)
-S_IRWXU = Constant('S_IRWXU',00700)
-S_IRUSR = Constant('S_IRUSR',00400)
-S_IWUSR = Constant('S_IWUSR',00200)
-S_IXUSR = Constant('S_IXUSR',00100)
-S_IRWXG = Constant('S_IRWXG',00070)
-S_IRGRP = Constant('S_IRGRP',00040)
-S_IWGRP = Constant('S_IWGRP',00020)
-S_IXGRP = Constant('S_IXGRP',00010)
-S_IRWXO = Constant('S_IRWXO',00007)
-S_IROTH = Constant('S_IROTH',00004)
-S_IWOTH = Constant('S_IWOTH',00002)
-S_IXOTH = Constant('S_IXOTH',00001)
-S_IREAD = Constant('S_IREAD',00400)
-S_IWRITE = Constant('S_IWRITE',00200)
-S_IEXEC = Constant('S_IEXEC',00100)
+S_IFMT = Constant('S_IFMT',0o0170000)
+S_IFSOCK = Constant('S_IFSOCK',0o140000)
+S_IFLNK = Constant('S_IFLNK',0o120000)
+S_IFREG = Constant('S_IFREG',0o100000)
+S_IFBLK = Constant('S_IFBLK',0o060000)
+S_IFDIR = Constant('S_IFDIR',0o040000)
+S_IFCHR = Constant('S_IFCHR',0o020000)
+S_IFIFO = Constant('S_IFIFO',0o010000)
+S_ISUID = Constant('S_ISUID',0o004000)
+S_ISGID = Constant('S_ISGID',0o002000)
+S_ISVTX = Constant('S_ISVTX',0o001000)
+S_IRWXU = Constant('S_IRWXU',0o0700)
+S_IRUSR = Constant('S_IRUSR',0o0400)
+S_IWUSR = Constant('S_IWUSR',0o0200)
+S_IXUSR = Constant('S_IXUSR',0o0100)
+S_IRWXG = Constant('S_IRWXG',0o0070)
+S_IRGRP = Constant('S_IRGRP',0o0040)
+S_IWGRP = Constant('S_IWGRP',0o0020)
+S_IXGRP = Constant('S_IXGRP',0o0010)
+S_IRWXO = Constant('S_IRWXO',0o0007)
+S_IROTH = Constant('S_IROTH',0o0004)
+S_IWOTH = Constant('S_IWOTH',0o0002)
+S_IXOTH = Constant('S_IXOTH',0o0001)
+S_IREAD = Constant('S_IREAD',0o0400)
+S_IWRITE = Constant('S_IWRITE',0o0200)
+S_IEXEC = Constant('S_IEXEC',0o0100)
 F_LINUX_SPECIFIC_BASE = Constant('F_LINUX_SPECIFIC_BASE',1024)
-O_ACCMODE = Constant('O_ACCMODE',0003)
-O_RDONLY = Constant('O_RDONLY',00)
-O_WRONLY = Constant('O_WRONLY',01)
-O_RDWR = Constant('O_RDWR',02)
-O_CREAT = Constant('O_CREAT',0100)
-O_EXCL = Constant('O_EXCL',0200)
-O_NOCTTY = Constant('O_NOCTTY',0400)
-O_TRUNC = Constant('O_TRUNC',01000)
-O_APPEND = Constant('O_APPEND',02000)
-O_NONBLOCK = Constant('O_NONBLOCK',04000)
-O_NDELAY = Constant('O_NDELAY',04000)
-O_SYNC = Constant('O_SYNC',010000)
-FASYNC = Constant('FASYNC',020000)
-O_DIRECTORY = Constant('O_DIRECTORY',040000)
-O_NOFOLLOW = Constant('O_NOFOLLOW',0100000)
-O_DIRECT = Constant('O_DIRECT',0200000)
-O_LARGEFILE = Constant('O_LARGEFILE',0400000)
-O_NOATIME = Constant('O_NOATIME',01000000)
+O_ACCMODE = Constant('O_ACCMODE',0o003)
+O_RDONLY = Constant('O_RDONLY',0o0)
+O_WRONLY = Constant('O_WRONLY',0o1)
+O_RDWR = Constant('O_RDWR',0o2)
+O_CREAT = Constant('O_CREAT',0o100)
+O_EXCL = Constant('O_EXCL',0o200)
+O_NOCTTY = Constant('O_NOCTTY',0o400)
+O_TRUNC = Constant('O_TRUNC',0o1000)
+O_APPEND = Constant('O_APPEND',0o2000)
+O_NONBLOCK = Constant('O_NONBLOCK',0o4000)
+O_NDELAY = Constant('O_NDELAY',0o4000)
+O_SYNC = Constant('O_SYNC',0o10000)
+FASYNC = Constant('FASYNC',0o20000)
+O_DIRECTORY = Constant('O_DIRECTORY',0o40000)
+O_NOFOLLOW = Constant('O_NOFOLLOW',0o100000)
+O_DIRECT = Constant('O_DIRECT',0o200000)
+O_LARGEFILE = Constant('O_LARGEFILE',0o400000)
+O_NOATIME = Constant('O_NOATIME',0o1000000)
 F_DUPFD = Constant('F_DUPFD',0)
 F_GETFD = Constant('F_GETFD',1)
 F_SETFD = Constant('F_SETFD',2)
@@ -992,7 +992,7 @@ LOCK_MAND = Constant('LOCK_MAND',32)
 LOCK_READ = Constant('LOCK_READ',64)
 LOCK_WRITE = Constant('LOCK_WRITE',128)
 LOCK_RW = Constant('LOCK_RW',192)
-O_ASYNC = Constant('O_ASYNC',020000)
+O_ASYNC = Constant('O_ASYNC',0o20000)
 MREMAP_MAYMOVE = Constant('MREMAP_MAYMOVE',1)
 MREMAP_FIXED = Constant('MREMAP_FIXED',2)
 PROT_READ = Constant('PROT_READ',0x1)
@@ -5,12 +5,14 @@ Implements context management so that nested/scoped contexts and threaded
 contexts work properly and as expected.
 """
 from __future__ import absolute_import
+from __future__ import division

 import collections
 import functools
 import logging
 import os
 import platform
+import six
 import socket
 import stat
 import string
@@ -138,9 +140,9 @@ class _Tls_DictStack(threading.local, _DictStack):

        >>> t = pwnlib.context._Tls_DictStack({})
        >>> t['key'] = 'value'
-        >>> print t
+        >>> print(t)
        {'key': 'value'}
-        >>> def p(): print t
+        >>> def p(): print(t)
        >>> thread = threading.Thread(target=p)
        >>> _ = (thread.start(), thread.join())
        {}
@@ -150,7 +152,7 @@ class _Tls_DictStack(threading.local, _DictStack):

 def _validator(validator):
    """
-    Validator that tis tightly coupled to the implementation
+    Validator that is tightly coupled to the implementation
    of the classes here.

    This expects that the object has a ._tls property which
@@ -194,9 +196,9 @@ class Thread(threading.Thread):
        >>> context.clear()
        >>> context.update(arch='arm')
        >>> def p():
-        ...     print context.arch
+        ...     print(context.arch)
        ...     context.arch = 'mips'
-        ...     print context.arch
+        ...     print(context.arch)
        >>> # Note that a normal Thread starts with a clean context
        >>> # (i386 is the default architecture)
        >>> t = threading.Thread(target=p)
@@ -204,7 +206,7 @@ class Thread(threading.Thread):
        i386
        mips
        >>> # Note that the main Thread's context is unchanged
-        >>> print context.arch
+        >>> print(context.arch)
        arm
        >>> # Note that a context-aware Thread receives a copy of the context
        >>> t = pwnlib.context.Thread(target=p)
@@ -212,7 +214,7 @@ class Thread(threading.Thread):
        arm
        mips
        >>> # Again, the main thread is unchanged
-        >>> print context.arch
+        >>> print(context.arch)
        arm

    Implementation Details:
@@ -238,7 +240,13 @@ class Thread(threading.Thread):
            differently.
        """
        context.update(**self.old)
-        super(Thread, self).__bootstrap()
+        sup = super(Thread, self)
+        bootstrap = getattr(sup, '_bootstrap', None)
+        if bootstrap is None:
+            sup.__bootstrap()
+        else:
+            bootstrap()
+    _bootstrap = __bootstrap

 def _longest(d):
    """
@@ -252,17 +260,13 @@ def _longest(d):
    >>> pwnlib.context._longest(data) == data
    True
    >>> for i in pwnlib.context._longest(data):
-    ...     print i
+    ...     print(i)
    ccc
    bb
    a
    """
    return collections.OrderedDict((k,d[k]) for k in sorted(d, key=len, reverse=True))

-def TlsProperty(object):
-    def __get__(self, obj, objtype=None):
-        return obj._tls
-
 class ContextType(object):
    r"""
    Class for specifying information about the target machine.
@@ -298,7 +302,7 @@ class ContextType(object):
        >>> context.bits
        32
        >>> def nop():
-        ...   print pwnlib.asm.asm('nop').encode('hex')
+        ...   print(enhex(pwnlib.asm.asm('nop')))
        >>> nop()
        00f020e3
        >>> with context.local(arch = 'i386'):
@@ -337,9 +341,13 @@ class ContextType(object):
        'binary': None,
        'bits': 32,
        'buffer_size': 4096,
+        'cyclic_alphabet': string.ascii_lowercase.encode(),
+        'cyclic_size': 4,
        'delete_corefiles': False,
        'device': os.getenv('ANDROID_SERIAL', None) or None,
+        'encoding': 'auto',
        'endian': 'little',
+        'gdbinit': "",
        'kernel': None,
        'log_level': logging.INFO,
        'log_file': _devnull(),
@@ -389,6 +397,7 @@ class ContextType(object):
        'sparc64':   big_64,
        'thumb':     little_32,
        'vax':       little_32,
+        'none':      {},
    })

    #: Valid values for :attr:`endian`
@@ -417,7 +426,7 @@ class ContextType(object):

        All keyword arguments are passed to :func:`update`.
        """
-        self._tls = _Tls_DictStack(_defaultdict(ContextType.defaults))
+        self._tls = _Tls_DictStack(_defaultdict(self.defaults))
        self.update(**kwargs)


@@ -497,15 +506,15 @@ class ContextType(object):
            >>> context.timeout = 1
            >>> context.timeout == 1
            True
-            >>> print context.timeout
+            >>> print(context.timeout)
            1.0
            >>> with context.local(timeout = 2):
-            ...     print context.timeout
+            ...     print(context.timeout)
            ...     context.timeout = 3
-            ...     print context.timeout
+            ...     print(context.timeout)
            2.0
            3.0
-            >>> print context.timeout
+            >>> print(context.timeout)
            1.0
        """
        class LocalContext(object):
@@ -684,11 +693,11 @@ class ContextType(object):
                break

        try:
-            defaults = ContextType.architectures[arch]
+            defaults = self.architectures[arch]
        except KeyError:
-            raise AttributeError('AttributeError: arch must be one of %r' % sorted(ContextType.architectures))
+            raise AttributeError('AttributeError: arch must be one of %r' % sorted(self.architectures))

-        for k,v in ContextType.architectures[arch].items():
+        for k,v in defaults.items():
            if k not in self._tls:
                self._tls[k] = v

@@ -718,8 +727,8 @@ class ContextType(object):
        Even then, this doesn't matter much -- only when the the segment
        registers need to be known
        """
-        with context.local(arch=arch):
-            return context.arch
+        with self.local(arch=arch):
+            return self.arch

    @_validator
    def bits(self, bits):
@@ -774,6 +783,7 @@ class ContextType(object):
        self.arch   = binary.arch
        self.bits   = binary.bits
        self.endian = binary.endian
+        self.os     = binary.os

        return binary

@@ -782,7 +792,7 @@ class ContextType(object):
        """
        Target machine word size, in bytes (i.e. the size of general purpose registers).

-        This is a convenience wrapper around ``bits / 8``.
+        This is a convenience wrapper around ``bits // 8``.

        Examples:

@@ -795,11 +805,41 @@ class ContextType(object):
            ...
            AttributeError: bits must be > 0 (0)
        """
-        return self.bits/8
+        return self.bits // 8
    @bytes.setter
    def bytes(self, value):
        self.bits = value*8

+    @_validator
+    def encoding(self, charset):
+        if charset == 'auto':
+            return charset
+
+        if (  b'aA'.decode(charset) != 'aA'
+            or 'aA'.encode(charset) != b'aA'):
+            raise ValueError('Strange encoding!')
+
+        return charset
+
+    def _encode(self, s):
+        if isinstance(s, (bytes, bytearray)):
+            return s   # already bytes
+
+        if self.encoding == 'auto':
+            try:
+                return s.encode('latin1')
+            except UnicodeEncodeError:
+                return s.encode('utf-8', 'surrogateescape')
+        return s.encode(self.encoding)
+
+    def _decode(self, b):
+        if self.encoding == 'auto':
+            try:
+                return b.decode('utf-8')
+            except UnicodeDecodeError:
+                return b.decode('latin1')
+        return b.decode(self.encoding)
+
    @_validator
    def endian(self, endianness):
        """
@@ -831,10 +871,10 @@ class ContextType(object):
        """
        endian = endianness.lower()

-        if endian not in ContextType.endiannesses:
-            raise AttributeError("endian must be one of %r" % sorted(ContextType.endiannesses))
+        if endian not in self.endiannesses:
+            raise AttributeError("endian must be one of %r" % sorted(self.endiannesses))

-        return ContextType.endiannesses[endian]
+        return self.endiannesses[endian]


    @_validator
@@ -891,24 +931,23 @@ class ContextType(object):
            >>> with context.local(log_file='bar.txt'):
            ...     log.debug('Hello from bar!')
            >>> log.info('Hello from foo!')
-            >>> file('foo.txt').readlines()[-3] #doctest: +ELLIPSIS
+            >>> open('foo.txt').readlines()[-3] #doctest: +ELLIPSIS
            '...:DEBUG:...:Hello!\n'
-            >>> file('foo.txt').readlines()[-2] #doctest: +ELLIPSIS
+            >>> open('foo.txt').readlines()[-2] #doctest: +ELLIPSIS
            '...:INFO:...:Hello again!\n'
-            >>> file('foo.txt').readlines()[-1] #doctest: +ELLIPSIS
+            >>> open('foo.txt').readlines()[-1] #doctest: +ELLIPSIS
            '...:INFO:...:Hello from foo!\n'
-            >>> file('bar.txt').readlines()[-1] #doctest: +ELLIPSIS
+            >>> open('bar.txt').readlines()[-1] #doctest: +ELLIPSIS
            '...:DEBUG:...:Hello from bar!\n'
        """
-        if isinstance(value, (str,unicode)):
-            modes = ('w', 'wb', 'a', 'ab')
+        if isinstance(value, (bytes, six.text_type)):
            # check if mode was specified as "[value],[mode]"
            if ',' not in value:
                value += ',a'
            filename, mode = value.rsplit(',', 1)
            value = open(filename, mode)

-        elif not isinstance(value, (file)):
+        elif not hasattr(value, "fileno"):
            raise AttributeError('log_file must be a file')

        # Is this the same file we already have open?
@@ -976,8 +1015,8 @@ class ContextType(object):
        """
        os = os.lower()

-        if os not in ContextType.oses:
-            raise AttributeError("os must be one of %r" % ContextType.oses)
+        if os not in self.oses:
+            raise AttributeError("os must be one of %r" % self.oses)

        return os

@@ -1015,11 +1054,11 @@ class ContextType(object):
            ...
            AttributeError: signed must be one of ['no', 'signed', 'unsigned', 'yes'] or a non-string truthy value
        """
-        try:             signed = ContextType.signednesses[signed]
+        try:             signed = self.signednesses[signed]
        except KeyError: pass

        if isinstance(signed, str):
-            raise AttributeError('signed must be one of %r or a non-string truthy value' % sorted(ContextType.signednesses))
+            raise AttributeError('signed must be one of %r or a non-string truthy value' % sorted(self.signednesses))

        return bool(signed)

@@ -1043,7 +1082,7 @@ class ContextType(object):
        Can be a string or an iterable of strings.  In the latter case the first
        entry is the terminal and the rest are default arguments.
        """
-        if isinstance(value, (str, unicode)):
+        if isinstance(value, (bytes, six.text_type)):
            return [value]
        return value

@@ -1124,13 +1163,13 @@ class ContextType(object):
    def device(self, device):
        """Sets the device being operated on.
        """
+        if isinstance(device, (bytes, six.text_type)):
+            device = Device(device)
        if isinstance(device, Device):
            self.arch = device.arch or self.arch
            self.bits = device.bits or self.bits
            self.endian = device.endian or self.endian
            self.os = device.os or self.os
-        elif isinstance(device, str):
-            device = Device(device)
        elif device is not None:
            raise AttributeError("device must be either a Device object or a serial number as a string")

@@ -1190,7 +1229,7 @@ class ContextType(object):
        if not os.access(home, os.W_OK):
            return None

-        cache = os.path.join(home, '.pwntools-cache')
+        cache = os.path.join(home, '.pwntools-cache-%d.%d' % sys.version_info[:2])

        if not os.path.exists(cache):
            try:
@@ -1231,6 +1270,49 @@ class ContextType(object):
        """
        return bool(v)

+
+    @_validator
+    def gdbinit(self, value):
+        """Path to the gdbinit that is used when running GDB locally.
+
+        This is useful if you want pwntools-launched GDB to include some additional modules,
+        like PEDA but you do not want to have GDB include them by default.
+
+        The setting will only apply when GDB is launched locally since remote hosts may not have
+        the necessary requirements for the gdbinit.
+
+        If set to an empty string, GDB will use the default `~/.gdbinit`.
+
+        Default value is ``""``.
+        """
+        return str(value)
+
+    @_validator
+    def cyclic_alphabet(self, alphabet):
+        """Cyclic alphabet.
+
+        Default value is `string.ascii_lowercase`.
+        """
+
+        # Do not allow multiple occurrences
+        if len(set(alphabet)) != len(alphabet):
+            raise AttributeError("cyclic alphabet cannot contain duplicates")
+
+        return alphabet.encode()
+
+    @_validator
+    def cyclic_size(self, size):
+        """Cyclic pattern size.
+
+        Default value is `4`.
+        """
+        size = int(size)
+
+        if size > self.bytes:
+            raise AttributeError("cyclic pattern size cannot be larger than word size")
+
+        return size
+
    #*************************************************************************
    #                               ALIASES
    #*************************************************************************
@@ -1341,11 +1423,39 @@ def LocalContext(function):
    """
    @functools.wraps(function)
    def setter(*a, **kw):
-        # Fast path to skip adding a Context frame
-        if not kw:
-            return function(*a)
+        with context.local(**{k:kw.pop(k) for k,v in tuple(kw.items()) if isinstance(getattr(ContextType, k, None), property)}):
+            arch = context.arch
+            bits = context.bits
+            endian = context.endian

-        with context.local(**{k:kw.pop(k) for k,v in kw.items() if isinstance(getattr(ContextType, k, None), property)}):
+            # Prevent the user from doing silly things with invalid
+            # architecture / bits / endianness combinations.
+            if (arch == 'i386' and bits != 32) \
+              or (arch == 'amd64' and bits != 64):
+                raise AttributeError("Invalid arch/bits combination: %s/%s" % (arch, bits))
+
+            if arch in ('i386', 'amd64') and endian == 'big':
+                raise AttributeError("Invalid arch/endianness combination: %s/%s" % (arch, endian))
+
+            return function(*a, **kw)
+    return setter
+
+def LocalNoarchContext(function):
+    """
+    Same as LocalContext, but resets arch to :const:`'none'` by default
+
+    Example:
+
+        >>> @LocalNoarchContext
+        ... def printArch():
+        ...     print(context.arch)
+        >>> printArch()
+        none
+    """
+    @functools.wraps(function)
+    def setter(*a, **kw):
+        kw.setdefault('arch', 'none')
+        with context.local(**{k:kw.pop(k) for k,v in tuple(kw.items()) if isinstance(getattr(ContextType, k, None), property)}):
            return function(*a, **kw)
    return setter

@@ -1362,11 +1472,19 @@ def update_context_defaults(section):

        default = ContextType.defaults[key]

-        if isinstance(default, (str, unicode, tuple, int, long, list, dict)):
+        if isinstance(default, six.string_types + six.integer_types + (tuple, list, dict)):
            value = safeeval.expr(value)
        else:
            log.warn("Unsupported configuration option %r in section %r" % (key, 'context'))

-        ContextType.defaults[key] = type(default)(value)
+        # Attempt to set the value, to see if it is value:
+        try:
+            with context.local(**{key: value}):
+                value = getattr(context, key)
+        except (ValueError, AttributeError) as e:
+            log.warn("Could not set context.%s=%s via pwn.conf (%s)", key, section[key], e)
+            continue
+
+        ContextType.defaults[key] = value

 register_config('context', update_context_defaults)
@@ -1,4 +1,6 @@
-#!/usr/bin/env python2
+#!/usr/bin/env python
+from __future__ import print_function
+
 import re
 import sys

@@ -7,7 +9,7 @@ from pwnlib.util import safeeval
 python = open(sys.argv[1], "w")
 header = open(sys.argv[2], "w")

-print >>python, 'from pwnlib.constants.constant import Constant'
+print('from pwnlib.constants.constant import Constant', file=python)

 data = sys.stdin.read().strip().split('\n')

@@ -29,8 +31,11 @@ for l in data:
    elif val.endswith('L'):
        val = val[:-1]

-    print >> python, "{key} = Constant({key!r},{val})".format(**locals())
-    if re.match(r'^0[0-9]', val) or re.match(r'[^0-9a-fA-Fx]0[0-9]', val):
-        print >> header, "#define %s %s" % (key, hex(safeeval.expr(val)))
+    if re.match(r'^0[0-9]', val):
+        val = '0o'+val[1:]
+
+    print("{key} = Constant({key!r},{val})".format(**locals()), file=python)
+    if re.match(r'^0o[0-9]', val) or re.match(r'[^0-9a-fA-Fx]0[0-9]', val):
+        print("#define %s %s" % (key, hex(safeeval.expr(val))), file=header)
    else:
-        print >> header, "#define %s %s" % (key, val)
+        print("#define %s %s" % (key, val), file=header)
@@ -1,4 +1,5 @@
 #!/usr/bin/env python2
+from __future__ import division
 import argparse
 import os

@@ -16,6 +17,7 @@ import collections
 import pwnlib.abi
 import pwnlib.constants
 import pwnlib.shellcraft
+import six
 %>
 '''

@@ -73,7 +75,9 @@ CALL = """

        # The argument is not a register.  It is a string value, and we
        # are expecting a string value
-        elif name in can_pushstr and isinstance(arg, str):
+        elif name in can_pushstr and isinstance(arg, (bytes, six.text_type)):
+            if not isinstance(arg, bytes):
+                arg = arg.encode('utf-8')
            string_arguments[name] = arg

        # The argument is not a register.  It is a dictionary, and we are
@@ -107,7 +111,7 @@ CALL = """
 %>
    /* {name}(${{', '.join(syscall_repr)}}) */
 %for name, arg in string_arguments.items():
-    ${{pwnlib.shellcraft.pushstr(arg, append_null=('\\x00' not in arg))}}
+    ${{pwnlib.shellcraft.pushstr(arg, append_null=(b'\\x00' not in arg))}}
    ${{pwnlib.shellcraft.mov(regs[argument_names.index(name)], abi.stack)}}
 %endfor
 %for name, arg in array_arguments.items():
@@ -184,12 +188,12 @@ def generate_one(target):

        # Skip anything with uppercase
        if name.lower() != name:
-            print 'Skipping %s' % name
+            print('Skipping %s' % name)
            continue

        # Skip anything that starts with 'unused' or 'sys' after stripping
        if name.startswith('unused'):
-            print 'Skipping %s' % name
+            print('Skipping %s' % name)
            continue

        function = functions.get(name, None)
@@ -200,7 +204,7 @@ def generate_one(target):
        # If we can't find a function, just stub it out with something
        # that has a vararg argument.
        if function is None:
-            print 'Stubbing out %s' % name
+            print('Stubbing out %s' % name)
            args = [Argument('int', 0, 'vararg')]
            function = Function('long', 0, name, args)

@@ -1,13 +1,19 @@
-<%page args="binary, host=None, port=None, user=None, password=None, remote_path=None"/>\
+<%page args="binary, host=None, port=None, user=None, password=None, remote_path=None, quiet=False"/>\
 <%
+import os
+import sys
+
 from pwnlib.context import context as ctx
 from pwnlib.elf.elf import ELF
+from pwnlib.util.sh_string import sh_string
 from elftools.common.exceptions import ELFError

-import os
+argv = list(sys.argv)
+argv[0] = os.path.basename(argv[0])
+
 try:
    if binary:
-        ctx.binary = ELF(binary, checksec=False)
+       ctx.binary = ELF(binary, checksec=False)
 except ELFError:
    pass

@@ -26,11 +32,17 @@ remote_path = remote_path or exe
 password = password or 'secret1234'
 binary_repr = repr(binary)
 %>\
-#!/usr/bin/env python2
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
+%if not quiet:
+# This exploit template was generated via:
+# $ ${' '.join(map(sh_string, argv))}
+%endif
 from pwn import *

+%if not quiet:
 # Set up pwntools for the correct architecture
+%endif
 %if ctx.binary:
 exe = context.binary = ELF(${binary_repr})
 <% binary_repr = 'exe.path' %>
@@ -40,6 +52,7 @@ exe = ${binary_repr}
 <% binary_repr = 'exe' %>
 %endif

+%if not quiet:
 # Many built-in settings can be controlled on the command-line and show up
 # in "args".  For example, to dump all data sent/received, and disable ASLR
 # for all created processes...
@@ -47,6 +60,7 @@ exe = ${binary_repr}
 %if host or port or user:
 # ./exploit.py GDB HOST=example.com PORT=4141
 %endif
+%endif
 %if host:
 host = args.HOST or ${repr(host)}
 %endif
@@ -61,22 +75,6 @@ password = args.PASSWORD or ${repr(password)}
 remote_path = ${repr(remote_path)}
 %endif

-%if exe or remote_path:
-# Specify your GDB script here for debugging
-# GDB will be launched if the exploit is run via e.g.
-# ./exploit.py GDB
-gdbscript = '''
-%if ctx.binary:
-  %if 'main' in ctx.binary.symbols:
-break *0x{exe.symbols.main:x}
-  %else:
-break *0x{exe.entry:x}
-  %endif
-%endif
-continue
-'''.format(**locals())
-%endif
-
 %if ssh:
 # Connect to the remote SSH server
 shell = None
@@ -86,25 +84,22 @@ if not args.LOCAL:
 %endif

 %if host:
-# Execute the target binary locally
 def local(argv=[], *a, **kw):
+    '''Execute the target binary locally'''
    if args.GDB:
-        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
+        return gdb.debug([${binary_repr}] + argv, gdbscript=gdbscript, *a, **kw)
    else:
-        return process([exe.path] + argv, *a, **kw)
+        return process([${binary_repr}] + argv, *a, **kw)

-%if ssh:
-# Execute the target binary on the remote host
-%else:
-# Connect to the process on the remote host
-%endif
 def remote(argv=[], *a, **kw):
  %if ssh:
+    '''Execute the target binary on the remote host'''
    if args.GDB:
        return gdb.debug([remote_path] + argv, gdbscript=gdbscript, ssh=shell, *a, **kw)
    else:
        return shell.process([remote_path] + argv, *a, **kw)
  %else:
+    '''Connect to the process on the remote host'''
    io = connect(host, port)
    if args.GDB:
        gdb.attach(io, gdbscript=gdbscript)
@@ -113,20 +108,60 @@ def remote(argv=[], *a, **kw):
 %endif

 %if host:
-start = local if args.LOCAL else remote
+def start(argv=[], *a, **kw):
+    '''Start the exploit against the target.'''
+    if args.LOCAL:
+        return local(argv, *a, **kw)
+    else:
+        return remote(argv, *a, **kw)
 %else:
 def start(argv=[], *a, **kw):
+    '''Start the exploit against the target.'''
    if args.GDB:
        return gdb.debug([${binary_repr}] + argv, gdbscript=gdbscript, *a, **kw)
    else:
        return process([${binary_repr}] + argv, *a, **kw)
 %endif

+%if exe or remote_path:
+%if not quiet:
+# Specify your GDB script here for debugging
+# GDB will be launched if the exploit is run via e.g.
+# ./exploit.py GDB
+%endif
+gdbscript = '''
+%if ctx.binary:
+  %if 'main' in ctx.binary.symbols:
+tbreak main
+  %elif 'DYN' != ctx.binary.elftype:
+tbreak *0x{exe.entry:x}
+  %endif
+%endif
+continue
+'''.format(**locals())
+%endif
+
+
+%if not quiet:
 #===========================================================
 #                    EXPLOIT GOES HERE
 #===========================================================
+%else:
+# -- Exploit goes here --
+%endif
+%if ctx.binary and not quiet:
+# ${'%-10s%s-%s-%s' % ('Arch:',
+                       ctx.binary.arch,
+                       ctx.binary.bits,
+                       ctx.binary.endian)}
+%for line in ctx.binary.checksec(color=False).splitlines():
+# ${line}
+%endfor
+%endif
+
 io = start()

+%if not quiet:
 # shellcode = asm(shellcraft.sh())
 # payload = fit({
 #     32: 0xdeadbeef,
@@ -135,5 +170,6 @@ io = start()
 # io.send(payload)
 # flag = io.recv(...)
 # log.success(flag)
+%endif

 io.interactive()
@@ -1,13 +1,12 @@
-This directory contains a script `download-useragents.py' which downloads a list
-of user agent strings from the Internet.
+This directory contains a script `download-useragents.py' which downloads a
+list of user agent strings from the Internet.

 The user agent strings are downloaded from:
- - http://www.useragentstring.com/
- - http://www.user-agents.org/
+ - http://www.user-agents.org
 - http://techpatterns.com/downloads/firefox/useragentswitcher.xml

-The latter list is part of the Firefox `User Agent Switcher' add-on and released
-under BSD 2 Clause.
+The latter list is part of the Firefox `User Agent Switcher' add-on and
+released under BSD 2 Clause.


 As mentioned elsewhere we are not lawyers and do not know the legal status of
@@ -1,13 +1,10 @@
 #!/usr/bin/env python2
-"""
-Script for downloading lists of user agent strings
-"""
+"""Script for downloading lists of user agent strings."""
+from __future__ import division
 import os
-import re
 import urllib

 from bs4 import BeautifulSoup
-
 from pwn import *

 uas = set()
@@ -23,39 +20,9 @@ def getxml(url):
    f.close()
    return xml

-with log.waitfor('Fetching from from http://www.useragentstring.com') as l:
-    html = getxml('http://www.useragentstring.com/pages/All/')
-    soup = BeautifulSoup(html)
-    l.success()
-
-with log.waitfor('Parsing list') as l:
-    liste = soup.select('#liste a')
-    for a in liste:
-        href = a.get('href')
-        if not href or href[0] != '/':
-            continue
-        m = re.match('More (.+) user agents strings -->>', a.string)
-        if m:
-            target = m.group(1)
-            with log.waitfor('Fetching additional user agents for %s' % target) as l:
-                html = getxml('http://www.useragentstring.com' + href)
-                soup = BeautifulSoup(html)
-                subliste = soup.select('#liste a')
-                for a in subliste:
-                    ua = a.string.strip()
-                    try:
-                        ua = ua.decode('utf-8')
-                    except UnicodeEncodeError:
-                        continue
-                    uas.add(ua)
-                l.success()
-        else:
-            uas.add(a.string.strip())
-    l.success()
-
 with log.waitfor('Fetching from from http://techpatterns.com') as l:
    xml = getxml('http://techpatterns.com/downloads/firefox/useragentswitcher.xml')
-    soup = BeautifulSoup(xml)
+    soup = BeautifulSoup(xml, 'html.parser')
    l.success()

 def loop(xml):
@@ -67,16 +34,16 @@ def loop(xml):
            uas.add(item['useragent'].strip())

 with log.waitfor('Parsing list') as l:
-    loop(soup.body.useragentswitcher)
+    loop(soup.useragentswitcher)
    l.success()

 with log.waitfor('Fetching from from http://www.user-agents.org') as l:
    xml = getxml('http://www.user-agents.org/allagents.xml')
-    soup = BeautifulSoup(xml)
+    soup = BeautifulSoup(xml, 'html.parser')
    l.success()

 with log.waitfor('Parsing list') as l:
-    for item in soup.body.__getattr__('user-agents'):
+    for item in soup.__getattr__('user-agents'):
        if item.name == 'user-agent':
            ua = item.select('string')[0].string.strip()
            try:
@@ -8211,6 +8211,7 @@ Mozilla/5.0 (BlackBerry; U; BlackBerry 9850; en-US) AppleWebKit/534.11+ (KHTML,
 Mozilla/5.0 (BlackBerry; U; BlackBerry 9850; en-US) AppleWebKit/534.11+ (KHTML, like Gecko) Version/7.0.0.254 Mobile Safari/534.11+
 Mozilla/5.0 (BlackBerry; U; BlackBerry 9860; en-US) AppleWebKit/534.11+ (KHTML, like Gecko) Version/7.0.0.254 Mobile Safari/534.11+
 Mozilla/5.0 (BlackBerry; U; BlackBerry 9900; en) AppleWebKit/534.11+ (KHTML, like Gecko) Version/7.1.0.346 Mobile Safari/534.11+
+Mozilla/5.0 (BlackBerry; U; BlackBerry 9930; en-US) AppleWebKit/534.11+ (KHTML, like Gecko) Version/7.1.0.267 Mobile Safari/534.11+
 Mozilla/5.0 (Clustered-Search-Bot/1.0; [email protected]; http://www.clush.com/)
 Mozilla/5.0 (Darwin; FreeBSD 5.6; en-GB; rv:1.8.1.17pre) Gecko/20080716 K-Meleon/1.5.0
 Mozilla/5.0 (Darwin; FreeBSD 5.6; en-GB; rv:1.9.1b3pre)Gecko/20081211 K-Meleon/1.5.2
@@ -8244,13 +8245,26 @@ Mozilla/5.0 (Linux; Android 4.4.4; XT1032 Build/KXB21.14-L1.61) AppleWebKit/537.
 Mozilla/5.0 (Linux; Android 4.4; Nexus 5 Build/BuildID) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Mobile Safari/537.36
 Mozilla/5.0 (Linux; Android 5.0.1; SCH-R970 Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.84 Mobile Safari/537.36
 Mozilla/5.0 (Linux; Android 5.0.2; SAMSUNG SM-T530NU Build/LRX22G) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/3.2 Chrome/38.0.2125.102 Safari/537.36
+Mozilla/5.0 (Linux; Android 5.1.1; Coolpad 3622A Build/LMY47V) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.83 Mobile Safari/537.36
 Mozilla/5.0 (Linux; Android 5.1.1; Nexus 7 Build/LMY47V) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.78 Safari/537.36 OPR/30.0.1856.93524
 Mozilla/5.0 (Linux; Android 5.1; C6740N Build/LMY47O) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.111 Mobile Safari/537.36
 Mozilla/5.0 (Linux; Android 6.0.1; SM-G900H Build/MMB29K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.98 Mobile Safari/537.36
+Mozilla/5.0 (Linux; Android 6.0; ALE-L21 Build/HuaweiALE-L21) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
 Mozilla/5.0 (Linux; Android 6.0; HTC One M9 Build/MRA58K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.98 Mobile Safari/537.36
 Mozilla/5.0 (Linux; Android 6.0; LG-D850 Build/MRA58K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.97 Mobile Safari/537.36
 Mozilla/5.0 (Linux; Android 6.0; Nexus 5X Build/MDB08L) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.124 Mobile Safari/537.36
+Mozilla/5.0 (Linux; Android 7.0; LG-H918 Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Mobile Safari/537.36
+Mozilla/5.0 (Linux; Android 7.0; LGL84VL Build/NRD90U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36
+Mozilla/5.0 (Linux; Android 7.0; LGUS997 Build/NRD90U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36
+Mozilla/5.0 (Linux; Android 7.0; Moto G (5) Plus Build/NPNS25.137-35-5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.107 Mobile Safari/537.36
 Mozilla/5.0 (Linux; Android 7.0; Nexus 9 Build/NRD90R) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.124 Safari/537.36
+Mozilla/5.0 (Linux; Android 7.0; SAMSUNG SM-G925R6 Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/5.4 Chrome/51.0.2704.106 Mobile Safari/537.36
+Mozilla/5.0 (Linux; Android 7.1.1; BBB100-1 Build/NMF26F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36
+Mozilla/5.0 (Linux; Android 7.1.1; Coolpad 3632A Build/NMF26F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36
+Mozilla/5.0 (Linux; Android 7.1.1; XT1710-02 Build/NDS26.74-36) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36
+Mozilla/5.0 (Linux; Android 7.1.2; Nexus 6P Build/N2G48C) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.107 Mobile Safari/537.36
+Mozilla/5.0 (Linux; Android 7.1.2; Pixel Build/NHG47N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.83 Mobile Safari/537.36
+Mozilla/5.0 (Linux; Android 8.0.0; Pixel XL Build/OPR6.170623.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.107 Mobile Safari/537.36
 Mozilla/5.0 (Linux; U) Opera 6.02  [en]
 Mozilla/5.0 (Linux; U; Android 0.5; en-us) AppleWebKit/522  (KHTML, like Gecko) Safari/419.3
 Mozilla/5.0 (Linux; U; Android 1.0; en-us; dream) AppleWebKit/525.10  (KHTML, like Gecko) Version/3.0.4 Mobile Safari/523.12.2
@@ -8369,6 +8383,7 @@ Mozilla/5.0 (Macintosh; I; Intel Mac OS X 11_7_9; de-LI; rv:1.9b4) Gecko/2012010
 Mozilla/5.0 (Macintosh; I; PPC Mac OS X Mach-O; en-US; rv:1.9a1) Gecko/20061204 Firefox/3.0a1
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:49.0) Gecko/20100101 Firefox/49.0
+Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:55.0) Gecko/20100101 Firefox/55.0
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.5; rv:10.0.1) Gecko/20100101 Firefox/10.0.1 SeaMonkey/2.7.1
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.5; rv:5.0) Gecko/20100101 Firefox/5.0
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:15.0) Gecko/20120909 Firefox/15.0.1 SeaMonkey/2.12.1
@@ -8405,17 +8420,20 @@ Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.1 Safari/537.36
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
+Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.1.25 (KHTML, like Gecko)
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 Safari/537.36 OPR/28.0.1750.51
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.82 Safari/537.36 OPR/29.0.1795.41
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.105 Safari/537.36 Vivaldi/1.0.162.9
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2859.0 Safari/537.36
+Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.49 Safari/537.36
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/600.8.9 (KHTML, like Gecko) Maxthon/4.5.2
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/600.8.9 (KHTML, like Gecko) Version/8.0.8 Safari/600.8.9
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/10.0 Safari/602.1.50
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/601.1.56 (KHTML, like Gecko) Version/9.0 Safari/601.1.56
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.84 Safari/537.36
+Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.8 (KHTML, like Gecko) Version/10.1 Safari/603.1.30
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_5_8) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_5_8) AppleWebKit/534.31 (KHTML, like Gecko) Chrome/13.0.748.0 Safari/534.31
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_5_8) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.801.0 Safari/535.1
@@ -10005,6 +10023,8 @@ Mozilla/5.0 (OS/2; Warp 4.5; rv:31.0) Gecko/20100101 Firefox/31.0
 Mozilla/5.0 (OS/2; Warp 4.5; rv:31.0) Gecko/20100101 Firefox/31.0 SeaMonkey/2.28
 Mozilla/5.0 (OS/2; Warp 4.5; rv:38.0) Gecko/20100101 Firefox/38.0
 Mozilla/5.0 (OS/2; Warp 4.5; rv:38.0) Gecko/20100101 Firefox/38.0 SeaMonkey/2.35
+Mozilla/5.0 (OS/2; Warp 4.5; rv:45.0) Gecko/20100101 Firefox/45.0
+Mozilla/5.0 (OS/2; Warp 4.5; rv:45.0) Gecko/20100101 Firefox/45.0 SeaMonkey/2.42.9esr
 Mozilla/5.0 (PLAYSTATION 3; 1.0)
 Mozilla/5.0 (PLAYSTATION 3; 1.00)
 Mozilla/5.0 (PLAYSTATION 3; 1.10)
@@ -10018,6 +10038,7 @@ Mozilla/5.0 (PlayBook; U; RIM Tablet OS 2.1.0; en-US) AppleWebKit/536.2+ (KHTML
 Mozilla/5.0 (S60; SymbOS; Opera Mobi/1181; U; en-GB; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.1
 Mozilla/5.0 (S60; SymbOS; Opera Mobi/1209; U; it; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.1
 Mozilla/5.0 (S60; SymbOS; Opera Mobi/SYB-1103211396; U; es-LA; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 11.00
+Mozilla/5.0 (SMART-TV; X11; Linux armv7l) AppleWebkit/537.42 (KHTML, like Gecko) Chromium/25.0.1349.2 Chrome/25.0.1349.2 Safari/537.42
 Mozilla/5.0 (Sage)
 Mozilla/5.0 (Slurp/cat; [email protected]; http://www.inktomi.com/slurp.html)
 Mozilla/5.0 (Slurp/si; [email protected]; http://www.inktomi.com/slurp.html)
@@ -10072,18 +10093,27 @@ Mozilla/5.0 (Windows ME; U) Opera 6.05  [de]
 Mozilla/5.0 (Windows ME; U; en) Opera 8.51
 Mozilla/5.0 (Windows ME; U; en; rv:1.8.1) Gecko/20061208 Firefox/2.0.0 Opera 9.63
 Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240
+Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
+Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.91 Safari/537.36 Vivaldi/1.92.917.39
 Mozilla/5.0 (Windows NT 10.0; ARM; Lumia 950 Dual SIM) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36 Edge/14.14393
 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.93 Safari/537.36
 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 UBrowser/5.6.13705.206 Safari/537.36
 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36 OPR/36.0.2130.46
 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.90 Safari/537.36 Vivaldi/1.4.589.11
+Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 AOL/11.0 AOLBUILD/11.0.1305 Safari/537.36
+Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.78 Safari/537.36 OPR/47.0.2631.55
+Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Maxthon/5.0.4.3000 Chrome/47.0.2526.73 Safari/537.36
 Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; MATBJS; rv:11.0) like Gecko
+Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; Touch; MALNJS; rv:11.0) like Gecko
 Mozilla/5.0 (Windows NT 10.0; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
 Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Edge/12.0
 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2869.0 Safari/537.36
+Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3191.0 Safari/537.36
 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0
+Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
+Mozilla/5.0 (Windows NT 10.0; rv:45.9) Gecko/20100101 Goanna/3.2 Firefox/45.9 PaleMoon/27.4.0
 Mozilla/5.0 (Windows NT 4.0; U) Opera 6.05  [en]
 Mozilla/5.0 (Windows NT 4.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
 Mozilla/5.0 (Windows NT 5.0) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1150.1  Iron/20.0.1150.1 Safari/536.11
@@ -10145,6 +10175,8 @@ Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.
 Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.3319.102 Safari/537.36
 Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
 Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2224.3 Safari/537.36
+Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 YaBrowser/17.3.0.1785 Yowser/2.5 Safari/537.36
+Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) MxBrowser/4.5.10.7000 Chrome/30.0.1551.0 Safari/537.36
 Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.4 (KHTML, like Gecko) Chrome/22.0.1250.0 Iron/22.0.2150.0 Safari/537.4
 Mozilla/5.0 (Windows NT 5.1) Gecko/20100101 Firefox/14.0 Opera/12.0
 Mozilla/5.0 (Windows NT 5.1; U) Opera 7.03  [de]
@@ -15192,6 +15224,7 @@ Mozilla/5.0 (X11; ; Linux i686; en-US; rv:1.8.1.3) Gecko
 Mozilla/5.0 (X11; ; Linux i686; rv:1.9.2.20) Gecko/20110805
 Mozilla/5.0 (X11; ; Linux x86_64; rv:1.8.1.6) Gecko/20070802 Firefox
 Mozilla/5.0 (X11; Arch Linux i686; rv:2.0) Gecko/20110321 Firefox/4.0
+Mozilla/5.0 (X11; CentOS; Linux x86_64; rv:36.0) Gecko/20100101 Firefox/36.0
 Mozilla/5.0 (X11; CrOS i686 0.13.507) AppleWebKit/534.35 (KHTML, like Gecko) Chrome/13.0.763.0 Safari/534.35
 Mozilla/5.0 (X11; CrOS i686 0.13.587) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.14 Safari/535.1
 Mozilla/5.0 (X11; CrOS i686 1193.158.0) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.75 Safari/535.7
@@ -15205,6 +15238,7 @@ Mozilla/5.0 (X11; CrOS i686 3912.101.0) AppleWebKit/537.36 (KHTML, like Gecko) C
 Mozilla/5.0 (X11; CrOS i686 4319.74.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.57 Safari/537.36
 Mozilla/5.0 (X11; CrOS x86_64 5841.83.0) AppleWebKit/537.36 (KHTML like Gecko) Chrome/36.0.1985.138 Safari/537.36
 Mozilla/5.0 (X11; Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
+Mozilla/5.0 (X11; Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3178.0 Safari/537.36
 Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:49.0) Gecko/20100101 Firefox/49.0
 Mozilla/5.0 (X11; FreeBSD 7.1-RELEASE i386; U; en; rv:1.8.1) Gecko/20061208 Firefox/2.0.0 Opera 9.63
 Mozilla/5.0 (X11; FreeBSD amd64) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.65 Safari/535.11
@@ -15215,6 +15249,7 @@ Mozilla/5.0 (X11; FreeBSD amd64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/3
 Mozilla/5.0 (X11; FreeBSD amd64) AppleWebKit/537.4 (KHTML like Gecko) Chrome/22.0.1229.79 Safari/537.4
 Mozilla/5.0 (X11; FreeBSD amd64; rv:27.0) Gecko/20100101 Firefox/27.0 SeaMonkey/2.24
 Mozilla/5.0 (X11; FreeBSD amd64; rv:5.0) Gecko/20100101 Firefox/5.0
+Mozilla/5.0 (X11; FreeBSD amd64; rv:54.0) Gecko/20100101 Firefox/54.0
 Mozilla/5.0 (X11; FreeBSD amd64; rv:6.0) Gecko/20110818 Firefox/6.0 SeaMonkey/2.3
 Mozilla/5.0 (X11; FreeBSD i386) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.121 Safari/535.2
 Mozilla/5.0 (X11; FreeBSD i386; rv:28.0) Gecko/20100101 Firefox/28.0 SeaMonkey/2.25
@@ -15239,6 +15274,7 @@ Mozilla/5.0 (X11; Linux armv7l; rv:2.0b4pre) Gecko/20100818 Firefox/4.0b4pre Fen
 Mozilla/5.0 (X11; Linux i386; U) Opera 7.60  [en-GB]
 Mozilla/5.0 (X11; Linux i586; rv:31.0) Gecko/20100101 Firefox/31.0
 Mozilla/5.0 (X11; Linux i686 (x86_64)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
+Mozilla/5.0 (X11; Linux i686 (x86_64)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3187.0 Safari/537.366
 Mozilla/5.0 (X11; Linux i686 on x86_64; rv:10.0.6) Gecko/20100101 Firefox/10.0.6 Iceweasel/10.0.6
 Mozilla/5.0 (X11; Linux i686 on x86_64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
 Mozilla/5.0 (X11; Linux i686 on x86_64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1 Fennec/2.0.1
@@ -15284,6 +15320,7 @@ Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0
 Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2166.2 Safari/537.36
 Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.101 Safari/537.36 OPR/40.0.2308.62
 Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/51.0.2704.79 Chrome/51.0.2704.79 Safari/537.36
+Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/60.0.3112.78 Chrome/60.0.3112.78 Safari/537.36
 Mozilla/5.0 (X11; Linux i686) AppleWebKit/538.1 (KHTML, like Gecko) QupZilla/1.8.6 Safari/538.1
 Mozilla/5.0 (X11; Linux i686; Debian Testing; rv:7.0.1) Gecko/20100101 Firefox/7.0.1 Iceweasel/7.0.1
 Mozilla/5.0 (X11; Linux i686; U) Opera 7.54  [en]
@@ -15387,6 +15424,7 @@ Mozilla/5.0 (X11; Linux i686; rv:40.0) Gecko/20100101 Firefox/40.0
 Mozilla/5.0 (X11; Linux i686; rv:43.0) Gecko/20100101 Firefox/43.0
 Mozilla/5.0 (X11; Linux i686; rv:46.0) Gecko/20100101 Firefox/46.0
 Mozilla/5.0 (X11; Linux i686; rv:49.0) Gecko/20100101 Firefox/49.0
+Mozilla/5.0 (X11; Linux i686; rv:49.0) Gecko/20100101 Firefox/49.0 SeaMonkey/2.46
 Mozilla/5.0 (X11; Linux i686; rv:5.0) Gecko/20100101 Firefox/5.0
 Mozilla/5.0 (X11; Linux i686; rv:5.0) Gecko/20100101 Firefox/5.0 Iceweasel/5.0
 Mozilla/5.0 (X11; Linux i686; rv:6.0) Gecko/20100101 Firefox/6.0
@@ -15453,6 +15491,7 @@ Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55
 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/33.0.1750.152 Chrome/33.0.1750.152 Safari/537.36
 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.4 (KHTML like Gecko) Chrome/22.0.1229.56 Safari/537.4
 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/538.1 (KHTML, like Gecko) QupZilla/1.9.0 Safari/538.1
+Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/604.1 (KHTML, like Gecko) Version/11.0 Safari/604.1 Ubuntu/17.04 (3.24.1-0ubuntu1) Epiphany/3.24.1
 Mozilla/5.0 (X11; Linux x86_64) Gecko Firefox/5.0
 Mozilla/5.0 (X11; Linux x86_64; U; de; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.62
 Mozilla/5.0 (X11; Linux x86_64; U; en; rv:1.8.1) Gecko/20061208 Firefox/2.0.0
@@ -15516,6 +15555,7 @@ Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0 Iceweasel/3
 Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 Firefox/5.0 FirePHP/0.5
 Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 Firefox/5.0 Firefox/5.0
 Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 Firefox/5.0 Iceweasel/5.0
+Mozilla/5.0 (X11; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0
 Mozilla/5.0 (X11; Linux x86_64; rv:6.0.1) Gecko/20110831 conkeror/0.9.3
 Mozilla/5.0 (X11; Linux x86_64; rv:7.0.1) Gecko/20100101 Firefox/7.0.1 Iceweasel/7.0.1 Debian
 Mozilla/5.0 (X11; Linux x86_64; rv:7.0a1) Gecko/20110602 Firefox/7.0a1 SeaMonkey/2.2a1pre Lightning/1.1a1pre
@@ -18563,6 +18603,7 @@ Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:21.0) Gecko/20130331 Firefox/21.0
 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:24.0) Gecko/20100101 Firefox/24.0
 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:35.0) Gecko/20100101 Firefox/35.0
 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:49.0) Gecko/20100101 Firefox/49.0
+Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0
 Mozilla/5.0 (X11; debian; Linux x86_64; rv:15.0) Gecko/20100101 Iceweasel/15.0
 Mozilla/5.0 (X11;U; Linux i686; en-GB; rv:1.9.1) Gecko/20090624 Ubuntu/9.04 (jaunty) Firefox/3.5
 Mozilla/5.0 (X11;U;Linux i686;en-US;rv:1.8.1) Gecko/2006101022 Firefox/2.0
@@ -19300,15 +19341,19 @@ Mozilla/5.0 (compatible; Yahoo! Slurp China; http://misc.yahoo.com.cn/help.html)
 Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
 Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)
 Mozilla/5.0 (compatible; YandexImages/3.0; +http://yandex.com/bots)
+Mozilla/5.0 (compatible; YandexNews/4.0; +http://yandex.com/bots)
 Mozilla/5.0 (compatible; YesupBot/1.0; +http://www.yesup.net/bot.html)
 Mozilla/5.0 (compatible; YodaoBot/1.0; http://www.yodao.com/help/webmaster/spider/; )
 Mozilla/5.0 (compatible; Yoono; http://www.yoono.com/)
 Mozilla/5.0 (compatible; YoudaoBot/1.0; http://www.youdao.com/help/webmaster/spider/; )
 Mozilla/5.0 (compatible; Zenbot/1.3; +http://zen.co.za/webmasters/)
 Mozilla/5.0 (compatible; aiHitBot/1.0; +http://www.aihit.com/)
+Mozilla/5.0 (compatible; alexa site audit/1.0; +http://www.alexa.com/help/webmasters; )
+Mozilla/5.0 (compatible; archive.org_bot +http://www.archive.org/details/archive.org_bot)
 Mozilla/5.0 (compatible; archive.org_bot/1.10.0 +http://www.loc.gov/minerva/crawl.html)
 Mozilla/5.0 (compatible; archive.org_bot/1.13.1x http://crawler.archive.org)
 Mozilla/5.0 (compatible; archive.org_bot/1.5.0-200506132127 http://crawler.archive.org) Hurricane Katrina
+Mozilla/5.0 (compatible; archive.org_bot; Wayback Machine Live Record; +http://archive.org/details/archive.org_bot)
 Mozilla/5.0 (compatible; bingbot/2.0  http://www.bing.com/bingbot.htm)
 Mozilla/5.0 (compatible; bingbot/2.0 +http://www.bing.com/bingbot.htm)
 Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)
@@ -19352,6 +19397,7 @@ Mozilla/5.0 (en-US;rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2
 Mozilla/5.0 (en-us) AppleWebKit/525.13 (KHTML, like Gecko; Google Web Preview) Version/3.1 Safari/525.13
 Mozilla/5.0 (hp-tablet; Linux; hpwOS/3.0.2; U; de-DE) AppleWebKit/534.6 (KHTML, like Gecko) wOSBrowser/234.40.1 Safari/534.6 TouchPad/1.0
 Mozilla/5.0 (iPad; CPU OS 10_0 like Mac OS X) AppleWebKit/601.1 (KHTML, like Gecko) CriOS/49.0.2623.109 Mobile/14A5335b Safari/601.1.46
+Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A5362a Safari/604.1
 Mozilla/5.0 (iPad; CPU OS 5_0_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Mobile/9B176
 Mozilla/5.0 (iPad; CPU OS 5_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko ) Version/5.1 Mobile/9B176 Safari/7534.48.3
 Mozilla/5.0 (iPad; CPU OS 5_1_1 like Mac OS X; ru-ru) AppleWebKit/534.46.0 (KHTML, like Gecko) CriOS/21.0.1180.80 Mobile/9B206 Safari/7534.48.3
@@ -19390,6 +19436,8 @@ Mozilla/5.0 (iPhone Simulator; U; CPU iPhone OS 3_2 like Mac OS X; en-us) AppleW
 Mozilla/5.0 (iPhone; CPU  iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16
 Mozilla/5.0 (iPhone; CPU iPhone OS 10_0 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/18.0.130791545 Mobile/14A5345a Safari/600.1.4
 Mozilla/5.0 (iPhone; CPU iPhone OS 10_0 like Mac OS X) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/10.0 Mobile/14A346 Safari/602.1
+Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Version/9.0 Mobile/13B143 Safari/601.1
+Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A5362a Safari/604.1
 Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A403 Safari/8536.25
 Mozilla/5.0 (iPhone; CPU iPhone OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53
 Mozilla/5.0 (iPhone; CPU iPhone OS 8_3 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12F70 Safari/600.1.4
@@ -20490,6 +20538,7 @@ Opera/9.80 (Android; Opera Mini/7.29530/27.1407; U; en) Presto/2.8.119 Version/1
 Opera/9.80 (Android; Opera Mini/7.5.33361/31.1350; U; en) Presto/2.8.119 Version/11.10
 Opera/9.80 (Android; Opera Mini/7.5.33361/31.1543; U; en) Presto/2.8.119 Version/11.1010
 Opera/9.80 (Android; Opera Mini/7.6.35766/35.5706; U; en) Presto/2.8.119 Version/11.10
+Opera/9.80 (Android; Opera Mini/9.0.1829/66.318; U; en) Presto/2.12.423 Version/12.16
 Opera/9.80 (Android;Opera Mini/6.0.24212/24.746 U;en) Presto/2.5.25 Version/10.5454
 Opera/9.80 (BlackBerry; Opera Mini/5.1.22303/22.387; U; en) Presto/2.5.25 Version/10.54
 Opera/9.80 (BlackBerry; Opera Mini/6.24209/27.1366; U; en) Presto/2.8.119 Version/11.10
@@ -21055,6 +21104,7 @@ Scooter_trk3-3.0.3
 Scope (Mars+)
 ScoutAbout
 ScoutAnt/0.1; +http://www.ant.com/what_is_ant.com/
+Screaming Frog SEO Spider/8.1
 Scrubby/2.1 (http://www.scrubtheweb.com/)
 Scrubby/2.2 (http://www.scrubtheweb.com/)
 Scrubby/2.x (http://www.scrubtheweb.com/)
@@ -21311,6 +21361,7 @@ Trampelpfad-Spider-v0.1
 TulipChain/5.x (http://ostermiller.org/tulipchain/) Java/1.x.1_0x (http://java.sun.com/) Linux/2.4.17
 TulipChain/5.xx (http://ostermiller.org/tulipchain/) Java/1.x.1_0x (http://apple.com/) Mac_OS_X/10.2.8
 Tumblr/1.0 RSS syndication (+http://www.tumblr.com/) ([email protected])
+TurnitinBot (https://turnitin.com/robot/crawlerinfo.html)
 TurnitinBot/1.5 (http://www.turnitin.com/robot/crawlerinfo.html)
 TurnitinBot/1.5 http://www.turnitin.com/robot/crawlerinfo.html
 TurnitinBot/2.0 http://www.turnitin.com/robot/crawlerinfo.html
@@ -21323,6 +21374,7 @@ TwengaBot
 Twiceler www.cuill.com/robots.html
 Twiceler-0.9 http://www.cuill.com/twiceler/robot.html
 Twisted PageGetter
+Twitterbot/1.0
 Twitturly / v0.x
 Twotrees Reactive Filter V2.0
 Tycoon Agent/Nutch-1.0-dev
@@ -21584,6 +21636,7 @@ Xenu Link Sleuth 1.2h
 Xenu Link Sleuth 1.2i
 Xenu Link Sleuth 1.xx
 Xenu Link Sleuth/1.3.7
+Xenu Link Sleuth/1.3.8
 Xenu's Link Sleuth 1.x[a-z]
 Xerka WebBot v1.0.0 [UPVOpenDir]
 Xylix
@@ -15,7 +15,7 @@ Example
    # leaks at least one byte at that address.
    def leak(address):
        data = p.read(address, 4)
-        log.debug("%#x => %s" % (address, (data or '').encode('hex')))
+        log.debug("%#x => %s" % (address, enhex(data or '')))
        return data

    # For the sake of this example, let's say that we
@@ -48,6 +48,7 @@ Example
 DynELF
 """
 from __future__ import absolute_import
+from __future__ import division

 import ctypes

@@ -447,7 +448,7 @@ class DynELF(object):
            if debug:
                w.status("r_debug.linkmap")
                linkmap = self.leak.field(debug, r_debug.r_map)
-                w.status("r_debug.linkmap %#x" % result)
+                w.status("r_debug.linkmap %#x" % linkmap)

        if not linkmap:
            w.failure("Could not find DT_PLTGOT or DT_DEBUG")
@@ -703,12 +704,14 @@ class DynELF(object):
            "A hash table of Elf32_Word objects supports symbol table access", or see:
            https://docs.oracle.com/cd/E19504-01/802-6319/6ia12qkfo/index.html#chapter6-48031

-            struct Elf_Hash {
-                uint32_t nbucket;
-                uint32_t nchain;
-                uint32_t bucket[nbucket];
-                uint32_t chain[nchain];
-            }
+            .. code-block:: c
+
+                struct Elf_Hash {
+                    uint32_t nbucket;
+                    uint32_t nchain;
+                    uint32_t bucket[nbucket];
+                    uint32_t chain[nchain];
+                }

            You can force an ELF to use this type of symbol table by compiling
            with 'gcc -Wl,--hash-style=sysv'
@@ -782,7 +785,7 @@ class DynELF(object):
        maskwords = leak.field(hshtab, elf.GNU_HASH.maskwords)

        # Skip over the bloom filter to get to the buckets
-        elfword = self.elfclass / 8
+        elfword = self.elfclass // 8
        buckets = hshtab + sizeof(elf.GNU_HASH) + (elfword * maskwords)

        # The chains come after the buckets
@@ -852,7 +855,7 @@ class DynELF(object):
        for offset in libcdb.get_build_id_offsets():
            address = libbase + offset
            if self.leak.compare(address + 0xC, "GNU\x00"):
-                return enhex(''.join(self.leak.raw(address + 0x10, 20)))
+                return enhex(b''.join(self.leak.raw(address + 0x10, 20)))
            else:
                self.status("Magic did not match")
                pass
@@ -910,3 +913,65 @@ class DynELF(object):
        self.success('*curbrk: %#x' % brk)

        return brk
+
+    def _find_mapped_pages(self, readonly = False, page_size = 0x1000):
+        """
+        A generator of all mapped pages, as found using the Program Headers.
+
+        Yields tuples of the form: (virtual address, memory size)
+        """
+        leak  = self.leak
+        base  = self.libbase
+
+        Ehdr  = {32: elf.Elf32_Ehdr, 64: elf.Elf64_Ehdr}[self.elfclass]
+        Phdr  = {32: elf.Elf32_Phdr, 64: elf.Elf64_Phdr}[self.elfclass]
+
+        phead = base + leak.field(base, Ehdr.e_phoff)
+        phnum = leak.field(base, Ehdr.e_phnum)
+
+        for i in range(phnum):
+            if leak.field_compare(phead, Phdr.p_type, constants.PT_LOAD) :
+                # the interesting pages are those that are aligned to PAGE_SIZE
+                if leak.field_compare(phead, Phdr.p_align, page_size) and \
+                    (readonly or leak.field(phead, Phdr.p_flags) & 0x02 != 0):
+                    vaddr = leak.field(phead, Phdr.p_vaddr)
+                    memsz = leak.field(phead, Phdr.p_memsz)
+                    # fix relative offsets
+                    if vaddr < base :
+                        vaddr += base
+                    yield vaddr, memsz
+            phead += sizeof(Phdr)
+
+    def dump(self, libs = False, readonly = False):
+        """dump(libs = False, readonly = False)
+
+        Dumps the ELF's memory pages to allow further analysis.
+
+        Arguments:
+            libs(bool, optional): True if should dump the libraries too (False by default)
+            readonly(bool, optional): True if should dump read-only pages (False by default)
+
+        Returns:
+            a dictionary of the form: { address : bytes }
+        """
+        leak      = self.leak
+        page_size = 0x1000
+        pages     = {}
+
+        for vaddr, memsz in self._find_mapped_pages(readonly, page_size) :
+            offset    = vaddr % page_size
+            if offset != 0 :
+                memsz += offset
+                vaddr -= offset
+            memsz += (page_size - (memsz % page_size)) % page_size
+            pages[vaddr] = leak.n(vaddr, memsz)
+
+        if libs :
+            for lib_name in self.bases() :
+                if len(lib_name) == 0 :
+                    continue
+                dyn_lib = self._dynamic_load_dynelf(lib_name)
+                if dyn_lib is not None :
+                    pages.update(dyn_lib.dump(readonly = readonly))
+
+        return pages
@@ -10,6 +10,7 @@ from pwnlib.elf.corefile import Core
 from pwnlib.elf.datatypes import *
 from pwnlib.elf.elf import ELF
 from pwnlib.elf.elf import load
+from pwnlib.elf import maps
 from pwnlib.elf import plt

 __all__ = ['load', 'ELF', 'Core'] + sorted(filter(lambda x: not x.startswith('_'), datatypes.__dict__.keys()))
@@ -1,7 +1,7 @@
 """
 Kernel-specific ELF functionality
 """
-
+from __future__ import division

 class KernelConfig(object):
    def __init__(self, name, title, requires=[], excludes=[], minver=0, maxver=99):
@@ -150,9 +150,9 @@ kernel_configuration = [
    Disabled('SCSI_CONSTANTS'),
    Disabled('SCSI_LOGGING'),
    Disabled('SCSI_SCAN_ASYNC'),
-    Disabled('CONFIG_MEDIA_RADIO_SUPPORT'),
-    Disabled('CONFIG_PFT'),
-    Disabled('CONFIG_SYSVIPC'),
+    Disabled('MEDIA_RADIO_SUPPORT'),
+    Disabled('PFT'),
+    Disabled('SYSVIPC'),


    # Permits reloading the kernel from disk
@@ -166,7 +166,7 @@ kernel_configuration = [
    Enabled('HIGHMEM64G', requires=['X86_32']),
    Enabled('X86_PAE', requires=['X86_32']),
    Disabled('LEGACY_VSYSCALL_NONE', requires=['X86_32', 'X86_64'], minver=4.4),
-    Disabled('CONFIG_IA32_EMULATION'),
+    Disabled('IA32_EMULATION'),
    Disabled('X86_X32'),
    Disabled('MODIFY_LDT_SYSCALL'),
    Minimum('DEFAULT_MMAP_MIN_ADDR', 65536, requires=['X86_32', 'X86_64']),
@@ -181,7 +181,7 @@ kernel_configuration = [
    Minimum('ARCH_MMAP_RND_BITS', 24, requires=['ARM64']),
    Minimum('ARCH_MMAP_RND_COMPAT_BITS', 16, requires=['ARM64']),
    Enabled('CPU_SW_DOMAIN_PAN', requires=['ARM'], minver=4.3),
-    Enabled('CONFIG_ARM64_PAN', requires=['ARM64'], minver=4.3),
+    Enabled('ARM64_PAN', requires=['ARM64'], minver=4.3),
    Disabled('OABI_COMPAT'),
    Disabled('CP_ACCESS', requires=['ARM']),
    Disabled('CP_ACCESS64', requires=['ARM64']),
@@ -52,8 +52,8 @@ dump to extract the relevant information.

    # Get a shell!
    io = process(['./crash', payload])
-    io.sendline('id')
-    print io.recvline()
+    io.sendline(b'id')
+    print(io.recvline())
    # uid=1000(user) gid=1000(user) groups=1000(user)

 Module Members
@@ -61,6 +61,7 @@ Module Members

 """
 from __future__ import absolute_import
+from __future__ import division

 import collections
 import ctypes
@@ -69,9 +70,11 @@ import gzip
 import re
 import os
 import socket
-import StringIO
+import subprocess
 import tempfile

+from io import BytesIO, StringIO
+
 import elftools
 from elftools.common.py3compat import bytes2str
 from elftools.common.utils import roundup
@@ -87,6 +90,7 @@ from pwnlib.tubes.process import process
 from pwnlib.tubes.ssh import ssh_channel
 from pwnlib.tubes.tube import tube
 from pwnlib.util.fiddling import b64d
+from pwnlib.util.fiddling import enhex
 from pwnlib.util.fiddling import unhex
 from pwnlib.util.misc import read
 from pwnlib.util.misc import write
@@ -143,7 +147,7 @@ def iter_notes(self):
 class Mapping(object):
    """Encapsulates information about a memory mapping in a :class:`Corefile`.
    """
-    def __init__(self, core, name, start, stop, flags):
+    def __init__(self, core, name, start, stop, flags, page_offset):
        self._core=core

        #: :class:`str`: Name of the mapping, e.g. ``'/bin/bash'`` or ``'[vdso]'``.
@@ -158,6 +162,9 @@ class Mapping(object):
        #: :class:`int`: Size of the mapping, in bytes
        self.size = stop-start

+        #: :class:`int`: Offset in pages in the mapped file
+        self.page_offset = page_offset or 0
+
        #: :class:`int`: Mapping flags, using e.g. ``PROT_READ`` and so on.
        self.flags = flags

@@ -183,12 +190,13 @@ class Mapping(object):
        return '%x-%x %s %x %s' % (self.start,self.stop,self.permstr,self.size,self.name)

    def __repr__(self):
-        return '%s(%r, start=%#x, stop=%#x, size=%#x, flags=%#x)' \
+        return '%s(%r, start=%#x, stop=%#x, size=%#x, flags=%#x, page_offset=%#x)' \
            % (self.__class__.__name__,
               self.name,
               self.start,
               self.stop,
               self.size,
+               self.page_offset,
               self.flags)

    def __int__(self):
@@ -223,6 +231,8 @@ class Mapping(object):
        return self._core.read(item, 1)

    def __contains__(self, item):
+        if isinstance(item, Mapping):
+            return (self.start <= item.start) and (item.stop <= self.stop)
        return self.start <= item < self.stop

    def find(self, sub, start=None, end=None):
@@ -294,21 +304,21 @@ class Corefile(ELF):
    ::

        >>> Corefile('./core').mappings
-        [Mapping('/home/user/pwntools/crash', start=0x8048000, stop=0x8049000, size=0x1000, flags=0x5),
-         Mapping('/home/user/pwntools/crash', start=0x8049000, stop=0x804a000, size=0x1000, flags=0x4),
-         Mapping('/home/user/pwntools/crash', start=0x804a000, stop=0x804b000, size=0x1000, flags=0x6),
-         Mapping(None, start=0xf7528000, stop=0xf7529000, size=0x1000, flags=0x6),
-         Mapping('/lib/i386-linux-gnu/libc-2.19.so', start=0xf7529000, stop=0xf76d1000, size=0x1a8000, flags=0x5),
-         Mapping('/lib/i386-linux-gnu/libc-2.19.so', start=0xf76d1000, stop=0xf76d2000, size=0x1000, flags=0x0),
-         Mapping('/lib/i386-linux-gnu/libc-2.19.so', start=0xf76d2000, stop=0xf76d4000, size=0x2000, flags=0x4),
-         Mapping('/lib/i386-linux-gnu/libc-2.19.so', start=0xf76d4000, stop=0xf76d5000, size=0x1000, flags=0x6),
-         Mapping(None, start=0xf76d5000, stop=0xf76d8000, size=0x3000, flags=0x6),
-         Mapping(None, start=0xf76ef000, stop=0xf76f1000, size=0x2000, flags=0x6),
-         Mapping('[vdso]', start=0xf76f1000, stop=0xf76f2000, size=0x1000, flags=0x5),
-         Mapping('/lib/i386-linux-gnu/ld-2.19.so', start=0xf76f2000, stop=0xf7712000, size=0x20000, flags=0x5),
-         Mapping('/lib/i386-linux-gnu/ld-2.19.so', start=0xf7712000, stop=0xf7713000, size=0x1000, flags=0x4),
-         Mapping('/lib/i386-linux-gnu/ld-2.19.so', start=0xf7713000, stop=0xf7714000, size=0x1000, flags=0x6),
-         Mapping('[stack]', start=0xfff3e000, stop=0xfff61000, size=0x23000, flags=0x6)]
+        [Mapping('/home/user/pwntools/crash', start=0x8048000, stop=0x8049000, size=0x1000, flags=0x5, page_offset=0x0),
+         Mapping('/home/user/pwntools/crash', start=0x8049000, stop=0x804a000, size=0x1000, flags=0x4, page_offset=0x1),
+         Mapping('/home/user/pwntools/crash', start=0x804a000, stop=0x804b000, size=0x1000, flags=0x6, page_offset=0x2),
+         Mapping(None, start=0xf7528000, stop=0xf7529000, size=0x1000, flags=0x6, page_offset=0x0),
+         Mapping('/lib/i386-linux-gnu/libc-2.19.so', start=0xf7529000, stop=0xf76d1000, size=0x1a8000, flags=0x5, page_offset=0x0),
+         Mapping('/lib/i386-linux-gnu/libc-2.19.so', start=0xf76d1000, stop=0xf76d2000, size=0x1000, flags=0x0, page_offset=0x1a8),
+         Mapping('/lib/i386-linux-gnu/libc-2.19.so', start=0xf76d2000, stop=0xf76d4000, size=0x2000, flags=0x4, page_offset=0x1a9),
+         Mapping('/lib/i386-linux-gnu/libc-2.19.so', start=0xf76d4000, stop=0xf76d5000, size=0x1000, flags=0x6, page_offset=0x1aa),
+         Mapping(None, start=0xf76d5000, stop=0xf76d8000, size=0x3000, flags=0x6, page_offset=0x0),
+         Mapping(None, start=0xf76ef000, stop=0xf76f1000, size=0x2000, flags=0x6, page_offset=0x0),
+         Mapping('[vdso]', start=0xf76f1000, stop=0xf76f2000, size=0x1000, flags=0x5, page_offset=0x0),
+         Mapping('/lib/i386-linux-gnu/ld-2.19.so', start=0xf76f2000, stop=0xf7712000, size=0x20000, flags=0x5, page_offset=0x0),
+         Mapping('/lib/i386-linux-gnu/ld-2.19.so', start=0xf7712000, stop=0xf7713000, size=0x1000, flags=0x4, page_offset=0x20),
+         Mapping('/lib/i386-linux-gnu/ld-2.19.so', start=0xf7713000, stop=0xf7714000, size=0x1000, flags=0x6, page_offset=0x21),
+         Mapping('[stack]', start=0xfff3e000, stop=0xfff61000, size=0x23000, flags=0x6, page_offset=0x0)]

    Example:

@@ -379,17 +389,17 @@ class Corefile(ELF):
        Data can also be extracted directly from the corefile.

        >>> core.exe[elf.address:elf.address+4]
-        '\x7fELF'
+        b'\x7fELF'
        >>> core.exe.data[:4]
-        '\x7fELF'
+        b'\x7fELF'

        Various other mappings are available by name.  On Linux, 32-bit Intel binaries
        should have a VDSO section.  Since our ELF is statically linked, there is
        no libc which gets mapped.

        >>> core.vdso.data[:4]
-        '\x7fELF'
-        >>> core.libc # docteset: +ELLIPSIS
+        b'\x7fELF'
+        >>> core.libc # doctest: +ELLIPSIS
        Mapping('/lib/x86_64-linux-gnu/libc-...', ...)

        The corefile also contains a :attr:`.Corefile.stack` property, which gives
@@ -397,8 +407,8 @@ class Corefile(ELF):
        should contain two pointer-widths of NULL bytes, preceded by the NULL-
        terminated path to the executable (as passed via the first arg to ``execve``).

-        >>> stack_end = core.exe.name
-        >>> stack_end += '\x00' * (1+8)
+        >>> stack_end = core.exe.name.encode()
+        >>> stack_end += b'\x00' * (1+8)
        >>> core.stack.data.endswith(stack_end)
        True
        >>> len(core.stack.data) == core.stack.size
@@ -409,19 +419,19 @@ class Corefile(ELF):
        >>> 'HELLO' in core.env
        True
        >>> core.getenv('HELLO')
-        'WORLD'
+        b'WORLD'
        >>> core.argc
        1
        >>> core.argv[0] in core.stack
        True
-        >>> core.string(core.argv[0]) == core.exe.path
+        >>> core.string(core.argv[0]) == core.exe.path.encode()
        True

        Corefiles can also be pulled from remote machines via SSH!

        >>> s = ssh('travis', 'example.pwnme')
        >>> _ = s.set_working_directory()
-        >>> elf = ELF.from_assembly('int3')
+        >>> elf = ELF.from_assembly(shellcraft.trap())
        >>> path = s.upload(elf.path)
        >>> _ =s.chmod('+x', path)
        >>> io = s.process(path)
@@ -429,6 +439,56 @@ class Corefile(ELF):
        -1
        >>> io.corefile.signal == signal.SIGTRAP # doctest: +SKIP
        True
+
+        Make sure fault_addr synthesis works for amd64 on ret.
+
+        >>> context.clear(arch='amd64')
+        >>> elf = ELF.from_assembly('push 1234; ret')
+        >>> io = elf.process()
+        >>> io.wait()
+        >>> io.corefile.fault_addr
+        1234
+
+    Tests:
+
+        These are extra tests not meant to serve as examples.
+
+        Corefile.getenv() works correctly, even if the environment variable's
+        value contains embedded '='. Corefile is able to find the stack, even
+        if the stack pointer doesn't point at the stack.
+
+        >>> elf = ELF.from_assembly(shellcraft.crash())
+        >>> io = elf.process(env={'FOO': 'BAR=BAZ'})
+        >>> io.wait()
+        >>> core = io.corefile
+        >>> core.getenv('FOO')
+        b'BAR=BAZ'
+        >>> core.sp == 0
+        True
+        >>> core.sp in core.stack
+        False
+
+        Corefile gracefully handles the stack being filled with garbage, including
+        argc / argv / envp being overwritten.
+
+        >>> context.clear(arch='i386')
+        >>> assembly = '''
+        ... LOOP:
+        ...   mov dword ptr [esp], 0x41414141
+        ...   pop eax
+        ...   jmp LOOP
+        ... '''
+        >>> elf = ELF.from_assembly(assembly)
+        >>> io = elf.process()
+        >>> io.wait()
+        >>> core = io.corefile
+        [!] End of the stack is corrupted, skipping stack parsing (got: 4141414141414141)
+        >>> core.argc, core.argv, core.env
+        (0, [], {})
+        >>> core.stack.data.endswith(b'AAAA')
+        True
+        >>> core.fault_addr == core.sp
+        True
    """

    _fill_gaps = False
@@ -454,14 +514,26 @@ class Corefile(ELF):
        #: variable.
        #:
        #: Note: Use with the :meth:`.ELF.string` method to extract them.
+        #:
+        #: Note: If FOO=BAR is in the environment, self.env['FOO'] is the
+        #:       address of the string "BAR\x00".
        self.env = {}

+        #: :class:`int`: Pointer to envp on the stack
+        self.envp_address = 0
+
        #: :class:`list`: List of addresses of arguments on the stack.
        self.argv = []

+        #: :class:`int`: Pointer to argv on the stack
+        self.argv_address = 0
+
        #: :class:`int`: Number of arguments passed
        self.argc = 0

+        #: :class:`int`: Pointer to argc on the stack
+        self.argc_address = 0
+
        # Pointer to the executable filename on the stack
        self.at_execfn = 0

@@ -493,57 +565,57 @@ class Corefile(ELF):
            for segment in self.segments:
                if not isinstance(segment, elftools.elf.segments.NoteSegment):
                    continue
+
+
+                # Note that older versions of pyelftools (<=0.24) are missing enum values
+                # for NT_PRSTATUS, NT_PRPSINFO, NT_AUXV, etc.
+                # For this reason, we have to check if note.n_type is any of several values.
                for note in iter_notes(segment):
-                    # Try to find NT_PRSTATUS.  Note that pyelftools currently
-                    # mis-identifies the enum name as 'NT_GNU_ABI_TAG'.
+                    if not isinstance(note.n_desc, bytes):
+                        note['n_desc'] = note.n_desc.encode('latin1')
+                    # Try to find NT_PRSTATUS.
                    if prstatus_type and \
                       note.n_descsz == ctypes.sizeof(prstatus_type) and \
-                       note.n_type == 'NT_GNU_ABI_TAG':
+                       note.n_type in ('NT_GNU_ABI_TAG', 'NT_PRSTATUS'):
                        self.NT_PRSTATUS = note
                        self.prstatus = prstatus_type.from_buffer_copy(note.n_desc)

                    # Try to find NT_PRPSINFO
-                    # Note that pyelftools currently mis-identifies the enum name
-                    # as 'NT_GNU_BUILD_ID'
-                    if note.n_descsz == ctypes.sizeof(prpsinfo_type) and \
-                       note.n_type == 'NT_GNU_BUILD_ID':
+                    if prpsinfo_type and \
+                       note.n_descsz == ctypes.sizeof(prpsinfo_type) and \
+                       note.n_type in ('NT_GNU_ABI_TAG', 'NT_PRPSINFO'):
                        self.NT_PRPSINFO = note
                        self.prpsinfo = prpsinfo_type.from_buffer_copy(note.n_desc)

                    # Try to find NT_SIGINFO so we can see the fault
-                    if note.n_type == 0x53494749:
+                    if note.n_type in (0x53494749, 'NT_SIGINFO'):
                        self.NT_SIGINFO = note
                        self.siginfo = siginfo_type.from_buffer_copy(note.n_desc)

                    # Try to find the list of mapped files
-                    if note.n_type == constants.NT_FILE:
+                    if note.n_type in (constants.NT_FILE, 'NT_FILE'):
                        with context.local(bytes=self.bytes):
                            self._parse_nt_file(note)

                    # Try to find the auxiliary vector, which will tell us
                    # where the top of the stack is.
-                    if note.n_type == constants.NT_AUXV:
+                    if note.n_type in (constants.NT_AUXV, 'NT_AUXV'):
+                        self.NT_AUXV = note
                        with context.local(bytes=self.bytes):
                            self._parse_auxv(note)

            if not self.stack and self.mappings:
-                self.stack = self.mappings[-1]
+                self.stack = self.mappings[-1].stop

            if self.stack and self.mappings:
                for mapping in self.mappings:
-                    if mapping.stop == self.stack:
+                    if self.stack in mapping or self.stack == mapping.stop:
                        mapping.name = '[stack]'
                        self.stack   = mapping
                        break
                else:
-                    for mapping in self.mappings:
-                        if self.stack in mapping:
-                            mapping.name = '[stack]'
-                            self.stack   = mapping
-                            break
-                    else:
-                        log.warn('Could not find the stack!')
-                        self.stack = None
+                    log.warn('Could not find the stack!')
+                    self.stack = None

            with context.local(bytes=self.bytes, log_level='warn'):
                try:
@@ -568,16 +640,19 @@ class Corefile(ELF):
        for i in range(count):
            start = t.unpack()
            end = t.unpack()
-            ofs = t.unpack()
-            starts.append(start)
+            offset = t.unpack()
+            starts.append((start, offset))

        for i in range(count):
-            filename = t.recvuntil('\x00', drop=True)
-            start = starts[i]
+            filename = t.recvuntil(b'\x00', drop=True)
+            if not isinstance(filename, str):
+                filename = filename.decode('utf-8')
+            (start, offset) = starts[i]

            for mapping in self.mappings:
                if mapping.start == start:
                    mapping.name = filename
+                    mapping.page_offset = offset

        self.mappings = sorted(self.mappings, key=lambda m: m.start)

@@ -594,7 +669,7 @@ class Corefile(ELF):
            if mapping.start == self.at_sysinfo_ehdr \
            or (not vdso and mapping.size in [0x1000, 0x2000] \
                and mapping.flags == 5 \
-                and self.read(mapping.start, 4) == '\x7fELF'):
+                and self.read(mapping.start, 4) == b'\x7fELF'):
                mapping.name = '[vdso]'
                vdso = True
                continue
@@ -647,6 +722,8 @@ class Corefile(ELF):

                if not m.name and self.at_execfn:
                    m.name = self.string(self.at_execfn)
+                    if not isinstance(m.name, str):
+                        m.name = m.name.decode('utf-8')

                return m

@@ -664,7 +741,22 @@ class Corefile(ELF):

    @property
    def signal(self):
-        """:class:`int`: Signal which caused the core to be dumped."""
+        """:class:`int`: Signal which caused the core to be dumped.
+
+        Example:
+
+            >>> elf = ELF.from_assembly(shellcraft.trap())
+            >>> io = elf.process()
+            >>> io.wait()
+            >>> io.corefile.signal == signal.SIGTRAP
+            True
+
+            >>> elf = ELF.from_assembly(shellcraft.crash())
+            >>> io = elf.process()
+            >>> io.wait()
+            >>> io.corefile.signal == signal.SIGSEGV
+            True
+        """
        if self.siginfo:
            return int(self.siginfo.si_signo)
        if self.prstatus:
@@ -675,11 +767,49 @@ class Corefile(ELF):
        """:class:`int`: Address which generated the fault, for the signals
            SIGILL, SIGFPE, SIGSEGV, SIGBUS.  This is only available in native
            core dumps created by the kernel.  If the information is unavailable,
-            this returns the address of the instruction pointer."""
-        if self.siginfo:
-            return int(self.siginfo.sigfault_addr)
+            this returns the address of the instruction pointer.

-        return getattr(self, 'pc', 0)
+
+        Example:
+
+            >>> elf = ELF.from_assembly('mov eax, 0xdeadbeef; jmp eax', arch='i386')
+            >>> io = elf.process()
+            >>> io.wait()
+            >>> io.corefile.fault_addr == io.corefile.eax == 0xdeadbeef
+            True
+        """
+        if not self.siginfo:
+            return getattr(self, 'pc', 0)
+
+        fault_addr = int(self.siginfo.sigfault_addr)
+
+        # The fault_addr is zero if the crash occurs due to a
+        # "protection fault", e.g. a dereference of 0x4141414141414141
+        # because this is technically a kernel address.
+        #
+        # A protection fault does not set "fault_addr" in the siginfo.
+        # (http://elixir.free-electrons.com/linux/v4.14-rc8/source/kernel/signal.c#L1052)
+        #
+        # Since a common use for corefiles is to spray the stack with a
+        # cyclic pattern to find the offset to get control of $PC,
+        # check for a "ret" instruction ("\xc3").
+        #
+        # If we find a RET at $PC, extract the "return address" from the
+        # top of the stack.
+        if fault_addr == 0 and self.siginfo.si_code == 0x80:
+            try:
+                code = self.read(self.pc, 1)
+                RET = b'\xc3'
+                if code == RET:
+                    fault_addr = self.unpack(self.sp)
+            except Exception:
+                # Could not read $rsp or $rip
+                pass
+
+        return fault_addr
+
+        # No embedded siginfo structure, so just return the
+        # current instruction pointer.

    @property
    def _pc_register(self):
@@ -722,8 +852,8 @@ class Corefile(ELF):
        fields = [
            repr(self.path),
            '%-10s %s' % ('Arch:', gnu_triplet),
-            '%-10s %#x' % ('%s:' % self._pc_register.upper(), getattr(self, 'pc', 0)),
-            '%-10s %#x' % ('%s:' % self._sp_register.upper(), getattr(self, 'sp', 0)),
+            '%-10s %#x' % ('%s:' % self._pc_register.upper(), self.pc or 0),
+            '%-10s %#x' % ('%s:' % self._sp_register.upper(), self.sp or 0),
        ]

        if self.exe and self.exe.name:
@@ -747,7 +877,8 @@ class Corefile(ELF):
                              None,
                              s.header.p_vaddr,
                              s.header.p_vaddr + s.header.p_memsz,
-                              s.header.p_flags)
+                              s.header.p_flags,
+                              None)
            self.mappings.append(mapping)

    def _parse_auxv(self, note):
@@ -790,22 +921,29 @@ class Corefile(ELF):
        if not stack:
            return

+        # If the stack does not end with zeroes, something is very wrong.
+        if not stack.data.endswith(b'\x00' * 8):
+            log.warn_once("End of the stack is corrupted, skipping stack parsing (got: %s)",
+                          enhex(self.data[-8:]))
+            return
+
        # AT_EXECFN is the start of the filename, e.g. '/bin/sh'
        # Immediately preceding is a NULL-terminated environment variable string.
        # We want to find the beginning of it
-        if self.at_execfn:
-            address = self.at_execfn-1
-        else:
-            log.debug('No AT_EXECFN')
+        if not self.at_execfn:
            address = stack.stop
            address -= 2*self.bytes
            address -= 1
-            address = stack.rfind('\x00', None, address)
+            address = stack.rfind(b'\x00', None, address)
            address += 1
+            self.at_execfn = address
+
+        address = self.at_execfn-1
+

        # Sanity check!
        try:
-            assert stack[address] == '\x00'
+            assert stack[address] == b'\x00'
        except AssertionError:
            # Something weird is happening.  Just don't touch it.
            log.debug("Something is weird")
@@ -819,7 +957,7 @@ class Corefile(ELF):

        # address is currently set to the NULL terminator of the last
        # environment variable.
-        address = stack.rfind('\x00', None, address)
+        address = stack.rfind(b'\x00', None, address)

        # We've found the beginning of the last environment variable.
        # We should be able to search up the stack for the envp[] array to
@@ -843,16 +981,38 @@ class Corefile(ELF):
        # Now let's find the end of argv
        p_end_of_argv = stack.rfind(pack(0), None, p_last_env_addr)

-        start_of_envp = p_end_of_argv + self.bytes
+        self.envp_address = p_end_of_argv + self.bytes

        # Now we can fill in the environment
-        env_pointer_data = stack[start_of_envp:p_last_env_addr+self.bytes]
+        env_pointer_data = stack[self.envp_address:p_last_env_addr+self.bytes]
        for pointer in unpack_many(env_pointer_data):
-            end = stack.find('=', last_env_addr)

-            if pointer in stack and end in stack:
-                name = stack[pointer:end]
-                self.env[name] = pointer
+            # If the stack is corrupted, the pointer will be outside of
+            # the stack.
+            if pointer not in stack:
+                continue
+
+            try:
+                name_value = self.string(pointer)
+            except Exception:
+                continue
+
+            name, _ = name_value.split(b'=', 1)
+
+            # "end" points at the byte after the null terminator
+            end = pointer + len(name_value) + 1
+
+            # Do not mark things as environment variables if they point
+            # outside of the stack itself, or we had to cross into a different
+            # mapping (after the stack) to read it.
+            # This may occur when the entire stack is filled with non-NUL bytes,
+            # and we NULL-terminate on a read failure in .string().
+            if end not in stack:
+                continue
+
+            if not isinstance(name, str):
+                name = name.decode('utf-8', 'surrogateescape')
+            self.env[name] = pointer + len(name) + len('=')

        # May as well grab the arguments off the stack as well.
        # argc comes immediately before argv[0] on the stack, but
@@ -864,10 +1024,12 @@ class Corefile(ELF):
            address -= self.bytes

        # address now points at argc
-        self.argc = self.unpack(address)
+        self.argc_address = address
+        self.argc = self.unpack(self.argc_address)

        # we can extract all of the arguments as well
-        self.argv = unpack_many(stack[address + self.bytes: p_end_of_argv])
+        self.argv_address = self.argc_address + self.bytes
+        self.argv = unpack_many(stack[self.argv_address: p_end_of_argv])

    @property
    def maps(self):
@@ -875,7 +1037,7 @@ class Corefile(ELF):

        ::

-            >>> print Corefile('./core').maps
+            >>> print(Corefile('./core').maps)
            8048000-8049000 r-xp 1000 /home/user/pwntools/crash
            8049000-804a000 r--p 1000 /home/user/pwntools/crash
            804a000-804b000 rw-p 1000 /home/user/pwntools/crash
@@ -904,15 +1066,34 @@ class Corefile(ELF):

        Returns:
            :class:`str`: The contents of the environment variable.
+
+        Example:
+
+            >>> elf = ELF.from_assembly(shellcraft.trap())
+            >>> io = elf.process(env={'GREETING': 'Hello!'})
+            >>> io.wait()
+            >>> io.corefile.getenv('GREETING')
+            b'Hello!'
        """
+        if not isinstance(name, str):
+            name = name.decode('utf-8', 'surrogateescape')
        if name not in self.env:
            log.error("Environment variable %r not set" % name)

-        return self.string(self.env[name]).split('=',1)[-1]
+        return self.string(self.env[name])

    @property
    def registers(self):
-        """:class:`dict`: All available registers in the coredump."""
+        """:class:`dict`: All available registers in the coredump.
+
+        Example:
+
+            >>> elf = ELF.from_assembly('mov eax, 0xdeadbeef;' + shellcraft.trap(), arch='i386')
+            >>> io = elf.process()
+            >>> io.wait()
+            >>> io.corefile.registers['eax'] == 0xdeadbeef
+            True
+        """
        if not self.prstatus:
            return {}

@@ -960,7 +1141,7 @@ class Coredump(Corefile):
 class CorefileFinder(object):
    def __init__(self, proc):
        if proc.poll() is None:
-            log.error("Process %i has not exited" % (process.pid))
+            log.error("Process %i has not exited" % (proc.pid))

        self.process = proc
        self.pid = proc.pid
@@ -1020,6 +1201,10 @@ class CorefileFinder(object):
            new_path = 'core.%i' % core_pid
            if core_pid > 0 and new_path != self.core_path:
                write(new_path, self.read(self.core_path))
+                try:
+                    self.unlink(self.core_path)
+                except (IOError, OSError):
+                    log.warn("Could not delete %r" % self.core_path)
                self.core_path = new_path

        # Check the PID
@@ -1080,7 +1265,7 @@ class CorefileFinder(object):
        Returns:
            `str`: Raw binary data for the core file, or ``None``.
        """
-        file = StringIO.StringIO(crashfile_data)
+        file = StringIO(crashfile_data)

        # Find the pid of the crashfile
        for line in file:
@@ -1109,8 +1294,8 @@ class CorefileFinder(object):
            chunks.append(b64d(line))

        # Smush everything together, then extract it
-        compressed_data = ''.join(chunks)
-        compressed_file = StringIO.StringIO(compressed_data)
+        compressed_data = b''.join(chunks)
+        compressed_file = BytesIO(compressed_data)
        gzip_file = gzip.GzipFile(fileobj=compressed_file)
        core_data = gzip_file.read()

@@ -1141,14 +1326,44 @@ class CorefileFinder(object):

        return data

+    def systemd_coredump_corefile(self):
+        """Find the systemd-coredump crash for the process and dump it to a file.
+
+        Arguments:
+            process(process): Process object we're looking for.
+
+        Returns:
+            `str`: Filename of core file, if coredump was found.
+        """
+        filename = "core.%s.%i.coredumpctl" % (self.basename, self.pid)
+        try:
+            subprocess.check_call(
+                [
+                    "coredumpctl",
+                    "dump",
+                    "--output=%s" % filename,
+                    # Filter coredump by pid and filename
+                    str(self.pid),
+                    self.basename,
+                ],
+                stdout=open(os.devnull, 'w'),
+                stderr=subprocess.STDOUT,
+                shell=False,
+            )
+            return filename
+        except subprocess.CalledProcessError as e:
+            log.debug("coredumpctl failed with status: %d" % e.returncode)
+
    def native_corefile(self):
        """Find the corefile for a native crash.

        Arguments:
            process(process): Process whose crash we should find.

+        Returns:
+            `str`: Filename of core file.
        """
-        if self.kernel_core_pattern.startswith('|'):
+        if self.kernel_core_pattern.startswith(b'|'):
            log.debug("Checking for corefile (piped)")
            return self.native_corefile_pipe()

@@ -1156,26 +1371,37 @@ class CorefileFinder(object):
        return self.native_corefile_pattern()

    def native_corefile_pipe(self):
-        """native_corefile_pipe(self) -> str
+        """Find the corefile for a piped core_pattern
+
+        Supports apport and systemd-coredump.
+
+        Arguments:
+            process(process): Process whose crash we should find.
+
+        Returns:
+            `str`: Filename of core file.
        """
-        # We only support apport
-        if '/apport' not in self.kernel_core_pattern:
-            log.warn_once("Unsupported core_pattern: %r" % self.kernel_core_pattern)
+        if b'/apport' in self.kernel_core_pattern:
+            log.debug("Found apport in core_pattern")
+            apport_core = self.apport_corefile()
+
+            if apport_core:
+                # Write the corefile to the local directory
+                filename = 'core.%s.%i.apport' % (self.basename, self.pid)
+                with open(filename, 'wb+') as f:
+                    f.write(apport_core)
+                return filename
+
+            # Pretend core_pattern was just 'core', and see if we come up with anything
+            self.kernel_core_pattern = 'core'
+            return self.native_corefile_pattern()
+        elif b'systemd-coredump' in self.kernel_core_pattern:
+            log.debug("Found systemd-coredump in core_pattern")
+            return self.systemd_coredump_corefile()
+        else:
+            log.warn_once("Unsupported core_pattern: %r", self.kernel_core_pattern)
            return None

-        apport_core = self.apport_corefile()
-
-        if apport_core:
-            # Write the corefile to the local directory
-            filename = 'core.%s.%i.apport' % (self.basename, self.pid)
-            with open(filename, 'wb+') as f:
-                f.write(apport_core)
-            return filename
-
-        # Pretend core_pattern was just 'core', and see if we come up with anything
-        self.kernel_core_pattern = 'core'
-        return self.native_corefile_pattern()
-
    def native_corefile_pattern(self):
        """
        %%  a single % character
@@ -1195,7 +1421,7 @@ class CorefileFinder(object):
        """
        replace = {
            '%%': '%',
-            '%e': self.basename,
+            '%e': os.path.basename(self.interpreter) or self.basename,
            '%E': self.exe.replace('/', '!'),
            '%g': str(self.gid),
            '%h': socket.gethostname(),
@@ -1206,8 +1432,10 @@ class CorefileFinder(object):
            '%s': str(-self.process.poll()),
            '%u': str(self.uid)
        }
-        replace = dict((re.escape(k), v) for k, v in replace.iteritems())
+        replace = dict((re.escape(k), v) for k, v in replace.items())
        pattern = re.compile("|".join(replace.keys()))
+        if not hasattr(self.kernel_core_pattern, 'encode'):
+            self.kernel_core_pattern = self.kernel_core_pattern.decode('utf-8')
        core_pattern = self.kernel_core_pattern
        corefile_path = pattern.sub(lambda m: replace[re.escape(m.group(0))], core_pattern)

@@ -1293,7 +1521,7 @@ class CorefileFinder(object):
                continue

            magic = bytearray(unhex(keys['magic']))
-            mask  = bytearray('\xff' * len(magic))
+            mask  = bytearray(b'\xff' * len(magic))

            if 'mask' in keys:
                mask = bytearray(unhex(keys['mask']))
@@ -29,6 +29,7 @@
 #  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 #  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #
+from __future__ import division

 import ctypes