Release 3.3.3

2026-11-10 10:11:32 -10:00 · 2017-01-10 23:35:11 +01:00
3798 changed files with 29037 additions and 58829 deletions
@@ -1,10 +1,8 @@
 [run]
 branch = True
-parallel = True
 omit =
    */constants/*
 source =
    pwn
    pwnlib
-    ~/.pwntools-cache-2.7/
-    ~/.pwntools-cache-3.8/
+    ~/.pwntools-cache/
@@ -4,11 +4,6 @@ Thanks for contributing to Pwntools!

 When reporting an issue, be sure that you are running the latest released version of pwntools (`pip install --upgrade pwntools`).

-Please verify that your issue occurs on 64-bit Ubuntu 14.04.  You can use the Dockerfile on `docker.io` for quick testing.
-
-```
-$ docker pull pwntools/pwntools:stable
-$ docker run -it pwntools/pwntools:stable
-```
+Please verify that your issue occurs on 64-bit Ubuntu 14.04.  You can use the Dockerfile in `extra/docker/Dockerfile` to save time.

 If possible, provide a proof-of-concept which demonstrates the problem.  Include any binaries or scripts necessary to reproduce the issue, and please include the full debug output via setting the environment variable `PWNLIB_DEBUG=1`.
@@ -1,107 +0,0 @@
-name: Continuous Integration
-on: [push, pull_request]
-
-jobs:
-  build:
-    strategy:
-      matrix:
-        python-version: [2.7, 3.8]
-        os: [ubuntu-latest]
-    runs-on: ${{ matrix.os }}
-    steps:
-    - uses: actions/checkout@v2
-    - name: Cache for pip
-      uses: actions/cache@v1
-      id: cache-pip
-      with:
-        path: ~/.cache/pip
-        key: ${{ matrix.os }}-cache-pip
-
-    - name: Cache for dependencies
-      uses: actions/cache@v1
-      id: cache-deps
-      with:
-        path: android-?dk
-        key: ${{ matrix.os }}-cache-deps
-
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v1
-      with:
-        python-version: ${{ matrix.python-version }}
-
-    - name: Lint
-      run: |
-        pip install flake8
-        flake8 . --count --select=E9,F63,F7 --show-source --statistics --exclude=android-?dk  # TODO: Add F82
-        flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics --exclude=pwnlib/constants,android-?dk,.git,__pycache__
-
-    - name: Install Linux dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y --no-install-recommends -o Acquire::Retries=3 \
-          ash bash-static dash ksh mksh zsh \
-          pandoc gdb socat sshpass \
-          binutils-multiarch qemu-user-static \
-          binutils-aarch64-linux-gnu \
-          binutils-arm-linux-gnueabihf \
-          binutils-mips-linux-gnu \
-          binutils-powerpc-linux-gnu \
-          gcc-multilib \
-          openjdk-8-jre-headless
-        sudo apt-get install -y -o Acquire::Retries=3 \
-          gcc-aarch64-linux-gnu \
-          gcc-arm-linux-gnueabihf
-
-    - name: Install android avd
-      if:  steps.cache-deps.outputs.cache-hit != 'true'
-      run: |
-        USER=travis source travis/install.sh
-        adb emu kill
-        set | egrep '^(ANDROID|PATH)' >android-sdk/.android.env
-
-    - name: Set up SSH
-      run: |
-        chmod og-rw ~ # see https://stackoverflow.com/a/60367309/3869724
-        ssh-keygen -t ed25519 -f ~/.ssh/pwntools-ci -N ''
-        cat > ~/.ssh/config <<EOF
-        Host example.pwnme
-            User $USER
-            HostName 127.0.0.1
-            IdentityFile ~/.ssh/pwntools-ci
-        EOF
-        echo -n 'from="127.0.0.1" ' | cat - ~/.ssh/pwntools-ci.pub > ~/.ssh/authorized_keys
-        ssh -o 'StrictHostKeyChecking no' example.pwnme id
-
-    - name: Install dependencies
-      run: |
-        pip install --upgrade pip
-        pip install --upgrade flake8 appdirs
-        python setup.py egg_info
-        pip install --upgrade --editable .
-
-    - name: Sanity checks
-      run:  PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
-
-    - name: Install documentation dependencies
-      run:  pip install -r docs/requirements.txt
-
-    - name: Coverage doctests
-      run: |
-        source android-sdk/.android.env
-        android-sdk/emulator/emulator -avd android-$ANDROID_ABI -no-window -no-boot-anim -read-only -no-audio -no-window -no-snapshot &
-        adb wait-for-device
-        echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope # required by some gdb doctests
-        PWNLIB_NOTERM=1 coverage run -m sphinx -b doctest docs/source docs/build/doctest
-        coverage combine
-
-    - name: Build source and wheel distributions
-      run: |
-        python setup.py sdist
-        python setup.py bdist_wheel --universal
-
-    - uses: actions/upload-artifact@v2-preview
-      with:
-        path: dist/*
-
-    - name: Upload coverage to coveralls.io
-      run:  COVERALLS_REPO_TOKEN=PP20MEgztXIQJJTguQwe2jeCh6Bm4lkbv coveralls
@@ -11,8 +11,7 @@ docs/build
 build
 MANIFEST
 dist
-venv
-.vscode
 *.egg-info
 *.core
 .coverage
+.tox
@@ -1,8 +1,10 @@
+sudo: false
 language: python
 addons:
  apt:
    packages:
    - gcc-multilib
+    - gcc-4.6-arm-linux-gnueabihf
    - lib32stdc++6
    - ash
    - bash
@@ -11,52 +13,27 @@ addons:
    - mksh
    - zsh
    - pandoc
-    - gdb
-    - socat
-    - sshpass
-    - binutils
-    - qemu-user-static
-    - binutils-multiarch
-    - binutils-aarch64-linux-gnu
-    - binutils-arm-linux-gnueabihf
-    - binutils-mips-linux-gnu
-    - binutils-powerpc-linux-gnu
 cache:
    - pip
    - directories:
        - usr
-        - /home/travis/virtualenv/python2.7.15/lib/python2.7/site-packages/
-        - /home/travis/virtualenv/python2.7.15/bin/
-        - /home/travis/virtualenv/python3.8.*/lib/python3.8/site-packages/
-        - /home/travis/virtualenv/python3.8.*/bin/
-        - docs/build/doctest/.doctrees
+        - /home/travis/virtualenv/python2.7.9/lib/python2.7/site-packages/
+        - /home/travis/virtualenv/python2.7.9/bin/
 python:
  - "2.7"
-  - "3.8"
 before_install:
-  - echo $-
  - source travis/install.sh
  - source travis/ssh_setup.sh
-  - echo $-
 install:
-  - pip install --upgrade pip
-  - pip install --upgrade flake8 appdirs # https://github.com/ActiveState/appdirs/issues/89#issuecomment-282326570
-  - python setup.py egg_info      # pypa/pip#6275
  - pip install --upgrade --editable .
-  - pip install --upgrade --requirement docs/requirements.txt
+  - pip install --requirement docs/requirements.txt
 before_script:
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
-  - sudo sh -c "echo 0 > /proc/sys/kernel/yama/ptrace_scope"
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
 script:
-  # stop the build if there are Python syntax errors or undefined names
-  - flake8 . --count --select=E9,F63,F7 --show-source --statistics --exclude=android-?dk  # TODO: Add F82
-  # exit-zero treats all errors as warnings.  The GitHub editor is 127 chars wide
-  - flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics --exclude=pwnlib/constants,android-?dk,.git,__pycache__
  - PWNLIB_NOTERM=1 coverage run -m sphinx -b doctest docs/source docs/build/doctest
-  - coverage combine
 after_success:
  - coveralls
  - source travis/update_demo.sh
@@ -9,31 +9,9 @@ The table below shows which release corresponds to each branch, and what date th

 | Version          | Branch   | Release Date           |
 | ---------------- | -------- | ---------------------- |
-| [4.3.0](#430)    | `dev`    | Jun 30, 2020 (planned)
-| [4.2.0](#420)    | `beta`   | May 30, 2020 (planned)
-| [4.1.0](#410)    | `stable` | May 8, 2020
-| [4.0.1](#401)    |          | Jan 22, 2020
-| [4.0.0](#400)    |          | Jan 09, 2020
-| [3.13.0](#3130)  |          | Nov 5, 2019
-| [3.12.1](#3121)  |          | Sept 17, 2018
-| [3.12.0](#3120)  |          | Feb 22, 2018
-| [3.11.0](#3110)  |          | Jan 3, 2018
-| [3.10.0](#3100)  |          | Oct 25, 2017
-| [3.9.2](#392)    |          | Oct 5, 2017
-| [3.9.1](#391)    |          | Sep 28, 2017
-| [3.9.0](#390)    |          | Sep 11, 2017
-| [3.8.0](#380)    |          | Jul 29, 2017
-| [3.7.1](#371)    |          | Jul 14, 2017
-| [3.7.0](#370)    |          | Jun 19, 2017
-| [3.6.1](#361)    |          | May 12, 2017
-| [3.6.0](#360)    |          | May 8, 2017
-| [3.5.1](#351)    |          | Apr 15, 2017
-| [3.5.0](#350)    |          | Mar 26, 2017
-| [3.4.1](#341)    |          | Feb 17, 2017
-| [3.4.0](#340)    |          | Feb 13, 2017
-| [3.3.4](#334)    |          | Jan 12, 2016
-| [3.3.3](#333)    |          | Jan 10, 2016
-| [3.3.2](#332)    |          | Jan 10, 2016
+| [3.5.0](#350)    | `dev`    | Mar 18, 2017 (planned)
+| [3.4.0](#340)    | `beta`   | Feb 4, 2017 (planned)
+| [3.3.2](#332)    | `stable` | Jan 10, 2016
 | [3.3.1](#331)    |          | Jan 10, 2016
 | [3.3.0](#330)    |          | Dec 24, 2016
 | [3.2.1](#321)    |          | Dec 24, 2016
@@ -47,389 +25,13 @@ The table below shows which release corresponds to each branch, and what date th
 | [3.0.0](#300)    |          | Aug 20, 2016
 | [2.2.0](#220)    |          | Jan 5, 2015

-## 4.3.0 (`dev`)
-
-To be released on Jun 30, 2020.
-
-## 4.2.0 (`beta`)
-
-To be released on May 30, 2020.
-
- #1436 Add ret2dlresolve automation
- [fecf9f] tubes.ssh.process() no longer requires python 2 installed on remote (still requires python, though)
- Miscellanous improvements to DynElf and fmtstr leaker (see examples/fmtstr/exploit2.py)
- #1454 Support for windows console colors
-
-[fecf9f]: http://github.com/Gallopsled/pwntols/commit/fecf9f
-
-
-## 4.1.0 (`stable`)
-
- [#1316][1316] Fix connect shellcraft in python 3
- [#1323][1323] Fix issues related with debugging
- [#1001][1001] Enhance `unlock_bootloader` with better status messages
- [#1389][1389] remove old dependencies
- [#1241][1241] Launch QEMU with sysroot if specified
- [#1218][1218] Support for FileStructure exploitation
-
-[1241]: https://github.com/Gallopsled/pwntools/pulls/1218
-[1218]: https://github.com/Gallopsled/pwntools/pulls/1218
-
-## 4.0.1
-
- [#1412][1412] `recvline_pred()` and similar do not reorder data
- Bypass unicorn-engine/unicorn#1100 and unicorn-engine/unicorn#1170 requiring unstable package
-
-[1412]: https://github.com/Gallopsled/pwntools/pulls/1412
-
-## 4.0.0
-
- **Python 3 support! <3**
- [#1402][1402] Fix serialtube in python 3
- [#1391][1391] Fix process.libs
- [#1317][1317] Tubes with `context.encoding`
- [#1216][1216] Improve format string generator
- [#1285][1285] Add freebsd generic syscall templates
- [76413f][76413f] Add pwnlib.adb.bootimg for 'ANDROID!' format boot.img images
- [#1202][1202] Docker: Kill 14 layers in pwntools base images
- [#1182][1182] shellcraft.dupio() for mips
-
-[1391]: https://github.com/Gallopsled/pwntools/pulls/1391
-[1317]: https://github.com/Gallopsled/pwntools/pulls/1317
-[1285]: https://github.com/Gallopsled/pwntools/pulls/1285
-[1216]: https://github.com/Gallopsled/pwntools/pulls/1216
-[1202]: https://github.com/Gallopsled/pwntools/pulls/1202
-[1182]: https://github.com/Gallopsled/pwntools/pulls/1182
-[76413f]: https://github.com/Gallopsled/pwntools/commit/76413f
-
-## 3.13.0
-
- [#1204][1204] Reduce ROP cache filename length
- [#1175][1175] Fix nested SSH connectors
- [#1355][1355] Fix 'break' syscall
- [#1277][1277] Fix timeout parameter passing in sendlineafter and other similar functions
- [#1292][1292] Provide correct arch name to gdb for sparc64
-
-[1175]: https://github.com/Gallopsled/pwntools/pulls/1175
-[1204]: https://github.com/Gallopsled/pwntools/pulls/1355
-[1277]: https://github.com/Gallopsled/pwntools/pulls/1277
-[1292]: https://github.com/Gallopsled/pwntools/pulls/1292
-[1355]: https://github.com/Gallopsled/pwntools/pulls/1355
-
-## 3.12.1
-
- [#1104][1104] Add `DynELF.dump()` for dumping remote ELF files
- [#1101][1101] Set `context.os` via `context.binary`, useful for Android exploitation
- [5fdc08][5fdc08] Work around broken `pidof` on Android
- [63dfed][63dfed] Print warning when Corefile deletion fails instead of throwing an exception
- [#1094][1094] Make hexdump output alignment more consistent
- [#1096][1096] `flat()` and `fit()` are now the same function
-
-[1104]: https://github.com/Gallopsled/pwntools/pull/1104
-[1101]: https://github.com/Gallopsled/pwntools/pull/1101
-[1094]: https://github.com/Gallopsled/pwntools/pull/1094
-[1096]: https://github.com/Gallopsled/pwntools/pull/1096
-[5fdc08]: https://github.com/Gallopsled/pwntools/commit/5fdc08
-[63dfed]: https://github.com/Gallopsled/pwntools/commit/63dfed
-
-## 3.12.2
-
- [1242][1242] Use IntervalTree 2.xx, disallow use of 3.xx
- [1243][1243] Fix a typo that caused an exception when executing a binary with `process()` which returns `-ENOEXEC` and the system does not have `qemu-user` binaries installed.
-
-[1242]: https://github.com/Gallopsled/pwntools/pull/1242
-[1243]: https://github.com/Gallopsled/pwntools/pull/1243
-
-## 3.12.1
-
- [#1198][1198] More compatibility fixes for pyelftools==0.25, and pin Sphinx<1.8.0 since it causes testing errors
- [#1191][1191] Fix compatibility with pyelftools==0.25
- [#1159][1159] Fix check for `/proc/.../status`
- [#1162][1162] Fix broken package versions
- [#1150][1150] Fix exception raised when a cache file is missing
- [#1156][1156] Fix ROP gadget selection logic involving `int` and `syscall` instructions
- [#1152][1152] Fix QEMU LD_PREFIX calculation (wrong parameter passed)
- [#1155][1155] Use Ubuntu Trusty for all CI builds
- [#1131][1131] Add "libc-" to libc prefixes in `process` tubes
- [#1125][1125] Fix a typo
- [#1121][1121] Fix tests which were broken by an upstream Sphinx change
-
-[1159]: https://github.com/Gallopsled/pwntools/pull/1159
-[1162]: https://github.com/Gallopsled/pwntools/pull/1162
-[1150]: https://github.com/Gallopsled/pwntools/pull/1150
-[1156]: https://github.com/Gallopsled/pwntools/pull/1156
-[1152]: https://github.com/Gallopsled/pwntools/pull/1152
-[1155]: https://github.com/Gallopsled/pwntools/pull/1155
-[1131]: https://github.com/Gallopsled/pwntools/pull/1131
-[1125]: https://github.com/Gallopsled/pwntools/pull/1125
-[1121]: https://github.com/Gallopsled/pwntools/pull/1121
-
-## 3.12.0
-
- [#1083][1083] Better error messages for `gdb` when `LD_PRELOAD` is incorrect
- [#1085][1085] Add support for extracting Android `BOOTLDR!` images
- [#1075][1075] Add support for detecting GNU Screen for `run_in_new_terminal`
- [#1074][1074] Add support for running `pwntools-gdb` wrapper script instead of `gdb`
- [#1068][1068] Work around very old OpenSSL versions which don't have sha256 support *AND* don't exit with an error code when trying to use it
- [#1067][1067] Add `pwnlib.tubes.server` module, which adds a reusable `server` listener
- [#1063][1063] Add support for labels in `fit()`, allowing dynamic contents to be injected.  (This feature is really cool, check out the pull request!)
-
-[1083]: https://github.com/Gallopsled/pwntools/pull/1083
-[1085]: https://github.com/Gallopsled/pwntools/pull/1085
-[1075]: https://github.com/Gallopsled/pwntools/pull/1075
-[1074]: https://github.com/Gallopsled/pwntools/pull/1074
-[1068]: https://github.com/Gallopsled/pwntools/pull/1068
-[1067]: https://github.com/Gallopsled/pwntools/pull/1067
-[1063]: https://github.com/Gallopsled/pwntools/pull/1063
-
-## 3.11.0
-
- [#1044][1044] Enhancements to ROP
-    + Much better support for 64-bit Intel (amd64) ROP
-    + ROP gadget selection is optimized to favor multi-pops instead of multiple single-pop gadgets
-    + Added support for blacklisting byte values in ROP gadget addresses
- [#1049][1049] Enhancements to `cyclic`
-    + `context` now has two additional attributes, `cyclic_alphabet` and `cyclic_length`, which correspond to the arguments `alphabet` and `n` to `cyclic()` and `cyclic_find()` and related routines.
-    + The motivation for this change is to allow setting the `alphabet` globally, so that any padding / patterns generated internally to pwntools can be controlled.  The specific motivation is blacklisting values in ROP padding.
- [#1052][1052] Enhancements for detecting `QEMU_LD_PREFIX` used by QEMU user-mode emulation for sysroots
- [#1035][1035] Minor documentation changes
- [#1032][1032] Enhancements to `pwn template`
- [#1031][1031] More accurate `Coredump.fault_addr` on amd64
- [#1084][1084] Fix broken tests due to `ftp.debian.org` going down
-
-[1044]: https://github.com/Gallopsled/pwntools/pull/1044
-[1049]: https://github.com/Gallopsled/pwntools/pull/1049
-[1052]: https://github.com/Gallopsled/pwntools/pull/1052
-[1035]: https://github.com/Gallopsled/pwntools/pull/1035
-[1032]: https://github.com/Gallopsled/pwntools/pull/1032
-[1031]: https://github.com/Gallopsled/pwntools/pull/1031
-[1084]: https://github.com/Gallopsled/pwntools/pull/1084
-
-## 3.10.0
-
- [#1007][1007] Add support for setting a `gdbinit` file in the context
- [#1055][1055] Fixes for `Corefile` stack parsing, speed up `ELF.string()`
- [#1057][1057] Fix a variable name typo in `DynELF` logging which results in an exception being thrown
- [#1058][1058] Fix an edge case in `ssh_process.exe`
-
-[1007]: https://github.com/Gallopsled/pwntools/pull/1007
-[1055]: https://github.com/Gallopsled/pwntools/pull/1055
-[1057]: https://github.com/Gallopsled/pwntools/pull/1057
-[1058]: https://github.com/Gallopsled/pwntools/pull/1058
-
-## 3.9.2
-
- [#1043][1043] Do not attempt to populate the libraries used by statically-linked binaries
-
-[1043]: https://github.com/Gallopsled/pwntools/pull/1043
-
-## 3.9.1
-
- [#1038][1038] Fix an issue with `process()` where glibc would buffer data internally, causing a hang on `select()`
- [#1036][1036] Fix Travis CI logging verbosity
- [#1029][1029] Fix some `unicode` issues when using the `readline` command history in `tube.interactive()`
-
-[1038]: https://github.com/Gallopsled/pwntools/pull/1038
-[1036]: https://github.com/Gallopsled/pwntools/pull/1036
-[1029]: https://github.com/Gallopsled/pwntools/pull/1029
-
-## 3.9.0
-
- [#1003][1003] Make `concat_all` faster while also simplifying it's logic
- [#1014][1014] Fix for overwritten env when parsing core file
- [#1023][1023] Fixes to Travis CI
-
-[1003]: https://github.com/Gallopsled/pwntools/pull/1003
-[1014]: https://github.com/Gallopsled/pwntools/pull/1014
-[1023]: https://github.com/Gallopsled/pwntools/pull/1023
-
-## 3.8.0
-
- [#981][981] Fixed RELRO detection logic
- [#986][986] Enhancements to DynELF for controlling usage of LibcDB
- A few documentation fixes
- A few fixes for the Docker image
-
-[981]: https://github.com/Gallopsled/pwntools/pull/981
-[986]: https://github.com/Gallopsled/pwntools/pull/986
-
-## 3.7.1
-
- [#998][998] Fix a bug where integer values could not be set in `.pwn.conf`.
-
-[998]: https://github.com/Gallopsled/pwntools/pull/998
-
-## 3.7.0
-
- [#933][933] DynELF works better with different base addresses
- [#952][952] A few small fixes were made to `pwn template`, and the CRC database was updated.
- [5c72d62c][5c72d62c] Updated the CRC database
-
-[933]: https://github.com/Gallopsled/pwntools/pull/933
-[952]: https://github.com/Gallopsled/pwntools/pull/952
-[5c72d62c]: https://github.com/Gallopsled/pwntools/commit/5c72d62c
-
-## 3.6.1
-
- [#979][979]+[1a4a1e1][1a4a1e1] Fixed [#974][974], a bug related to the terminal handling and numlock.
- [#980][980] Fixed the `pwn template` command.
-
-[974]: https://github.com/Gallopsled/pwntools/issues/974
-[979]: https://github.com/Gallopsled/pwntools/pull/979
-[980]: https://github.com/Gallopsled/pwntools/pull/980
-[1a4a1e1]: https://github.com/Gallopsled/pwntools/commit/1a4a1e1
-
-## 3.6.0
-
- [#895][895] Added a Dockerfile to simplify testing setup and allow testing on OSX
- [#897][897] Fixed some incorrect AArch64 syscals
- [#893][893] Added the `pwnlib.config` module
-    + Configuration options can now be set in `~/.pwn.conf`
-    + This replaces the old, **undocumented** mechanism for changing logging colors.  Only @br0ns and @ebeip90 were likely using this.
-    + More information is available in the documentation [here](http://docs.pwntools.com/en/dev/config.html).
- [#899][899] Pwntools now uses Unicorn Engine to emulate PLT instructions to ensure correct mapping of PIE / RELRO binaries.
- [#904][904] Enhancements to the accuracy of the `pwn checksec` command.
- [#905][905] Added a `pwn debug` command-line utility which automates the process of `gdb.attach(process(...))` to spawn GDB
-    + More information is available in the documentation [here](http://docs.pwntools.com/en/dev/commandline.html#pwn-debug)
- [#919][919] Added a `pwn template` command-line utility to simplify the process of bootstrapping a new exploit.
-    + More information is available in the documentation [here](http://docs.pwntools.com/en/dev/commandline.html#pwn-template).
- [#948][948] Fix unnecessary warning for Core files
- [#954][954] Fix list processing in `~/.pwn.conf`
- [#967][967] Respect `TERM_PROGRAM` for `run_in_new_terminal`
- [#970][970] Fix overly-aggressive corefile caching
-
-[947]: https://github.com/Gallopsled/pwntools/pull/947
-[948]: https://github.com/Gallopsled/pwntools/pull/948
-[954]: https://github.com/Gallopsled/pwntools/pull/954
-[960]: https://github.com/Gallopsled/pwntools/pull/960
-[967]: https://github.com/Gallopsled/pwntools/pull/967
-[968]: https://github.com/Gallopsled/pwntools/pull/968
-[970]: https://github.com/Gallopsled/pwntools/pull/970
-
-[895]: https://github.com/Gallopsled/pwntools/pull/895
-[897]: https://github.com/Gallopsled/pwntools/pull/897
-[893]: https://github.com/Gallopsled/pwntools/pull/893
-[899]: https://github.com/Gallopsled/pwntools/pull/899
-[904]: https://github.com/Gallopsled/pwntools/pull/904
-[905]: https://github.com/Gallopsled/pwntools/pull/905
-[919]: https://github.com/Gallopsled/pwntools/pull/919
-
-## 3.5.1
-
- [#945][945] Speed up ssh via caching checksec results (fixes [#944][944])
- [#950][950] Fixes a bug where setting `context.arch` does not have an effect on `adb.compile()` output architecture
-
-[944]: https://github.com/Gallopsled/pwntools/issues/944
-[945]: https://github.com/Gallopsled/pwntools/pull/945
-[950]: https://github.com/Gallopsled/pwntools/pull/950
-
 ## 3.5.0

- [b584ca3][b584ca3] Fixed an issue running `setup.py` on ARM
- [#822][822] Enabled relative leaks with `MemLeak`
-    + This should be useful for e.g. heap-relative leaks
- [#832][832] Changed all internal imports to use absolute imports (no functional changes)
- [a12d0b6][a12d0b6] Move `STDOUT`, `PIPE`, `PTY` constants to globals
-    + `process(..., stdin=process.PTY)` --> `process(..., stdin=PTY)`
- [#828][828] Use `PR_SET_PTRACER` for all `process()` and `ssh.process()` instances
-    + This simplifies debugging on systems with YAMA ptrace enabled
- Various documentation enhancements
-    + In particular, the [gdb][gdb], [elf][elf], and [ssh][ssh] docs are much better
- [#833][833] Performance enhancements for `adb` module
- [d0267f3][d0267f3] `packing.fit()` now treats large offsets as cyclic patterns (e.g. `0x61616161` behaves the same as `"aaaa"`)
- [#835][835] Added `ssh.checksec`
-    + Reports the kernel version and other relevant information on connection
- [#857][857] Slightly shortened `execve` shellcode
- [300f8e0][300f8e0] Slightly speed up processing of large ELF files
- [#861][861] Adds support for extracting `IKCONFIG` configs from Linux kernel images, and extends `checksec` to report on any insecure configurations discovered
- [#871][871] Moves all of the basic syscall templates to `shellcraft/common` and exposes them via symlinks.  Closed [#685][685]
-    + Should not have any visible effects from any documented APIs
-    + `shellcraft.arch.os.syscall_function()` still works the same
-    + We now have the ability to differentiate between the `connect` syscall, and a TCP `connect` helper
- [#887][887] `sh_string` now returns a quoted empty string `''` rather than just an empty string
- [#839][839] Exposes a huge amount of functionality via corefiles which was not previously availble.  See the [docs][corefile_docs] for examples.
-    + `process().corefile` will automatically instantiate a Corefile for the process
-    + QEMU-emulated processes are supported
-    + Native processes are supported, including extraction of coredumps from `apport` crash logs
-    + Native processes can be dumped *while running*, in a manner similar to `GDB`'s `gcore` script
- [#875][857] Added [documentation][aarch64] (and tests) for AArch64 shellcode
- [#882][882] The `ROP` class now respects `context.bytes` instead of using the hard-coded value of `4` (fixed [#879][879])
- [#869][869] Added several fields to the `process` class (`uid`, `gid`, `suid`, `sgid`) which are recorded at execution time, based on the file permissions
- [#868][868] Changed the way that `ssh.process()` works internally, and it now returns a more specialized class, `ssh_process`.
-    + Added `ssh_process.corefile` for fetching remote corefiles
-    + Added `ssh_process.ELF` for getting an ELF of the remote executable
-    + The `uid`, `gid`, and `suid`, and `sgid` which are recorded at execution time, based on the file permissions
- [#865][865] Fixes `ELF.read` to support contiguous memory reads across non-contiguous file-backed segments
- [#862][862] Adds a `symlink=` argument to `ssh.set_working_directory`, which will automatically symlink all of the files in the "old" working directory into the "new" working directory
-
-[ssh]: http://docs.pwntools.com/en/dev/tubes/ssh.html
-[gdb]: http://docs.pwntools.com/en/dev/gdb.html
-[elf]: http://docs.pwntools.com/en/dev/elf.html
-[corefile_docs]: http://docs.pwntools.com/en/dev/elf/corefile.html
-[aarch64]: http://docs.pwntools.com/en/dev/shellcraft/aarch64.html
-
-[685]: https://github.com/Gallopsled/pwntools/pull/685
-[822]: https://github.com/Gallopsled/pwntools/pull/822
-[828]: https://github.com/Gallopsled/pwntools/pull/828
-[832]: https://github.com/Gallopsled/pwntools/pull/832
-[833]: https://github.com/Gallopsled/pwntools/pull/833
-[835]: https://github.com/Gallopsled/pwntools/pull/835
-[839]: https://github.com/Gallopsled/pwntools/pull/839
-[857]: https://github.com/Gallopsled/pwntools/pull/857
-[861]: https://github.com/Gallopsled/pwntools/pull/861
-[862]: https://github.com/Gallopsled/pwntools/pull/862
-[865]: https://github.com/Gallopsled/pwntools/pull/865
-[868]: https://github.com/Gallopsled/pwntools/pull/868
-[869]: https://github.com/Gallopsled/pwntools/pull/869
-[871]: https://github.com/Gallopsled/pwntools/pull/871
-[875]: https://github.com/Gallopsled/pwntools/pull/857
-[879]: https://github.com/Gallopsled/pwntools/issues/879
-[882]: https://github.com/Gallopsled/pwntools/pull/882
-[887]: https://github.com/Gallopsled/pwntools/pull/887
-
-
-[b584ca3]: https://github.com/Gallopsled/pwntools/commit/b584ca3
-[a12d0b6]: https://github.com/Gallopsled/pwntools/commit/a12d0b6
-[d0267f3]: https://github.com/Gallopsled/pwntools/commit/d0267f3
-[300f8e0]: https://github.com/Gallopsled/pwntools/commit/300f8e0
-
-## 3.4.1
-
- [#894][894] Fix a bug when using `gdb.debug()` over ssh.
- [e021f57][e021f57] Fix a bug ([#891][891]) in `rop` when needing to insert padding to fix alignment
-
-[e021f57]: https://github.com/Gallopsled/pwntools/commit/e021f57
-[894]: https://github.com/Gallopsled/pwntools/pull/894
-[891]: https://github.com/Gallopsled/pwntools/issues/891
+To be released on Mar 18, 2017.

 ## 3.4.0

- [#800][800] Add `shell=` option to `ssh.process()`
- [#806][806] Add `context.buffer_size` for fine-tuning `tube` performance
-    + Also adds `buffer_fill_size=` argument for all tubes
- [b83a6c7][b83a6c7] Fix undocumented `process.leak` function
- [546061e][546061e] Modify `coredump_filter` of all spawned processes, so that core dumps are more complete
- [#809][809] Add several functions to `adb` (`unlink`, `mkdir`, `makedirs`, `isdir`, `exists`)
- [#817][817] Make disconnection detection more robust
-
-[800]: https://github.com/Gallopsled/pwntools/pull/800
-[806]: https://github.com/Gallopsled/pwntools/pull/806
-[809]: https://github.com/Gallopsled/pwntools/pull/809
-[817]: https://github.com/Gallopsled/pwntools/pull/817
-[5d9792f]: https://github.com/Gallopsled/pwntools/commit/5d9792f
-[b83a6c7]: https://github.com/Gallopsled/pwntools/commit/b83a6c7
-[546061e]: https://github.com/Gallopsled/pwntools/commit/546061e
-
-## 3.3.4
-
- [#850][850] and [#846][846] fix issues with `hexdump` and the `phd` command-line utility, when using pipes (e.g. `echo foo | phd`)
- [#852][852] Fixes register ordering in `regsort`
- [#853][853] Fixes the registers restored in `shellcraft.amd64.popad`
-
-[846]: https://github.com/gallopsled/pwntools/pull/846
-[850]: https://github.com/gallopsled/pwntools/pull/850
-[852]: https://github.com/gallopsled/pwntools/pull/852
-[853]: https://github.com/gallopsled/pwntools/pull/853
+To be released on Feb 4, 2017.

 ## 3.3.3

@@ -539,7 +141,7 @@ Multiple bug fixes.
 - [1e414af][1e414af] Added `connect()` alias for `remote()`
    + For example, `io=connect('google.com', 80)`
    + This also works with `tcp(...)` and `udp(...)` aliases
- [869ec42][869ec42] Added `ssh.read()` and `ssh.write()` aliases
+- [869ec42][869ec42] Added `ssh.read()` and `ssh.write()` aiases
 - [2af55c9][2af55c9] `AdbDevice` objects exposed via e.g. `adb.devices()` now offer scoped access to all `adb` module properties
    + It is now possible to e.g. `map(lambda d: d.process(['id']).recvall(), adb.devices())`

@@ -626,7 +228,7 @@ Android support via a new `adb` module, `context.device`, `context.adb_host`, an
 - Added `context.log_file` setting for sending logs to a file.  This can be set with the `LOG_FILE` magic command-line option.
 - Added `context.noptrace` setting for disabling actions which require `ptrace` support.  This is useful for turning all `gdb.debug` and `gdb.attach` options into no-ops, and can be set via the `NOPTRACE` magic command-line option.
 - Added `context.proxy` which hooks all connections and sends them to a SOCKS4/SOCKS5.  This can be set via the `PROXY` magic command-line option.
- Added `context.randomize` to control randomization of settings like XOR keys and register ordering (default off).
+- Added `context.randomize` to control randommization of settings like XOR keys and register ordering (default off).
 - Added `context.terminal` for setting how to launch commands in a new terminal.

 #### DynELF and MemLeak Module
@@ -639,7 +241,7 @@ Android support via a new `adb` module, `context.device`, `context.adb_host`, an
 #### Encoders Module

 - Added a `pwnlib.encoders` module for assembled-shellcode encoders/decoders
- Includes position-independent basic XOR encoders
+- Includes position-indepentent basic XOR encoders
 - Includes position-independent delta encoders
 - Includes non-position-independent alphanumeric encoders for Intel
 - Includes position-independent alphanumeric encoders for ARM/Thumb
@@ -2,6 +2,6 @@ graft examples
 graft extra
 include *.md *.txt *.sh *.yml MANIFEST.in
 recursive-include docs   *.rst *.png Makefile *.py *.txt
-recursive-include pwnlib *.py *.asm *.rst *.md *.txt *.sh __doc__ *.mako
+recursive-include pwnlib *.py *.asm *.rst *.md *.txt *.sh
 recursive-include pwn    *.py *.asm *.rst *.md *.txt *.sh
 recursive-exclude *.pyc
@@ -2,13 +2,13 @@
 ![pwntools logo](https://github.com/Gallopsled/pwntools/blob/stable/docs/source/logo.png?raw=true)

 [![Docs](https://readthedocs.org/projects/pwntools/badge/?version=stable)](https://docs.pwntools.com/)
-[![PyPI](https://img.shields.io/pypi/v/pwntools?style=flat)](https://pypi.python.org/pypi/pwntools/)
+[![PyPI](https://img.shields.io/badge/pypi-v3.3.3-green.svg?style=flat)](https://pypi.python.org/pypi/pwntools/)
 [![Travis](https://travis-ci.org/Gallopsled/pwntools.svg)](https://travis-ci.org/Gallopsled/pwntools)
 [![Coveralls](https://img.shields.io/coveralls/Gallopsled/pwntools/dev.svg)](https://coveralls.io/github/Gallopsled/pwntools?branch=dev)
 [![Twitter](https://img.shields.io/badge/twitter-pwntools-4099FF.svg?style=flat)](https://twitter.com/pwntools)
 [![MIT License](https://img.shields.io/badge/license-MIT-blue.svg?style=flat)](http://choosealicense.com/licenses/mit/)

-Pwntools is a CTF framework and exploit development library. Written in Python, it is designed for rapid prototyping and development, and intended to make exploit writing as simple as possible.
+pwntools is a CTF framework and exploit development library. Written in Python, it is designed for rapid prototyping and development, and intended to make exploit writing as simple as possible.

 ```python
 from pwn import *
@@ -32,15 +32,14 @@ To get you started, we've provided some example solutions for past CTF challenge

 # Installation

-Pwntools is best supported on 64-bit Ubuntu LTE releases (12.04, 14.04, 16.04 and 18.04).  Most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).  Python >= 2.7 is required (Python 3 suggested as best).
+pwntools is best supported on 64-bit Ubuntu 12.04 and 14.04, but most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).  Python 2.7 is required.

 Most of the functionality of pwntools is self-contained and Python-only.  You should be able to get running quickly with

 ```sh
 apt-get update
-apt-get install python3 python3-pip python3-dev git libssl-dev libffi-dev build-essential
-python3 -m pip install --upgrade pip
-python3 -m pip install --upgrade git+https://github.com/Gallopsled/pwntools.git@dev3
+apt-get install python2.7 python-pip python-dev git libssl-dev
+pip install --upgrade pwntools
 ```

 However, some of the features (assembling/disassembling foreign architectures) require non-Python dependencies.  For more information, see the [complete installation instructions here](https://docs.pwntools.com/en/stable/install.html).
@@ -4,6 +4,7 @@ Pwntools makes extensive use of unit tests and integration tests to ensure every

 ## Test Suite

+
 To run the test suite, it is best to use Ubuntu 12.04 or 14.04, and run the following commands.  **Be aware** that this will add a user to the machine, and create a public key for SSH login!

 ```sh
@@ -13,12 +14,6 @@ pip install --upgrade --editable .
 PWNLIB_NOTERM=1 make -C docs doctest
 ```

-## Testing in Docker
-
-A `Dockerfile` has been provided which has a clean testing environment with Ubuntu Xenial.  It is very similar to the online Travis CI testing environment, but uses a more modern version of Ubuntu.
-
-See `travis/docker/README.md` for more information.
-
 ## New Tests

 To add a new test to an existing module, just add an inline doctest.  If the test needs access to an external module, add the import statement to the `testsetup` block in the corresponding file in `docs/source/<module>.rst`.
@@ -44,7 +44,7 @@ def main(args):
 		doc2dash.__main__.main.main( \
 			[ os.path.join(dstdir, "html"), "-d", dstdir, "-n", name, \
 					"-f", "-I", "index.html"], "doc2dash", False)
-	except SystemExit as e:
+	except SystemExit,e:
 		pass

 	# Insert a link to the online version.
@@ -1,17 +1,16 @@
-capstone
-coveralls
-doc2dash
+sphinxcontrib-napoleon
+sphinxcontrib-autoprogram==0.1.2
 isort
-mako>=1.0.0
 paramiko>=1.15.2
-pip>=6.0.8
+mako>=1.0.0
 pyelftools>=0.2.3
-pygments>=2.0
-pypandoc
+capstone
+ropgadget>=5.3
 pyserial>=2.7
 requests>=2.5.1
-ropgadget>=5.3
-sphinx
+pip>=6.0.8
+tox>=1.8.1
+pygments>=2.0
 sphinx_rtd_theme
-sphinxcontrib-napoleon
-sphinxcontrib-autoprogram
+doc2dash
+coveralls
@@ -1,6 +1,5 @@
 .. testsetup:: *

-   from pprint import pprint
   from pwn import *
   adb = pwnlib.adb

@@ -6,7 +6,6 @@
   from pwnlib.asm import *
   from pwnlib import shellcraft
   from pwnlib.tubes.process import process
-   from pwnlib.util.fiddling import unhex


 :mod:`pwnlib.asm` --- Assembler functions
@@ -14,13 +13,3 @@

 .. automodule:: pwnlib.asm
   :members:
-
-Internal Functions
-----------------------------------------
-
-These are only included so that their tests are run.
-
-You should never need these.
-
-.. autofunction:: pwnlib.asm.dpkg_search_for_binutils
-.. autofunction:: pwnlib.asm.print_binutils_instructions
@@ -12,9 +12,6 @@
 # serve to show the default.

 import os
-import doctest
-import signal
-import six
 import subprocess
 import sys

@@ -27,6 +24,8 @@ sys.path.insert(0, os.path.abspath('../..'))

 import pwnlib

+# -- General configuration -----------------------------------------------------
+
 # If your documentation needs a minimal Sphinx version, state it here.
 #needs_sphinx = '1.0'

@@ -45,36 +44,14 @@ extensions = [
    'sphinxcontrib.napoleon'
 ]

-# Disable "info" logging directly to stdout by Sphinx
-import logging
-
-class SphinxPwnlibFilter(logging.Filter):
-    def filter(self, record):
-        if record.name.startswith('pwn'):
-            return False
-        if record.name.startswith('paramiko'):
-            return False
-        return True
-
-log_filter = SphinxPwnlibFilter()
-
-for i, handler in enumerate(logging.root.handlers):
-    print("Filtering Sphinx handler", handler)
-    handler.addFilter(log_filter)
-
-# Napoleon settings
-napoleon_use_ivar = True
-napoleon_use_rtype = False
-
 doctest_global_setup = '''
 import sys, os
 os.environ['PWNLIB_NOTERM'] = '1'
 os.environ['PWNLIB_RANDOMIZE'] = '0'
-import pwnlib, logging
+import pwnlib
 pwnlib.context.context.reset_local()
-pwnlib.context.ContextType.defaults['log_level'] = logging.ERROR
+pwnlib.context.ContextType.defaults['log_level'] = 'ERROR'
 pwnlib.context.ContextType.defaults['randomize'] = False
-pwnlib.util.fiddling.default_style = {}
 pwnlib.term.text.when = 'never'
 pwnlib.log.install_default_handler()
 pwnlib.log.rootlogger.setLevel(1)
@@ -90,13 +67,12 @@ class stdout(object):
 pwnlib.context.ContextType.defaults['log_console'] = stdout()
 '''

-autoclass_content = 'both'
-autodoc_member_order = 'groupwise' # 'alphabetical'
+autodoc_member_order = 'alphabetical'

 # Add any paths that contain templates here, relative to this directory.
 templates_path = ['_templates']

-doctest_test_doctest_blocks = 'true'
+doctest_test_doctest_blocks = True

 # The suffix of source filenames.
 source_suffix = '.rst'
@@ -255,7 +231,7 @@ latex_documents = [
 ]

 intersphinx_mapping = {'python': ('https://docs.python.org/2.7', None),
-                       'paramiko': ('https://paramiko-docs.readthedocs.org/en/2.1/', None)}
+                       'paramiko': ('https://paramiko-docs.readthedocs.org/en/1.15/', None)}

 # The name of an image file (relative to this directory) to place at the top of
 # the title page.
@@ -314,13 +290,13 @@ texinfo_documents = [
 branch = release

 try:
-    git_branch = subprocess.check_output('git describe --tags', shell = True, universal_newlines = True)
+    git_branch = subprocess.check_output('git describe --tags', shell = True)
 except subprocess.CalledProcessError:
    git_branch = '-'

 try:
    if '-' in git_branch:
-        branch = subprocess.check_output('git rev-parse HEAD', shell = True, universal_newlines = True).strip()[:10]
+        branch = subprocess.check_output('git rev-parse HEAD', shell = True).strip()[:10]
 except subprocess.CalledProcessError:
    pass

@@ -348,11 +324,11 @@ def linkcode_resolve(domain, info):
    else:
        filename = info['module'].replace('.', '/') + '.py'

-        if isinstance(val, (types.ModuleType, types.MethodType, types.FunctionType, types.TracebackType, types.FrameType, types.CodeType) + six.class_types):
+        if isinstance(val, (types.ModuleType, types.ClassType, types.MethodType, types.FunctionType, types.TracebackType, types.FrameType, types.CodeType)):
            try:
                lines, first = inspect.getsourcelines(val)
-                filename += '#L%d-L%d' % (first, first + len(lines) - 1)
-            except (IOError, TypeError):
+                filename += '#L%d-%d' % (first, first + len(lines) - 1)
+            except IOError:
                pass

    return "https://github.com/Gallopsled/pwntools/blob/%s/%s" % (branch, filename)
@@ -371,53 +347,3 @@ if build_dash:
        html_theme_path = [sphinx_rtd_theme.get_html_theme_path()]

    # otherwise, readthedocs.org uses their theme by default, so no need to specify it
-
-
-# -- Customization to Sphinx autodoc generation --------------------------------------------
-import sphinx.ext.autodoc
-
-# Test hidden members (e.g. def _foo(...))
-def dont_skip_any_doctests(app, what, name, obj, skip, options):
-    return False
-
-class _DummyClass(object): pass
-
-class Py2OutputChecker(_DummyClass, doctest.OutputChecker):
-    def check_output(self, want, got, optionflags):
-        sup = super(Py2OutputChecker, self).check_output
-        if sup(want, got, optionflags):
-            return True
-        try:
-            rly_want = pwnlib.util.safeeval.const(want)
-            if sup(repr(rly_want), got, optionflags):
-                return True
-            rly_got = pwnlib.util.safeeval.const(got)
-            if rly_want == rly_got:
-                return True
-        except ValueError:
-            pass
-        rly_want = ' '.join(x[:2].replace('b"','"').replace("b'","'")+x[2:] for x in want.replace('\n','\n ').split(' ')).replace('\n ','\n')
-        if sup(rly_want, got, optionflags):
-            return True
-        rly_want = ' '.join(x[:2].replace('b"',' "').replace("b'"," '")+x[2:] for x in want.replace('\n','\n ').split(' ')).replace('\n ','\n')
-        return sup(rly_want, got, optionflags)
-
-def py2_doctest_init(self, checker=None, verbose=None, optionflags=0):
-    if checker is None:
-        checker = Py2OutputChecker()
-    doctest.DocTestRunner.__init__(self, checker, verbose, optionflags)
-
-class EndlessLoop(Exception): pass
-def alrm_handler(sig, frame):
-    signal.alarm(180) # three minutes
-    raise EndlessLoop()
-signal.signal(signal.SIGALRM, alrm_handler)
-signal.alarm(600) # ten minutes
-
-if 'doctest' in sys.argv:
-    def setup(app):
-        app.connect('autodoc-skip-member', dont_skip_any_doctests)
-
-    if sys.version_info[:1] < (3,):
-        import sphinx.ext.doctest
-        sphinx.ext.doctest.SphinxDocTestRunner.__init__ = py2_doctest_init
@@ -1,4 +0,0 @@
-:mod:`pwnlib.config` --- Pwntools Configuration File
-====================================================
-
-.. automodule:: pwnlib.config
@@ -3,31 +3,13 @@
   from pwn import *
   import logging
   log = pwnlib.log.getLogger('pwnlib.context')
-   context.clear()

 :mod:`pwnlib.context` --- Setting runtime variables
 =====================================================

-Many settings in ``pwntools`` are controlled via the global variable :data:`.context`, such as the selected target operating system, architecture, and bit-width.
+.. autodata:: pwnlib.context.context

-In general, exploits will start with something like:
+.. autoclass:: pwnlib.context.ContextType
+    :members:

-.. code-block:: python
-
-    from pwn import *
-    context.arch = 'amd64'
-
-Which sets up everything in the exploit for exploiting a 64-bit Intel binary.
-
-The recommended method is to use ``context.binary``  to automagically set all of the appropriate values.
-
-.. code-block:: python
-
-    from pwn import *
-    context.binary = './challenge-binary'
-
-Module Members
----------------------------------------------------
-
-.. automodule:: pwnlib.context
-   :members:
+.. autoclass:: pwnlib.context.Thread
@@ -3,16 +3,8 @@
   from pwnlib.elf import *
   from pwnlib.util.misc import which

-:mod:`pwnlib.elf` --- ELF Executables and Libraries
-===================================================
+:mod:`pwnlib.elf` --- Working with ELF binaries
+===============================================

 .. automodule:: pwnlib.elf
-
-
-ELF Modules
-------------------
-
-.. toctree::
-    elf/elf
-    elf/config
-    elf/corefile
+   :members:
@@ -1,10 +0,0 @@
-.. testsetup:: *
-
-   from pwn import *
-   from pwnlib.elf.config import parse_kconfig
-
-:mod:`pwnlib.elf.config` --- Kernel Config Parsing
-===========================================================
-
-.. automodule:: pwnlib.elf.config
-  :members:
@@ -1,16 +0,0 @@
-.. testsetup:: *
-
-   from glob import glob
-   from pwn import *
-
-:mod:`pwnlib.elf.corefile` --- Core Files
-===========================================================
-
-.. automodule:: pwnlib.elf.corefile
-
-  .. autoclass:: pwnlib.elf.corefile.Corefile
-     :members:
-     :show-inheritance:
-
-  .. autoclass:: pwnlib.elf.corefile.Mapping
-     :members:
@@ -1,29 +0,0 @@
-.. testsetup:: *
-
-   from pwn import *
-   from glob import glob
-   from pwnlib.elf.maps import CAT_PROC_MAPS_EXIT
-
-:mod:`pwnlib.elf.elf` --- ELF Files
-===========================================================
-
-.. automodule:: pwnlib.elf.elf
-
-  .. autoclass:: pwnlib.elf.elf.ELF
-     :members:
-     :show-inheritance:
-     :inherited-members:
-     :exclude-members: address_offsets,
-                       get_data,
-                       get_dwarf_info,
-                       get_section,
-                       get_segment,
-                       has_dwarf_info,
-                       iter_sections,
-                       iter_segments
-
-  .. autoclass:: pwnlib.elf.elf.Function
-     :members:
-
-  .. autoclass:: pwnlib.elf.elf.dotdict
-     :members:
@@ -1,9 +0,0 @@
-.. testsetup:: *
-
-   from pwnlib.filepointer import *
-
-:mod:`pwnlib.filepointer` --- `FILE*` structure exploitation
-============================================================
-
-.. automodule:: pwnlib.filepointer
-   :members:
@@ -1,9 +1,3 @@
-.. testsetup:: *
-
-    from pwn import *
-    context.arch = 'amd64'
-    context.terminal = [os.path.join(os.path.dirname(pwnlib.__file__), 'gdb_faketerminal.py')]
-
 :mod:`pwnlib.gdb` --- Working with GDB
 ======================================

@@ -13,11 +13,11 @@ Which imports a bazillion things into the global namespace to make your life eas

 This is a quick list of most of the objects and routines imported, in rough order of importance and frequency of use.

- :mod:`pwnlib.context`
+- ``context``
    - :data:`pwnlib.context.context`
    - Responsible for most of the pwntools convenience settings
    - Set `context.log_level = 'debug'` when troubleshooting your exploit
-    - Scope-aware, so you can disable logging for a subsection of code via :meth:`.ContextType.local`
+    - Scope-aware, so you can disable logging for a subsection of code via ``pwnlib.context.ContextType.local``
 - ``remote``, ``listen``, ``ssh``, ``process``
    - :mod:`pwnlib.tubes`
    - Super convenient wrappers around all of the common functionality for CTF challenges
@@ -57,11 +57,11 @@ This is a quick list of most of the objects and routines imported, in rough orde
 - ``gdb.debug`` and ``gdb.attach``
    - :mod:`pwnlib.gdb`
    - Launch a binary under GDB and pop up a new terminal to interact with it.  Automates setting breakpoints and makes iteration on exploits MUCH faster.
-    - Alternately, attach to a running process given a PID, :mod:`pwnlib.tubes` object, or even just a socket that's connected to it
+    - Alternately, attach to a running process given a PID, ``pwnlib.tubes`` object, or even just a socket that's connected to it
 - ``args``
-    - Dictionary containing all-caps command-line arguments for quick access
+    - Dictionary contining all-caps command-line arguments for quick access
    - Run via ``python foo.py REMOTE=1`` and ``args['REMOTE'] == '1'``.
-    - Can also control logging verbosity and terminal fanciness
+    - Can also control logging verbosity and terminal fancyness
        - `NOTERM`
        - `SILENT`
        - `DEBUG`
@@ -78,7 +78,7 @@ This is a quick list of most of the objects and routines imported, in rough orde
    - It's the new ``getch``
 - ``safeeval``
    - :mod:`pwnlib.util.safeeval`
-    - Functions for safely evaluating python code without nasty side-effects.
+    - Functions for safely evalutaing python code without nasty side-effects.

 These are all pretty self explanatory, but are useful to have in the global namespace.

@@ -48,21 +48,16 @@ Each of the ``pwntools`` modules is documented here.
   atexception
   atexit
   constants
-   config
   context
   dynelf
   encoders
   elf
   exception
-   filepointer
   flag
   fmtstr
   gdb
-   libcdb
   log
   memleak
-   protocols
-   qemu
   replacements
   rop
   rop/*
@@ -24,9 +24,7 @@ pwntools is available as a ``pip`` package.

 .. code-block:: bash

-    $ apt-get update
-    $ apt-get install python2.7 python-pip python-dev git libssl-dev libffi-dev build-essential
-    $ pip install --upgrade pip
+    $ apt-get install python2.7 python2.7-dev python-pip
    $ pip install --upgrade pwntools

 Development
@@ -27,14 +27,14 @@ This exposes a standard interface to talk to processes, sockets, serial ports,
 and all manner of things, along with some nifty helpers for common tasks.
 For example, remote connections via :mod:`pwnlib.tubes.remote`.

-    >>> conn = remote('ftp.ubuntu.com',21)
+    >>> conn = remote('ftp.debian.org',21)
    >>> conn.recvline() # doctest: +ELLIPSIS
-    b'220 ...'
-    >>> conn.send(b'USER anonymous\r\n')
-    >>> conn.recvuntil(b' ', drop=True)
-    b'331'
+    '220 ...'
+    >>> conn.send('USER anonymous\r\n')
+    >>> conn.recvuntil(' ', drop=True)
+    '331'
    >>> conn.recvline()
-    b'Please specify the password.\r\n'
+    'Please specify the password.\r\n'
    >>> conn.close()

 It's also easy to spin up a listener
@@ -42,20 +42,20 @@ It's also easy to spin up a listener
    >>> l = listen()
    >>> r = remote('localhost', l.lport)
    >>> c = l.wait_for_connection()
-    >>> r.send(b'hello')
+    >>> r.send('hello')
    >>> c.recv()
-    b'hello'
+    'hello'

 Interacting with processes is easy thanks to :mod:`pwnlib.tubes.process`.

 ::

    >>> sh = process('/bin/sh')
-    >>> sh.sendline(b'sleep 3; echo hello world;')
+    >>> sh.sendline('sleep 3; echo hello world;')
    >>> sh.recvline(timeout=1)
-    b''
+    ''
    >>> sh.recvline(timeout=5)
-    b'hello world\n'
+    'hello world\n'
    >>> sh.close()

 Not only can you interact with processes programmatically, but you can
@@ -72,16 +72,16 @@ a ``process`` tube.

 ::

-    >>> shell = ssh('bandit0', 'bandit.labs.overthewire.org', password='bandit0', port=2220)
+    >>> shell = ssh('bandit0', 'bandit.labs.overthewire.org', password='bandit0')
    >>> shell['whoami']
-    b'bandit0'
+    'bandit0'
    >>> shell.download_file('/etc/motd')
    >>> sh = shell.run('sh')
-    >>> sh.sendline(b'sleep 3; echo hello world;') # doctest: +SKIP
+    >>> sh.sendline('sleep 3; echo hello world;') # doctest: +SKIP
    >>> sh.recvline(timeout=1)
-    b''
+    ''
    >>> sh.recvline(timeout=5)
-    b'hello world\n'
+    'hello world\n'
    >>> shell.close()

 Packing Integers
@@ -97,13 +97,13 @@ unpacking codes, and littering your code with helper routines.
    >>> import struct
    >>> p32(0xdeadbeef) == struct.pack('I', 0xdeadbeef)
    True
-    >>> leet = unhex('37130000')
-    >>> u32(b'abcd') == struct.unpack('I', b'abcd')[0]
+    >>> leet = '37130000'.decode('hex')
+    >>> u32('abcd') == struct.unpack('I', 'abcd')[0]
    True

 The packing/unpacking operations are defined for many common bit-widths.

-    >>> u8(b'A') == 0x41
+    >>> u8('A') == 0x41
    True

 Setting the Target Architecture and OS
@@ -112,9 +112,9 @@ Setting the Target Architecture and OS
 The target architecture can generally be specified as an argument to the routine that requires it.

    >>> asm('nop')
-    b'\x90'
+    '\x90'
    >>> asm('nop', arch='arm')
-    b'\x00\xf0 \xe3'
+    '\x00\xf0 \xe3'

 However, it can also be set once in the global ``context``.  The operating system, word size, and endianness can also be set here.

@@ -126,10 +126,10 @@ However, it can also be set once in the global ``context``.  The operating syste
 Additionally, you can use a shorthand to set all of the values at once.

    >>> asm('nop')
-    b'\x90'
+    '\x90'
    >>> context(arch='arm', os='linux', endian='big', word_size=32)
    >>> asm('nop')
-    b'\xe3 \xf0\x00'
+    '\xe3 \xf0\x00'

 .. doctest::
   :hide:
@@ -158,12 +158,12 @@ Assembly and Disassembly
 Never again will you need to run some already-assembled pile of shellcode
 from the internet!  The :mod:`pwnlib.asm` module is full of awesome.

-    >>> enhex(asm('mov eax, 0'))
+    >>> asm('mov eax, 0').encode('hex')
    'b800000000'

 But if you do, it's easy to suss out!

-    >>> print(disasm(unhex('6a0258cd80ebf9')))
+    >>> print disasm('6a0258cd80ebf9'.decode('hex'))
       0:   6a 02                   push   0x2
       2:   58                      pop    eax
       3:   cd 80                   int    0x80
@@ -176,7 +176,7 @@ loaded with useful time-saving shellcodes.
 Let's say that we want to `setreuid(getuid(), getuid())` followed by `dup`ing
 file descriptor 4 to `stdin`, `stdout`, and `stderr`, and then pop a shell!

-    >>> enhex(asm(shellcraft.setreuid() + shellcraft.dupsh(4))) # doctest: +ELLIPSIS
+    >>> asm(shellcraft.setreuid() + shellcraft.dupsh(4)).encode('hex') # doctest: +ELLIPSIS
    '6a3158cd80...'


@@ -188,10 +188,10 @@ Never write another hexdump, thanks to :mod:`pwnlib.util.fiddling`.

 Find offsets in your buffer that cause a crash, thanks to :mod:`pwnlib.cyclic`.

-    >>> print(cyclic(20).decode())
+    >>> print cyclic(20)
    aaaabaaacaaadaaaeaaa
-    >>> # Assume EIP = 0x62616166 (b'faab' which is pack(0x62616166))  at crash time
-    >>> print(cyclic_find(b'faab'))
+    >>> # Assume EIP = 0x62616166 ('faab' which is pack(0x62616166))  at crash time
+    >>> print cyclic_find('faab')
    120

 ELF Manipulation
@@ -200,22 +200,22 @@ ELF Manipulation
 Stop hard-coding things!  Look them up at runtime with :mod:`pwnlib.elf`.

    >>> e = ELF('/bin/cat')
-    >>> print(hex(e.address)) #doctest: +SKIP
+    >>> print hex(e.address) #doctest: +SKIP
    0x400000
-    >>> print(hex(e.symbols['write'])) #doctest: +SKIP
+    >>> print hex(e.symbols['write']) #doctest: +SKIP
    0x401680
-    >>> print(hex(e.got['write'])) #doctest: +SKIP
+    >>> print hex(e.got['write']) #doctest: +SKIP
    0x60b070
-    >>> print(hex(e.plt['write'])) #doctest: +SKIP
+    >>> print hex(e.plt['write']) #doctest: +SKIP
    0x401680

 You can even patch and save the files.

    >>> e = ELF('/bin/cat')
-    >>> e.read(e.address, 4)
-    b'\x7fELF'
+    >>> e.read(e.address+1, 3)
+    'ELF'
    >>> e.asm(e.address, 'ret')
    >>> e.save('/tmp/quiet-cat')
-    >>> disasm(open('/tmp/quiet-cat','rb').read(1))
+    >>> disasm(file('/tmp/quiet-cat','rb').read(1))
    '   0:   c3                      ret'

@@ -1,10 +0,0 @@
-.. testsetup:: *
-
-   from pwn import *
-   from pwnlib.libcdb import *
-
-:mod:`pwnlib.libcdb` --- Libc Database
-===========================================
-
-.. automodule:: pwnlib.libcdb
-   :members:
@@ -1,9 +1,11 @@
 .. testsetup:: *

-    from pwn import *
+   from pwnlib.memleak import *

 :mod:`pwnlib.memleak` --- Helper class for leaking memory
 =========================================================

-.. automodule:: pwnlib.memleak
-    :members:
+.. module:: pwnlib.memleak
+
+.. autoclass:: MemLeak
+   :members:
@@ -1,15 +0,0 @@
-:mod:`pwnlib.protocols` --- Wire Protocols
-=============================================
-
-.. automodule:: pwnlib.protocols
-
-
-Supported Protocols
-------------------
-
-.. toctree::
-    :maxdepth: 3
-    :glob:
-
-    protocols/*
-
@@ -1,11 +0,0 @@
-.. testsetup:: *
-
-   from pwn import *
-   from pwnlib.protocols.adb import AdbClient
-   AdbClient().wait_for_device()
-
-:mod:`pwnlib.protocols.adb` --- ADB Protocol Implementation
-===========================================================
-
-.. automodule:: pwnlib.protocols.adb
-   :members:
@@ -1,10 +0,0 @@
-.. testsetup:: *
-
-   from pwn import *
-
-
-:mod:`pwnlib.qemu` --- QEMU Utilities
-==========================================
-
-.. automodule:: pwnlib.qemu
-   :members:
@@ -1,19 +0,0 @@
-.. testsetup:: *
-
-   from pwn import *
-   context.clear(arch='aarch64')
-
-:mod:`pwnlib.shellcraft.aarch64` --- Shellcode for AArch64
-===========================================================
-
-:mod:`pwnlib.shellcraft.aarch64`
--------------------------------
-
-.. automodule:: pwnlib.shellcraft.aarch64
-   :members:
-
-:mod:`pwnlib.shellcraft.aarch64.linux`
--------------------------------------
-
-.. automodule:: pwnlib.shellcraft.aarch64.linux
-   :members:
@@ -3,9 +3,3 @@

 .. automodule:: pwnlib.term
   :members:
-
-Term Modules
-------------------
-
-.. toctree::
-    term/readline
@@ -1,10 +0,0 @@
-.. testsetup:: *
-
-   from pwnlib.term.readline import *
-   import io
-
-:mod:`pwnlib.term.readline` --- Terminal nice readline
-======================================================
-
-.. automodule:: pwnlib.term.readline
-   :members:
@@ -27,4 +27,4 @@ Types of Tubes
  .. autoclass:: pwnlib.tubes.tube.tube()
     :members:
     :exclude-members: recv_raw, send_raw, settimeout_raw,
-                       can_recv_raw, shutdown_raw, connected_raw,
+                       can_recv_raw
@@ -1,9 +0,0 @@
-.. testsetup:: *
-
-   from pwnlib.tubes.buffer import *
-
-:mod:`pwnlib.tubes.buffer` --- buffer implementation for tubes
-==============================================================
-
-.. automodule:: pwnlib.tubes.buffer
-   :members:
@@ -1,7 +1,6 @@
 .. testsetup:: *

   from pwn import *
-   from pwnlib.tubes.server import server

 :mod:`pwnlib.tubes.sock` --- Sockets
 ===========================================================
@@ -24,9 +23,3 @@
   .. autoclass:: pwnlib.tubes.listen.listen
      :members:
      :show-inheritance:
-
-.. automodule:: pwnlib.tubes.server
-
-   .. autoclass:: pwnlib.tubes.server.server
-      :members:
-      :show-inheritance:
@@ -1,8 +1,3 @@
-.. testsetup:: *
-
-   from pwn import *
-   import io
-
 :mod:`pwnlib.ui` --- Functions for user interaction
 ===================================================

@@ -1,6 +1,5 @@
 .. testsetup:: *

-   from pwn import *
   from pwnlib.util.cyclic import *


@@ -1,7 +1,6 @@
 .. testsetup:: *

-    from pwn import *
-    from pwnlib.util.fiddling import *
+   from pwnlib.util.fiddling import *


 :mod:`pwnlib.util.fiddling` --- Utilities bit fiddling
@@ -1,11 +0,0 @@
-.. testsetup:: *
-
-   from pwnlib.util.getdents import *
-   from pwnlib.util.fiddling import unhex
-
-
-:mod:`pwnlib.util.getdents` --- Linux binary directory listing
-==============================================================
-
-.. automodule:: pwnlib.util.getdents
-   :members:
@@ -1,6 +1,5 @@
 .. testsetup:: *

-   from pprint import pprint
   from pwnlib.util.misc import *
   import os, subprocess
   os.chdir("..")
@@ -1,7 +1,6 @@
 .. testsetup:: *

   from pwnlib.util.proc import *
-   from pwnlib.tubes.process import process
   import os, sys


@@ -1,7 +1,6 @@
 .. testsetup:: *

   from pwnlib.util.safeeval import *
-   _get_opcodes = pwnlib.util.safeeval._get_opcodes


 :mod:`pwnlib.util.safeeval` --- Safe evaluation of python code
@@ -26,10 +26,6 @@ Try running this example with::
 ```
 Example showing the interface to `pwnlib.asm.asm` and `pwnlib.shellcraft`.
 ```
-* `attach.py`
-```
-Example showing `pwnlib.gdb.attach()`
-```
 * `clean_and_log.py`
 ```
 Use case for `pwnlib.tubes.tube.clean_and_log`.
@@ -69,7 +65,8 @@ Example showing `pwnlib.ui.options()`
 ```
 * `port_forward.py`
 ```
-A very simple port forwarder using `pwnlib.tubes.tube.connect_both()`.
+A very simple port forwarder using `pwnlib.tubes.tube.connect_both()`.  Notice
+that `<>` is just a shorthand.
 ```
 * `readline_completers.py`
 ```
@@ -77,10 +74,6 @@ Example showing pwnlib's readline implementation and a few completers.  This
 part of pwnlib will probably see some major changes soon, but we wanted to show
 off some proof-of-concepts.
 ```
-* `remote.py`
-```
-Example showing how to use the remote class.
-```
 * `remote_gdb_debugging.py`
 ```
 Simple example showing how to use the remote
@@ -110,7 +103,7 @@ and::

  $ TERM=xterm-256color python text.py
 ```
-* `yesno.py`
+* `remote.py`
 ```
-Example showing `pwnlib.ui.yesno()`
+Example showing how to use the remote class.
 ```
@@ -1,25 +1,22 @@
-from __future__ import print_function
-
-import gdb
-from pwn import adb, context
+from pwn import *

 # Tell pwntools that the target is an Android device
-context.os = "android"
-context.arch = "aarch64"  # or 'arm'
+context.os='android'
+context.arch='aarch64' # or 'arm'

 # Optionally, set the remote ADB server address
-context.adb_host = "172.16.110.1"
+context.adb_host='172.16.110.1'

 # Wait for a device to become available
-print(adb.wait_for_device())
+print adb.wait_for_device()

 # Who am I?
-print(adb.process("id").recvall().strip())
+print adb.process('id').recvall().strip()

 # Interactive sessions!
 io = adb.shell()
-io.sendline("echo Hello, world; exit")
-print(io.recvall().replace("\r\n", "\n").strip())
+io.sendline('echo Hello, world; exit')
+print io.recvall().replace('\r\n', '\n').strip()

 # Debugging!
-gdb.debug("sh").interactive()
+gdb.debug('sh').interactive()
@@ -14,5 +14,5 @@ Try running this example with::

 from pwn import *

-print(args['RHOST'] or 'RHOST is not set')
-print(args['RPORT'] or 'RPORT is not set')
+print args['RHOST'] or 'RHOST is not set'
+print args['RPORT'] or 'RPORT is not set'
@@ -9,5 +9,5 @@ context(arch='i386', os='linux')
 shellcode = shellcraft.i386_to_amd64()
 shellcode_asm = asm(shellcode)

-print(enhex(shellcode_asm))
-print(disasm(shellcode_asm))
+print enhex(shellcode_asm)
+print disasm(shellcode_asm)
@@ -5,7 +5,7 @@ Example showing `pwnlib.gdb.attach()`
 from pwn import *

 bash = process('/bin/bash')
-gdb.attach(bash, gdbscript = '''
+gdb.attach(bash, execute = '''
 p "hello from pwnlib"
 c
 ''')
@@ -25,4 +25,4 @@ atexit.register(r.clean_and_log)

 while True:
    line = r.recvline()
-    print(re.findall('^prefix (\S+)$', line)[0])
+    print re.findall('^prefix (\S+)$', line)[0]
@@ -1,51 +0,0 @@
-CFLAGS := -Wno-unused-result -Wno-format-security
-TARGETS := printf.mips printf.mips64 printf.mipsel printf.mips64el printf.arm printf.aarch64 \
-	         printf.ppc printf.ppc64 printf.sparc64 printf.native printf.native32
-
-.PHONY: run
-run: all
-	./exploit.py
-
-.PHONY: all
-all: $(TARGETS)
-
-.PHONY: clean
-clean:
-	rm -f $(TARGETS)
-
-# mips variants
-%.mips: %.c
-	mips-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
-%.mipsel: %.c
-	mipsel-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
-%.mips64: %.c
-	mips64-linux-gnuabi64-gcc $(CFLAGS) -static -Os -o "$@" $^
-%.mips64el: %.c
-	mips64el-linux-gnuabi64-gcc $(CFLAGS) -static -Os -o "$@" $^
-
-# arm variants
-%.arm: %.c
-	arm-linux-gnueabi-gcc $(CFLAGS) -static -Os -o "$@" $^
-%.aarch64: %.c
-	aarch64-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
-
-# ppc variants
-%.ppc: %.c
-	powerpc-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
-%.ppc64: %.c
-	powerpc64-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
-
-# sparc variants
-%.sparc64: %.c
-	sparc64-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
-
-# native variants
-%.native: %.c
-	gcc $(CFLAGS) -o "$@" $^
-%.native32: %.c
-	i686-linux-gnu-gcc $(CFLAGS) -o "$@" $^
-
-# install deps on ubuntu xenial
-.PHONY: install-apt
-install-apt:
-	apt-get install -y make gcc-mips64el-linux-gnuabi64 gcc-sparc64-linux-gnu gcc-powerpc64-linux-gnu gcc-powerpc-linux-gnu gcc-arm-linux-gnueabi gcc-aarch64-linux-gnu gcc-mips64-linux-gnuabi64 gcc-mipsel-linux-gnu gcc-mips64el-linux-gnuabi64 gcc-mips-linux-gnu gcc-i686-linux-gnu gcc
@@ -1,39 +0,0 @@
-#!/usr/bin/env python2
-from pwn import *
-
-@context.quiet
-def exec_fmt(payload):
-    p = context.binary.process()
-    p.sendline(payload)
-    return p.recvall()
-
-def exploit(binary):
-    context.binary = ELF(binary)
-    autofmt = FmtStr(exec_fmt)
-    offset = autofmt.offset
-    with context.binary.process() as p:
-        addr = unpack(p.recv(context.bytes))
-        payload = fmtstr_payload(offset, {addr: p32(0x1337babe)})
-        p.sendline(payload)
-        p.recvuntil("DONE")
-        print(hex(u32(p.recv(4))))
-
-binaries = [
-    "printf.mips",
-    "printf.mips64",
-    "printf.mipsel",
-    "printf.mips64el",
-    "printf.native",
-    "printf.native32",
-    "printf.ppc",
-    "printf.ppc64",
-    "printf.sparc64",
-    "printf.arm",
-    "printf.aarch64",
-]
-
-if len(sys.argv) > 1:
-    binaries = sys.argv[1:]
-
-for binary in binaries:
-    exploit(binary)
@@ -1,29 +0,0 @@
-#ifdef _FORTIFY_SOURCE
-#undef _FORTIFY_SOURCE
-#endif
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <sys/mman.h>
-#define MEMORY_ADDRESS ((void*)0x11110000)
-#define MEMORY_SIZE 1024
-#define TARGET ((int *) 0x11110100)
-int main(int argc, char const *argv[])
-{
-       char buff[1024];
-       void *ptr = NULL;
-       int *my_var = TARGET;
-       ptr = mmap(MEMORY_ADDRESS, MEMORY_SIZE, PROT_READ|PROT_WRITE, MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE, 0, 0);
-       if(ptr != MEMORY_ADDRESS)
-       {
-               perror("mmap");
-               return EXIT_FAILURE;
-       }
-       *my_var = 0x41414141;
-       write(1, &my_var, sizeof(int *));
-       scanf("%s", buff);
-       dprintf(2, buff);
-       write(1, "DONE", 4);
-       write(1, my_var, sizeof(int));
-       return 0;
-}
@@ -24,7 +24,7 @@ def append_example(_arg, top, names):
            continue
        path = os.path.join(top, name)[2:] # strip './'
        log.info('-> %s' % path)
-        data = read(path).strip().decode()
+        data = read(path).strip()
        if data[0:3] not in ('"""', "'''"):
            log.warning('  Has no docstring!')
            continue
@@ -37,7 +37,6 @@ def append_example(_arg, top, names):
        out += '* `%s`\n' % path
        out += '```%s```\n' % doc

-for path, dirs, files in os.walk('.', onerror=None):
-    append_example(dirs, path, sorted(files))
+os.path.walk('.', append_example, None)

 write('README.md', out)
@@ -5,4 +5,4 @@ Example showing `pwnlib.ui.options()`
 from pwn import *

 opts = [string.letters[x] for x in range(10)]
-print('You choose "%s"' % opts[options('Pick one:', opts)])
+print 'You choose "%s"' % opts[options('Pick one:', opts)]
@@ -1,10 +1,11 @@
 """
-A very simple port forwarder using `pwnlib.tubes.tube.connect_both()`.
+A very simple port forwarder using `pwnlib.tubes.tube.connect_both()`.  Notice
+that `<>` is just a shorthand.
 """

 from pwn import *

 while True:
-    listen(1337).wait_for_connection().connect_both(remote('google.com', 80))
+    listen(1337).wait_for_connection() <> remote('google.com', 80)

 # now point your browser (or curl(1)) to http://localhost:1337
@@ -19,13 +19,13 @@ c1 = LongestPrefixCompleter([
 c2 = PathCompleter(mask = '*.py')

 with c1:
-    print('type "exit" to exit')
+    print 'type "exit" to exit'
    while True:
        s = term.readline.readline(prompt = '> ').strip()
        if s in ('exit', 'enough!'):
            break
-        print('You wrote', s)
+        print 'You wrote', s
 with c2:
-    print('choose a file')
+    print 'choose a file'
    s = term.readline.readline(prompt = text.bold_green('$ ')).strip()
-    print('You picked', s)
+    print 'You picked', s
@@ -6,6 +6,6 @@ from pwn import *

 sock = remote('127.0.0.1', 9001)

-print(sock.recvline())
+print sock.recvline()
 sock.send('foo')
 sock.interactive()
@@ -8,10 +8,10 @@ import getpass
 from pwn import *

 s = ssh(getpass.getuser(), '127.0.0.1', port = 22, keyfile = "~/.ssh/id_rsa")
-c = gdb.ssh_gdb(s, '/bin/sh', gdbscript = '''
+c = gdb.ssh_gdb(s, '/bin/sh', execute = '''
 p/x $pc
 c''')

 c.sendline('ls -la')
 c.sendline('exit')
-print(c.recvall())
+print c.recvall()
@@ -1,31 +0,0 @@
-from pwn import *
-context.arch='aarch64'
-frame = SigreturnFrame()
-
-registers = ['x%i' % i for i in range(0, 31)]
-registers += ['sp', 'pc']
-
-
-for index, register in enumerate(registers):
-    setattr(frame, register, index)
-
-assembly = '\n'.join([
-    shellcraft.read(constants.STDIN_FILENO, 'sp', 1024),
-    shellcraft.syscall(constants.SYS_rt_sigreturn)
-])
-
-binary = ELF.from_assembly(assembly)
-
-io = binary.process()
-io.flat(frame)
-io.wait()
-assert io.poll() == -11
-
-corefile = io.corefile
-
-for index, register in enumerate(registers):
-    value = getattr(corefile, register)
-    if index != value:
-        log.error("%s != %i (%i)" % (register, index, value))
-    else:
-        log.success("%s == %i" % (register, value))
@@ -1,32 +0,0 @@
-from pwn import *
-context.arch='amd64'
-frame = SigreturnFrame()
-
-registers = ['rax', 'rbx', 'rcx', 'rdx',
-             'rdi', 'rsi', 'rbp', 'rsp',
-             'rip',
-             'r8', 'r9', 'r10', 'r11', 'r12', 'r13', 'r14', 'r15']
-
-for index, register in enumerate(registers):
-    setattr(frame, register, index)
-
-assembly = '\n'.join([
-    shellcraft.read(constants.STDIN_FILENO, 'rsp', 1024),
-    shellcraft.sigreturn()
-])
-
-binary = ELF.from_assembly(assembly)
-
-io = binary.process()
-io.flat(frame)
-io.wait()
-assert io.poll() == -11
-
-corefile = io.corefile
-
-for index, register in enumerate(registers):
-    value = getattr(corefile, register)
-    if index != value:
-        log.error("%s != %i (%i)" % (register, index, value))
-    else:
-        log.success("%s == %i" % (register, value))
@@ -1,32 +0,0 @@
-from pwn import *
-
-context.arch='arm'
-frame = SigreturnFrame()
-
-registers = ['r0', 'r1', 'r2', 'r3', 'r4', 'r5', 'r6', 'r7',
-             'r8', 'r9', 'r10', 'fp', 'ip', 'sp', 'pc', 'lr']
-
-
-for index, register in enumerate(registers):
-    setattr(frame, register, index)
-
-assembly = '\n'.join([
-    shellcraft.read(constants.STDIN_FILENO, 'sp', 1024),
-    shellcraft.sigreturn()
-])
-
-binary = ELF.from_assembly(assembly)
-
-io = binary.process()
-io.flat(frame)
-io.wait()
-assert io.poll() == -11
-
-corefile = io.corefile
-
-for index, register in enumerate(registers):
-    value = getattr(corefile, register)
-    if index != value:
-        log.error("%s != %i (%i)" % (register, index, value))
-    else:
-        log.success("%s == %i" % (register, value))
@@ -1,31 +0,0 @@
-from pwn import *
-context.kernel='amd64'
-frame = SigreturnFrame()
-
-registers = ['eax', 'ebx', 'ecx', 'edx',
-             'edi', 'esi', 'ebp', 'esp',
-             'eip']
-
-for index, register in enumerate(registers):
-    setattr(frame, register, index)
-
-assembly = '\n'.join([
-    shellcraft.read(constants.STDIN_FILENO, 'esp', 1024),
-    shellcraft.sigreturn()
-])
-
-binary = ELF.from_assembly(assembly)
-
-io = binary.process()
-io.flat(frame)
-io.wait()
-assert io.poll() == -11
-
-corefile = io.corefile
-
-for index, register in enumerate(registers):
-    value = getattr(corefile, register)
-    if index != value:
-        log.error("%s != %i (%i)" % (register, index, value))
-    else:
-        log.success("%s == %i" % (register, value))
@@ -10,7 +10,7 @@ n = 1
 h = log.waitfor('spinners running', status = str(n))

 hs = []
-print('type "q" to quit')
+print 'type "q" to quit'
 while True:
    s = raw_input('> ')
    if s == 'q':
@@ -4,7 +4,7 @@ Example showing how to use the ssh class.

 from pwn import *

-shell = ssh(host='bandit.labs.overthewire.org',user='bandit0',password='bandit0', port=2220)
+shell = ssh(host='bandit.labs.overthewire.org',user='bandit0',password='bandit0')

 # Show basic command syntax
 log.info("username: %s" % shell.whoami())
@@ -14,7 +14,7 @@ log.info("pwd: %s" % shell.pwd())
 tube = shell.run('cat')
 tube.send("Hello, cat")
 tube.shutdown("out")
-print(tube.recvall())
+print tube.recvall()

 # Show automatic working directories
 shell.set_working_directory()
@@ -29,12 +29,12 @@ int main() {

 shell.gcc(['example.c','-o','example'])

-print(shell['./example'])
+print shell['./example']

 # Show the different styles of calling
-print(shell.echo("single string"))
-print(shell.echo(["list","of","strings"]))
-print(shell["echo single statement"])
+print shell.echo("single string")
+print shell.echo(["list","of","strings"])
+print shell["echo single statement"]

 # Show off the interactive shell
 shell.interactive()
@@ -12,8 +12,8 @@ and::
 from pwn import *

 s = 'hello from pwntools'
-print(text.black_on_green(s))
-print(text.black_on_bright_green(s))
-print(text.green_on_black(s))
-print(text.bright_green_on_black(s))
-print(text.bold_green_on_black(s))
+print text.black_on_green(s)
+print text.black_on_bright_green(s)
+print text.green_on_black(s)
+print text.bright_green_on_black(s)
+print text.bold_green_on_black(s)
@@ -5,6 +5,6 @@ Example showing `pwnlib.ui.yesno()`
 from pwn import *

 if ui.yesno('Do you like Pwntools?'):
-    print(':D')
+    print ':D'
 else:
-    print(':(')
+    print ':('
@@ -0,0 +1,58 @@
+############################################################
+# Dockerfile to build Pwntools container
+# Based on Ubuntu
+############################################################
+
+FROM ubuntu:trusty
+MAINTAINER Maintainer Gallopsled et al.
+
+RUN apt-get update && apt-get install -y software-properties-common
+RUN apt-add-repository --yes ppa:pwntools/binutils
+RUN apt-get update
+RUN apt-get install -y \
+	binutils \
+	binutils-aarch64-linux-gnu \
+	binutils-arm-linux-gnueabihf \
+	curl \
+	gdb \
+	gdbserver \
+	gdb-multiarch \
+	git \
+	libc6-i386 \
+	libc6-arm64-cross \
+	libc6-armhf-cross \
+	libc6-dev-i386 \
+	libffi-dev \
+	libglib2.0-dev \
+	libncurses5-dev \
+	libncursesw5-dev \
+	ltrace \
+	python-dev \
+	python-pip \
+	python3-pip \
+	python2.7 \
+	qemu \
+	qemu-user-static \
+	strace \
+	tmux \
+	wget
+RUN pip install --upgrade ipython
+RUN useradd -m zerocool
+RUN usermod -U zerocool
+
+RUN mkdir -p /etc/qemu-binfmt
+RUN ln -s /usr/aarch64-linux-gnu /etc/qemu-binfmt/aarch64
+RUN ln -s /usr/arm-linux-gnueabihf /etc/qemu-binfmt/arm
+
+RUN pip install --upgrade pip pycparser psutil python-ptrace
+RUN pip3 install --upgrade pip pycparser psutil python-ptrace
+
+RUN pip install --upgrade git+https://github.com/Gallopsled/pwntools.git
+
+RUN locale-gen en_US.UTF-8
+ENV LANG en_US.UTF-8
+ENV LANGUAGE en_US:en
+ENV LC_ALL en_US.UTF-8
+
+RUN chown -R zerocool.zerocool /home/zerocool
+RUN chsh -s /bin/bash zerocool
@@ -1,13 +0,0 @@
-subdirs=xenial stable $(wildcard */)
-makefiles=$(wildcard */Makefile)
-tags=base stable beta dev
-
-all: $(makefiles) $(subdirs)
-
-$(subdirs):
-	docker build -t pwntools/pwntools:$(shell basename $(@)) "$@"
-
-$(makefiles):
-	make -C $(shell dirname $@)
-
-.PHONY: all $(subdirs) $(makefiles)
@@ -1 +0,0 @@
-xenial
@@ -1,6 +0,0 @@
-FROM pwntools/pwntools:stable
-
-USER root
-RUN pip install --upgrade git+https://github.com/Gallopsled/pwntools@beta
-RUN PWNLIB_NOTERM=1 pwn update
-USER pwntools
@@ -1,6 +0,0 @@
-FROM pwntools/pwntools:stable
-
-USER root
-RUN pip install --upgrade git+https://github.com/Gallopsled/pwntools@dev
-RUN PWNLIB_NOTERM=1 pwn update
-USER pwntools
@@ -1,26 +0,0 @@
-############################################################
-# Dockerfile to build Pwntools container
-# Based on Ubuntu
-############################################################
-
-FROM kalilinux/kali-linux-docker
-MAINTAINER Maintainer Gallopsled et al.
-
-RUN apt-get update \
-    && apt-get install -y \
-        build-essential \
-        git \
-        libssl-dev \
-        libffi-dev \
-        python2.7 \
-        python-pip \
-        python-dev \
-    && pip install --upgrade pip \
-    && python -m pip install --upgrade pwntools \
-    && PWNLIB_NOTERM=1 pwn update \
-    && apt-get install -y sudo \
-    && useradd -m pwntools \
-    && passwd --delete --unlock pwntools \
-    && echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
-USER pwntools
-WORKDIR /home/pwntools
@@ -1,8 +0,0 @@
-all: Dockerfile
-
-Dockerfile: ../xenial/Dockerfile FORCE
-	sed "s|ubuntu:xenial|kalilinux/kali-linux-docker|" < "$<" > "$@"
-
-FORCE:
-
-.PHONY: all
@@ -1,26 +0,0 @@
-############################################################
-# Dockerfile to build Pwntools container
-# Based on Ubuntu
-############################################################
-
-FROM ubuntu:precise
-MAINTAINER Maintainer Gallopsled et al.
-
-RUN apt-get update \
-    && apt-get install -y \
-        build-essential \
-        git \
-        libssl-dev \
-        libffi-dev \
-        python2.7 \
-        python-pip \
-        python-dev \
-    && pip install --upgrade pip \
-    && python -m pip install --upgrade pwntools \
-    && PWNLIB_NOTERM=1 pwn update \
-    && apt-get install -y sudo \
-    && useradd -m pwntools \
-    && passwd --delete --unlock pwntools \
-    && echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
-USER pwntools
-WORKDIR /home/pwntools
@@ -1,8 +0,0 @@
-all: Dockerfile
-
-Dockerfile: ../xenial/Dockerfile FORCE
-	sed "s|ubuntu:xenial|ubuntu:precise|" < "$<" > "$@"
-
-FORCE:
-
-.PHONY: all
@@ -1,6 +0,0 @@
-FROM pwntools/pwntools:base
-
-USER root
-RUN pip install --upgrade git+https://github.com/Gallopsled/pwntools@stable
-RUN PWNLIB_NOTERM=1 pwn update
-USER pwntools
@@ -1,26 +0,0 @@
-############################################################
-# Dockerfile to build Pwntools container
-# Based on Ubuntu
-############################################################
-
-FROM ubuntu:trusty
-MAINTAINER Maintainer Gallopsled et al.
-
-RUN apt-get update \
-    && apt-get install -y \
-        build-essential \
-        git \
-        libssl-dev \
-        libffi-dev \
-        python2.7 \
-        python-pip \
-        python-dev \
-    && pip install --upgrade pip \
-    && python -m pip install --upgrade pwntools \
-    && PWNLIB_NOTERM=1 pwn update \
-    && apt-get install -y sudo \
-    && useradd -m pwntools \
-    && passwd --delete --unlock pwntools \
-    && echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
-USER pwntools
-WORKDIR /home/pwntools
@@ -1,8 +0,0 @@
-all: Dockerfile
-
-Dockerfile: ../xenial/Dockerfile FORCE
-	sed "s|ubuntu:xenial|ubuntu:trusty|" < "$<" > "$@"
-
-FORCE:
-
-.PHONY: all
@@ -1,26 +0,0 @@
-############################################################
-# Dockerfile to build Pwntools container
-# Based on Ubuntu
-############################################################
-
-FROM ubuntu:xenial
-MAINTAINER Maintainer Gallopsled et al.
-
-RUN apt-get update \
-    && apt-get install -y \
-        build-essential \
-        git \
-        libssl-dev \
-        libffi-dev \
-        python2.7 \
-        python-pip \
-        python-dev \
-    && pip install --upgrade pip \
-    && python -m pip install --upgrade pwntools \
-    && PWNLIB_NOTERM=1 pwn update \
-    && apt-get install -y sudo \
-    && useradd -m pwntools \
-    && passwd --delete --unlock pwntools \
-    && echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
-USER pwntools
-WORKDIR /home/pwntools
@@ -1,11 +1,8 @@
 # Promote useful stuff to toplevel
-from __future__ import absolute_import
-
-from pwn.toplevel import *
+from .toplevel import *

 pwnlib.args.initialize()
 pwnlib.log.install_default_handler()
-pwnlib.config.initialize()

 log = pwnlib.log.getLogger('pwnlib.exploit')
 args = pwnlib.args.args
@@ -21,19 +21,18 @@ import pwnlib
 from pwnlib import *
 from pwnlib.asm import *
 from pwnlib.context import Thread
-from pwnlib.context import context, LocalContext
+from pwnlib.context import context
 from pwnlib.dynelf import DynELF
 from pwnlib.encoders import *
-from pwnlib.elf.corefile import Core, Corefile, Coredump
-from pwnlib.elf.elf import ELF, load
+from pwnlib.elf import Core
+from pwnlib.elf import ELF
+from pwnlib.elf import load
 from pwnlib.encoders import *
 from pwnlib.exception import PwnlibException
-from pwnlib.gdb import attach, debug, debug_assembly, debug_shellcode
-from pwnlib.filepointer import *
 from pwnlib.flag import *
 from pwnlib.fmtstr import FmtStr, fmtstr_payload
 from pwnlib.log import getLogger
-from pwnlib.memleak import MemLeak, RelativeMemLeak
+from pwnlib.memleak import MemLeak
 from pwnlib.regsort import *
 from pwnlib.replacements import *
 from pwnlib.rop import ROP
@@ -41,10 +40,9 @@ from pwnlib.rop.srop import SigreturnFrame
 from pwnlib.runner import *
 from pwnlib.timeout import Timeout
 from pwnlib.tubes.listen import listen
-from pwnlib.tubes.process import process, PTY, PIPE, STDOUT
+from pwnlib.tubes.process import process
 from pwnlib.tubes.remote import remote, tcp, udp, connect
 from pwnlib.tubes.serialtube import serialtube
-from pwnlib.tubes.server import server
 from pwnlib.tubes.ssh import ssh
 from pwnlib.tubes.tube import tube
 from pwnlib.ui import *
@@ -68,8 +66,15 @@ from pwnlib.util.web import *

 # Promote these modules, so that "from pwn import *" will let you access them

-from six.moves import cPickle as pickle, cStringIO as StringIO
-from six import BytesIO
+try:
+    import cPickle as pickle
+except ImportError:
+    import pickle
+
+try:
+    from cStringIO import StringIO
+except ImportError:
+    from StringIO import StringIO

 error   = log.error
 warning = log.warning
@@ -77,5 +82,3 @@ warn    = log.warning
 info    = log.info
 debug   = log.debug
 success = log.success
-
-__all__ = [x for x in globals().keys() if x != '__name__']
@@ -1,8 +1,6 @@
-from __future__ import absolute_import
-
 import importlib

-from pwnlib.version import __version__
+from .version import __version__

 version = __version__

@@ -14,7 +12,6 @@ __all__ = [
    'commandline',
    'constants',
    'context',
-    'data',
    'dynelf',
    'encoders',
    'elf',
@@ -1,9 +1,6 @@
 # -*- coding: utf-8 -*-
-from __future__ import absolute_import
-from __future__ import division
-
-from pwnlib.context import LocalContext
-from pwnlib.context import context
+from .context import LocalContext
+from .context import context


 class ABI(object):
@@ -27,8 +24,7 @@ class ABI(object):
    #: Indicates that this ABI returns to the next address on the slot
    returns            = True

-    def __init__(self, stack, regs, align, minimum):
-        self.stack              = stack
+    def __init__(self, regs, align, minimum):
        self.register_arguments = regs
        self.arg_alignment      = align
        self.stack_minimum      = minimum
@@ -36,26 +32,12 @@ class ABI(object):
    @staticmethod
    @LocalContext
    def default():
-        if context.os == 'android':
-            context.os = 'linux'
-
        return {
        (32, 'i386', 'linux'):  linux_i386,
-        (64, 'aarch64', 'linux'): linux_aarch64,
        (64, 'amd64', 'linux'): linux_amd64,
        (32, 'arm', 'linux'):   linux_arm,
        (32, 'thumb', 'linux'):   linux_arm,
        (32, 'mips', 'linux'):   linux_mips,
-        (32, 'powerpc', 'linux'): linux_ppc,
-        (64, 'powerpc', 'linux'): linux_ppc64,
-        (32, 'i386', 'freebsd'):  freebsd_i386,
-        (64, 'aarch64', 'freebsd'): freebsd_aarch64,
-        (64, 'amd64', 'freebsd'): freebsd_amd64,
-        (32, 'arm', 'freebsd'):   freebsd_arm,
-        (32, 'thumb', 'freebsd'):   freebsd_arm,
-        (32, 'mips', 'freebsd'):   freebsd_mips,
-        (32, 'powerpc', 'freebsd'): freebsd_ppc,
-        (64, 'powerpc', 'freebsd'): freebsd_ppc64,
        (32, 'i386', 'windows'):  windows_i386,
        (64, 'amd64', 'windows'): windows_amd64,
        }[(context.bits, context.arch, context.os)]
@@ -63,47 +45,22 @@ class ABI(object):
    @staticmethod
    @LocalContext
    def syscall():
-        if context.os == 'android':
-            context.os = 'linux'
-
        return {
        (32, 'i386', 'linux'):  linux_i386_syscall,
        (64, 'amd64', 'linux'): linux_amd64_syscall,
-        (64, 'aarch64', 'linux'): linux_aarch64_syscall,
        (32, 'arm', 'linux'):   linux_arm_syscall,
        (32, 'thumb', 'linux'):   linux_arm_syscall,
        (32, 'mips', 'linux'):   linux_mips_syscall,
-        (64, 'aarch64', 'linux'):   linux_aarch64_syscall,
-        (32, 'powerpc', 'linux'): linux_ppc_syscall,
-        (64, 'powerpc', 'linux'): linux_ppc64_syscall,
-        (32, 'i386', 'freebsd'):  freebsd_i386_syscall,
-        (64, 'amd64', 'freebsd'): freebsd_amd64_syscall,
-        (64, 'aarch64', 'freebsd'): freebsd_aarch64_syscall,
-        (32, 'arm', 'freebsd'):   freebsd_arm_syscall,
-        (32, 'thumb', 'freebsd'):   freebsd_arm_syscall,
-        (32, 'mips', 'freebsd'):   freebsd_mips_syscall,
-        (64, 'aarch64', 'freebsd'):   freebsd_aarch64_syscall,
-        (32, 'powerpc', 'freebsd'): freebsd_ppc_syscall,
-        (64, 'powerpc', 'freebsd'): freebsd_ppc64_syscall,
        }[(context.bits, context.arch, context.os)]

    @staticmethod
    @LocalContext
    def sigreturn():
-        if context.os == 'android':
-            context.os = 'linux'
-
        return {
        (32, 'i386', 'linux'):  linux_i386_sigreturn,
        (64, 'amd64', 'linux'): linux_amd64_sigreturn,
        (32, 'arm', 'linux'):   linux_arm_sigreturn,
        (32, 'thumb', 'linux'):   linux_arm_sigreturn,
-        (64, 'aarch64', 'linux'):   linux_aarch64_sigreturn,
-        (32, 'i386', 'freebsd'):  freebsd_i386_sigreturn,
-        (64, 'amd64', 'freebsd'): freebsd_amd64_sigreturn,
-        (32, 'arm', 'freebsd'):   freebsd_arm_sigreturn,
-        (32, 'thumb', 'freebsd'):   freebsd_arm_sigreturn,
-        (64, 'aarch64', 'freebsd'):   freebsd_aarch64_sigreturn,
        }[(context.bits, context.arch, context.os)]

 class SyscallABI(ABI):
@@ -111,9 +68,9 @@ class SyscallABI(ABI):
    The syscall ABI treats the syscall number as the zeroth argument,
    which must be loaded into the specified register.
    """
-    def __init__(self, *a, **kw):
-        super(SyscallABI, self).__init__(*a, **kw)
-        self.syscall_register = self.register_arguments[0]
+    def __init__(self, register_arguments, *a, **kw):
+        super(SyscallABI, self).__init__(register_arguments, *a, **kw)
+        self.syscall_register = register_arguments[0]

 class SigreturnABI(SyscallABI):
    """
@@ -124,61 +81,26 @@ class SigreturnABI(SyscallABI):
    returns = False


-# System V ABI used by many UNIXes
-linux_i386   = ABI('esp', [], 4, 0)
-linux_amd64  = ABI('rsp', ['rdi','rsi','rdx','rcx','r8','r9'], 8, 0)
-linux_arm    = ABI('sp', ['r0', 'r1', 'r2', 'r3'], 8, 0)
-linux_aarch64 = ABI('sp', ['x0', 'x1', 'x2', 'x3'], 16, 0)
-linux_mips  = ABI('$sp', ['$a0','$a1','$a2','$a3'], 4, 0)
-linux_ppc = ABI('sp', ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 4, 0)
-linux_ppc64 = ABI('sp', ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 8, 0)
+linux_i386   = ABI([], 4, 0)
+linux_amd64  = ABI(['rdi','rsi','rdx','rcx','r8','r9'], 8, 0)
+linux_arm    = ABI(['r0', 'r1', 'r2', 'r3'], 8, 0)
+linux_aarch64 = ABI(['x0', 'x1', 'x2', 'x3'], 16, 0)
+linux_mips  = ABI(['$a0','$a1','$a2','$a3'], 4, 0)

-sysv_i386 = linux_i386
-sysv_amd64 = linux_amd64
-sysv_arm = linux_arm
-sysv_aarch64 = linux_aarch64
-sysv_mips = linux_mips
-sysv_ppc = linux_ppc
-sysv_ppc64 = linux_ppc64
+linux_i386_syscall = SyscallABI(['eax', 'ebx', 'ecx', 'edx', 'esi', 'edi', 'ebp'], 4, 0)
+linux_amd64_syscall = SyscallABI(['rax','rdi', 'rsi', 'rdx', 'r10', 'r8', 'r9'],   8, 0)
+linux_arm_syscall   = SyscallABI(['r7', 'r0', 'r1', 'r2', 'r3', 'r4', 'r5', 'r6'], 4, 0)
+linux_aarch64_syscall   = SyscallABI(['x8', 'x0', 'x1', 'x2', 'x3', 'x4', 'x5', 'x6'], 16, 0)
+linux_mips_syscall  = ABI(['$v0', '$a0','$a1','$a2','$a3'], 4, 0)

-linux_i386_syscall = SyscallABI('esp', ['eax', 'ebx', 'ecx', 'edx', 'esi', 'edi', 'ebp'], 4, 0)
-linux_amd64_syscall = SyscallABI('rsp', ['rax', 'rdi', 'rsi', 'rdx', 'r10', 'r8', 'r9'],   8, 0)
-linux_arm_syscall   = SyscallABI('sp', ['r7', 'r0', 'r1', 'r2', 'r3', 'r4', 'r5', 'r6'], 4, 0)
-linux_aarch64_syscall   = SyscallABI('sp', ['x8', 'x0', 'x1', 'x2', 'x3', 'x4', 'x5', 'x6'], 16, 0)
-linux_mips_syscall  = SyscallABI('$sp', ['$v0','$a0','$a1','$a2','$a3'], 4, 0)
-linux_ppc_syscall = ABI('sp', ['r0', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9'], 4, 0)
-linux_ppc64_syscall = ABI('sp', ['r0', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9'], 8, 0)
+linux_i386_sigreturn = SigreturnABI(['eax'], 4, 0)
+linux_amd64_sigreturn = SigreturnABI(['rax'], 4, 0)
+linux_arm_sigreturn = SigreturnABI(['r7'], 4, 0)

-linux_i386_sigreturn = SigreturnABI('esp', ['eax'], 4, 0)
-linux_amd64_sigreturn = SigreturnABI('rsp', ['rax'], 4, 0)
-linux_arm_sigreturn = SigreturnABI('sp', ['r7'], 4, 0)
-linux_aarch64_sigreturn = SigreturnABI('sp', ['x8'], 16, 0)
+windows_i386  = ABI([], 4, 0)
+windows_amd64 = ABI(['rcx','rdx','r8','r9'], 32, 32)

-sysv_i386_sigreturn = linux_i386_sigreturn
-sysv_amd64_sigreturn = linux_amd64_sigreturn
-sysv_arm_sigreturn = linux_arm_sigreturn
-sysv_aarch64_sigreturn = linux_aarch64_sigreturn
-
-freebsd_i386 = sysv_i386
-freebsd_amd64 = sysv_amd64
-freebsd_arm = sysv_arm
-freebsd_aarch64 = sysv_aarch64
-freebsd_mips = sysv_mips
-freebsd_ppc = sysv_ppc
-freebsd_ppc64 = sysv_ppc64
-
-freebsd_i386_syscall   = SyscallABI('esp', ['eax'], 4, 0)
-freebsd_amd64_syscall  = SyscallABI('rsp', ['rax','rdi','rsi','rdx','rcx','r8','r9'], 8, 0)
-freebsd_arm_syscall    = SyscallABI('sp', ['r7', 'r0', 'r1', 'r2', 'r3'], 8, 0)
-freebsd_aarch64_syscall = SyscallABI('sp', ['x8', 'x0', 'x1', 'x2', 'x3'], 16, 0)
-freebsd_mips_syscall  = SyscallABI('$sp', ['$v0','$a0','$a1','$a2','$a3'], 4, 0)
-freebsd_ppc_syscall = SyscallABI('sp', ['r0', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 4, 0)
-freebsd_ppc64_syscall = SyscallABI('sp', ['r0', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 8, 0)
-
-freebsd_i386_sigreturn = sysv_i386_sigreturn
-freebsd_amd64_sigreturn = sysv_amd64_sigreturn
-freebsd_arm_sigreturn = sysv_arm_sigreturn
-freebsd_aarch64_sigreturn = sysv_aarch64_sigreturn
-
-windows_i386  = ABI('esp', [], 4, 0)
-windows_amd64 = ABI('rsp', ['rcx','rdx','r8','r9'], 32, 32)
+# Fake ABIs used by SROP
+linux_i386_srop = ABI(['eax'], 4, 0)
+linux_amd64_srop = ABI(['rax'], 4, 0)
+linux_arm_srop = ABI(['r7'], 4, 0)
@@ -1,6 +1,2 @@
-from __future__ import absolute_import
-
-from pwnlib.adb.adb import *
-from pwnlib.adb.protocol import Client
-from pwnlib.adb.bootimg import BootImage
-from pwnlib.adb.bootloader import BootloaderImage
+from .adb import *
+from .protocol import Client
@@ -1,7 +1,6 @@
 """Provides utilities for interacting with Android devices via the Android Debug Bridge.

-Using Android Devices with Pwntools
-----------------------------------
+# Using Android Devices with Pwntools

 Pwntools tries to be as easy as possible to use with Android devices.

@@ -30,45 +29,42 @@ instance.
        error("Could not find any shamus!")

 Once a device is selected, you can operate on it with any of the functions in
-the :mod:`pwnlib.adb` module.
+the ``pwnlib.adb`` module.

 .. code-block:: python

    # Get a process listing
-    print(adb.process(['ps']).recvall())
+    print adb.process(['ps']).recvall()

    # Fetch properties
-    print(adb.properties.ro.build.fingerprint)
+    print adb.properties.ro.build.fingerprint

    # Read and write files
-    print(adb.read('/proc/version'))
+    print adb.read('/proc/version')
    adb.write('/data/local/tmp/foo', 'my data')

 """
-from __future__ import absolute_import
-from __future__ import division
-
 import functools
 import glob
 import logging
 import os
+import platform
 import re
 import shutil
-import six
 import stat
 import tempfile
 import time

 import dateutil.parser

-from pwnlib import atexit
-from pwnlib import tubes
-from pwnlib.context import LocalContext
-from pwnlib.context import context
-from pwnlib.device import Device
-from pwnlib.log import getLogger
-from pwnlib.protocols.adb import AdbClient
-from pwnlib.util import misc
+from .. import atexit
+from .. import tubes
+from ..context import LocalContext
+from ..context import context
+from ..device import Device
+from ..log import getLogger
+from ..util import misc
+from .protocol import Client

 log = getLogger(__name__)

@@ -76,9 +72,9 @@ def adb(argv, *a, **kw):
    r"""Returns the output of an ADB subcommand.

    >>> adb.adb(['get-serialno'])
-    b'emulator-5554\n'
+    'emulator-5554\n'
    """
-    if isinstance(argv, (bytes, six.text_type)):
+    if isinstance(argv, (str, unicode)):
        argv = [argv]

    log.debug("$ " + ' '.join(context.adb + argv))
@@ -89,10 +85,10 @@ def adb(argv, *a, **kw):

    return tubes.process.process(context.adb + argv, *a, **kw).recvall()

-@context.quietfunc
+@context.quiet
 def devices(serial=None):
    """Returns a list of ``Device`` objects corresponding to the connected devices."""
-    with AdbClient() as c:
+    with Client() as c:
        lines = c.devices(long=True)
    result = []

@@ -115,7 +111,7 @@ def current_device(any=False):

        >>> device = adb.current_device(any=True)
        >>> device
-        AdbDevice(serial='emulator-5554', type='device', port='emulator', product='sdk_google_phone_armv7', model='sdk google phone armv7', device='generic')
+        AdbDevice(serial='emulator-5554', type='device', port='emulator', product='sdk_phone_armv7', model='sdk phone armv7', device='generic')
        >>> device.port
        'emulator'
    """
@@ -147,7 +143,7 @@ def root():
    log.info("Enabling root on %s" % context.device)

    with context.quiet:
-        with AdbClient() as c:
+        with Client() as c:
            reply = c.root()

    if 'already running as root' in reply:
@@ -176,7 +172,7 @@ def reboot(wait=True):
    """
    log.info('Rebooting device %s' % context.device)

-    with AdbClient() as c:
+    with Client() as c:
        c.reboot()

    if wait:
@@ -189,7 +185,7 @@ def reboot_bootloader():
    """
    log.info('Rebooting %s to bootloader' % context.device)

-    with AdbClient() as c:
+    with Client() as c:
        c.reboot_bootloader()

@with_device
@@ -228,7 +224,7 @@ class AdbDevice(Device):
        >>> device.os
        'android'
        >>> device.product
-        'sdk_google_phone_armv7'
+        'sdk_phone_armv7'
        >>> device.serial
        'emulator-5554'
    """
@@ -277,7 +273,7 @@ class AdbDevice(Device):
            return

        with context.local(device=self.serial):
-            abi = getprop('ro.product.cpu.abi')
+            abi = str(properties.ro.product.cpu.abi)
            context.clear()
            context.arch = str(abi)
            self._arch = context.arch
@@ -329,7 +325,7 @@ class AdbDevice(Device):
            kwargs['port'] = 'emulator'

        for field in fields[2:]:
-            k,v = field.split(':', 1)
+            k,v = field.split(':')
            kwargs[k] = v

        return AdbDevice(serial, type, **kwargs)
@@ -347,7 +343,7 @@ class AdbDevice(Device):
        of this device.

        >>> property = 'ro.build.fingerprint'
-        >>> device = adb.wait_for_device()
+        >>> device = adb.current_device()
        >>> adb.getprop(property) == device.getprop(property)
        True
        """
@@ -356,6 +352,7 @@ class AdbDevice(Device):

            if name not in g:
                raise AttributeError('%r object has no attribute %r' % (type(self).__name__,name))
+
            value = g[name]

        if not hasattr(value, '__call__'):
@@ -379,7 +376,7 @@ def wait_for_device(kick=False):
        >>> device = adb.wait_for_device()
    """
    with log.waitfor("Waiting for device to come online") as w:
-        with AdbClient() as c:
+        with Client() as c:
            if kick:
                try:
                    c.reconnect()
@@ -390,7 +387,7 @@ def wait_for_device(kick=False):
            if context.device:
                serial = str(context.device)

-        with AdbClient() as c:
+        with Client() as c:
            c.wait_for_device(serial)

        for device in devices():
@@ -415,10 +412,10 @@ def wait_for_device(kick=False):
@with_device
 def disable_verity():
    """Disables dm-verity on the device."""
-    with log.waitfor("Disabling dm-verity on %s" % context.device):
+    with log.waitfor("Disabling dm-verity on %s" % context.device) as w:
        root()

-        with AdbClient() as c:
+        with Client() as c:
            reply = c.disable_verity()

        if 'Verity already disabled' in reply:
@@ -433,11 +430,11 @@ def disable_verity():
@with_device
 def remount():
    """Remounts the filesystem as writable."""
-    with log.waitfor("Remounting filesystem on %s" % context.device):
+    with log.waitfor("Remounting filesystem on %s" % context.device) as w:
        disable_verity()
        root()

-        with AdbClient() as c:
+        with Client() as c:
            reply = c.remount()

        if 'remount succeeded' not in reply:
@@ -448,7 +445,7 @@ def unroot():
    """Restarts adbd as AID_SHELL."""
    log.info("Unrooting %s" % context.device)
    with context.quiet:
-        with AdbClient() as c:
+        with Client() as c:
            reply  = c.unroot()

    if '0006closed' == reply:
@@ -486,7 +483,7 @@ def pull(remote_path, local_path=None):
    Example:

        >>> _=adb.pull('/proc/version', './proc-version')
-        >>> print(read('./proc-version').decode('utf-8')) # doctest: +ELLIPSIS
+        >>> print read('./proc-version') # doctest: +ELLIPSIS
        Linux version ...
    """
    if local_path is None:
@@ -511,16 +508,12 @@ def push(local_path, remote_path):
        local_path(str): Path to the local file to push.
        remote_path(str): Path or directory to store the file on the device.

-    Returns:
-        Remote path of the file.
-
    Example:

        >>> write('./filename', 'contents')
-        >>> adb.push('./filename', '/data/local/tmp')
-        '/data/local/tmp/filename'
+        >>> _=adb.push('./filename', '/data/local/tmp')
        >>> adb.read('/data/local/tmp/filename')
-        b'contents'
+        'contents'
        >>> adb.push('./filename', '/does/not/exist')
        Traceback (most recent call last):
        ...
@@ -533,7 +526,7 @@ def push(local_path, remote_path):
        msg += ' (%s)' % context.device

    with log.waitfor(msg) as w:
-        with AdbClient() as c:
+        with Client() as c:

            # We need to discover whether remote_path is a directory or not.
            # If we cannot stat the full path, assume it's a path-plus-filename,
@@ -553,13 +546,10 @@ def push(local_path, remote_path):
            if stat.S_ISDIR(mode):
                remote_path = os.path.join(remote_path, remote_filename)

-            c.write(remote_path,
-                    misc.read(local_path),
-                    callback=_create_adb_push_pull_callback(w))
-
-    return remote_path
-
-@context.quietfunc
+            return c.write(remote_path,
+                           misc.read(local_path),
+                           callback=_create_adb_push_pull_callback(w))
+@context.quiet
@with_device
 def read(path, target=None, callback=None):
    """Download a file from the device, and extract its contents.
@@ -569,18 +559,18 @@ def read(path, target=None, callback=None):
        target(str): Optional, location to store the file.
            Uses a temporary file by default.
        callback(callable): See the documentation for
-            ``adb.protocol.AdbClient.read``.
+            ``adb.protocol.Client.read``.

    Examples:

-        >>> print(adb.read('/proc/version').decode('utf-8')) # doctest: +ELLIPSIS
+        >>> print adb.read('/proc/version') # doctest: +ELLIPSIS
        Linux version ...
        >>> adb.read('/does/not/exist')
        Traceback (most recent call last):
        ...
        PwnlibException: Could not stat '/does/not/exist'
    """
-    with AdbClient() as c:
+    with Client() as c:
        stat = c.stat(path)
        if not stat:
            log.error('Could not stat %r' % path)
@@ -591,9 +581,9 @@ def read(path, target=None, callback=None):

    return data

-@context.quietfunc
+@context.quiet
@with_device
-def write(path, data=b''):
+def write(path, data=''):
    """Create a file on the device with the provided contents.

    Arguments:
@@ -602,173 +592,29 @@ def write(path, data=b''):

    Examples:

-        >>> adb.write('/dev/null', b'data')
+        >>> adb.write('/dev/null', 'data')
        >>> adb.write('/data/local/tmp/')
    """
    with tempfile.NamedTemporaryFile() as temp:
        misc.write(temp.name, data)
        push(temp.name, path)

-@context.quietfunc
-@with_device
-def mkdir(path):
-    """Create a directory on the target device.
-
-    Note:
-        Silently succeeds if the directory already exists.
-
-    Arguments:
-        path(str): Directory to create.
-
-    Examples:
-
-        >>> adb.mkdir('/')
-
-        >>> path = '/data/local/tmp/mkdir_test'
-        >>> adb.exists(path)
-        False
-        >>> adb.mkdir(path)
-        >>> adb.exists(path)
-        True
-
-        >>> adb.mkdir('/init')
-        Traceback (most recent call last):
-        ...
-        PwnlibException: mkdir failed for /init, File exists
-    """
-    if not path.startswith('/'):
-        log.error("Must provide an absolute path: %r" % path)
-
-    with AdbClient() as c:
-        st = c.stat(path)
-
-        # Don't re-create existing directories
-        if st and stat.S_ISDIR(st['mode']):
-            return
-
-        result = process(['mkdir', path]).recvall()
-
-        # Any output at all is an error
-        if result:
-            log.error(result.rstrip().decode('utf-8'))
-
-@context.quietfunc
-@with_device
-def makedirs(path):
-    """Create a directory and all parent directories on the target device.
-
-    Note:
-        Silently succeeds if the directory already exists.
-
-    Examples:
-
-        >>> adb.makedirs('/data/local/tmp/this/is/a/directory/heirarchy')
-        >>> adb.listdir('/data/local/tmp/this/is/a/directory')
-        ['heirarchy']
-    """
-    if path != '/':
-        makedirs(os.path.dirname(path))
-
-    mkdir(path)
-
-@context.quietfunc
-@with_device
-def exists(path):
-    """Return :const:`True` if ``path`` exists on the target device.
-
-    Examples:
-
-        >>> adb.exists('/')
-        True
-        >>> adb.exists('/etc/hosts')
-        True
-        >>> adb.exists('/does/not/exist')
-        False
-    """
-    with AdbClient() as c:
-        return bool(c.stat(path))
-
-@context.quietfunc
-@with_device
-def isdir(path):
-    """Return :const:`True` if ``path`` is a on the target device.
-
-    Examples:
-
-        >>> adb.isdir('/')
-        True
-        >>> adb.isdir('/init')
-        False
-        >>> adb.isdir('/does/not/exist')
-        False
-    """
-    with AdbClient() as c:
-        st = c.stat(path)
-        return bool(st and stat.S_ISDIR(st['mode']))
-
-@context.quietfunc
-@with_device
-def unlink(path, recursive=False):
-    """Unlinks a file or directory on the target device.
-
-    Examples:
-
-        >>> adb.unlink("/does/not/exist")
-        Traceback (most recent call last):
-        ...
-        PwnlibException: Could not unlink '/does/not/exist': Does not exist
-
-        >>> filename = '/data/local/tmp/unlink-test'
-        >>> adb.write(filename, 'hello')
-        >>> adb.exists(filename)
-        True
-        >>> adb.unlink(filename)
-        >>> adb.exists(filename)
-        False
-
-        >>> adb.mkdir(filename)
-        >>> adb.write(filename + '/contents', 'hello')
-        >>> adb.unlink(filename)
-        Traceback (most recent call last):
-        ...
-        PwnlibException: Cannot delete non-empty directory '/data/local/tmp/unlink-test' without recursive=True
-
-        >>> adb.unlink(filename, recursive=True)
-        >>> adb.exists(filename)
-        False
-    """
-    with AdbClient() as c:
-        st = c.stat(path)
-        if not st:
-            log.error("Could not unlink %r: Does not exist" % path)
-
-        # If the directory is not empty, do not delete it
-        if isdir(path) and c.list(path) and not recursive:
-            log.error("Cannot delete non-empty directory %r without recursive=True" % path)
-
-        flags = '-rf' if recursive else '-f'
-
-        output = c.execute(['rm', flags, path]).recvall()
-
-        if output:
-            log.error(output.decode('utf-8'))
-
@with_device
 def process(argv, *a, **kw):
    """Execute a process on the device.

-    See :class:`pwnlib.tubes.process.process` documentation for more info.
+    See ``pwnlib.tubes.process.process`` documentation for more info.

    Returns:
-        A :class:`pwnlib.tubes.process.process` tube.
+        A ``process`` tube.

    Examples:

        >>> adb.root()
-        >>> print(adb.process(['cat','/proc/version']).recvall().decode('utf-8')) # doctest: +ELLIPSIS
+        >>> print adb.process(['cat','/proc/version']).recvall() # doctest: +ELLIPSIS
        Linux version ...
    """
-    if isinstance(argv, (bytes, six.text_type)):
+    if isinstance(argv, (str, unicode)):
        argv = [argv]

    message = "Starting %s process %r" % ('Android', argv[0])
@@ -777,7 +623,7 @@ def process(argv, *a, **kw):
        if argv != [argv[0]]: message += ' argv=%r ' % argv

    with log.progress(message) as p:
-        return AdbClient().execute(argv)
+        return Client().execute(argv)

@with_device
 def interactive(**kw):
@@ -790,62 +636,27 @@ def shell(**kw):
    return process(['sh', '-i'], **kw)

@with_device
-def which(name, all = False, *a, **kw):
-    """Retrieves the full path to a binary in ``$PATH`` on the device
+def which(name):
+    """Retrieves the full path to a binary in ``PATH`` on the device

-    Arguments:
-        name(str): Binary name
-        all(bool): Whether to return all paths, or just the first
-        *a: Additional arguments for :func:`.adb.process`
-        **kw: Additional arguments for :func:`.adb.process`
-
-    Returns:
-        Either a path, or list of paths
-
-    Example:
-
-        >>> adb.which('sh')
-        '/system/bin/sh'
-        >>> adb.which('sh', all=True)
-        ['/system/bin/sh']
-
-        >>> adb.which('foobar') is None
-        True
-        >>> adb.which('foobar', all=True)
-        []
+    >>> adb.which('sh')
+    '/system/bin/sh'
    """
    # Unfortunately, there is no native 'which' on many phones.
    which_cmd = '''
-echo $PATH | while read -d: directory; do
-    [ -x "$directory/{name}" ] || continue;
-    echo -n "$directory/{name}\\x00";
+IFS=:
+BINARY=%s
+P=($PATH)
+for path in "${P[@]}"; do \
+    if [ -e "$path/$BINARY" ]; then \
+        echo "$path/$BINARY";
+        break
+    fi
 done
-[ -x "{name}" ] && echo -n "$PWD/{name}\\x00"
-'''.format(name=name)
+''' % name

    which_cmd = which_cmd.strip()
-    data = process(['sh','-c', which_cmd], *a, **kw).recvall()
-    if not hasattr(data, 'encode'):
-        data = data.decode('utf-8')
-    result = []
-
-    for path in data.split('\x00'):
-        # Skip empty entries
-        if not path:
-            continue
-
-        # Return the first entry if all=False
-        if not all:
-            return path
-
-        # Accumulate all entries if all=True
-        result.append(path)
-
-    if all:
-        return result
-
-    return None
-
+    return process(['sh','-c',which_cmd]).recvall().strip()

@with_device
 def whoami():
@@ -855,10 +666,10 @@ def whoami():
 def forward(port):
    """Sets up a port to forward to the device."""
    tcp_port = 'tcp:%s' % port
-    adb(['forward', tcp_port, tcp_port])
+    start_forwarding = adb(['forward', tcp_port, tcp_port])
    atexit.register(lambda: adb(['forward', '--remove', tcp_port]))

-@context.quietfunc
+@context.quiet
@with_device
 def logcat(stream=False):
    """Reads the system log file.
@@ -866,12 +677,12 @@ def logcat(stream=False):
    By default, causes logcat to exit after reading the file.

    Arguments:
-        stream(bool): If :const:`True`, the contents are streamed rather than
-            read in a one-shot manner.  Default is :const:`False`.
+        stream(bool): If ``True``, the contents are streamed rather than
+            read in a one-shot manner.  Default is ``False``.

    Returns:
-        If ``stream`` is :const:`False`, returns a string containing the log data.
-        Otherwise, it returns a :class:`pwnlib.tubes.tube.tube` connected to the log output.
+        If ``stream`` is ``False``, returns a string containing the log data.
+        Otherwise, it returns a ``tube`` connected to the log output.
    """

    if stream:
@@ -883,16 +694,9 @@ def logcat(stream=False):
 def pidof(name):
    """Returns a list of PIDs for the named process."""
    with context.quiet:
-        # Older devices have a broken 'pidof', apparently.
-        # Try pgrep first.
-        io = process(['pgrep', name])
-        data = io.recvall()
-
-        if 'not found' in data:
-            io = process(['pidof', name])
-            data = io.recvall()
-
-    return list(map(int, data.split()))
+        io = process(['pidof', name])
+        data = io.recvall().split()
+    return list(map(int, data))

@with_device
 def proc_exe(pid):
@@ -915,17 +719,11 @@ def getprop(name=None):
    """
    with context.quiet:
        if name:
-            result = process(['getprop', name]).recvall().strip()
-            if not hasattr(result, 'encode'):
-                result = result.decode('utf-8')
-            return result
+            return process(['getprop', name]).recvall().strip()


        result = process(['getprop']).recvall()

-    if not hasattr(result, 'encode'):
-        result = result.decode('utf-8')
-
    expr = r'\[([^\]]+)\]: \[(.*)\]'

    props = {}
@@ -960,32 +758,33 @@ def listdir(directory='/'):
        Otherwise, less files may be returned due to restrictive SELinux
        policies on adbd.
    """
-    return list(sorted(AdbClient().list(directory)))
+    return list(sorted(Client().list(directory)))

-@with_device
 def fastboot(args, *a, **kw):
    """Executes a fastboot command.

    Returns:
        The command output.
    """
-    argv = ['fastboot', '-s', str(context.device)] + list(args)
-    return tubes.process.process(argv, *a, **kw).recvall()
+    serial = context.device
+    if not serial:
+        log.error("Unknown device")
+    return tubes.process.process(['fastboot', '-s', serial] + list(args), **kw).recvall()

@with_device
 def fingerprint():
    """Returns the device build fingerprint."""
-    return getprop('ro.build.fingerprint')
+    return str(properties.ro.build.fingerprint)

@with_device
 def product():
    """Returns the device product identifier."""
-    return getprop('ro.build.product')
+    return str(properties.ro.build.product)

@with_device
 def build():
    """Returns the Build ID of the device."""
-    return getprop('ro.build.id')
+    return str(properties.ro.build.id)

@with_device
@no_emulator
@@ -995,33 +794,9 @@ def unlock_bootloader():
    Note:
        This requires physical interaction with the device.
    """
-    w = log.waitfor("Unlocking bootloader")
-    with w:
-        if getprop('ro.oem_unlock_supported') == '0':
-            log.error("Bootloader cannot be unlocked: ro.oem_unlock_supported=0")
-
-        if getprop('ro.boot.oem_unlock_support') == '0':
-            log.error("Bootloader cannot be unlocked: ro.boot.oem_unlock_support=0")
-
-        if getprop('sys.oem_unlock_allowed') == '0':
-            log.error("Bootloader cannot be unlocked: Enable OEM Unlock in developer settings first", context.device)
-
-        AdbClient().reboot_bootloader()
-
-        # Check to see if it's unlocked before attempting unlock
-        unlocked = fastboot(['getvar', 'unlocked'])
-        if 'unlocked: yes' in unlocked:
-            w.success("Already unlocked")
-            fastboot(['continue'])
-            return
-
-        fastboot(['oem', 'unlock'])
-        unlocked = fastboot(['getvar', 'unlocked'])
-
-        fastboot(['continue'])
-
-        if 'unlocked: yes' not in unlocked:
-            log.error("Unlock failed")
+    Client().reboot_bootloader()
+    fastboot(['oem', 'unlock'])
+    fastboot(['continue'])

 class Kernel(object):
    _kallsyms = None
@@ -1031,7 +806,7 @@ class Kernel(object):
        return self.symbols['_text']

    @property
-    @context.quietfunc
+    @context.quiet
    def symbols(self):
        """Returns a dictionary of kernel symbols"""
        result = {}
@@ -1043,7 +818,7 @@ class Kernel(object):
        return result

    @property
-    @context.quietfunc
+    @context.quiet
    def kallsyms(self):
        """Returns the raw output of kallsyms"""
        if not self._kallsyms:
@@ -1054,20 +829,20 @@ class Kernel(object):
        return self._kallsyms

    @property
-    @context.quietfunc
+    @context.quiet
    def version(self):
        """Returns the kernel version of the device."""
        root()
        return read('/proc/version').strip()

    @property
-    @context.quietfunc
+    @context.quiet
    def cmdline(self):
        root()
        return read('/proc/cmdline').strip()

    @property
-    @context.quietfunc
+    @context.quiet
    def lastmsg(self):
        root()
        if 'last_kmsg' in listdir('/proc'):
@@ -1078,7 +853,7 @@ class Kernel(object):

    def enable_uart(self):
        """Reboots the device with kernel logging to the UART enabled."""
-        model = getprop('ro.product.model')
+        model = str(properties.ro.product.model)

        known_commands = {
            'Nexus 4': None,
@@ -1089,7 +864,7 @@ class Kernel(object):
            'Nexus 7': 'oem uart-on',
        }

-        with log.waitfor('Enabling kernel UART'):
+        with log.waitfor('Enabling kernel UART') as w:

            if model not in known_commands:
                log.error("Device UART is unsupported.")
@@ -1126,15 +901,15 @@ kernel = Kernel()

 class Property(object):
    def __init__(self, name=None):
-        # Need to avoid overloaded setattr() so we go through __dict__
        self.__dict__['_name'] = name

    def __str__(self):
-        return str(getprop(self._name)).strip()
+        return getprop(self._name).strip()
+
+    def __repr__(self):
+        return repr(str(self))

    def __getattr__(self, attr):
-        if attr.startswith('_'):
-            raise AttributeError(attr)
        if self._name:
            attr = '%s.%s' % (self._name, attr)
        return Property(attr)
@@ -1147,17 +922,6 @@ class Property(object):
            attr = '%s.%s' % (self._name, attr)
        setprop(attr, value)

-    def __eq__(self, other):
-        # Allow simple comparison, e.g.:
-        # adb.properties.ro.oem_unlock_supported == "1"
-        if isinstance(other, six.string_types):
-            return str(self) == other
-        return super(Property, self).__eq__(other)
-
-    def __hash__(self, other):
-        # Allow hash indices matching on the property
-        return hash(self._name)
-
 properties = Property()

 def _build_date():
@@ -1248,23 +1012,13 @@ def compile(source):
    if not project:
        # Realistically this should inherit from context.arch, but
        # this works for now.
+        abi = 'armeabi-v7a'
        sdk = '21'
-        abi = {
-            'aarch64': 'arm64-v8a',
-            'amd64':   'x86_64',
-            'arm':     'armeabi-v7a',
-            'i386':    'x86',
-            'mips':    'mips',
-            'mips64':  'mips64',
-        }.get(context.arch, None)

        # If we have an attached device, use its settings.
        if context.device:
-            abi = getprop('ro.product.cpu.abi')
-            sdk = getprop('ro.build.version.sdk')
-
-        if abi is None:
-            log.error("Unknown CPU ABI")
+            abi = str(properties.ro.product.cpu.abi)
+            sdk = str(properties.ro.build.version.sdk)

        project = _generate_ndk_project(source, abi, sdk)

@@ -1302,7 +1056,7 @@ class Partition(object):
 def walk(top, topdown=True):
    join = os.path.join
    isdir = lambda x: stat.S_ISDIR(x['mode'])
-    client = AdbClient()
+    client = Client()
    names = client.list(top)

    dirs, nondirs = [], []
@@ -1340,15 +1094,15 @@ def readlink(path):

 class Partitions(object):
    @property
-    @context.quietfunc
+    @context.quiet
    def by_name_dir(self):
        return next(find('/dev/block/platform','by-name'))

-    @context.quietfunc
+    @context.quiet
    def __dir__(self):
        return list(self)

-    @context.quietfunc
+    @context.quiet
    @with_device
    def __iter__(self):
        root()
@@ -1357,10 +1111,9 @@ class Partitions(object):
        for name in listdir(self.by_name_dir):
            yield name

+    @context.quiet
+    @with_device
    def __getattr__(self, attr):
-        if name.startswith("_"):
-            raise AttributeError(attr)
-
        for name in self:
            if name == attr:
                break
@@ -1369,20 +1122,19 @@ class Partitions(object):

        path = os.path.join(self.by_name_dir, name)

-        with context.quiet:
-            # Find the actual path of the device
-            devpath = readlink(path)
-            devname = os.path.basename(devpath)
+        # Find the actual path of the device
+        devpath = readlink(path)
+        devname = os.path.basename(devpath)

-            # Get the size of the partition
-            for line in read('/proc/partitions').splitlines():
-                if not line.strip():
-                    continue
-                major, minor, blocks, name = line.split(None, 4)
-                if devname == name:
-                    break
-            else:
-                log.error("Could not find size of partition %r" % name)
+        # Get the size of the partition
+        for line in read('/proc/partitions').splitlines():
+            if not line.strip():
+                continue
+            major, minor, blocks, name = line.split(None, 4)
+            if devname == name:
+                break
+        else:
+            log.error("Could not find size of partition %r" % name)

        return Partition(devpath, attr, int(blocks))

@@ -1429,14 +1181,8 @@ def uninstall(package, *arguments):
        with context.quiet:
            return process(['pm','uninstall',package] + list(arguments)).recvall()

-@context.quietfunc
+@context.quiet
 def packages():
    """Returns a list of packages installed on the system"""
    packages = process(['pm', 'list', 'packages']).recvall()
    return [line.split('package:', 1)[-1] for line in packages.splitlines()]
-
-@context.quietfunc
-def version():
-    """Returns rthe platform version as a tuple."""
-    prop = getprop('ro.build.version.release')
-    return [int(v) for v in prop.split('.')]
@@ -1,52 +0,0 @@
-from __future__ import division
-
-import ctypes
-
-BOOT_MAGIC = b"ANDROID!"
-BOOT_MAGIC_SIZE = 8
-BOOT_NAME_SIZE = 16
-BOOT_ARGS_SIZE = 512
-BOOT_EXTRA_ARGS_SIZE = 1024
-
-
-class boot_img_hdr(ctypes.Structure):
-    _fields_ = [
-        ('magic', ctypes.c_char * BOOT_MAGIC_SIZE),
-
-        ('kernel_size', ctypes.c_uint32),
-        ('kernel_addr', ctypes.c_uint32),
-
-        ('ramdisk_size', ctypes.c_uint32),
-        ('ramdisk_addr', ctypes.c_uint32),
-
-        ('second_size', ctypes.c_uint32),
-        ('second_addr', ctypes.c_uint32),
-
-        ('tags_addr', ctypes.c_uint32),
-        ('page_size', ctypes.c_uint32),
-        ('unused', ctypes.c_uint32),
-
-        ('os_version', ctypes.c_uint32),
-
-        ('name', ctypes.c_char * BOOT_NAME_SIZE),
-        ('cmdline', ctypes.c_char * BOOT_ARGS_SIZE),
-        ('id', ctypes.c_char * 8),
-
-        ('extra_cmdline', ctypes.c_char * BOOT_EXTRA_ARGS_SIZE),
-    ]
-
-class BootImage(object):
-    def __init__(self, data):
-        self.data = data
-        self.header = boot_img_hdr.from_buffer_copy(data)
-
-        PAGE = self.page_size
-
-        # The kernel starts at the beginning of the second page.
-        self.kernel = self.data[PAGE:PAGE+self.kernel_size]
-
-    def __getattr__(self, name):
-        value = getattr(self.header, name, None)
-        if value is not None:
-            return value
-        return getattr(super(BootImage, self), name)
@@ -1,124 +0,0 @@
-from __future__ import unicode_literals
-from __future__ import division
-
-import ctypes
-import io
-import os
-import sys
-
-from pwnlib.log import getLogger
-
-log = getLogger(__name__)
-
-class img_info(ctypes.Structure):
-    _fields_ = [
-        ('name', ctypes.c_char * 64),
-        ('size', ctypes.c_uint32)
-    ]
-
-class bootloader_images_header(ctypes.Structure):
-    _fields_ = [
-        ('magic', ctypes.c_char * 8),
-        ('num_images', ctypes.c_uint32),
-        ('start_offset', ctypes.c_uint32),
-        ('bootldr_size', ctypes.c_uint32),
-    ]
-
-BOOTLDR_MAGIC = b'BOOTLDR!'
-
-class BootloaderImage(object):
-    def __init__(self, data):
-        """Android Bootloader image
-
-        Arguments:
-            data(str): Binary data from the image file.
-        """
-        self.data = data
-        self.header = bootloader_images_header.from_buffer_copy(data)
-
-        if self.magic != BOOTLDR_MAGIC:
-            log.error("Incorrect magic (%r, expected %r)" % (self.magic, BOOTLDR_MAGIC))
-
-        if(self.bootldr_size > len(data)):
-            log.warn_once("Bootloader is supposed to be %#x bytes, only have %#x",
-                          self.bootldr_size,
-                          len(data))
-
-        if(self.num_images >= 0x100):
-            old = self.num_images
-            self.num_images = 1
-            log.warn_once("Bootloader num_images (%#x) appears corrupted, truncating to 1",
-                          old)
-
-        imgarray = ctypes.ARRAY(img_info, self.num_images)
-        self.img_info = imgarray.from_buffer_copy(data, ctypes.sizeof(self.header))
-
-    def extract(self, index_or_name):
-        """extract(index_or_name) -> bytes
-
-        Extract the contents of an image.
-
-        Arguments:
-            index_or_name(str,int): Either an image index or name.
-
-        Returns:
-            Contents of the image.
-        """
-        if isinstance(index_or_name, int):
-            index = index_or_name
-        else:
-            for i in range(len(self.img_info)):
-                if self.img_info[i].name == index_or_name:
-                    index = i
-                    break
-            else:
-                raise ValueError("Invalid img name: %r" % index_or_name)
-
-        if index >= len(self.img_info):
-            raise ValueError("index out of range (%s, max %s)" % (index, len(self.img_info)))
-
-        offset = self.start_offset
-
-        for i in range(index):
-            offset += self.img_info[i].size
-
-        return self.data[offset:offset + self.img_info[index].size]
-
-    def extract_all(self, path):
-        """extract_all(path)
-
-        Extracts all images to the provided path.  The filenames are taken
-        from the image name, with '.img' appended.
-        """
-        if not os.path.isdir(path):
-            raise ValueError("%r does not exist or is not a directory" % path)
-
-        for img in self.img_info:
-            imgpath = os.path.join(path, img.name + '.img')
-            with open(imgpath, 'wb+') as f:
-                data = self.extract(img.name)
-                f.write(data)
-
-    def __str__(self):
-        rv = []
-        rv.append("Bootloader")
-        rv.append("  Magic:  %r" % self.magic)
-        rv.append("  Offset: %#x" % self.start_offset)
-        rv.append("  Size:   %#x" % self.bootldr_size)
-        rv.append("  Images: %s" % self.num_images)
-        for img in self.img_info:
-            rv.append("    Name: %s" % img.name)
-            rv.append("    Size: %#x" % img.size)
-            rv.append("    Data: %r..." % self.extract(img.name)[:32])
-        return '\n'.join(rv)
-
-    def __getattr__(self, name):
-        value = getattr(self.header, name, None)
-        if value is not None:
-            return value
-        return getattr(super(BootImage, self), name)
-
-if __name__ == '__main__':
-    # Easy sanity checking
-    b = BootloaderImage(open(sys.argv[1], 'rb').read())
-    print(b)
@@ -1,5 +1,553 @@
 """
-This file exists only for backward compatibility
+Implementation of the Android Debug Bridge (ADB) protocol, as far as Binjitsu needs it.
+
+Documentation is available here:
+https://android.googlesource.com/platform/system/core/+/master/adb/protocol.txt
 """
-from pwnlib.protocols.adb import AdbClient
-Client = AdbClient
+import functools
+import stat
+import time
+
+from ..context import context
+from ..log import Logger
+from ..log import getLogger
+from ..tubes.listen import listen
+from ..tubes.process import process
+from ..tubes.remote import remote
+from ..util.lists import group
+from ..util.misc import size
+from ..util.packing import p32
+from ..util.proc import pidof
+from ..util.sh_string import sh_string
+
+log = getLogger(__name__)
+
+def pack(val):
+    return '%04x' % val
+
+def unpack(val):
+    return int(val, 16)
+
+OKAY = "OKAY"
+FAIL = "FAIL"
+
+class Message(object):
+    """An ADB hex-length-prefixed message"""
+    def __init__(self, string):
+        self.string = string
+    def __str__(self):
+        return ('%04x' % len(self.string)) + self.string
+    def __flat__(self):
+        return str(self)
+
+class Connection(remote):
+    """Connection to the ADB server"""
+    def __init__(self, host, port, level=None, *a, **kw):
+        super(Connection, self).__init__(host, port, level=level, *a, **kw)
+
+        self._executable = None
+        self._argv       = None
+        self._pid        = None
+        self._cwd        = None
+        self._env        = None
+
+    def close(self):
+        with context.quiet:
+            super(Connection, self).close()
+
+    def adb_send(self, message):
+        self.send(str(Message(message)))
+        return self.recvn(4)
+
+    def adb_unpack(self):
+        return unpack(self.recvn(4))
+
+    def flat(self, *a, **kw):
+        kw.setdefault('word_size', 32)
+        return super(Connection, self).flat(*a, **kw)
+
+class Process(Connection):
+    """Duck-typed ``tubes.remote`` object to add properties of a ``tubes.process``"""
+
+class Client(Logger):
+    """ADB Client"""
+    def __init__(self, level=None):
+        super(Client, self).__init__()
+
+        if level is not None:
+            self.setLevel(level)
+
+        self.host = context.adb_host
+        self.port = context.adb_port
+        self._c   = None
+
+    @property
+    def c(self):
+        """Client's connection to the ADB server"""
+        if not self._c:
+            try:
+                self._c = Connection(self.host, self.port, level=self.level)
+            except Exception:
+                # If the connection fails, try starting a server on that port
+                # as long as it's the *default* port.
+                if self.host == context.defaults['adb_host'] \
+                and self.port == context.defaults['adb_port']:
+                    log.warn("Could not connect to ADB server, trying to start it")
+                    process(context.adb + ['start-server']).recvall()
+                else:
+                    log.exception('Could not connect to ADB server')
+
+        # Final attempt...
+        if not self._c:
+            self._c = Connection(self.host, self.port, level=self.level)
+        return self._c
+
+    def _autoclose(fn):
+        """Decorator which automatically closes the connection to the ADB server
+        after calling the decorated function."""
+        @functools.wraps(fn)
+        def wrapper(self, *a, **kw):
+            rv = fn(self, *a, **kw)
+            if self._c:
+                self._c.close()
+                self._c = None
+            return rv
+        return wrapper
+
+    def _with_transport(fn):
+        """Decorator which automatically selects a device transport before calling
+        the decorated function, and closes the connection afterward."""
+        @functools.wraps(fn)
+        def wrapper(self, *a, **kw):
+            self.transport()
+            rv = fn(self, *a, **kw)
+            if self._c:
+                self._c.close()
+                self._c = None
+            return rv
+        return wrapper
+
+    def send(self, *a, **kw):
+        """Sends data to the ADB server"""
+        return self.c.adb_send(*a, **kw)
+
+    def unpack(self, *a, **kw):
+        """Receives a hex-ascii packed integer from the ADB server"""
+        return self.c.adb_unpack(*a, **kw)
+
+    def recvl(self):
+        """Receives a length-prefixed data buffer from the ADB server"""
+        length = self.c.adb_unpack()
+        return self.c.recvn(length)
+
+    @_autoclose
+    def kill(self):
+        """Kills the remote ADB server"
+
+        >>> c=adb.protocol.Client()
+        >>> c.kill()
+
+        The server is automatically re-started on the next request,
+        if the default host/port are used.
+
+        >>> c.version() > (4,0)
+        True
+        """
+        try:
+            self.send('host:kill')
+        except EOFError:
+            pass
+
+    @_autoclose
+    def version(self):
+        """
+        Returns:
+            Tuple containing the ``(major, minor)`` version from the ADB server
+
+        Example:
+
+            >>> adb.protocol.Client().version() # doctest: +SKIP
+            (4, 36)
+        """
+        response = self.send('host:version')
+        if response == OKAY:
+            return (self.c.adb_unpack(), self.c.adb_unpack())
+        self.error("Could not fetch version")
+
+    @_autoclose
+    def devices(self, long=False):
+        """
+        Arguments:
+            long(bool): If ``True``, fetch the long-format listing.
+        Returns:
+            String representation of all available devices.
+        """
+        msg = 'host:devices'
+        if long:
+            msg += '-l'
+        response = self.send(msg)
+        if response == 'OKAY':
+            return self.recvl()
+        self.error("Could not enumerate devices")
+
+    @_autoclose
+    def track_devices(self):
+        """
+        Returns:
+            Generator which returns a short-format listing of available
+            devices each time a device state changes.
+        """
+        self.send('host:track-devices')
+        while True:
+            yield self.recvl()
+
+    def transport(self, serial=None):
+        """Sets the Transport on the rmeote device.
+
+        Examples:
+
+            >>> adb.protocol.Client().transport()
+        """
+        msg = 'host:transport:%s' % (serial or context.device)
+        if self.send(msg) == FAIL:
+            self.error("Could not set transport to %r" % serial)
+
+    @_autoclose
+    @_with_transport
+    def execute(self, argv):
+        r"""Executes a program on the device.
+
+        Returns:
+            A ``tube`` which is connected to the process.
+
+        Examples:
+
+            >>> adb.protocol.Client().execute(['echo','hello']).recvall()
+            'hello\n'
+        """
+        self.transport(context.device)
+        if isinstance(argv, str):
+            argv = [argv]
+        argv = list(map(sh_string, argv))
+        cmd = 'exec:%s' % (' '.join(argv))
+        if OKAY == self.send(cmd):
+            rv = self._c
+            self._c = None
+            return rv
+
+    def _basic_wrapper(string):
+        @_autoclose
+        @_with_transport
+        def wrapper(self):
+            self.send(string)
+            return self.c.recvall()
+        return wrapper
+
+    @_autoclose
+    @_with_transport
+    def remount(self):
+        self.send('remount:')
+        return self.c.recvall()
+
+    @_autoclose
+    @_with_transport
+    def root(self):
+        self.send('root:')
+        return self.c.recvall()
+
+    @_autoclose
+    @_with_transport
+    def unroot(self):
+        self.send('unroot:')
+        return self.c.recvall()
+
+    @_autoclose
+    @_with_transport
+    def disable_verity(self):
+        self.send('disable-verity:')
+        return self.c.recvall()
+
+    @_autoclose
+    @_with_transport
+    def enable_verity(self):
+        self.send('enable-verity:')
+        return self.c.recvall()
+
+    @_autoclose
+    @_with_transport
+    def reconnect(self):
+        self.send('reconnect:')
+        return self.c.recvall()
+
+    @_autoclose
+    @_with_transport
+    def reboot(self):
+        self.send('reboot:')
+        return self.c.recvall()
+
+    @_autoclose
+    @_with_transport
+    def reboot_bootloader(self):
+        self.send('reboot:bootloader')
+        return self.c.recvall()
+
+    @_autoclose
+    def wait_for_device(self, serial=''):
+        response = self.send('host-serial:%s:wait-for-any-device' % serial)
+
+        # The first OKAY is that the command was understood
+        if response != 'OKAY':
+            self.error("An error occurred while waiting for device with serial %r" % serial)
+
+        # The second OKAY is that the device is available
+        response = self.c.recvn(4)
+        if response != 'OKAY':
+            self.error("An error occurred while waiting for device with serial %r" % serial)
+
+    def _sync(fn):
+        """Decorator which enters 'sync:' mode to the selected transport,
+        then invokes the decorated funciton."""
+        @functools.wraps(fn)
+        def wrapper(self, *a, **kw):
+            rv = None
+            if FAIL != self.send('sync:'):
+                rv = fn(self, *a, **kw)
+            return rv
+        return wrapper
+
+    def list(self, path):
+        """Execute the ``LIST`` command of the ``SYNC`` API.
+
+        Arguments:
+            path(str): Path of the directory to list.
+
+        Return:
+            A dictionary, where the keys are relative filenames,
+            and the values are a dictionary containing the same
+            values as ``stat()`` supplies.
+
+        Note:
+            In recent releases of Android (e.g. 7.0), the domain that
+            adbd executes from does not have access to everything that
+            the shell user does.
+
+            Because of this, while the shell user can get listings of
+            e.g. the root directory ('/'), adbd cannot.
+
+            The SYNC APIs are executed within the adbd context, not the
+            shell user context.
+
+            This issue is not a problem if the phone is rooted via
+            'adb root', since adbd then runs in the ``su`` domain.
+
+        Examples:
+
+            >>> pprint(adb.Client().list('/data/user'))
+            {'0': {'mode': 41471, 'size': 11, 'time': ...}}
+            >>> adb.Client().list('/does/not/exist')
+            Traceback (most recent call last):
+            ...
+            PwnlibException: Cannot list directory '/does/not/exist': Does not exist
+        """
+        st = self.stat(path)
+
+        if not st:
+            log.error("Cannot list directory %r: Does not exist" % path)
+
+        if not stat.S_ISDIR(st['mode']):
+            log.error("Cannot list directory %r: Path is not a directory" % path)
+
+        return self._list(path)
+
+    @_with_transport
+    @_sync
+    def _list(self, path):
+        self.c.flat('LIST', len(path), path)
+        files = {}
+        while True:
+            response = self.c.recvn(4)
+
+            if response == 'DONE':
+                break
+
+            if response != 'DENT':
+                self.error('Unexpected response: %r' % response)
+
+            mode = self.c.u32()
+            size = self.c.u32()
+            time = self.c.u32()
+            name = self.c.recvn(self.c.u32())
+
+            # Ignore the current directory and parent
+            if name in ('', '.', '..'):
+                continue
+
+            files[name] = {'mode': mode,
+                           'size': size,
+                           'time': time}
+
+        return files
+
+    @_with_transport
+    @_sync
+    def stat(self, path):
+        """Execute the ``STAT`` command of the ``SYNC`` API.
+
+        Arguments:
+            path(str): Path to the file to stat.
+
+        Return:
+            On success, a dictionary mapping the values returned.
+            If the file cannot be ``stat()``ed, None is returned.
+
+        Example:
+
+            >>> expected = {'mode': 16749, 'size': 0, 'time': 0}
+            >>> adb.protocol.Client().stat('/proc')           == expected
+            True
+            >>> adb.protocol.Client().stat('/does/not/exist') == None
+            True
+        """
+        self.c.flat('STAT', len(path), path)
+        if self.c.recvn(4) != 'STAT':
+            self.error("An error occured while attempting to STAT a file.")
+
+        mode = self.c.u32()
+        size = self.c.u32()
+        time = self.c.u32()
+
+        if (mode,size,time) == (0,0,0):
+            return None
+
+        return {'mode': mode, 'size': size, 'time': time}
+
+    def write(self, path, data, mode=0o755, timestamp=None, callback=None):
+        """Execute the ``WRITE`` command of the ``SYNC`` API.
+
+        Arguments:
+            path(str): Path to the file to write
+            data(str): Data to write to the file
+            mode(int): File mode to set (e.g. ``0o755``)
+            timestamp(int): Unix timestamp to set the file date to
+            callback(callable): Callback function invoked as data
+                is written.  Arguments provided are:
+
+                - File path
+                - All data
+                - Expected size of all data
+                - Current chunk
+                - Expected size of chunk
+        """
+        # We must ensure that 'path' is not a directory
+        # Writing to a directory is supported, but creates a temporary file
+        st = self.stat(path)
+
+        if st and stat.S_ISDIR(st['mode']):
+            log.error("Cannot write to %r: Path is a directory" % path)
+
+        return self._write(path, data, mode=0o755, timestamp=None, callback=None)
+
+    @_with_transport
+    @_sync
+    def _write(self, path, data, mode=0o755, timestamp=None, callback=None):
+        path += ',' + str(mode)
+        self.c.flat('SEND', len(path), path)
+
+        sent = 0
+
+        # Data needs to be broken up into chunks!
+        for chunk in group(0x10000, data):
+            self.c.flat('DATA', len(chunk), chunk)
+            if callback:
+                callback(path, data[:sent], len(data), chunk, len(chunk))
+            sent += len(chunk)
+
+        # Send completion notification and timestamp
+        if timestamp is None:
+            timestamp = int(time.time())
+        self.c.flat('DONE', timestamp)
+
+        result = self.c.recvn(4)
+        if result != 'OKAY':
+            log.error("Sync write failed: %r (expected OKAY)" % result)
+
+        return
+
+    @_with_transport
+    @_sync
+    def read(self, path, filesize=0, callback=lambda *a: True):
+        """Execute the ``READ`` command of the ``SYNC`` API.
+
+        Arguments:
+            path(str): Path to the file to read
+            filesize(int): Size of the file, in bytes.  Optional.
+            callback(callable): Callback function invoked as data
+                becomes available.  Arguments provided are:
+
+                - File path
+                - All data
+                - Expected size of all data
+                - Current chunk
+                - Expected size of chunk
+
+        Return:
+            The data received as a string.
+        """
+        self.c.send('RECV' + p32(len(path)) + path)
+
+        # Accumulate all data here
+        all_data = ''
+
+        while True:
+            magic = self.c.recvn(4)
+
+            # adbd says there is no more data to send
+            if magic == 'DONE':
+                break
+
+            if magic == 'FAIL':
+                self.error('Could not read file %r: Got FAIL.' % path)
+
+            # did we expect to be done?
+            if magic != 'DATA':
+                self.error('Error after file read: %r (expected DATA)' % magic)
+
+            # receive all of the data in the chunk
+            chunk_size = self.c.u32()
+            chunk_data  = ''
+            while len(chunk_data) != chunk_size:
+                chunk_data += self.c.recv(chunk_size - len(chunk_data))
+
+                if callback:
+                    callback(path,
+                             all_data,
+                             filesize,
+                             chunk_data,
+                             chunk_size)
+
+            # add the chunk onto what we have
+            all_data += chunk_data
+
+        zero = self.c.u32()
+        if zero != 0:
+            self.error('Error after file read: %r (expected ZERO)' % zero)
+
+        return all_data
+
+    @_with_transport
+    def forward(self, device, host_proto, host_port, device_proto, device_port):
+        self.send('host:forward:%s:%s;%s:%s' % (host_proto, host_port, device_proto, device_port))
+        self.c.recvall()
+
+    def __enter__(self, *a, **kw):
+        return self
+
+    @_autoclose
+    def __exit__(self, *a, **kw): pass
+
+def proxy(port=9999):
+    """Starts an ADB proxy on the specified port, for debugging purposes."""
+    l = listen(port)
+    l.wait_for_connection()
+    r = remote(context.adb_host, context.adb_port, level='debug')
+    l <> r