Release 3.3.3

2026-11-09 01:59:33 -10:00 · 2017-01-10 23:35:11 +01:00
3804 changed files with 29041 additions and 59055 deletions
@@ -1,10 +1,8 @@
 [run]
 branch = True
-parallel = True
 omit =
    */constants/*
 source =
    pwn
    pwnlib
-    ~/.pwntools-cache-2.7/
-    ~/.pwntools-cache-3.8/
+    ~/.pwntools-cache/
@@ -4,11 +4,6 @@ Thanks for contributing to Pwntools!

 When reporting an issue, be sure that you are running the latest released version of pwntools (`pip install --upgrade pwntools`).

-Please verify that your issue occurs on 64-bit Ubuntu 14.04.  You can use the Dockerfile on `docker.io` for quick testing.
-
-```
-$ docker pull pwntools/pwntools:stable
-$ docker run -it pwntools/pwntools:stable
-```
+Please verify that your issue occurs on 64-bit Ubuntu 14.04.  You can use the Dockerfile in `extra/docker/Dockerfile` to save time.

 If possible, provide a proof-of-concept which demonstrates the problem.  Include any binaries or scripts necessary to reproduce the issue, and please include the full debug output via setting the environment variable `PWNLIB_DEBUG=1`.
@@ -1,54 +0,0 @@
---
-name: Bug report
-about: Create a report to help us improve
-title: ''
-labels: backport-required, bug
-assignees: ''
-
---
-
-Thanks for contributing to Pwntools!
-
-## Update Pwntools First
-
-When reporting an issue, be sure that you are running the latest released version of pwntools (`pip install --upgrade pwntools`).
-
-## Debug Output
-
-Having the extra debug output really helps us, and might help you diagnose the problem yourself.
-
-When submitting an issue that has output from Pwntools, make sure to run your script as shown below, to enable the extra debugging data.
-
-```sh
-$ python exploit.py DEBUG LOG_FILE=log.txt
-```
-
-You should see `[DEBUG]` statements that show what's happening behind the scenes:
-
-```
-[+] Starting local process '/bin/sh' argv=['sh'] : pid 16823
-[DEBUG] Sent 0x7 bytes:
-    'whoami\n'
-[DEBUG] Sent 0x5 bytes:
-    'exit\n'
-[+] Receiving all data: Done (11B)
-[DEBUG] Received 0xb bytes:
-    'crashheap\n'
-[*] Process '/bin/sh' stopped with exit code 0 (pid 16823)
-```
-
-## Verify on Ubuntu
-
-If possible, please verify that your issue occurs on 64-bit Ubuntu 18.04.  We provide a Dockerfile based on Ubuntu 18.04 via `docker.io` to make this super simple, no VM required!
-
-```sh
-# Download the Docker image
-$ docker pull pwntools/pwntools:stable
-
-# Boot the image
-$ docker run -it pwntools/pwntools:stable
-
-pwntools@7dc3ef409476:~$ python
->>> from pwn import *
->>> # Test your code here
-```
@@ -1,18 +0,0 @@
---
-name: Feature request
-about: Suggest an idea for this project
-title: ''
-labels: feature
-assignees: ''
-
---
-
-Thanks for contributing to Pwntools!   Ideas from the community help make Pwntools an amazing tool for everybody.
-
-If you've got an idea for a new feature, please provide information about:
-
-* What the feature does
-* Why the feature should exit
-* What tests should be included
-
-If you think you can write the feature yourself, please submit a Pull Request and we can review your changes!
@@ -1,18 +0,0 @@
---
-name: Question
-about: Ask us a question about Pwntools
-title: ''
-labels: question
-assignees: ''
-
---
-
-Thanks for using Pwntools!  If you have a question, here are some tips that will make it easier for us to help you.
-
-## Check the Documentation
-
-Pwntools has REALLY extensive documentation.  Please check there first!  https://docs.pwntools.com
-
-## Debug Output
-
-If you're having an issue with an exploit, run your script with full debugging output, i.e. `python exploit.py DEBUG`.  This may help you to see what's happening under the hood, and the debug output will help to diagnose any issues you're encountering.
@@ -1,197 +0,0 @@
-name: Continuous Integration
-on: [push, pull_request]
-
-jobs:
-  build:
-    strategy:
-      matrix:
-        python-version: [2.7, 3.8]
-        os: [ubuntu-latest]
-    runs-on: ${{ matrix.os }}
-    steps:
-    - uses: actions/checkout@v2
-      with:
-        fetch-depth: 0
-
-    - name: Git History 2
-      run: git log --oneline --graph -10
-
-    - name: Cache for pip
-      uses: actions/cache@v1
-      id: cache-pip
-      with:
-        path: ~/.cache/pip
-        key: ${{ matrix.os }}-cache-pip
-
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v1
-      with:
-        python-version: ${{ matrix.python-version }}
-
-    - name: Lint
-      run: |
-        pip install flake8
-        flake8 . --count --select=E9,F63,F7 --show-source --statistics --exclude=android-?dk  # TODO: Add F82
-        flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics --exclude=pwnlib/constants,android-?dk,.git,__pycache__
-
-    - name: Detect whether java is needed
-      id: java-needed
-      env:
-        GITHUB_REF: ${{ github.event.ref }}
-        GITHUB_COMMIT_RANGE: ${{ github.event.before }}...${{ github.event.after }}
-      run: |
-        if echo "$GITHUB_REF" | grep -Eq 'staging|tags'; then
-          echo "Found release or important branch ($GITHUB_REF), forcing tests."
-        elif ! git show "$GITHUB_COMMIT_RANGE" >/dev/null; then
-          echo 'Incorrect commit range, forcing android tests.'
-        elif git log --stat "$GITHUB_COMMIT_RANGE" | grep -iE 'android|\<adb\>'; then
-          echo 'Found Android-related commits, forcing tests.'
-        else
-          # clear files that cause Android doctests
-          : > docs/source/adb.rst > docs/source/protocols/adb.rst
-          exit 0
-        fi
-        echo ::set-output name=need::openjdk-8-jre-headless
-
-    - name: Install Linux dependencies
-      env:
-        ANDROID_JRE: ${{ steps.java-needed.outputs.need }}
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y --no-install-recommends -o Acquire::Retries=3 \
-          ash bash-static dash ksh mksh zsh \
-          pandoc gdb gdbserver socat sshpass \
-          binutils-multiarch qemu-user-static \
-          binutils-aarch64-linux-gnu \
-          binutils-arm-linux-gnueabihf \
-          binutils-mips-linux-gnu \
-          binutils-powerpc-linux-gnu \
-          gcc-multilib \
-          $ANDROID_JRE
-        sudo apt-get install -y -o Acquire::Retries=3 \
-          gcc-aarch64-linux-gnu \
-          gcc-arm-linux-gnueabihf
-
-    - name: Install android avd
-      if:  steps.java-needed.outputs.need
-      run: |
-        USER=travis source travis/install.sh
-        set | egrep '^(ANDROID|PATH)' >.android.env
-
-    - name: Set up SSH
-      run: |
-        travis/ssh_setup.sh
-
-    - name: Install dependencies
-      run: |
-        pip install --upgrade pip
-        pip install --upgrade flake8 appdirs
-        python setup.py egg_info
-        pip install --upgrade --editable .
-
-    - name: Sanity checks
-      run:  PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
-
-    - name: Install documentation dependencies
-      run:  pip install -r docs/requirements.txt
-
-    - name: Disable broken tests
-      run: |
-        rm -f docs/source/elf/corefile.rst
-        rm -f docs/source/ui.rst
-
-    - name: Manually install non-broken Unicorn
-      run:  pip install unicorn==1.0.2rc3
-
-    - name: Coverage doctests
-      run: |
-        source .android.env || :
-        echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope # required by some gdb doctests
-        PWNLIB_NOTERM=1 coverage run -m sphinx -b doctest docs/source docs/build/doctest
-
-    - name: Coverage running examples
-      run: |
-        export TERM=linux
-        set -x
-        python travis/coverage_chdir.py examples/fmtstr examples/fmtstr/exploit.py
-        python travis/coverage_chdir.py examples/fmtstr examples/fmtstr/exploit2.py || : # can fail randomly?
-        coverage run examples/asm.py
-        coverage run examples/asm.py
-        coverage run examples/text.py
-        # for f in examples/sigreturn_corefile_*.py; do coverage run "$f"; done # XXX something is wrong
-
-    - name: Coverage running commandline tools
-      run: |
-        export TERM=linux
-        pwn() { coverage run -m pwnlib.commandline.main "$@"; }
-        set -x
-
-        pwn cyclic 32
-        pwn cyclic -l 0x62616161
-
-        pwn shellcraft -f asm --color amd64.linux.sh
-
-        pwn disasm --color ff3424c3ebfe
-
-        pwn hex abcd
-        pwn unhex 4141 4141
-
-        head -c256 /dev/urandom | pwn phd
-
-        pwn errno 2
-
-        pwn constgrep -c freebsd -m ^PROT_ '3 + 4'
-        pwn constgrep ^MAP_ 0
-        pwn constgrep ^O_
-
-    - name: Build source and wheel distributions
-      run: |
-        python setup.py sdist
-        python setup.py bdist_wheel --universal
-
-    - uses: actions/upload-artifact@v2
-      with:
-        name: packages
-        path: dist/
-
-    - name: Upload coverage to coveralls.io
-      run: |
-        coverage combine
-        COVERALLS_REPO_TOKEN=PP20MEgztXIQJJTguQwe2jeCh6Bm4lkbv coveralls
-
-  staging-merge:
-    runs-on: ubuntu-latest
-    if: github.repository_owner == 'Gallopsled' && github.event_name == 'push' && startsWith(github.event.ref, 'refs/heads/') && endsWith(github.event.ref, '-staging')
-    needs: build
-    steps:
-    - uses: actions/checkout@v2
-      with:
-        fetch-depth: 20
-    - name: Push changes to protected branch
-      env:
-        GITHUB_REF: ${{ github.event.ref }}
-      run: |
-        BRANCH=${GITHUB_REF#refs/heads/}
-        TARGET=${BRANCH%-staging}
-        git branch -f "$TARGET"
-        git push origin "$TARGET"
-
-  pypi:
-    runs-on: ubuntu-latest
-    if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags')
-    needs: build
-    steps:
-    - name: Download artifacts
-      uses: actions/download-artifact@v2
-      with:
-        name: packages
-        path: dist
-
-    - name: Publish package
-      uses: pypa/[email protected]
-      with:
-        user: __token__
-        password: ${{ secrets.pypi_password }}
-
-    - if: failure()
-      run: ls -R
@@ -11,8 +11,7 @@ docs/build
 build
 MANIFEST
 dist
-venv
-.vscode
 *.egg-info
 *.core
 .coverage
+.tox
@@ -1,7 +1,10 @@
+sudo: false
 language: python
 addons:
  apt:
    packages:
+    - gcc-multilib
+    - gcc-4.6-arm-linux-gnueabihf
    - lib32stdc++6
    - ash
    - bash
@@ -10,55 +13,27 @@ addons:
    - mksh
    - zsh
    - pandoc
-    - gdb
-    - socat
-    - sshpass
-    - binutils
-    - qemu-user-static
-    - binutils-multiarch
-    - binutils-aarch64-linux-gnu
-    - binutils-arm-linux-gnueabihf
-    - binutils-mips-linux-gnu
-    - binutils-powerpc-linux-gnu
-    - gcc-aarch64-linux-gnu
-    - gcc-arm-linux-gnueabihf
-    - bash-static
-
 cache:
    - pip
    - directories:
        - usr
-        - /home/travis/virtualenv/python2.7.15/lib/python2.7/site-packages/
-        - /home/travis/virtualenv/python2.7.15/bin/
-        - /home/travis/virtualenv/python3.8.*/lib/python3.8/site-packages/
-        - /home/travis/virtualenv/python3.8.*/bin/
-        - docs/build/doctest/.doctrees
+        - /home/travis/virtualenv/python2.7.9/lib/python2.7/site-packages/
+        - /home/travis/virtualenv/python2.7.9/bin/
 python:
  - "2.7"
-  - "3.8"
 before_install:
-  - echo $-
  - source travis/install.sh
  - source travis/ssh_setup.sh
-  - echo $-
 install:
-  - pip install --upgrade pip
-  - pip install --upgrade flake8 appdirs # https://github.com/ActiveState/appdirs/issues/89#issuecomment-282326570
-  - python setup.py egg_info      # pypa/pip#6275
  - pip install --upgrade --editable .
-  - pip install --upgrade --requirement docs/requirements.txt
+  - pip install --requirement docs/requirements.txt
 before_script:
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
-  - sudo sh -c "echo 0 > /proc/sys/kernel/yama/ptrace_scope"
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
 script:
-  # stop the build if there are Python syntax errors or undefined names
-  - flake8 . --count --select=E9,F63,F7 --show-source --statistics --exclude=android-?dk  # TODO: Add F82
-  # exit-zero treats all errors as warnings.  The GitHub editor is 127 chars wide
  - PWNLIB_NOTERM=1 coverage run -m sphinx -b doctest docs/source docs/build/doctest
-  - coverage combine
 after_success:
  - coveralls
  - source travis/update_demo.sh
@@ -9,33 +9,9 @@ The table below shows which release corresponds to each branch, and what date th

 | Version          | Branch   | Release Date           |
 | ---------------- | -------- | ---------------------- |
-| [4.3.0](#430)    | `dev`    | Jun 30, 2020 (planned)
-| [4.2.0](#420)    | `beta`   | Jun 5, 2020 (planned)
-| [4.1.1](#411)    | `stable` | Jun 3, 2020
-| [4.1.0](#410)    |          | May 8, 2020
-| [4.0.1](#401)    |          | Jan 22, 2020
-| [4.0.0](#400)    |          | Jan 09, 2020
-| [3.13.0](#3130)  |          | Nov 5, 2019
-| [3.12.2](#3122)  |          | Jan 8, 2019
-| [3.12.1](#3121)  |          | Sept 17, 2018
-| [3.12.0](#3120)  |          | Feb 22, 2018
-| [3.11.0](#3110)  |          | Jan 3, 2018
-| [3.10.0](#3100)  |          | Oct 25, 2017
-| [3.9.2](#392)    |          | Oct 5, 2017
-| [3.9.1](#391)    |          | Sep 28, 2017
-| [3.9.0](#390)    |          | Sep 11, 2017
-| [3.8.0](#380)    |          | Jul 29, 2017
-| [3.7.1](#371)    |          | Jul 14, 2017
-| [3.7.0](#370)    |          | Jun 19, 2017
-| [3.6.1](#361)    |          | May 12, 2017
-| [3.6.0](#360)    |          | May 8, 2017
-| [3.5.1](#351)    |          | Apr 15, 2017
-| [3.5.0](#350)    |          | Mar 26, 2017
-| [3.4.1](#341)    |          | Feb 17, 2017
-| [3.4.0](#340)    |          | Feb 13, 2017
-| [3.3.4](#334)    |          | Jan 12, 2016
-| [3.3.3](#333)    |          | Jan 10, 2016
-| [3.3.2](#332)    |          | Jan 10, 2016
+| [3.5.0](#350)    | `dev`    | Mar 18, 2017 (planned)
+| [3.4.0](#340)    | `beta`   | Feb 4, 2017 (planned)
+| [3.3.2](#332)    | `stable` | Jan 10, 2016
 | [3.3.1](#331)    |          | Jan 10, 2016
 | [3.3.0](#330)    |          | Dec 24, 2016
 | [3.2.1](#321)    |          | Dec 24, 2016
@@ -49,402 +25,13 @@ The table below shows which release corresponds to each branch, and what date th
 | [3.0.0](#300)    |          | Aug 20, 2016
 | [2.2.0](#220)    |          | Jan 5, 2015

-## 4.3.0 (`dev`)
-
-To be released on Jun 30, 2020.
-
-## 4.2.0 (`beta`)
-
-To be released on Jun 5, 2020.
-
- [#1436][1436] Add ret2dlresolve automation
- [fecf9f] tubes.ssh.process() no longer requires python 2 installed on remote (still requires python, though)
- Miscellanous improvements to DynElf and fmtstr leaker (see examples/fmtstr/exploit2.py)
- [#1454][1454] Support for windows console colors
-
-[1436]: https://github.com/Gallopsled/pwntools/pull/1436
-[fecf9f]: http://github.com/Gallopsled/pwntools/commit/fecf9f
-[1454]: https://github.com/Gallopsled/pwntools/pull/1454
-
-## 4.1.1 (`stable`)
-
- Fix PLT resolution by locking unicorn <1.0.2rc4 (#1538)
- Fix wrong ELF/context unpack handling (c4c11a37)
- Fix updating of ELF.functions addresses after changing ELF.address #1512 (#1513)
- Update Corefile warnings and replace asserts with normal checks (#1526)
- several py2-py3 issues (#1451)
- Fix cyclic command
-
-## 4.1.0
-
- [#1316][1316] Fix connect shellcraft in python 3
- [#1323][1323] Fix issues related with debugging
- [#1001][1001] Enhance `unlock_bootloader` with better status messages
- [#1389][1389] remove old dependencies
- [#1241][1241] Launch QEMU with sysroot if specified
- [#1218][1218] Support for FileStructure exploitation
-
-[1316]: https://github.com/Gallopsled/pwntools/pull/1316
-[1323]: https://github.com/Gallopsled/pwntools/pull/1323
-[1001]: https://github.com/Gallopsled/pwntools/pull/1001
-[1389]: https://github.com/Gallopsled/pwntools/pull/1389
-[1241]: https://github.com/Gallopsled/pwntools/pull/1241
-[1218]: https://github.com/Gallopsled/pwntools/pull/1218  
-
-## 4.0.1
-
- [#1412][1412] `recvline_pred()` and similar do not reorder data
- Bypass unicorn-engine/unicorn#1100 and unicorn-engine/unicorn#1170 requiring unstable package
-
-[1412]: https://github.com/Gallopsled/pwntools/pull/1412
-
-## 4.0.0
-
- **Python 3 support! <3**
- [#1402][1402] Fix serialtube in python 3
- [#1391][1391] Fix process.libs
- [#1317][1317] Tubes with `context.encoding`
- [#1216][1216] Improve format string generator
- [#1285][1285] Add freebsd generic syscall templates
- [76413f][76413f] Add pwnlib.adb.bootimg for 'ANDROID!' format boot.img images
- [#1202][1202] Docker: Kill 14 layers in pwntools base images
- [#1182][1182] shellcraft.dupio() for mips
-
-[1402]: https://github.com/Gallopsled/pwntools/pull/1402
-[1391]: https://github.com/Gallopsled/pwntools/pull/1391
-[1317]: https://github.com/Gallopsled/pwntools/pull/1317
-[1285]: https://github.com/Gallopsled/pwntools/pull/1285
-[1216]: https://github.com/Gallopsled/pwntools/pull/1216
-[1202]: https://github.com/Gallopsled/pwntools/pull/1202
-[1182]: https://github.com/Gallopsled/pwntools/pull/1182
-[76413f]: https://github.com/Gallopsled/pwntools/commit/76413f
-
-## 3.13.0
-
- [#1204][1204] Reduce ROP cache filename length
- [#1175][1175] Fix nested SSH connectors
- [#1355][1355] Fix 'break' syscall
- [#1277][1277] Fix timeout parameter passing in sendlineafter and other similar functions
- [#1292][1292] Provide correct arch name to gdb for sparc64
-
-[1175]: https://github.com/Gallopsled/pwntools/pull/1175
-[1204]: https://github.com/Gallopsled/pwntools/pull/1204
-[1277]: https://github.com/Gallopsled/pwntools/pull/1277
-[1292]: https://github.com/Gallopsled/pwntools/pull/1292
-[1355]: https://github.com/Gallopsled/pwntools/pull/1355
-
-## 3.12.2
-
- [#1242][1242] Use IntervalTree 2.xx, disallow use of 3.xx
- [#1243][1243] Fix a typo that caused an exception when executing a binary with `process()` which returns `-ENOEXEC` and the system does not have `qemu-user` binaries installed.
-
-[1242]: https://github.com/Gallopsled/pwntools/pull/1242
-[1243]: https://github.com/Gallopsled/pwntools/pull/1243
-
-## 3.12.1
-
- [#1198][1198] More compatibility fixes for pyelftools==0.25, and pin Sphinx<1.8.0 since it causes testing errors
- [#1191][1191] Fix compatibility with pyelftools==0.25
- [#1159][1159] Fix check for `/proc/.../status`
- [#1162][1162] Fix broken package versions
- [#1150][1150] Fix exception raised when a cache file is missing
- [#1156][1156] Fix ROP gadget selection logic involving `int` and `syscall` instructions
- [#1152][1152] Fix QEMU LD_PREFIX calculation (wrong parameter passed)
- [#1155][1155] Use Ubuntu Trusty for all CI builds
- [#1131][1131] Add "libc-" to libc prefixes in `process` tubes
- [#1125][1125] Fix a typo
- [#1121][1121] Fix tests which were broken by an upstream Sphinx change
- [#1104][1104] Add `DynELF.dump()` for dumping remote ELF files
- [#1101][1101] Set `context.os` via `context.binary`, useful for Android exploitation
- [5fdc08][5fdc08] Work around broken `pidof` on Android
- [63dfed][63dfed] Print warning when Corefile deletion fails instead of throwing an exception
- [#1094][1094] Make hexdump output alignment more consistent
- [#1096][1096] `flat()` and `fit()` are now the same function
-
-[1198]: https://github.com/Gallopsled/pwntools/pull/1198
-[1191]: https://github.com/Gallopsled/pwntools/pull/1191
-[1159]: https://github.com/Gallopsled/pwntools/pull/1159
-[1162]: https://github.com/Gallopsled/pwntools/pull/1162
-[1150]: https://github.com/Gallopsled/pwntools/pull/1150
-[1156]: https://github.com/Gallopsled/pwntools/pull/1156
-[1152]: https://github.com/Gallopsled/pwntools/pull/1152
-[1155]: https://github.com/Gallopsled/pwntools/pull/1155
-[1131]: https://github.com/Gallopsled/pwntools/pull/1131
-[1125]: https://github.com/Gallopsled/pwntools/pull/1125
-[1121]: https://github.com/Gallopsled/pwntools/pull/1121
-[1104]: https://github.com/Gallopsled/pwntools/pull/1104
-[1101]: https://github.com/Gallopsled/pwntools/pull/1101
-[1094]: https://github.com/Gallopsled/pwntools/pull/1094
-[1096]: https://github.com/Gallopsled/pwntools/pull/1096
-[5fdc08]: https://github.com/Gallopsled/pwntools/commit/5fdc08
-[63dfed]: https://github.com/Gallopsled/pwntools/commit/63dfed
-
-## 3.12.0
-
- [#1083][1083] Better error messages for `gdb` when `LD_PRELOAD` is incorrect
- [#1085][1085] Add support for extracting Android `BOOTLDR!` images
- [#1075][1075] Add support for detecting GNU Screen for `run_in_new_terminal`
- [#1074][1074] Add support for running `pwntools-gdb` wrapper script instead of `gdb`
- [#1068][1068] Work around very old OpenSSL versions which don't have sha256 support *AND* don't exit with an error code when trying to use it
- [#1067][1067] Add `pwnlib.tubes.server` module, which adds a reusable `server` listener
- [#1063][1063] Add support for labels in `fit()`, allowing dynamic contents to be injected.  (This feature is really cool, check out the pull request!)
-
-[1083]: https://github.com/Gallopsled/pwntools/pull/1083
-[1085]: https://github.com/Gallopsled/pwntools/pull/1085
-[1075]: https://github.com/Gallopsled/pwntools/pull/1075
-[1074]: https://github.com/Gallopsled/pwntools/pull/1074
-[1068]: https://github.com/Gallopsled/pwntools/pull/1068
-[1067]: https://github.com/Gallopsled/pwntools/pull/1067
-[1063]: https://github.com/Gallopsled/pwntools/pull/1063
-
-## 3.11.0
-
- [#1044][1044] Enhancements to ROP
-    + Much better support for 64-bit Intel (amd64) ROP
-    + ROP gadget selection is optimized to favor multi-pops instead of multiple single-pop gadgets
-    + Added support for blacklisting byte values in ROP gadget addresses
- [#1049][1049] Enhancements to `cyclic`
-    + `context` now has two additional attributes, `cyclic_alphabet` and `cyclic_length`, which correspond to the arguments `alphabet` and `n` to `cyclic()` and `cyclic_find()` and related routines.
-    + The motivation for this change is to allow setting the `alphabet` globally, so that any padding / patterns generated internally to pwntools can be controlled.  The specific motivation is blacklisting values in ROP padding.
- [#1052][1052] Enhancements for detecting `QEMU_LD_PREFIX` used by QEMU user-mode emulation for sysroots
- [#1035][1035] Minor documentation changes
- [#1032][1032] Enhancements to `pwn template`
- [#1031][1031] More accurate `Coredump.fault_addr` on amd64
- [#1084][1084] Fix broken tests due to `ftp.debian.org` going down
-
-[1044]: https://github.com/Gallopsled/pwntools/pull/1044
-[1049]: https://github.com/Gallopsled/pwntools/pull/1049
-[1052]: https://github.com/Gallopsled/pwntools/pull/1052
-[1035]: https://github.com/Gallopsled/pwntools/pull/1035
-[1032]: https://github.com/Gallopsled/pwntools/pull/1032
-[1031]: https://github.com/Gallopsled/pwntools/pull/1031
-[1084]: https://github.com/Gallopsled/pwntools/pull/1084
-
-## 3.10.0
-
- [#1007][1007] Add support for setting a `gdbinit` file in the context
- [#1055][1055] Fixes for `Corefile` stack parsing, speed up `ELF.string()`
- [#1057][1057] Fix a variable name typo in `DynELF` logging which results in an exception being thrown
- [#1058][1058] Fix an edge case in `ssh_process.exe`
-
-[1007]: https://github.com/Gallopsled/pwntools/pull/1007
-[1055]: https://github.com/Gallopsled/pwntools/pull/1055
-[1057]: https://github.com/Gallopsled/pwntools/pull/1057
-[1058]: https://github.com/Gallopsled/pwntools/pull/1058
-
-## 3.9.2
-
- [#1043][1043] Do not attempt to populate the libraries used by statically-linked binaries
-
-[1043]: https://github.com/Gallopsled/pwntools/pull/1043
-
-## 3.9.1
-
- [#1038][1038] Fix an issue with `process()` where glibc would buffer data internally, causing a hang on `select()`
- [#1036][1036] Fix Travis CI logging verbosity
- [#1029][1029] Fix some `unicode` issues when using the `readline` command history in `tube.interactive()`
-
-[1038]: https://github.com/Gallopsled/pwntools/pull/1038
-[1036]: https://github.com/Gallopsled/pwntools/pull/1036
-[1029]: https://github.com/Gallopsled/pwntools/pull/1029
-
-## 3.9.0
-
- [#1003][1003] Make `concat_all` faster while also simplifying it's logic
- [#1014][1014] Fix for overwritten env when parsing core file
- [#1023][1023] Fixes to Travis CI
-
-[1003]: https://github.com/Gallopsled/pwntools/pull/1003
-[1014]: https://github.com/Gallopsled/pwntools/pull/1014
-[1023]: https://github.com/Gallopsled/pwntools/pull/1023
-
-## 3.8.0
-
- [#981][981] Fixed RELRO detection logic
- [#986][986] Enhancements to DynELF for controlling usage of LibcDB
- A few documentation fixes
- A few fixes for the Docker image
-
-[981]: https://github.com/Gallopsled/pwntools/pull/981
-[986]: https://github.com/Gallopsled/pwntools/pull/986
-
-## 3.7.1
-
- [#998][998] Fix a bug where integer values could not be set in `.pwn.conf`.
-
-[998]: https://github.com/Gallopsled/pwntools/pull/998
-
-## 3.7.0
-
- [#933][933] DynELF works better with different base addresses
- [#952][952] A few small fixes were made to `pwn template`, and the CRC database was updated.
- [5c72d62c][5c72d62c] Updated the CRC database
-
-[933]: https://github.com/Gallopsled/pwntools/pull/933
-[952]: https://github.com/Gallopsled/pwntools/pull/952
-[5c72d62c]: https://github.com/Gallopsled/pwntools/commit/5c72d62c
-
-## 3.6.1
-
- [#979][979]+[1a4a1e1][1a4a1e1] Fixed [#974][974], a bug related to the terminal handling and numlock.
- [#980][980] Fixed the `pwn template` command.
-
-[974]: https://github.com/Gallopsled/pwntools/issues/974
-[979]: https://github.com/Gallopsled/pwntools/pull/979
-[980]: https://github.com/Gallopsled/pwntools/pull/980
-[1a4a1e1]: https://github.com/Gallopsled/pwntools/commit/1a4a1e1
-
-## 3.6.0
-
- [#895][895] Added a Dockerfile to simplify testing setup and allow testing on OSX
- [#897][897] Fixed some incorrect AArch64 syscals
- [#893][893] Added the `pwnlib.config` module
-    + Configuration options can now be set in `~/.pwn.conf`
-    + This replaces the old, **undocumented** mechanism for changing logging colors.  Only @br0ns and @ebeip90 were likely using this.
-    + More information is available in the documentation [here](http://docs.pwntools.com/en/dev/config.html).
- [#899][899] Pwntools now uses Unicorn Engine to emulate PLT instructions to ensure correct mapping of PIE / RELRO binaries.
- [#904][904] Enhancements to the accuracy of the `pwn checksec` command.
- [#905][905] Added a `pwn debug` command-line utility which automates the process of `gdb.attach(process(...))` to spawn GDB
-    + More information is available in the documentation [here](http://docs.pwntools.com/en/dev/commandline.html#pwn-debug)
- [#919][919] Added a `pwn template` command-line utility to simplify the process of bootstrapping a new exploit.
-    + More information is available in the documentation [here](http://docs.pwntools.com/en/dev/commandline.html#pwn-template).
- [#948][948] Fix unnecessary warning for Core files
- [#954][954] Fix list processing in `~/.pwn.conf`
- [#967][967] Respect `TERM_PROGRAM` for `run_in_new_terminal`
- [#970][970] Fix overly-aggressive corefile caching
-
-[947]: https://github.com/Gallopsled/pwntools/pull/947
-[948]: https://github.com/Gallopsled/pwntools/pull/948
-[954]: https://github.com/Gallopsled/pwntools/pull/954
-[960]: https://github.com/Gallopsled/pwntools/pull/960
-[967]: https://github.com/Gallopsled/pwntools/pull/967
-[968]: https://github.com/Gallopsled/pwntools/pull/968
-[970]: https://github.com/Gallopsled/pwntools/pull/970
-
-[895]: https://github.com/Gallopsled/pwntools/pull/895
-[897]: https://github.com/Gallopsled/pwntools/pull/897
-[893]: https://github.com/Gallopsled/pwntools/pull/893
-[899]: https://github.com/Gallopsled/pwntools/pull/899
-[904]: https://github.com/Gallopsled/pwntools/pull/904
-[905]: https://github.com/Gallopsled/pwntools/pull/905
-[919]: https://github.com/Gallopsled/pwntools/pull/919
-
-## 3.5.1
-
- [#945][945] Speed up ssh via caching checksec results (fixes [#944][944])
- [#950][950] Fixes a bug where setting `context.arch` does not have an effect on `adb.compile()` output architecture
-
-[944]: https://github.com/Gallopsled/pwntools/issues/944
-[945]: https://github.com/Gallopsled/pwntools/pull/945
-[950]: https://github.com/Gallopsled/pwntools/pull/950
-
 ## 3.5.0

- [b584ca3][b584ca3] Fixed an issue running `setup.py` on ARM
- [#822][822] Enabled relative leaks with `MemLeak`
-    + This should be useful for e.g. heap-relative leaks
- [#832][832] Changed all internal imports to use absolute imports (no functional changes)
- [a12d0b6][a12d0b6] Move `STDOUT`, `PIPE`, `PTY` constants to globals
-    + `process(..., stdin=process.PTY)` --> `process(..., stdin=PTY)`
- [#828][828] Use `PR_SET_PTRACER` for all `process()` and `ssh.process()` instances
-    + This simplifies debugging on systems with YAMA ptrace enabled
- Various documentation enhancements
-    + In particular, the [gdb][gdb], [elf][elf], and [ssh][ssh] docs are much better
- [#833][833] Performance enhancements for `adb` module
- [d0267f3][d0267f3] `packing.fit()` now treats large offsets as cyclic patterns (e.g. `0x61616161` behaves the same as `"aaaa"`)
- [#835][835] Added `ssh.checksec`
-    + Reports the kernel version and other relevant information on connection
- [#857][857] Slightly shortened `execve` shellcode
- [300f8e0][300f8e0] Slightly speed up processing of large ELF files
- [#861][861] Adds support for extracting `IKCONFIG` configs from Linux kernel images, and extends `checksec` to report on any insecure configurations discovered
- [#871][871] Moves all of the basic syscall templates to `shellcraft/common` and exposes them via symlinks.  Closed [#685][685]
-    + Should not have any visible effects from any documented APIs
-    + `shellcraft.arch.os.syscall_function()` still works the same
-    + We now have the ability to differentiate between the `connect` syscall, and a TCP `connect` helper
- [#887][887] `sh_string` now returns a quoted empty string `''` rather than just an empty string
- [#839][839] Exposes a huge amount of functionality via corefiles which was not previously availble.  See the [docs][corefile_docs] for examples.
-    + `process().corefile` will automatically instantiate a Corefile for the process
-    + QEMU-emulated processes are supported
-    + Native processes are supported, including extraction of coredumps from `apport` crash logs
-    + Native processes can be dumped *while running*, in a manner similar to `GDB`'s `gcore` script
- [#875][857] Added [documentation][aarch64] (and tests) for AArch64 shellcode
- [#882][882] The `ROP` class now respects `context.bytes` instead of using the hard-coded value of `4` (fixed [#879][879])
- [#869][869] Added several fields to the `process` class (`uid`, `gid`, `suid`, `sgid`) which are recorded at execution time, based on the file permissions
- [#868][868] Changed the way that `ssh.process()` works internally, and it now returns a more specialized class, `ssh_process`.
-    + Added `ssh_process.corefile` for fetching remote corefiles
-    + Added `ssh_process.ELF` for getting an ELF of the remote executable
-    + The `uid`, `gid`, and `suid`, and `sgid` which are recorded at execution time, based on the file permissions
- [#865][865] Fixes `ELF.read` to support contiguous memory reads across non-contiguous file-backed segments
- [#862][862] Adds a `symlink=` argument to `ssh.set_working_directory`, which will automatically symlink all of the files in the "old" working directory into the "new" working directory
-
-[ssh]: http://docs.pwntools.com/en/dev/tubes/ssh.html
-[gdb]: http://docs.pwntools.com/en/dev/gdb.html
-[elf]: http://docs.pwntools.com/en/dev/elf.html
-[corefile_docs]: http://docs.pwntools.com/en/dev/elf/corefile.html
-[aarch64]: http://docs.pwntools.com/en/dev/shellcraft/aarch64.html
-
-[685]: https://github.com/Gallopsled/pwntools/pull/685
-[822]: https://github.com/Gallopsled/pwntools/pull/822
-[828]: https://github.com/Gallopsled/pwntools/pull/828
-[832]: https://github.com/Gallopsled/pwntools/pull/832
-[833]: https://github.com/Gallopsled/pwntools/pull/833
-[835]: https://github.com/Gallopsled/pwntools/pull/835
-[839]: https://github.com/Gallopsled/pwntools/pull/839
-[857]: https://github.com/Gallopsled/pwntools/pull/857
-[861]: https://github.com/Gallopsled/pwntools/pull/861
-[862]: https://github.com/Gallopsled/pwntools/pull/862
-[865]: https://github.com/Gallopsled/pwntools/pull/865
-[868]: https://github.com/Gallopsled/pwntools/pull/868
-[869]: https://github.com/Gallopsled/pwntools/pull/869
-[871]: https://github.com/Gallopsled/pwntools/pull/871
-[875]: https://github.com/Gallopsled/pwntools/pull/857
-[879]: https://github.com/Gallopsled/pwntools/issues/879
-[882]: https://github.com/Gallopsled/pwntools/pull/882
-[887]: https://github.com/Gallopsled/pwntools/pull/887
-
-
-[b584ca3]: https://github.com/Gallopsled/pwntools/commit/b584ca3
-[a12d0b6]: https://github.com/Gallopsled/pwntools/commit/a12d0b6
-[d0267f3]: https://github.com/Gallopsled/pwntools/commit/d0267f3
-[300f8e0]: https://github.com/Gallopsled/pwntools/commit/300f8e0
-
-## 3.4.1
-
- [#894][894] Fix a bug when using `gdb.debug()` over ssh.
- [e021f57][e021f57] Fix a bug ([#891][891]) in `rop` when needing to insert padding to fix alignment
-
-[e021f57]: https://github.com/Gallopsled/pwntools/commit/e021f57
-[894]: https://github.com/Gallopsled/pwntools/pull/894
-[891]: https://github.com/Gallopsled/pwntools/issues/891
+To be released on Mar 18, 2017.

 ## 3.4.0

- [#800][800] Add `shell=` option to `ssh.process()`
- [#806][806] Add `context.buffer_size` for fine-tuning `tube` performance
-    + Also adds `buffer_fill_size=` argument for all tubes
- [b83a6c7][b83a6c7] Fix undocumented `process.leak` function
- [546061e][546061e] Modify `coredump_filter` of all spawned processes, so that core dumps are more complete
- [#809][809] Add several functions to `adb` (`unlink`, `mkdir`, `makedirs`, `isdir`, `exists`)
- [#817][817] Make disconnection detection more robust
-
-[800]: https://github.com/Gallopsled/pwntools/pull/800
-[806]: https://github.com/Gallopsled/pwntools/pull/806
-[809]: https://github.com/Gallopsled/pwntools/pull/809
-[817]: https://github.com/Gallopsled/pwntools/pull/817
-[5d9792f]: https://github.com/Gallopsled/pwntools/commit/5d9792f
-[b83a6c7]: https://github.com/Gallopsled/pwntools/commit/b83a6c7
-[546061e]: https://github.com/Gallopsled/pwntools/commit/546061e
-
-## 3.3.4
-
- [#850][850] and [#846][846] fix issues with `hexdump` and the `phd` command-line utility, when using pipes (e.g. `echo foo | phd`)
- [#852][852] Fixes register ordering in `regsort`
- [#853][853] Fixes the registers restored in `shellcraft.amd64.popad`
-
-[846]: https://github.com/gallopsled/pwntools/pull/846
-[850]: https://github.com/gallopsled/pwntools/pull/850
-[852]: https://github.com/gallopsled/pwntools/pull/852
-[853]: https://github.com/gallopsled/pwntools/pull/853
+To be released on Feb 4, 2017.

 ## 3.3.3

@@ -554,7 +141,7 @@ Multiple bug fixes.
 - [1e414af][1e414af] Added `connect()` alias for `remote()`
    + For example, `io=connect('google.com', 80)`
    + This also works with `tcp(...)` and `udp(...)` aliases
- [869ec42][869ec42] Added `ssh.read()` and `ssh.write()` aliases
+- [869ec42][869ec42] Added `ssh.read()` and `ssh.write()` aiases
 - [2af55c9][2af55c9] `AdbDevice` objects exposed via e.g. `adb.devices()` now offer scoped access to all `adb` module properties
    + It is now possible to e.g. `map(lambda d: d.process(['id']).recvall(), adb.devices())`

@@ -641,7 +228,7 @@ Android support via a new `adb` module, `context.device`, `context.adb_host`, an
 - Added `context.log_file` setting for sending logs to a file.  This can be set with the `LOG_FILE` magic command-line option.
 - Added `context.noptrace` setting for disabling actions which require `ptrace` support.  This is useful for turning all `gdb.debug` and `gdb.attach` options into no-ops, and can be set via the `NOPTRACE` magic command-line option.
 - Added `context.proxy` which hooks all connections and sends them to a SOCKS4/SOCKS5.  This can be set via the `PROXY` magic command-line option.
- Added `context.randomize` to control randomization of settings like XOR keys and register ordering (default off).
+- Added `context.randomize` to control randommization of settings like XOR keys and register ordering (default off).
 - Added `context.terminal` for setting how to launch commands in a new terminal.

 #### DynELF and MemLeak Module
@@ -654,7 +241,7 @@ Android support via a new `adb` module, `context.device`, `context.adb_host`, an
 #### Encoders Module

 - Added a `pwnlib.encoders` module for assembled-shellcode encoders/decoders
- Includes position-independent basic XOR encoders
+- Includes position-indepentent basic XOR encoders
 - Includes position-independent delta encoders
 - Includes non-position-independent alphanumeric encoders for Intel
 - Includes position-independent alphanumeric encoders for ARM/Thumb
@@ -2,6 +2,6 @@ graft examples
 graft extra
 include *.md *.txt *.sh *.yml MANIFEST.in
 recursive-include docs   *.rst *.png Makefile *.py *.txt
-recursive-include pwnlib *.py *.asm *.rst *.md *.txt *.sh __doc__ *.mako
+recursive-include pwnlib *.py *.asm *.rst *.md *.txt *.sh
 recursive-include pwn    *.py *.asm *.rst *.md *.txt *.sh
 recursive-exclude *.pyc
@@ -2,13 +2,13 @@
 ![pwntools logo](https://github.com/Gallopsled/pwntools/blob/stable/docs/source/logo.png?raw=true)

 [![Docs](https://readthedocs.org/projects/pwntools/badge/?version=stable)](https://docs.pwntools.com/)
-[![PyPI](https://img.shields.io/pypi/v/pwntools?style=flat)](https://pypi.python.org/pypi/pwntools/)
+[![PyPI](https://img.shields.io/badge/pypi-v3.3.3-green.svg?style=flat)](https://pypi.python.org/pypi/pwntools/)
 [![Travis](https://travis-ci.org/Gallopsled/pwntools.svg)](https://travis-ci.org/Gallopsled/pwntools)
 [![Coveralls](https://img.shields.io/coveralls/Gallopsled/pwntools/dev.svg)](https://coveralls.io/github/Gallopsled/pwntools?branch=dev)
 [![Twitter](https://img.shields.io/badge/twitter-pwntools-4099FF.svg?style=flat)](https://twitter.com/pwntools)
 [![MIT License](https://img.shields.io/badge/license-MIT-blue.svg?style=flat)](http://choosealicense.com/licenses/mit/)

-Pwntools is a CTF framework and exploit development library. Written in Python, it is designed for rapid prototyping and development, and intended to make exploit writing as simple as possible.
+pwntools is a CTF framework and exploit development library. Written in Python, it is designed for rapid prototyping and development, and intended to make exploit writing as simple as possible.

 ```python
 from pwn import *
@@ -32,15 +32,14 @@ To get you started, we've provided some example solutions for past CTF challenge

 # Installation

-Pwntools is best supported on 64-bit Ubuntu LTE releases (12.04, 14.04, 16.04 and 18.04).  Most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).  Python >= 2.7 is required (Python 3 suggested as best).
+pwntools is best supported on 64-bit Ubuntu 12.04 and 14.04, but most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).  Python 2.7 is required.

 Most of the functionality of pwntools is self-contained and Python-only.  You should be able to get running quickly with

 ```sh
 apt-get update
-apt-get install python3 python3-pip python3-dev git libssl-dev libffi-dev build-essential
-python3 -m pip install --upgrade pip
-python3 -m pip install --upgrade git+https://github.com/Gallopsled/pwntools.git@dev3
+apt-get install python2.7 python-pip python-dev git libssl-dev
+pip install --upgrade pwntools
 ```

 However, some of the features (assembling/disassembling foreign architectures) require non-Python dependencies.  For more information, see the [complete installation instructions here](https://docs.pwntools.com/en/stable/install.html).
@@ -4,6 +4,7 @@ Pwntools makes extensive use of unit tests and integration tests to ensure every

 ## Test Suite

+
 To run the test suite, it is best to use Ubuntu 12.04 or 14.04, and run the following commands.  **Be aware** that this will add a user to the machine, and create a public key for SSH login!

 ```sh
@@ -13,12 +14,6 @@ pip install --upgrade --editable .
 PWNLIB_NOTERM=1 make -C docs doctest
 ```

-## Testing in Docker
-
-A `Dockerfile` has been provided which has a clean testing environment with Ubuntu Xenial.  It is very similar to the online Travis CI testing environment, but uses a more modern version of Ubuntu.
-
-See `travis/docker/README.md` for more information.
-
 ## New Tests

 To add a new test to an existing module, just add an inline doctest.  If the test needs access to an external module, add the import statement to the `testsetup` block in the corresponding file in `docs/source/<module>.rst`.
@@ -44,7 +44,7 @@ def main(args):
 		doc2dash.__main__.main.main( \
 			[ os.path.join(dstdir, "html"), "-d", dstdir, "-n", name, \
 					"-f", "-I", "index.html"], "doc2dash", False)
-	except SystemExit as e:
+	except SystemExit,e:
 		pass

 	# Insert a link to the online version.
@@ -1,17 +1,16 @@
-capstone
-coveralls
-doc2dash
+sphinxcontrib-napoleon
+sphinxcontrib-autoprogram==0.1.2
 isort
-mako>=1.0.0
 paramiko>=1.15.2
-pip>=6.0.8
+mako>=1.0.0
 pyelftools>=0.2.3
-pygments>=2.0
-pypandoc
+capstone
+ropgadget>=5.3
 pyserial>=2.7
 requests>=2.5.1
-ropgadget>=5.3
-sphinx
+pip>=6.0.8
+tox>=1.8.1
+pygments>=2.0
 sphinx_rtd_theme
-sphinxcontrib-napoleon
-sphinxcontrib-autoprogram
+doc2dash
+coveralls
@@ -47,7 +47,7 @@ This module is our "clean" python-code. As a rule, we do not think that
 importing :mod:`pwnlib` or any of the submodules should have any significant
 side-effects (besides e.g. caching).

-For the most part, you will also only get the bits you import. You for instance would
+For the most part, you will also only get the bits you import. You for instance
 not get access to :mod:`pwnlib.util.packing` simply by doing ``import
 pwnlib.util``.

@@ -1,6 +1,5 @@
 .. testsetup:: *

-   from pprint import pprint
   from pwn import *
   adb = pwnlib.adb

@@ -6,7 +6,6 @@
   from pwnlib.asm import *
   from pwnlib import shellcraft
   from pwnlib.tubes.process import process
-   from pwnlib.util.fiddling import unhex


 :mod:`pwnlib.asm` --- Assembler functions
@@ -14,13 +13,3 @@

 .. automodule:: pwnlib.asm
   :members:
-
-Internal Functions
-----------------------------------------
-
-These are only included so that their tests are run.
-
-You should never need these.
-
-.. autofunction:: pwnlib.asm.dpkg_search_for_binutils
-.. autofunction:: pwnlib.asm.print_binutils_instructions
@@ -12,9 +12,6 @@
 # serve to show the default.

 import os
-import doctest
-import signal
-import six
 import subprocess
 import sys

@@ -27,6 +24,8 @@ sys.path.insert(0, os.path.abspath('../..'))

 import pwnlib

+# -- General configuration -----------------------------------------------------
+
 # If your documentation needs a minimal Sphinx version, state it here.
 #needs_sphinx = '1.0'

@@ -45,36 +44,14 @@ extensions = [
    'sphinxcontrib.napoleon'
 ]

-# Disable "info" logging directly to stdout by Sphinx
-import logging
-
-class SphinxPwnlibFilter(logging.Filter):
-    def filter(self, record):
-        if record.name.startswith('pwn'):
-            return False
-        if record.name.startswith('paramiko'):
-            return False
-        return True
-
-log_filter = SphinxPwnlibFilter()
-
-for i, handler in enumerate(logging.root.handlers):
-    print("Filtering Sphinx handler", handler)
-    handler.addFilter(log_filter)
-
-# Napoleon settings
-napoleon_use_ivar = True
-napoleon_use_rtype = False
-
 doctest_global_setup = '''
 import sys, os
 os.environ['PWNLIB_NOTERM'] = '1'
 os.environ['PWNLIB_RANDOMIZE'] = '0'
-import pwnlib, logging
+import pwnlib
 pwnlib.context.context.reset_local()
-pwnlib.context.ContextType.defaults['log_level'] = logging.ERROR
+pwnlib.context.ContextType.defaults['log_level'] = 'ERROR'
 pwnlib.context.ContextType.defaults['randomize'] = False
-pwnlib.util.fiddling.default_style = {}
 pwnlib.term.text.when = 'never'
 pwnlib.log.install_default_handler()
 pwnlib.log.rootlogger.setLevel(1)
@@ -90,13 +67,12 @@ class stdout(object):
 pwnlib.context.ContextType.defaults['log_console'] = stdout()
 '''

-autoclass_content = 'both'
-autodoc_member_order = 'groupwise' # 'alphabetical'
+autodoc_member_order = 'alphabetical'

 # Add any paths that contain templates here, relative to this directory.
 templates_path = ['_templates']

-doctest_test_doctest_blocks = 'true'
+doctest_test_doctest_blocks = True

 # The suffix of source filenames.
 source_suffix = '.rst'
@@ -255,7 +231,7 @@ latex_documents = [
 ]

 intersphinx_mapping = {'python': ('https://docs.python.org/2.7', None),
-                       'paramiko': ('https://paramiko-docs.readthedocs.org/en/2.1/', None)}
+                       'paramiko': ('https://paramiko-docs.readthedocs.org/en/1.15/', None)}

 # The name of an image file (relative to this directory) to place at the top of
 # the title page.
@@ -314,13 +290,13 @@ texinfo_documents = [
 branch = release

 try:
-    git_branch = subprocess.check_output('git describe --tags', shell = True, universal_newlines = True)
+    git_branch = subprocess.check_output('git describe --tags', shell = True)
 except subprocess.CalledProcessError:
    git_branch = '-'

 try:
    if '-' in git_branch:
-        branch = subprocess.check_output('git rev-parse HEAD', shell = True, universal_newlines = True).strip()[:10]
+        branch = subprocess.check_output('git rev-parse HEAD', shell = True).strip()[:10]
 except subprocess.CalledProcessError:
    pass

@@ -348,11 +324,11 @@ def linkcode_resolve(domain, info):
    else:
        filename = info['module'].replace('.', '/') + '.py'

-        if isinstance(val, (types.ModuleType, types.MethodType, types.FunctionType, types.TracebackType, types.FrameType, types.CodeType) + six.class_types):
+        if isinstance(val, (types.ModuleType, types.ClassType, types.MethodType, types.FunctionType, types.TracebackType, types.FrameType, types.CodeType)):
            try:
                lines, first = inspect.getsourcelines(val)
-                filename += '#L%d-L%d' % (first, first + len(lines) - 1)
-            except (IOError, TypeError):
+                filename += '#L%d-%d' % (first, first + len(lines) - 1)
+            except IOError:
                pass

    return "https://github.com/Gallopsled/pwntools/blob/%s/%s" % (branch, filename)
@@ -371,53 +347,3 @@ if build_dash:
        html_theme_path = [sphinx_rtd_theme.get_html_theme_path()]

    # otherwise, readthedocs.org uses their theme by default, so no need to specify it
-
-
-# -- Customization to Sphinx autodoc generation --------------------------------------------
-import sphinx.ext.autodoc
-
-# Test hidden members (e.g. def _foo(...))
-def dont_skip_any_doctests(app, what, name, obj, skip, options):
-    return False
-
-class _DummyClass(object): pass
-
-class Py2OutputChecker(_DummyClass, doctest.OutputChecker):
-    def check_output(self, want, got, optionflags):
-        sup = super(Py2OutputChecker, self).check_output
-        if sup(want, got, optionflags):
-            return True
-        try:
-            rly_want = pwnlib.util.safeeval.const(want)
-            if sup(repr(rly_want), got, optionflags):
-                return True
-            rly_got = pwnlib.util.safeeval.const(got)
-            if rly_want == rly_got:
-                return True
-        except ValueError:
-            pass
-        rly_want = ' '.join(x[:2].replace('b"','"').replace("b'","'")+x[2:] for x in want.replace('\n','\n ').split(' ')).replace('\n ','\n')
-        if sup(rly_want, got, optionflags):
-            return True
-        rly_want = ' '.join(x[:2].replace('b"',' "').replace("b'"," '")+x[2:] for x in want.replace('\n','\n ').split(' ')).replace('\n ','\n')
-        return sup(rly_want, got, optionflags)
-
-def py2_doctest_init(self, checker=None, verbose=None, optionflags=0):
-    if checker is None:
-        checker = Py2OutputChecker()
-    doctest.DocTestRunner.__init__(self, checker, verbose, optionflags)
-
-class EndlessLoop(Exception): pass
-def alrm_handler(sig, frame):
-    signal.alarm(180) # three minutes
-    raise EndlessLoop()
-signal.signal(signal.SIGALRM, alrm_handler)
-signal.alarm(600) # ten minutes
-
-if 'doctest' in sys.argv:
-    def setup(app):
-        app.connect('autodoc-skip-member', dont_skip_any_doctests)
-
-    if sys.version_info[:1] < (3,):
-        import sphinx.ext.doctest
-        sphinx.ext.doctest.SphinxDocTestRunner.__init__ = py2_doctest_init
@@ -1,4 +0,0 @@
-:mod:`pwnlib.config` --- Pwntools Configuration File
-====================================================
-
-.. automodule:: pwnlib.config
@@ -3,31 +3,13 @@
   from pwn import *
   import logging
   log = pwnlib.log.getLogger('pwnlib.context')
-   context.clear()

 :mod:`pwnlib.context` --- Setting runtime variables
 =====================================================

-Many settings in ``pwntools`` are controlled via the global variable :data:`.context`, such as the selected target operating system, architecture, and bit-width.
+.. autodata:: pwnlib.context.context

-In general, exploits will start with something like:
+.. autoclass:: pwnlib.context.ContextType
+    :members:

-.. code-block:: python
-
-    from pwn import *
-    context.arch = 'amd64'
-
-Which sets up everything in the exploit for exploiting a 64-bit Intel binary.
-
-The recommended method is to use ``context.binary``  to automagically set all of the appropriate values.
-
-.. code-block:: python
-
-    from pwn import *
-    context.binary = './challenge-binary'
-
-Module Members
----------------------------------------------------
-
-.. automodule:: pwnlib.context
-   :members:
+.. autoclass:: pwnlib.context.Thread
@@ -3,16 +3,8 @@
   from pwnlib.elf import *
   from pwnlib.util.misc import which

-:mod:`pwnlib.elf` --- ELF Executables and Libraries
-===================================================
+:mod:`pwnlib.elf` --- Working with ELF binaries
+===============================================

 .. automodule:: pwnlib.elf
-
-
-ELF Modules
-------------------
-
-.. toctree::
-    elf/elf
-    elf/config
-    elf/corefile
+   :members:
@@ -1,10 +0,0 @@
-.. testsetup:: *
-
-   from pwn import *
-   from pwnlib.elf.config import parse_kconfig
-
-:mod:`pwnlib.elf.config` --- Kernel Config Parsing
-===========================================================
-
-.. automodule:: pwnlib.elf.config
-  :members:
@@ -1,16 +0,0 @@
-.. testsetup:: *
-
-   from glob import glob
-   from pwn import *
-
-:mod:`pwnlib.elf.corefile` --- Core Files
-===========================================================
-
-.. automodule:: pwnlib.elf.corefile
-
-  .. autoclass:: pwnlib.elf.corefile.Corefile
-     :members:
-     :show-inheritance:
-
-  .. autoclass:: pwnlib.elf.corefile.Mapping
-     :members:
@@ -1,29 +0,0 @@
-.. testsetup:: *
-
-   from pwn import *
-   from glob import glob
-   from pwnlib.elf.maps import CAT_PROC_MAPS_EXIT
-
-:mod:`pwnlib.elf.elf` --- ELF Files
-===========================================================
-
-.. automodule:: pwnlib.elf.elf
-
-  .. autoclass:: pwnlib.elf.elf.ELF
-     :members:
-     :show-inheritance:
-     :inherited-members:
-     :exclude-members: address_offsets,
-                       get_data,
-                       get_dwarf_info,
-                       get_section,
-                       get_segment,
-                       has_dwarf_info,
-                       iter_sections,
-                       iter_segments
-
-  .. autoclass:: pwnlib.elf.elf.Function
-     :members:
-
-  .. autoclass:: pwnlib.elf.elf.dotdict
-     :members:
@@ -1,9 +0,0 @@
-.. testsetup:: *
-
-   from pwnlib.filepointer import *
-
-:mod:`pwnlib.filepointer` --- `FILE*` structure exploitation
-============================================================
-
-.. automodule:: pwnlib.filepointer
-   :members:
@@ -1,9 +1,3 @@
-.. testsetup:: *
-
-    from pwn import *
-    context.arch = 'amd64'
-    context.terminal = [os.path.join(os.path.dirname(pwnlib.__file__), 'gdb_faketerminal.py')]
-
 :mod:`pwnlib.gdb` --- Working with GDB
 ======================================

@@ -13,11 +13,11 @@ Which imports a bazillion things into the global namespace to make your life eas

 This is a quick list of most of the objects and routines imported, in rough order of importance and frequency of use.

- :mod:`pwnlib.context`
+- ``context``
    - :data:`pwnlib.context.context`
    - Responsible for most of the pwntools convenience settings
    - Set `context.log_level = 'debug'` when troubleshooting your exploit
-    - Scope-aware, so you can disable logging for a subsection of code via :meth:`.ContextType.local`
+    - Scope-aware, so you can disable logging for a subsection of code via ``pwnlib.context.ContextType.local``
 - ``remote``, ``listen``, ``ssh``, ``process``
    - :mod:`pwnlib.tubes`
    - Super convenient wrappers around all of the common functionality for CTF challenges
@@ -57,11 +57,11 @@ This is a quick list of most of the objects and routines imported, in rough orde
 - ``gdb.debug`` and ``gdb.attach``
    - :mod:`pwnlib.gdb`
    - Launch a binary under GDB and pop up a new terminal to interact with it.  Automates setting breakpoints and makes iteration on exploits MUCH faster.
-    - Alternately, attach to a running process given a PID, :mod:`pwnlib.tubes` object, or even just a socket that's connected to it
+    - Alternately, attach to a running process given a PID, ``pwnlib.tubes`` object, or even just a socket that's connected to it
 - ``args``
-    - Dictionary containing all-caps command-line arguments for quick access
+    - Dictionary contining all-caps command-line arguments for quick access
    - Run via ``python foo.py REMOTE=1`` and ``args['REMOTE'] == '1'``.
-    - Can also control logging verbosity and terminal fanciness
+    - Can also control logging verbosity and terminal fancyness
        - `NOTERM`
        - `SILENT`
        - `DEBUG`
@@ -78,7 +78,7 @@ This is a quick list of most of the objects and routines imported, in rough orde
    - It's the new ``getch``
 - ``safeeval``
    - :mod:`pwnlib.util.safeeval`
-    - Functions for safely evaluating python code without nasty side-effects.
+    - Functions for safely evalutaing python code without nasty side-effects.

 These are all pretty self explanatory, but are useful to have in the global namespace.

@@ -48,21 +48,16 @@ Each of the ``pwntools`` modules is documented here.
   atexception
   atexit
   constants
-   config
   context
   dynelf
   encoders
   elf
   exception
-   filepointer
   flag
   fmtstr
   gdb
-   libcdb
   log
   memleak
-   protocols
-   qemu
   replacements
   rop
   rop/*
@@ -24,10 +24,8 @@ pwntools is available as a ``pip`` package.

 .. code-block:: bash

-    $ apt-get update
-    $ apt-get install python3 python3-pip python3-dev git libssl-dev libffi-dev build-essential
-    $ python3 -m pip install --upgrade pip
-    $ python3 -m pip install --upgrade pwntools
+    $ apt-get install python2.7 python2.7-dev python-pip
+    $ pip install --upgrade pwntools

 Development
 --------------
@@ -27,14 +27,14 @@ This exposes a standard interface to talk to processes, sockets, serial ports,
 and all manner of things, along with some nifty helpers for common tasks.
 For example, remote connections via :mod:`pwnlib.tubes.remote`.

-    >>> conn = remote('ftp.ubuntu.com',21)
+    >>> conn = remote('ftp.debian.org',21)
    >>> conn.recvline() # doctest: +ELLIPSIS
-    b'220 ...'
-    >>> conn.send(b'USER anonymous\r\n')
-    >>> conn.recvuntil(b' ', drop=True)
-    b'331'
+    '220 ...'
+    >>> conn.send('USER anonymous\r\n')
+    >>> conn.recvuntil(' ', drop=True)
+    '331'
    >>> conn.recvline()
-    b'Please specify the password.\r\n'
+    'Please specify the password.\r\n'
    >>> conn.close()

 It's also easy to spin up a listener
@@ -42,20 +42,20 @@ It's also easy to spin up a listener
    >>> l = listen()
    >>> r = remote('localhost', l.lport)
    >>> c = l.wait_for_connection()
-    >>> r.send(b'hello')
+    >>> r.send('hello')
    >>> c.recv()
-    b'hello'
+    'hello'

 Interacting with processes is easy thanks to :mod:`pwnlib.tubes.process`.

 ::

    >>> sh = process('/bin/sh')
-    >>> sh.sendline(b'sleep 3; echo hello world;')
+    >>> sh.sendline('sleep 3; echo hello world;')
    >>> sh.recvline(timeout=1)
-    b''
+    ''
    >>> sh.recvline(timeout=5)
-    b'hello world\n'
+    'hello world\n'
    >>> sh.close()

 Not only can you interact with processes programmatically, but you can
@@ -72,16 +72,16 @@ a ``process`` tube.

 ::

-    >>> shell = ssh('bandit0', 'bandit.labs.overthewire.org', password='bandit0', port=2220)
+    >>> shell = ssh('bandit0', 'bandit.labs.overthewire.org', password='bandit0')
    >>> shell['whoami']
-    b'bandit0'
+    'bandit0'
    >>> shell.download_file('/etc/motd')
    >>> sh = shell.run('sh')
-    >>> sh.sendline(b'sleep 3; echo hello world;') # doctest: +SKIP
+    >>> sh.sendline('sleep 3; echo hello world;') # doctest: +SKIP
    >>> sh.recvline(timeout=1)
-    b''
+    ''
    >>> sh.recvline(timeout=5)
-    b'hello world\n'
+    'hello world\n'
    >>> shell.close()

 Packing Integers
@@ -97,13 +97,13 @@ unpacking codes, and littering your code with helper routines.
    >>> import struct
    >>> p32(0xdeadbeef) == struct.pack('I', 0xdeadbeef)
    True
-    >>> leet = unhex('37130000')
-    >>> u32(b'abcd') == struct.unpack('I', b'abcd')[0]
+    >>> leet = '37130000'.decode('hex')
+    >>> u32('abcd') == struct.unpack('I', 'abcd')[0]
    True

 The packing/unpacking operations are defined for many common bit-widths.

-    >>> u8(b'A') == 0x41
+    >>> u8('A') == 0x41
    True

 Setting the Target Architecture and OS
@@ -112,9 +112,9 @@ Setting the Target Architecture and OS
 The target architecture can generally be specified as an argument to the routine that requires it.

    >>> asm('nop')
-    b'\x90'
+    '\x90'
    >>> asm('nop', arch='arm')
-    b'\x00\xf0 \xe3'
+    '\x00\xf0 \xe3'

 However, it can also be set once in the global ``context``.  The operating system, word size, and endianness can also be set here.

@@ -126,10 +126,10 @@ However, it can also be set once in the global ``context``.  The operating syste
 Additionally, you can use a shorthand to set all of the values at once.

    >>> asm('nop')
-    b'\x90'
+    '\x90'
    >>> context(arch='arm', os='linux', endian='big', word_size=32)
    >>> asm('nop')
-    b'\xe3 \xf0\x00'
+    '\xe3 \xf0\x00'

 .. doctest::
   :hide:
@@ -158,12 +158,12 @@ Assembly and Disassembly
 Never again will you need to run some already-assembled pile of shellcode
 from the internet!  The :mod:`pwnlib.asm` module is full of awesome.

-    >>> enhex(asm('mov eax, 0'))
+    >>> asm('mov eax, 0').encode('hex')
    'b800000000'

 But if you do, it's easy to suss out!

-    >>> print(disasm(unhex('6a0258cd80ebf9')))
+    >>> print disasm('6a0258cd80ebf9'.decode('hex'))
       0:   6a 02                   push   0x2
       2:   58                      pop    eax
       3:   cd 80                   int    0x80
@@ -176,7 +176,7 @@ loaded with useful time-saving shellcodes.
 Let's say that we want to `setreuid(getuid(), getuid())` followed by `dup`ing
 file descriptor 4 to `stdin`, `stdout`, and `stderr`, and then pop a shell!

-    >>> enhex(asm(shellcraft.setreuid() + shellcraft.dupsh(4))) # doctest: +ELLIPSIS
+    >>> asm(shellcraft.setreuid() + shellcraft.dupsh(4)).encode('hex') # doctest: +ELLIPSIS
    '6a3158cd80...'


@@ -188,10 +188,10 @@ Never write another hexdump, thanks to :mod:`pwnlib.util.fiddling`.

 Find offsets in your buffer that cause a crash, thanks to :mod:`pwnlib.cyclic`.

-    >>> print(cyclic(20).decode())
+    >>> print cyclic(20)
    aaaabaaacaaadaaaeaaa
-    >>> # Assume EIP = 0x62616166 (b'faab' which is pack(0x62616166))  at crash time
-    >>> print(cyclic_find(b'faab'))
+    >>> # Assume EIP = 0x62616166 ('faab' which is pack(0x62616166))  at crash time
+    >>> print cyclic_find('faab')
    120

 ELF Manipulation
@@ -200,22 +200,22 @@ ELF Manipulation
 Stop hard-coding things!  Look them up at runtime with :mod:`pwnlib.elf`.

    >>> e = ELF('/bin/cat')
-    >>> print(hex(e.address)) #doctest: +SKIP
+    >>> print hex(e.address) #doctest: +SKIP
    0x400000
-    >>> print(hex(e.symbols['write'])) #doctest: +SKIP
+    >>> print hex(e.symbols['write']) #doctest: +SKIP
    0x401680
-    >>> print(hex(e.got['write'])) #doctest: +SKIP
+    >>> print hex(e.got['write']) #doctest: +SKIP
    0x60b070
-    >>> print(hex(e.plt['write'])) #doctest: +SKIP
+    >>> print hex(e.plt['write']) #doctest: +SKIP
    0x401680

 You can even patch and save the files.

    >>> e = ELF('/bin/cat')
-    >>> e.read(e.address, 4)
-    b'\x7fELF'
+    >>> e.read(e.address+1, 3)
+    'ELF'
    >>> e.asm(e.address, 'ret')
    >>> e.save('/tmp/quiet-cat')
-    >>> disasm(open('/tmp/quiet-cat','rb').read(1))
+    >>> disasm(file('/tmp/quiet-cat','rb').read(1))
    '   0:   c3                      ret'

@@ -1,10 +0,0 @@
-.. testsetup:: *
-
-   from pwn import *
-   from pwnlib.libcdb import *
-
-:mod:`pwnlib.libcdb` --- Libc Database
-===========================================
-
-.. automodule:: pwnlib.libcdb
-   :members:
@@ -1,9 +1,11 @@
 .. testsetup:: *

-    from pwn import *
+   from pwnlib.memleak import *

 :mod:`pwnlib.memleak` --- Helper class for leaking memory
 =========================================================

-.. automodule:: pwnlib.memleak
-    :members:
+.. module:: pwnlib.memleak
+
+.. autoclass:: MemLeak
+   :members:
@@ -1,15 +0,0 @@
-:mod:`pwnlib.protocols` --- Wire Protocols
-=============================================
-
-.. automodule:: pwnlib.protocols
-
-
-Supported Protocols
-------------------
-
-.. toctree::
-    :maxdepth: 3
-    :glob:
-
-    protocols/*
-
@@ -1,11 +0,0 @@
-.. testsetup:: *
-
-   from pwn import *
-   from pwnlib.protocols.adb import AdbClient
-   AdbClient().wait_for_device()
-
-:mod:`pwnlib.protocols.adb` --- ADB Protocol Implementation
-===========================================================
-
-.. automodule:: pwnlib.protocols.adb
-   :members:
@@ -1,10 +0,0 @@
-.. testsetup:: *
-
-   from pwn import *
-
-
-:mod:`pwnlib.qemu` --- QEMU Utilities
-==========================================
-
-.. automodule:: pwnlib.qemu
-   :members:
@@ -1,19 +0,0 @@
-.. testsetup:: *
-
-   from pwn import *
-   context.clear(arch='aarch64')
-
-:mod:`pwnlib.shellcraft.aarch64` --- Shellcode for AArch64
-===========================================================
-
-:mod:`pwnlib.shellcraft.aarch64`
--------------------------------
-
-.. automodule:: pwnlib.shellcraft.aarch64
-   :members:
-
-:mod:`pwnlib.shellcraft.aarch64.linux`
--------------------------------------
-
-.. automodule:: pwnlib.shellcraft.aarch64.linux
-   :members:
@@ -3,9 +3,3 @@

 .. automodule:: pwnlib.term
   :members:
-
-Term Modules
-------------------
-
-.. toctree::
-    term/readline
@@ -1,10 +0,0 @@
-.. testsetup:: *
-
-   from pwnlib.term.readline import *
-   import io
-
-:mod:`pwnlib.term.readline` --- Terminal nice readline
-======================================================
-
-.. automodule:: pwnlib.term.readline
-   :members:
@@ -27,4 +27,4 @@ Types of Tubes
  .. autoclass:: pwnlib.tubes.tube.tube()
     :members:
     :exclude-members: recv_raw, send_raw, settimeout_raw,
-                       can_recv_raw, shutdown_raw, connected_raw,
+                       can_recv_raw
@@ -1,9 +0,0 @@
-.. testsetup:: *
-
-   from pwnlib.tubes.buffer import *
-
-:mod:`pwnlib.tubes.buffer` --- buffer implementation for tubes
-==============================================================
-
-.. automodule:: pwnlib.tubes.buffer
-   :members:
@@ -1,7 +1,6 @@
 .. testsetup:: *

   from pwn import *
-   from pwnlib.tubes.server import server

 :mod:`pwnlib.tubes.sock` --- Sockets
 ===========================================================
@@ -24,9 +23,3 @@
   .. autoclass:: pwnlib.tubes.listen.listen
      :members:
      :show-inheritance:
-
-.. automodule:: pwnlib.tubes.server
-
-   .. autoclass:: pwnlib.tubes.server.server
-      :members:
-      :show-inheritance:
@@ -1,8 +1,3 @@
-.. testsetup:: *
-
-   from pwn import *
-   import io
-
 :mod:`pwnlib.ui` --- Functions for user interaction
 ===================================================

@@ -1,6 +1,5 @@
 .. testsetup:: *

-   from pwn import *
   from pwnlib.util.cyclic import *


@@ -1,7 +1,6 @@
 .. testsetup:: *

-    from pwn import *
-    from pwnlib.util.fiddling import *
+   from pwnlib.util.fiddling import *


 :mod:`pwnlib.util.fiddling` --- Utilities bit fiddling
@@ -1,11 +0,0 @@
-.. testsetup:: *
-
-   from pwnlib.util.getdents import *
-   from pwnlib.util.fiddling import unhex
-
-
-:mod:`pwnlib.util.getdents` --- Linux binary directory listing
-==============================================================
-
-.. automodule:: pwnlib.util.getdents
-   :members:
@@ -1,6 +1,5 @@
 .. testsetup:: *

-   from pprint import pprint
   from pwnlib.util.misc import *
   import os, subprocess
   os.chdir("..")
@@ -1,7 +1,6 @@
 .. testsetup:: *

   from pwnlib.util.proc import *
-   from pwnlib.tubes.process import process
   import os, sys


@@ -1,7 +1,6 @@
 .. testsetup:: *

   from pwnlib.util.safeeval import *
-   _get_opcodes = pwnlib.util.safeeval._get_opcodes


 :mod:`pwnlib.util.safeeval` --- Safe evaluation of python code
@@ -26,10 +26,6 @@ Try running this example with::
 ```
 Example showing the interface to `pwnlib.asm.asm` and `pwnlib.shellcraft`.
 ```
-* `attach.py`
-```
-Example showing `pwnlib.gdb.attach()`
-```
 * `clean_and_log.py`
 ```
 Use case for `pwnlib.tubes.tube.clean_and_log`.
@@ -69,7 +65,8 @@ Example showing `pwnlib.ui.options()`
 ```
 * `port_forward.py`
 ```
-A very simple port forwarder using `pwnlib.tubes.tube.connect_both()`.
+A very simple port forwarder using `pwnlib.tubes.tube.connect_both()`.  Notice
+that `<>` is just a shorthand.
 ```
 * `readline_completers.py`
 ```
@@ -77,10 +74,6 @@ Example showing pwnlib's readline implementation and a few completers.  This
 part of pwnlib will probably see some major changes soon, but we wanted to show
 off some proof-of-concepts.
 ```
-* `remote.py`
-```
-Example showing how to use the remote class.
-```
 * `remote_gdb_debugging.py`
 ```
 Simple example showing how to use the remote
@@ -110,7 +103,7 @@ and::

  $ TERM=xterm-256color python text.py
 ```
-* `yesno.py`
+* `remote.py`
 ```
-Example showing `pwnlib.ui.yesno()`
+Example showing how to use the remote class.
 ```
@@ -1,25 +1,22 @@
-from __future__ import print_function
-
-import gdb
-from pwn import adb, context
+from pwn import *

 # Tell pwntools that the target is an Android device
-context.os = "android"
-context.arch = "aarch64"  # or 'arm'
+context.os='android'
+context.arch='aarch64' # or 'arm'

 # Optionally, set the remote ADB server address
-context.adb_host = "172.16.110.1"
+context.adb_host='172.16.110.1'

 # Wait for a device to become available
-print(adb.wait_for_device())
+print adb.wait_for_device()

 # Who am I?
-print(adb.process("id").recvall().strip())
+print adb.process('id').recvall().strip()

 # Interactive sessions!
 io = adb.shell()
-io.sendline("echo Hello, world; exit")
-print(io.recvall().replace("\r\n", "\n").strip())
+io.sendline('echo Hello, world; exit')
+print io.recvall().replace('\r\n', '\n').strip()

 # Debugging!
-gdb.debug("sh").interactive()
+gdb.debug('sh').interactive()
@@ -14,5 +14,5 @@ Try running this example with::

 from pwn import *

-print(args['RHOST'] or 'RHOST is not set')
-print(args['RPORT'] or 'RPORT is not set')
+print args['RHOST'] or 'RHOST is not set'
+print args['RPORT'] or 'RPORT is not set'
@@ -9,5 +9,5 @@ context(arch='i386', os='linux')
 shellcode = shellcraft.i386_to_amd64()
 shellcode_asm = asm(shellcode)

-print(enhex(shellcode_asm))
-print(disasm(shellcode_asm))
+print enhex(shellcode_asm)
+print disasm(shellcode_asm)
@@ -5,7 +5,7 @@ Example showing `pwnlib.gdb.attach()`
 from pwn import *

 bash = process('/bin/bash')
-gdb.attach(bash, gdbscript = '''
+gdb.attach(bash, execute = '''
 p "hello from pwnlib"
 c
 ''')
@@ -25,4 +25,4 @@ atexit.register(r.clean_and_log)

 while True:
    line = r.recvline()
-    print(re.findall('^prefix (\S+)$', line)[0])
+    print re.findall('^prefix (\S+)$', line)[0]
@@ -1,51 +0,0 @@
-CFLAGS := -Wno-unused-result -Wno-format-security
-TARGETS := printf.mips printf.mips64 printf.mipsel printf.mips64el printf.arm printf.aarch64 \
-	         printf.ppc printf.ppc64 printf.sparc64 printf.native printf.native32
-
-.PHONY: run
-run: all
-	./exploit.py
-
-.PHONY: all
-all: $(TARGETS)
-
-.PHONY: clean
-clean:
-	rm -f $(TARGETS)
-
-# mips variants
-%.mips: %.c
-	mips-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
-%.mipsel: %.c
-	mipsel-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
-%.mips64: %.c
-	mips64-linux-gnuabi64-gcc $(CFLAGS) -static -Os -o "$@" $^
-%.mips64el: %.c
-	mips64el-linux-gnuabi64-gcc $(CFLAGS) -static -Os -o "$@" $^
-
-# arm variants
-%.arm: %.c
-	arm-linux-gnueabi-gcc $(CFLAGS) -static -Os -o "$@" $^
-%.aarch64: %.c
-	aarch64-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
-
-# ppc variants
-%.ppc: %.c
-	powerpc-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
-%.ppc64: %.c
-	powerpc64-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
-
-# sparc variants
-%.sparc64: %.c
-	sparc64-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
-
-# native variants
-%.native: %.c
-	gcc $(CFLAGS) -o "$@" $^
-%.native32: %.c
-	i686-linux-gnu-gcc $(CFLAGS) -o "$@" $^
-
-# install deps on ubuntu xenial
-.PHONY: install-apt
-install-apt:
-	apt-get install -y make gcc-mips64el-linux-gnuabi64 gcc-sparc64-linux-gnu gcc-powerpc64-linux-gnu gcc-powerpc-linux-gnu gcc-arm-linux-gnueabi gcc-aarch64-linux-gnu gcc-mips64-linux-gnuabi64 gcc-mipsel-linux-gnu gcc-mips64el-linux-gnuabi64 gcc-mips-linux-gnu gcc-i686-linux-gnu gcc
@@ -1,39 +0,0 @@
-#!/usr/bin/env python2
-from pwn import *
-
-@context.quiet
-def exec_fmt(payload):
-    p = context.binary.process()
-    p.sendline(payload)
-    return p.recvall()
-
-def exploit(binary):
-    context.binary = ELF(binary)
-    autofmt = FmtStr(exec_fmt)
-    offset = autofmt.offset
-    with context.binary.process() as p:
-        addr = unpack(p.recv(context.bytes))
-        payload = fmtstr_payload(offset, {addr: p32(0x1337babe)})
-        p.sendline(payload)
-        p.recvuntil("DONE")
-        print(hex(u32(p.recv(4))))
-
-binaries = [
-    "printf.mips",
-    "printf.mips64",
-    "printf.mipsel",
-    "printf.mips64el",
-    "printf.native",
-    "printf.native32",
-    "printf.ppc",
-    "printf.ppc64",
-    "printf.sparc64",
-    "printf.arm",
-    "printf.aarch64",
-]
-
-if len(sys.argv) > 1:
-    binaries = sys.argv[1:]
-
-for binary in binaries:
-    exploit(binary)
@@ -1,29 +0,0 @@
-#ifdef _FORTIFY_SOURCE
-#undef _FORTIFY_SOURCE
-#endif
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <sys/mman.h>
-#define MEMORY_ADDRESS ((void*)0x11110000)
-#define MEMORY_SIZE 1024
-#define TARGET ((int *) 0x11110100)
-int main(int argc, char const *argv[])
-{
-       char buff[1024];
-       void *ptr = NULL;
-       int *my_var = TARGET;
-       ptr = mmap(MEMORY_ADDRESS, MEMORY_SIZE, PROT_READ|PROT_WRITE, MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE, 0, 0);
-       if(ptr != MEMORY_ADDRESS)
-       {
-               perror("mmap");
-               return EXIT_FAILURE;
-       }
-       *my_var = 0x41414141;
-       write(1, &my_var, sizeof(int *));
-       scanf("%s", buff);
-       dprintf(2, buff);
-       write(1, "DONE", 4);
-       write(1, my_var, sizeof(int));
-       return 0;
-}
@@ -24,7 +24,7 @@ def append_example(_arg, top, names):
            continue
        path = os.path.join(top, name)[2:] # strip './'
        log.info('-> %s' % path)
-        data = read(path).strip().decode()
+        data = read(path).strip()
        if data[0:3] not in ('"""', "'''"):
            log.warning('  Has no docstring!')
            continue
@@ -37,7 +37,6 @@ def append_example(_arg, top, names):
        out += '* `%s`\n' % path
        out += '```%s```\n' % doc

-for path, dirs, files in os.walk('.', onerror=None):
-    append_example(dirs, path, sorted(files))
+os.path.walk('.', append_example, None)

 write('README.md', out)
@@ -5,4 +5,4 @@ Example showing `pwnlib.ui.options()`
 from pwn import *

 opts = [string.letters[x] for x in range(10)]
-print('You choose "%s"' % opts[options('Pick one:', opts)])
+print 'You choose "%s"' % opts[options('Pick one:', opts)]
@@ -1,10 +1,11 @@
 """
-A very simple port forwarder using `pwnlib.tubes.tube.connect_both()`.
+A very simple port forwarder using `pwnlib.tubes.tube.connect_both()`.  Notice
+that `<>` is just a shorthand.
 """

 from pwn import *

 while True:
-    listen(1337).wait_for_connection().connect_both(remote('google.com', 80))
+    listen(1337).wait_for_connection() <> remote('google.com', 80)

 # now point your browser (or curl(1)) to http://localhost:1337
@@ -19,13 +19,13 @@ c1 = LongestPrefixCompleter([
 c2 = PathCompleter(mask = '*.py')

 with c1:
-    print('type "exit" to exit')
+    print 'type "exit" to exit'
    while True:
        s = term.readline.readline(prompt = '> ').strip()
        if s in ('exit', 'enough!'):
            break
-        print('You wrote', s)
+        print 'You wrote', s
 with c2:
-    print('choose a file')
+    print 'choose a file'
    s = term.readline.readline(prompt = text.bold_green('$ ')).strip()
-    print('You picked', s)
+    print 'You picked', s
@@ -6,6 +6,6 @@ from pwn import *

 sock = remote('127.0.0.1', 9001)

-print(sock.recvline())
+print sock.recvline()
 sock.send('foo')
 sock.interactive()
@@ -8,10 +8,10 @@ import getpass
 from pwn import *

 s = ssh(getpass.getuser(), '127.0.0.1', port = 22, keyfile = "~/.ssh/id_rsa")
-c = gdb.ssh_gdb(s, '/bin/sh', gdbscript = '''
+c = gdb.ssh_gdb(s, '/bin/sh', execute = '''
 p/x $pc
 c''')

 c.sendline('ls -la')
 c.sendline('exit')
-print(c.recvall())
+print c.recvall()
@@ -1,31 +0,0 @@
-from pwn import *
-context.arch='aarch64'
-frame = SigreturnFrame()
-
-registers = ['x%i' % i for i in range(0, 31)]
-registers += ['sp', 'pc']
-
-
-for index, register in enumerate(registers):
-    setattr(frame, register, index)
-
-assembly = '\n'.join([
-    shellcraft.read(constants.STDIN_FILENO, 'sp', 1024),
-    shellcraft.syscall(constants.SYS_rt_sigreturn)
-])
-
-binary = ELF.from_assembly(assembly)
-
-io = binary.process()
-io.flat(frame)
-io.wait()
-assert io.poll() == -11
-
-corefile = io.corefile
-
-for index, register in enumerate(registers):
-    value = getattr(corefile, register)
-    if index != value:
-        log.error("%s != %i (%i)" % (register, index, value))
-    else:
-        log.success("%s == %i" % (register, value))
@@ -1,32 +0,0 @@
-from pwn import *
-context.arch='amd64'
-frame = SigreturnFrame()
-
-registers = ['rax', 'rbx', 'rcx', 'rdx',
-             'rdi', 'rsi', 'rbp', 'rsp',
-             'rip',
-             'r8', 'r9', 'r10', 'r11', 'r12', 'r13', 'r14', 'r15']
-
-for index, register in enumerate(registers):
-    setattr(frame, register, index)
-
-assembly = '\n'.join([
-    shellcraft.read(constants.STDIN_FILENO, 'rsp', 1024),
-    shellcraft.sigreturn()
-])
-
-binary = ELF.from_assembly(assembly)
-
-io = binary.process()
-io.flat(frame)
-io.wait()
-assert io.poll() == -11
-
-corefile = io.corefile
-
-for index, register in enumerate(registers):
-    value = getattr(corefile, register)
-    if index != value:
-        log.error("%s != %i (%i)" % (register, index, value))
-    else:
-        log.success("%s == %i" % (register, value))
@@ -1,32 +0,0 @@
-from pwn import *
-
-context.arch='arm'
-frame = SigreturnFrame()
-
-registers = ['r0', 'r1', 'r2', 'r3', 'r4', 'r5', 'r6', 'r7',
-             'r8', 'r9', 'r10', 'fp', 'ip', 'sp', 'pc', 'lr']
-
-
-for index, register in enumerate(registers):
-    setattr(frame, register, index)
-
-assembly = '\n'.join([
-    shellcraft.read(constants.STDIN_FILENO, 'sp', 1024),
-    shellcraft.sigreturn()
-])
-
-binary = ELF.from_assembly(assembly)
-
-io = binary.process()
-io.flat(frame)
-io.wait()
-assert io.poll() == -11
-
-corefile = io.corefile
-
-for index, register in enumerate(registers):
-    value = getattr(corefile, register)
-    if index != value:
-        log.error("%s != %i (%i)" % (register, index, value))
-    else:
-        log.success("%s == %i" % (register, value))
@@ -1,31 +0,0 @@
-from pwn import *
-context.kernel='amd64'
-frame = SigreturnFrame()
-
-registers = ['eax', 'ebx', 'ecx', 'edx',
-             'edi', 'esi', 'ebp', 'esp',
-             'eip']
-
-for index, register in enumerate(registers):
-    setattr(frame, register, index)
-
-assembly = '\n'.join([
-    shellcraft.read(constants.STDIN_FILENO, 'esp', 1024),
-    shellcraft.sigreturn()
-])
-
-binary = ELF.from_assembly(assembly)
-
-io = binary.process()
-io.flat(frame)
-io.wait()
-assert io.poll() == -11
-
-corefile = io.corefile
-
-for index, register in enumerate(registers):
-    value = getattr(corefile, register)
-    if index != value:
-        log.error("%s != %i (%i)" % (register, index, value))
-    else:
-        log.success("%s == %i" % (register, value))
@@ -10,7 +10,7 @@ n = 1
 h = log.waitfor('spinners running', status = str(n))

 hs = []
-print('type "q" to quit')
+print 'type "q" to quit'
 while True:
    s = raw_input('> ')
    if s == 'q':
@@ -4,7 +4,7 @@ Example showing how to use the ssh class.

 from pwn import *

-shell = ssh(host='bandit.labs.overthewire.org',user='bandit0',password='bandit0', port=2220)
+shell = ssh(host='bandit.labs.overthewire.org',user='bandit0',password='bandit0')

 # Show basic command syntax
 log.info("username: %s" % shell.whoami())
@@ -14,7 +14,7 @@ log.info("pwd: %s" % shell.pwd())
 tube = shell.run('cat')
 tube.send("Hello, cat")
 tube.shutdown("out")
-print(tube.recvall())
+print tube.recvall()

 # Show automatic working directories
 shell.set_working_directory()
@@ -29,12 +29,12 @@ int main() {

 shell.gcc(['example.c','-o','example'])

-print(shell['./example'])
+print shell['./example']

 # Show the different styles of calling
-print(shell.echo("single string"))
-print(shell.echo(["list","of","strings"]))
-print(shell["echo single statement"])
+print shell.echo("single string")
+print shell.echo(["list","of","strings"])
+print shell["echo single statement"]

 # Show off the interactive shell
 shell.interactive()
@@ -12,8 +12,8 @@ and::
 from pwn import *

 s = 'hello from pwntools'
-print(text.black_on_green(s))
-print(text.black_on_bright_green(s))
-print(text.green_on_black(s))
-print(text.bright_green_on_black(s))
-print(text.bold_green_on_black(s))
+print text.black_on_green(s)
+print text.black_on_bright_green(s)
+print text.green_on_black(s)
+print text.bright_green_on_black(s)
+print text.bold_green_on_black(s)
@@ -5,6 +5,6 @@ Example showing `pwnlib.ui.yesno()`
 from pwn import *

 if ui.yesno('Do you like Pwntools?'):
-    print(':D')
+    print ':D'
 else:
-    print(':(')
+    print ':('
@@ -0,0 +1,58 @@
+############################################################
+# Dockerfile to build Pwntools container
+# Based on Ubuntu
+############################################################
+
+FROM ubuntu:trusty
+MAINTAINER Maintainer Gallopsled et al.
+
+RUN apt-get update && apt-get install -y software-properties-common
+RUN apt-add-repository --yes ppa:pwntools/binutils
+RUN apt-get update
+RUN apt-get install -y \
+	binutils \
+	binutils-aarch64-linux-gnu \
+	binutils-arm-linux-gnueabihf \
+	curl \
+	gdb \
+	gdbserver \
+	gdb-multiarch \
+	git \
+	libc6-i386 \
+	libc6-arm64-cross \
+	libc6-armhf-cross \
+	libc6-dev-i386 \
+	libffi-dev \
+	libglib2.0-dev \
+	libncurses5-dev \
+	libncursesw5-dev \
+	ltrace \
+	python-dev \
+	python-pip \
+	python3-pip \
+	python2.7 \
+	qemu \
+	qemu-user-static \
+	strace \
+	tmux \
+	wget
+RUN pip install --upgrade ipython
+RUN useradd -m zerocool
+RUN usermod -U zerocool
+
+RUN mkdir -p /etc/qemu-binfmt
+RUN ln -s /usr/aarch64-linux-gnu /etc/qemu-binfmt/aarch64
+RUN ln -s /usr/arm-linux-gnueabihf /etc/qemu-binfmt/arm
+
+RUN pip install --upgrade pip pycparser psutil python-ptrace
+RUN pip3 install --upgrade pip pycparser psutil python-ptrace
+
+RUN pip install --upgrade git+https://github.com/Gallopsled/pwntools.git
+
+RUN locale-gen en_US.UTF-8
+ENV LANG en_US.UTF-8
+ENV LANGUAGE en_US:en
+ENV LC_ALL en_US.UTF-8
+
+RUN chown -R zerocool.zerocool /home/zerocool
+RUN chsh -s /bin/bash zerocool
@@ -1,13 +0,0 @@
-subdirs=xenial stable $(wildcard */)
-makefiles=$(wildcard */Makefile)
-tags=base stable beta dev
-
-all: $(makefiles) $(subdirs)
-
-$(subdirs):
-	docker build -t pwntools/pwntools:$(shell basename $(@)) "$@"
-
-$(makefiles):
-	make -C $(shell dirname $@)
-
-.PHONY: all $(subdirs) $(makefiles)
@@ -1 +0,0 @@
-xenial
@@ -1,6 +0,0 @@
-FROM pwntools/pwntools:stable
-
-USER root
-RUN pip install --upgrade git+https://github.com/Gallopsled/pwntools@beta
-RUN PWNLIB_NOTERM=1 pwn update
-USER pwntools
@@ -1,6 +0,0 @@
-FROM pwntools/pwntools:stable
-
-USER root
-RUN pip install --upgrade git+https://github.com/Gallopsled/pwntools@dev
-RUN PWNLIB_NOTERM=1 pwn update
-USER pwntools
@@ -1,26 +0,0 @@
-############################################################
-# Dockerfile to build Pwntools container
-# Based on Ubuntu
-############################################################
-
-FROM kalilinux/kali-linux-docker
-MAINTAINER Maintainer Gallopsled et al.
-
-RUN apt-get update \
-    && apt-get install -y \
-        build-essential \
-        git \
-        libssl-dev \
-        libffi-dev \
-        python2.7 \
-        python-pip \
-        python-dev \
-    && pip install --upgrade pip \
-    && python -m pip install --upgrade pwntools \
-    && PWNLIB_NOTERM=1 pwn update \
-    && apt-get install -y sudo \
-    && useradd -m pwntools \
-    && passwd --delete --unlock pwntools \
-    && echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
-USER pwntools
-WORKDIR /home/pwntools
@@ -1,8 +0,0 @@
-all: Dockerfile
-
-Dockerfile: ../xenial/Dockerfile FORCE
-	sed "s|ubuntu:xenial|kalilinux/kali-linux-docker|" < "$<" > "$@"
-
-FORCE:
-
-.PHONY: all
@@ -1,26 +0,0 @@
-############################################################
-# Dockerfile to build Pwntools container
-# Based on Ubuntu
-############################################################
-
-FROM ubuntu:precise
-MAINTAINER Maintainer Gallopsled et al.
-
-RUN apt-get update \
-    && apt-get install -y \
-        build-essential \
-        git \
-        libssl-dev \
-        libffi-dev \
-        python2.7 \
-        python-pip \
-        python-dev \
-    && pip install --upgrade pip \
-    && python -m pip install --upgrade pwntools \
-    && PWNLIB_NOTERM=1 pwn update \
-    && apt-get install -y sudo \
-    && useradd -m pwntools \
-    && passwd --delete --unlock pwntools \
-    && echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
-USER pwntools
-WORKDIR /home/pwntools
@@ -1,8 +0,0 @@
-all: Dockerfile
-
-Dockerfile: ../xenial/Dockerfile FORCE
-	sed "s|ubuntu:xenial|ubuntu:precise|" < "$<" > "$@"
-
-FORCE:
-
-.PHONY: all
@@ -1,6 +0,0 @@
-FROM pwntools/pwntools:base
-
-USER root
-RUN pip install --upgrade git+https://github.com/Gallopsled/pwntools@stable
-RUN PWNLIB_NOTERM=1 pwn update
-USER pwntools
@@ -1,26 +0,0 @@
-############################################################
-# Dockerfile to build Pwntools container
-# Based on Ubuntu
-############################################################
-
-FROM ubuntu:trusty
-MAINTAINER Maintainer Gallopsled et al.
-
-RUN apt-get update \
-    && apt-get install -y \
-        build-essential \
-        git \
-        libssl-dev \
-        libffi-dev \
-        python2.7 \
-        python-pip \
-        python-dev \
-    && pip install --upgrade pip \
-    && python -m pip install --upgrade pwntools \
-    && PWNLIB_NOTERM=1 pwn update \
-    && apt-get install -y sudo \
-    && useradd -m pwntools \
-    && passwd --delete --unlock pwntools \
-    && echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
-USER pwntools
-WORKDIR /home/pwntools
@@ -1,8 +0,0 @@
-all: Dockerfile
-
-Dockerfile: ../xenial/Dockerfile FORCE
-	sed "s|ubuntu:xenial|ubuntu:trusty|" < "$<" > "$@"
-
-FORCE:
-
-.PHONY: all
@@ -1,26 +0,0 @@
-############################################################
-# Dockerfile to build Pwntools container
-# Based on Ubuntu
-############################################################
-
-FROM ubuntu:xenial
-MAINTAINER Maintainer Gallopsled et al.
-
-RUN apt-get update \
-    && apt-get install -y \
-        build-essential \
-        git \
-        libssl-dev \
-        libffi-dev \
-        python2.7 \
-        python-pip \
-        python-dev \
-    && pip install --upgrade pip \
-    && python -m pip install --upgrade pwntools \
-    && PWNLIB_NOTERM=1 pwn update \
-    && apt-get install -y sudo \
-    && useradd -m pwntools \
-    && passwd --delete --unlock pwntools \
-    && echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
-USER pwntools
-WORKDIR /home/pwntools
@@ -1,11 +1,8 @@
 # Promote useful stuff to toplevel
-from __future__ import absolute_import
-
-from pwn.toplevel import *
+from .toplevel import *

 pwnlib.args.initialize()
 pwnlib.log.install_default_handler()
-pwnlib.config.initialize()

 log = pwnlib.log.getLogger('pwnlib.exploit')
 args = pwnlib.args.args
@@ -21,19 +21,18 @@ import pwnlib
 from pwnlib import *
 from pwnlib.asm import *
 from pwnlib.context import Thread
-from pwnlib.context import context, LocalContext
+from pwnlib.context import context
 from pwnlib.dynelf import DynELF
 from pwnlib.encoders import *
-from pwnlib.elf.corefile import Core, Corefile, Coredump
-from pwnlib.elf.elf import ELF, load
+from pwnlib.elf import Core
+from pwnlib.elf import ELF
+from pwnlib.elf import load
 from pwnlib.encoders import *
 from pwnlib.exception import PwnlibException
-from pwnlib.gdb import attach, debug, debug_assembly, debug_shellcode
-from pwnlib.filepointer import *
 from pwnlib.flag import *
 from pwnlib.fmtstr import FmtStr, fmtstr_payload
 from pwnlib.log import getLogger
-from pwnlib.memleak import MemLeak, RelativeMemLeak
+from pwnlib.memleak import MemLeak
 from pwnlib.regsort import *
 from pwnlib.replacements import *
 from pwnlib.rop import ROP
@@ -41,10 +40,9 @@ from pwnlib.rop.srop import SigreturnFrame
 from pwnlib.runner import *
 from pwnlib.timeout import Timeout
 from pwnlib.tubes.listen import listen
-from pwnlib.tubes.process import process, PTY, PIPE, STDOUT
+from pwnlib.tubes.process import process
 from pwnlib.tubes.remote import remote, tcp, udp, connect
 from pwnlib.tubes.serialtube import serialtube
-from pwnlib.tubes.server import server
 from pwnlib.tubes.ssh import ssh
 from pwnlib.tubes.tube import tube
 from pwnlib.ui import *
@@ -68,8 +66,15 @@ from pwnlib.util.web import *

 # Promote these modules, so that "from pwn import *" will let you access them

-from six.moves import cPickle as pickle, cStringIO as StringIO
-from six import BytesIO
+try:
+    import cPickle as pickle
+except ImportError:
+    import pickle
+
+try:
+    from cStringIO import StringIO
+except ImportError:
+    from StringIO import StringIO

 error   = log.error
 warning = log.warning
@@ -77,5 +82,3 @@ warn    = log.warning
 info    = log.info
 debug   = log.debug
 success = log.success
-
-__all__ = [x for x in globals().keys() if x != '__name__']
@@ -1,8 +1,6 @@
-from __future__ import absolute_import
-
 import importlib

-from pwnlib.version import __version__
+from .version import __version__

 version = __version__

@@ -14,7 +12,6 @@ __all__ = [
    'commandline',
    'constants',
    'context',
-    'data',
    'dynelf',
    'encoders',
    'elf',
@@ -1,9 +1,6 @@
 # -*- coding: utf-8 -*-
-from __future__ import absolute_import
-from __future__ import division
-
-from pwnlib.context import LocalContext
-from pwnlib.context import context
+from .context import LocalContext
+from .context import context


 class ABI(object):
@@ -27,8 +24,7 @@ class ABI(object):
    #: Indicates that this ABI returns to the next address on the slot
    returns            = True

-    def __init__(self, stack, regs, align, minimum):
-        self.stack              = stack
+    def __init__(self, regs, align, minimum):
        self.register_arguments = regs
        self.arg_alignment      = align
        self.stack_minimum      = minimum
@@ -36,26 +32,12 @@ class ABI(object):
    @staticmethod
    @LocalContext
    def default():
-        if context.os == 'android':
-            context.os = 'linux'
-
        return {
        (32, 'i386', 'linux'):  linux_i386,
-        (64, 'aarch64', 'linux'): linux_aarch64,
        (64, 'amd64', 'linux'): linux_amd64,
        (32, 'arm', 'linux'):   linux_arm,
        (32, 'thumb', 'linux'):   linux_arm,
        (32, 'mips', 'linux'):   linux_mips,
-        (32, 'powerpc', 'linux'): linux_ppc,
-        (64, 'powerpc', 'linux'): linux_ppc64,
-        (32, 'i386', 'freebsd'):  freebsd_i386,
-        (64, 'aarch64', 'freebsd'): freebsd_aarch64,
-        (64, 'amd64', 'freebsd'): freebsd_amd64,
-        (32, 'arm', 'freebsd'):   freebsd_arm,
-        (32, 'thumb', 'freebsd'):   freebsd_arm,
-        (32, 'mips', 'freebsd'):   freebsd_mips,
-        (32, 'powerpc', 'freebsd'): freebsd_ppc,
-        (64, 'powerpc', 'freebsd'): freebsd_ppc64,
        (32, 'i386', 'windows'):  windows_i386,
        (64, 'amd64', 'windows'): windows_amd64,
        }[(context.bits, context.arch, context.os)]
@@ -63,47 +45,22 @@ class ABI(object):
    @staticmethod
    @LocalContext
    def syscall():
-        if context.os == 'android':
-            context.os = 'linux'
-
        return {
        (32, 'i386', 'linux'):  linux_i386_syscall,
        (64, 'amd64', 'linux'): linux_amd64_syscall,
-        (64, 'aarch64', 'linux'): linux_aarch64_syscall,
        (32, 'arm', 'linux'):   linux_arm_syscall,
        (32, 'thumb', 'linux'):   linux_arm_syscall,
        (32, 'mips', 'linux'):   linux_mips_syscall,
-        (64, 'aarch64', 'linux'):   linux_aarch64_syscall,
-        (32, 'powerpc', 'linux'): linux_ppc_syscall,
-        (64, 'powerpc', 'linux'): linux_ppc64_syscall,
-        (32, 'i386', 'freebsd'):  freebsd_i386_syscall,
-        (64, 'amd64', 'freebsd'): freebsd_amd64_syscall,
-        (64, 'aarch64', 'freebsd'): freebsd_aarch64_syscall,
-        (32, 'arm', 'freebsd'):   freebsd_arm_syscall,
-        (32, 'thumb', 'freebsd'):   freebsd_arm_syscall,
-        (32, 'mips', 'freebsd'):   freebsd_mips_syscall,
-        (64, 'aarch64', 'freebsd'):   freebsd_aarch64_syscall,
-        (32, 'powerpc', 'freebsd'): freebsd_ppc_syscall,
-        (64, 'powerpc', 'freebsd'): freebsd_ppc64_syscall,
        }[(context.bits, context.arch, context.os)]

    @staticmethod
    @LocalContext
    def sigreturn():
-        if context.os == 'android':
-            context.os = 'linux'
-
        return {
        (32, 'i386', 'linux'):  linux_i386_sigreturn,
        (64, 'amd64', 'linux'): linux_amd64_sigreturn,
        (32, 'arm', 'linux'):   linux_arm_sigreturn,
        (32, 'thumb', 'linux'):   linux_arm_sigreturn,
-        (64, 'aarch64', 'linux'):   linux_aarch64_sigreturn,
-        (32, 'i386', 'freebsd'):  freebsd_i386_sigreturn,
-        (64, 'amd64', 'freebsd'): freebsd_amd64_sigreturn,
-        (32, 'arm', 'freebsd'):   freebsd_arm_sigreturn,
-        (32, 'thumb', 'freebsd'):   freebsd_arm_sigreturn,
-        (64, 'aarch64', 'freebsd'):   freebsd_aarch64_sigreturn,
        }[(context.bits, context.arch, context.os)]

 class SyscallABI(ABI):
@@ -111,9 +68,9 @@ class SyscallABI(ABI):
    The syscall ABI treats the syscall number as the zeroth argument,
    which must be loaded into the specified register.
    """
-    def __init__(self, *a, **kw):
-        super(SyscallABI, self).__init__(*a, **kw)
-        self.syscall_register = self.register_arguments[0]
+    def __init__(self, register_arguments, *a, **kw):
+        super(SyscallABI, self).__init__(register_arguments, *a, **kw)
+        self.syscall_register = register_arguments[0]

 class SigreturnABI(SyscallABI):
    """
@@ -124,61 +81,26 @@ class SigreturnABI(SyscallABI):
    returns = False


-# System V ABI used by many UNIXes
-linux_i386   = ABI('esp', [], 4, 0)
-linux_amd64  = ABI('rsp', ['rdi','rsi','rdx','rcx','r8','r9'], 8, 0)
-linux_arm    = ABI('sp', ['r0', 'r1', 'r2', 'r3'], 8, 0)
-linux_aarch64 = ABI('sp', ['x0', 'x1', 'x2', 'x3'], 16, 0)
-linux_mips  = ABI('$sp', ['$a0','$a1','$a2','$a3'], 4, 0)
-linux_ppc = ABI('sp', ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 4, 0)
-linux_ppc64 = ABI('sp', ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 8, 0)
+linux_i386   = ABI([], 4, 0)
+linux_amd64  = ABI(['rdi','rsi','rdx','rcx','r8','r9'], 8, 0)
+linux_arm    = ABI(['r0', 'r1', 'r2', 'r3'], 8, 0)
+linux_aarch64 = ABI(['x0', 'x1', 'x2', 'x3'], 16, 0)
+linux_mips  = ABI(['$a0','$a1','$a2','$a3'], 4, 0)

-sysv_i386 = linux_i386
-sysv_amd64 = linux_amd64
-sysv_arm = linux_arm
-sysv_aarch64 = linux_aarch64
-sysv_mips = linux_mips
-sysv_ppc = linux_ppc
-sysv_ppc64 = linux_ppc64
+linux_i386_syscall = SyscallABI(['eax', 'ebx', 'ecx', 'edx', 'esi', 'edi', 'ebp'], 4, 0)
+linux_amd64_syscall = SyscallABI(['rax','rdi', 'rsi', 'rdx', 'r10', 'r8', 'r9'],   8, 0)
+linux_arm_syscall   = SyscallABI(['r7', 'r0', 'r1', 'r2', 'r3', 'r4', 'r5', 'r6'], 4, 0)
+linux_aarch64_syscall   = SyscallABI(['x8', 'x0', 'x1', 'x2', 'x3', 'x4', 'x5', 'x6'], 16, 0)
+linux_mips_syscall  = ABI(['$v0', '$a0','$a1','$a2','$a3'], 4, 0)

-linux_i386_syscall = SyscallABI('esp', ['eax', 'ebx', 'ecx', 'edx', 'esi', 'edi', 'ebp'], 4, 0)
-linux_amd64_syscall = SyscallABI('rsp', ['rax', 'rdi', 'rsi', 'rdx', 'r10', 'r8', 'r9'],   8, 0)
-linux_arm_syscall   = SyscallABI('sp', ['r7', 'r0', 'r1', 'r2', 'r3', 'r4', 'r5', 'r6'], 4, 0)
-linux_aarch64_syscall   = SyscallABI('sp', ['x8', 'x0', 'x1', 'x2', 'x3', 'x4', 'x5', 'x6'], 16, 0)
-linux_mips_syscall  = SyscallABI('$sp', ['$v0','$a0','$a1','$a2','$a3'], 4, 0)
-linux_ppc_syscall = ABI('sp', ['r0', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9'], 4, 0)
-linux_ppc64_syscall = ABI('sp', ['r0', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9'], 8, 0)
+linux_i386_sigreturn = SigreturnABI(['eax'], 4, 0)
+linux_amd64_sigreturn = SigreturnABI(['rax'], 4, 0)
+linux_arm_sigreturn = SigreturnABI(['r7'], 4, 0)

-linux_i386_sigreturn = SigreturnABI('esp', ['eax'], 4, 0)
-linux_amd64_sigreturn = SigreturnABI('rsp', ['rax'], 4, 0)
-linux_arm_sigreturn = SigreturnABI('sp', ['r7'], 4, 0)
-linux_aarch64_sigreturn = SigreturnABI('sp', ['x8'], 16, 0)
+windows_i386  = ABI([], 4, 0)
+windows_amd64 = ABI(['rcx','rdx','r8','r9'], 32, 32)

-sysv_i386_sigreturn = linux_i386_sigreturn
-sysv_amd64_sigreturn = linux_amd64_sigreturn
-sysv_arm_sigreturn = linux_arm_sigreturn
-sysv_aarch64_sigreturn = linux_aarch64_sigreturn
-
-freebsd_i386 = sysv_i386
-freebsd_amd64 = sysv_amd64
-freebsd_arm = sysv_arm
-freebsd_aarch64 = sysv_aarch64
-freebsd_mips = sysv_mips
-freebsd_ppc = sysv_ppc
-freebsd_ppc64 = sysv_ppc64
-
-freebsd_i386_syscall   = SyscallABI('esp', ['eax'], 4, 0)
-freebsd_amd64_syscall  = SyscallABI('rsp', ['rax','rdi','rsi','rdx','rcx','r8','r9'], 8, 0)
-freebsd_arm_syscall    = SyscallABI('sp', ['r7', 'r0', 'r1', 'r2', 'r3'], 8, 0)
-freebsd_aarch64_syscall = SyscallABI('sp', ['x8', 'x0', 'x1', 'x2', 'x3'], 16, 0)
-freebsd_mips_syscall  = SyscallABI('$sp', ['$v0','$a0','$a1','$a2','$a3'], 4, 0)
-freebsd_ppc_syscall = SyscallABI('sp', ['r0', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 4, 0)
-freebsd_ppc64_syscall = SyscallABI('sp', ['r0', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 8, 0)
-
-freebsd_i386_sigreturn = sysv_i386_sigreturn
-freebsd_amd64_sigreturn = sysv_amd64_sigreturn
-freebsd_arm_sigreturn = sysv_arm_sigreturn
-freebsd_aarch64_sigreturn = sysv_aarch64_sigreturn
-
-windows_i386  = ABI('esp', [], 4, 0)
-windows_amd64 = ABI('rsp', ['rcx','rdx','r8','r9'], 32, 32)
+# Fake ABIs used by SROP
+linux_i386_srop = ABI(['eax'], 4, 0)
+linux_amd64_srop = ABI(['rax'], 4, 0)
+linux_arm_srop = ABI(['r7'], 4, 0)
@@ -1,6 +1,2 @@
-from __future__ import absolute_import
-
-from pwnlib.adb.adb import *
-from pwnlib.adb.protocol import Client
-from pwnlib.adb.bootimg import BootImage
-from pwnlib.adb.bootloader import BootloaderImage
+from .adb import *
+from .protocol import Client