Pin legacy release to v0.24

2026-11-09 17:13:08 -10:00 · 2020-06-02 16:52:27 +02:00
713 changed files with 4362 additions and 10542 deletions
@@ -1,10 +1,8 @@
 [run]
 branch = True
-parallel = True
 omit =
    */constants/*
 source =
    pwn
    pwnlib
-    ~/.pwntools-cache-2.7/
-    ~/.pwntools-cache-3.8/
+    ~/.pwntools-cache/
@@ -1,54 +0,0 @@
---
-name: Bug report
-about: Create a report to help us improve
-title: ''
-labels: backport-required, bug
-assignees: ''
-
---
-
-Thanks for contributing to Pwntools!
-
-## Update Pwntools First
-
-When reporting an issue, be sure that you are running the latest released version of pwntools (`pip install --upgrade pwntools`).
-
-## Debug Output
-
-Having the extra debug output really helps us, and might help you diagnose the problem yourself.
-
-When submitting an issue that has output from Pwntools, make sure to run your script as shown below, to enable the extra debugging data.
-
-```sh
-$ python exploit.py DEBUG LOG_FILE=log.txt
-```
-
-You should see `[DEBUG]` statements that show what's happening behind the scenes:
-
-```
-[+] Starting local process '/bin/sh' argv=['sh'] : pid 16823
-[DEBUG] Sent 0x7 bytes:
-    'whoami\n'
-[DEBUG] Sent 0x5 bytes:
-    'exit\n'
-[+] Receiving all data: Done (11B)
-[DEBUG] Received 0xb bytes:
-    'crashheap\n'
-[*] Process '/bin/sh' stopped with exit code 0 (pid 16823)
-```
-
-## Verify on Ubuntu
-
-If possible, please verify that your issue occurs on 64-bit Ubuntu 18.04.  We provide a Dockerfile based on Ubuntu 18.04 via `docker.io` to make this super simple, no VM required!
-
-```sh
-# Download the Docker image
-$ docker pull pwntools/pwntools:stable
-
-# Boot the image
-$ docker run -it pwntools/pwntools:stable
-
-pwntools@7dc3ef409476:~$ python
->>> from pwn import *
->>> # Test your code here
-```
@@ -1,18 +0,0 @@
---
-name: Feature request
-about: Suggest an idea for this project
-title: ''
-labels: feature
-assignees: ''
-
---
-
-Thanks for contributing to Pwntools!   Ideas from the community help make Pwntools an amazing tool for everybody.
-
-If you've got an idea for a new feature, please provide information about:
-
-* What the feature does
-* Why the feature should exit
-* What tests should be included
-
-If you think you can write the feature yourself, please submit a Pull Request and we can review your changes!
@@ -1,18 +0,0 @@
---
-name: Question
-about: Ask us a question about Pwntools
-title: ''
-labels: question
-assignees: ''
-
---
-
-Thanks for using Pwntools!  If you have a question, here are some tips that will make it easier for us to help you.
-
-## Check the Documentation
-
-Pwntools has REALLY extensive documentation.  Please check there first!  https://docs.pwntools.com
-
-## Debug Output
-
-If you're having an issue with an exploit, run your script with full debugging output, i.e. `python exploit.py DEBUG`.  This may help you to see what's happening under the hood, and the debug output will help to diagnose any issues you're encountering.
@@ -1,197 +0,0 @@
-name: Continuous Integration
-on: [push, pull_request]
-
-jobs:
-  build:
-    strategy:
-      matrix:
-        python-version: [2.7, 3.8]
-        os: [ubuntu-latest]
-    runs-on: ${{ matrix.os }}
-    steps:
-    - uses: actions/checkout@v2
-      with:
-        fetch-depth: 0
-
-    - name: Git History 2
-      run: git log --oneline --graph -10
-
-    - name: Cache for pip
-      uses: actions/cache@v1
-      id: cache-pip
-      with:
-        path: ~/.cache/pip
-        key: ${{ matrix.os }}-cache-pip
-
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v1
-      with:
-        python-version: ${{ matrix.python-version }}
-
-    - name: Lint
-      run: |
-        pip install flake8
-        flake8 . --count --select=E9,F63,F7 --show-source --statistics --exclude=android-?dk  # TODO: Add F82
-        flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics --exclude=pwnlib/constants,android-?dk,.git,__pycache__
-
-    - name: Detect whether java is needed
-      id: java-needed
-      env:
-        GITHUB_REF: ${{ github.event.ref }}
-        GITHUB_COMMIT_RANGE: ${{ github.event.before }}...${{ github.event.after }}
-      run: |
-        if echo "$GITHUB_REF" | grep -Eq 'staging|tags'; then
-          echo "Found release or important branch ($GITHUB_REF), forcing tests."
-        elif ! git show "$GITHUB_COMMIT_RANGE" >/dev/null; then
-          echo 'Incorrect commit range, forcing android tests.'
-        elif git log --stat "$GITHUB_COMMIT_RANGE" | grep -iE 'android|\<adb\>'; then
-          echo 'Found Android-related commits, forcing tests.'
-        else
-          # clear files that cause Android doctests
-          : > docs/source/adb.rst > docs/source/protocols/adb.rst
-          exit 0
-        fi
-        echo ::set-output name=need::openjdk-8-jre-headless
-
-    - name: Install Linux dependencies
-      env:
-        ANDROID_JRE: ${{ steps.java-needed.outputs.need }}
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y --no-install-recommends -o Acquire::Retries=3 \
-          ash bash-static dash ksh mksh zsh \
-          pandoc gdb gdbserver socat sshpass \
-          binutils-multiarch qemu-user-static \
-          binutils-aarch64-linux-gnu \
-          binutils-arm-linux-gnueabihf \
-          binutils-mips-linux-gnu \
-          binutils-powerpc-linux-gnu \
-          gcc-multilib \
-          $ANDROID_JRE
-        sudo apt-get install -y -o Acquire::Retries=3 \
-          gcc-aarch64-linux-gnu \
-          gcc-arm-linux-gnueabihf
-
-    - name: Install android avd
-      if:  steps.java-needed.outputs.need
-      run: |
-        USER=travis source travis/install.sh
-        set | egrep '^(ANDROID|PATH)' >.android.env
-
-    - name: Set up SSH
-      run: |
-        travis/ssh_setup.sh
-
-    - name: Install dependencies
-      run: |
-        pip install --upgrade pip
-        pip install --upgrade flake8 appdirs
-        python setup.py egg_info
-        pip install --upgrade --editable .
-
-    - name: Sanity checks
-      run:  PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
-
-    - name: Install documentation dependencies
-      run:  pip install -r docs/requirements.txt
-
-    - name: Disable broken tests
-      run: |
-        rm -f docs/source/elf/corefile.rst
-        rm -f docs/source/ui.rst
-
-    - name: Manually install non-broken Unicorn
-      run:  pip install unicorn==1.0.2rc3
-
-    - name: Coverage doctests
-      run: |
-        source .android.env || :
-        echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope # required by some gdb doctests
-        PWNLIB_NOTERM=1 coverage run -m sphinx -b doctest docs/source docs/build/doctest
-
-    - name: Coverage running examples
-      run: |
-        export TERM=linux
-        set -x
-        python travis/coverage_chdir.py examples/fmtstr examples/fmtstr/exploit.py
-        python travis/coverage_chdir.py examples/fmtstr examples/fmtstr/exploit2.py || : # can fail randomly?
-        coverage run examples/asm.py
-        coverage run examples/asm.py
-        coverage run examples/text.py
-        # for f in examples/sigreturn_corefile_*.py; do coverage run "$f"; done # XXX something is wrong
-
-    - name: Coverage running commandline tools
-      run: |
-        export TERM=linux
-        pwn() { coverage run -m pwnlib.commandline.main "$@"; }
-        set -x
-
-        pwn cyclic 32
-        pwn cyclic -l 0x62616161
-
-        pwn shellcraft -f asm --color amd64.linux.sh
-
-        pwn disasm --color ff3424c3ebfe
-
-        pwn hex abcd
-        pwn unhex 4141 4141
-
-        head -c256 /dev/urandom | pwn phd
-
-        pwn errno 2
-
-        pwn constgrep -c freebsd -m ^PROT_ '3 + 4'
-        pwn constgrep ^MAP_ 0
-        pwn constgrep ^O_
-
-    - name: Build source and wheel distributions
-      run: |
-        python setup.py sdist
-        python setup.py bdist_wheel --universal
-
-    - uses: actions/upload-artifact@v2
-      with:
-        name: packages
-        path: dist/
-
-    - name: Upload coverage to coveralls.io
-      run: |
-        coverage combine
-        COVERALLS_REPO_TOKEN=PP20MEgztXIQJJTguQwe2jeCh6Bm4lkbv coveralls
-
-  staging-merge:
-    runs-on: ubuntu-latest
-    if: github.repository_owner == 'Gallopsled' && github.event_name == 'push' && startsWith(github.event.ref, 'refs/heads/') && endsWith(github.event.ref, '-staging')
-    needs: build
-    steps:
-    - uses: actions/checkout@v2
-      with:
-        fetch-depth: 20
-    - name: Push changes to protected branch
-      env:
-        GITHUB_REF: ${{ github.event.ref }}
-      run: |
-        BRANCH=${GITHUB_REF#refs/heads/}
-        TARGET=${BRANCH%-staging}
-        git branch -f "$TARGET"
-        git push origin "$TARGET"
-
-  pypi:
-    runs-on: ubuntu-latest
-    if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags')
-    needs: build
-    steps:
-    - name: Download artifacts
-      uses: actions/download-artifact@v2
-      with:
-        name: packages
-        path: dist
-
-    - name: Publish package
-      uses: pypa/[email protected]
-      with:
-        user: __token__
-        password: ${{ secrets.pypi_password }}
-
-    - if: failure()
-      run: ls -R
@@ -11,8 +11,7 @@ docs/build
 build
 MANIFEST
 dist
-venv
-.vscode
 *.egg-info
 *.core
 .coverage
+.tox
@@ -1,7 +1,9 @@
+dist: precise
 language: python
 addons:
  apt:
    packages:
+    - gcc-multilib
    - lib32stdc++6
    - ash
    - bash
@@ -11,31 +13,14 @@ addons:
    - zsh
    - pandoc
    - gdb
-    - socat
-    - sshpass
-    - binutils
-    - qemu-user-static
-    - binutils-multiarch
-    - binutils-aarch64-linux-gnu
-    - binutils-arm-linux-gnueabihf
-    - binutils-mips-linux-gnu
-    - binutils-powerpc-linux-gnu
-    - gcc-aarch64-linux-gnu
-    - gcc-arm-linux-gnueabihf
-    - bash-static
-
 cache:
    - pip
    - directories:
        - usr
-        - /home/travis/virtualenv/python2.7.15/lib/python2.7/site-packages/
-        - /home/travis/virtualenv/python2.7.15/bin/
-        - /home/travis/virtualenv/python3.8.*/lib/python3.8/site-packages/
-        - /home/travis/virtualenv/python3.8.*/bin/
-        - docs/build/doctest/.doctrees
+        - /home/travis/virtualenv/python2.7.13/lib/python2.7/site-packages/
+        - /home/travis/virtualenv/python2.7.13/bin/
 python:
  - "2.7"
-  - "3.8"
 before_install:
  - echo $-
  - source travis/install.sh
@@ -43,22 +28,16 @@ before_install:
  - echo $-
 install:
  - pip install --upgrade pip
-  - pip install --upgrade flake8 appdirs # https://github.com/ActiveState/appdirs/issues/89#issuecomment-282326570
-  - python setup.py egg_info      # pypa/pip#6275
+  - pip install --upgrade appdirs # https://github.com/ActiveState/appdirs/issues/89#issuecomment-282326570
  - pip install --upgrade --editable .
  - pip install --upgrade --requirement docs/requirements.txt
 before_script:
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
-  - sudo sh -c "echo 0 > /proc/sys/kernel/yama/ptrace_scope"
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
 script:
-  # stop the build if there are Python syntax errors or undefined names
-  - flake8 . --count --select=E9,F63,F7 --show-source --statistics --exclude=android-?dk  # TODO: Add F82
-  # exit-zero treats all errors as warnings.  The GitHub editor is 127 chars wide
  - PWNLIB_NOTERM=1 coverage run -m sphinx -b doctest docs/source docs/build/doctest
-  - coverage combine
 after_success:
  - coveralls
  - source travis/update_demo.sh
@@ -9,19 +9,9 @@ The table below shows which release corresponds to each branch, and what date th

 | Version          | Branch   | Release Date           |
 | ---------------- | -------- | ---------------------- |
-| [4.3.0](#430)    | `dev`    | Jun 30, 2020 (planned)
-| [4.2.0](#420)    | `beta`   | Jun 5, 2020 (planned)
-| [4.1.1](#411)    | `stable` | Jun 3, 2020
-| [4.1.0](#410)    |          | May 8, 2020
-| [4.0.1](#401)    |          | Jan 22, 2020
-| [4.0.0](#400)    |          | Jan 09, 2020
-| [3.13.0](#3130)  |          | Nov 5, 2019
-| [3.12.2](#3122)  |          | Jan 8, 2019
-| [3.12.1](#3121)  |          | Sept 17, 2018
-| [3.12.0](#3120)  |          | Feb 22, 2018
-| [3.11.0](#3110)  |          | Jan 3, 2018
-| [3.10.0](#3100)  |          | Oct 25, 2017
-| [3.9.2](#392)    |          | Oct 5, 2017
+| [3.11.0](#3110)  | `dev`    | Dec 2, 2017 (planned)
+| [3.10.0](#3100)  | `beta`   | Oct 21, 2017 (planned)
+| [3.9.2](#392)    | `stable` | Oct 5, 2017
 | [3.9.1](#391)    |          | Sep 28, 2017
 | [3.9.0](#390)    |          | Sep 11, 2017
 | [3.8.0](#380)    |          | Jul 29, 2017
@@ -49,188 +39,13 @@ The table below shows which release corresponds to each branch, and what date th
 | [3.0.0](#300)    |          | Aug 20, 2016
 | [2.2.0](#220)    |          | Jan 5, 2015

-## 4.3.0 (`dev`)
-
-To be released on Jun 30, 2020.
-
-## 4.2.0 (`beta`)
-
-To be released on Jun 5, 2020.
-
- [#1436][1436] Add ret2dlresolve automation
- [fecf9f] tubes.ssh.process() no longer requires python 2 installed on remote (still requires python, though)
- Miscellanous improvements to DynElf and fmtstr leaker (see examples/fmtstr/exploit2.py)
- [#1454][1454] Support for windows console colors
-
-[1436]: https://github.com/Gallopsled/pwntools/pull/1436
-[fecf9f]: http://github.com/Gallopsled/pwntools/commit/fecf9f
-[1454]: https://github.com/Gallopsled/pwntools/pull/1454
-
-## 4.1.1 (`stable`)
-
- Fix PLT resolution by locking unicorn <1.0.2rc4 (#1538)
- Fix wrong ELF/context unpack handling (c4c11a37)
- Fix updating of ELF.functions addresses after changing ELF.address #1512 (#1513)
- Update Corefile warnings and replace asserts with normal checks (#1526)
- several py2-py3 issues (#1451)
- Fix cyclic command
-
-## 4.1.0
-
- [#1316][1316] Fix connect shellcraft in python 3
- [#1323][1323] Fix issues related with debugging
- [#1001][1001] Enhance `unlock_bootloader` with better status messages
- [#1389][1389] remove old dependencies
- [#1241][1241] Launch QEMU with sysroot if specified
- [#1218][1218] Support for FileStructure exploitation
-
-[1316]: https://github.com/Gallopsled/pwntools/pull/1316
-[1323]: https://github.com/Gallopsled/pwntools/pull/1323
-[1001]: https://github.com/Gallopsled/pwntools/pull/1001
-[1389]: https://github.com/Gallopsled/pwntools/pull/1389
-[1241]: https://github.com/Gallopsled/pwntools/pull/1241
-[1218]: https://github.com/Gallopsled/pwntools/pull/1218  
-
-## 4.0.1
-
- [#1412][1412] `recvline_pred()` and similar do not reorder data
- Bypass unicorn-engine/unicorn#1100 and unicorn-engine/unicorn#1170 requiring unstable package
-
-[1412]: https://github.com/Gallopsled/pwntools/pull/1412
-
-## 4.0.0
-
- **Python 3 support! <3**
- [#1402][1402] Fix serialtube in python 3
- [#1391][1391] Fix process.libs
- [#1317][1317] Tubes with `context.encoding`
- [#1216][1216] Improve format string generator
- [#1285][1285] Add freebsd generic syscall templates
- [76413f][76413f] Add pwnlib.adb.bootimg for 'ANDROID!' format boot.img images
- [#1202][1202] Docker: Kill 14 layers in pwntools base images
- [#1182][1182] shellcraft.dupio() for mips
-
-[1402]: https://github.com/Gallopsled/pwntools/pull/1402
-[1391]: https://github.com/Gallopsled/pwntools/pull/1391
-[1317]: https://github.com/Gallopsled/pwntools/pull/1317
-[1285]: https://github.com/Gallopsled/pwntools/pull/1285
-[1216]: https://github.com/Gallopsled/pwntools/pull/1216
-[1202]: https://github.com/Gallopsled/pwntools/pull/1202
-[1182]: https://github.com/Gallopsled/pwntools/pull/1182
-[76413f]: https://github.com/Gallopsled/pwntools/commit/76413f
-
-## 3.13.0
-
- [#1204][1204] Reduce ROP cache filename length
- [#1175][1175] Fix nested SSH connectors
- [#1355][1355] Fix 'break' syscall
- [#1277][1277] Fix timeout parameter passing in sendlineafter and other similar functions
- [#1292][1292] Provide correct arch name to gdb for sparc64
-
-[1175]: https://github.com/Gallopsled/pwntools/pull/1175
-[1204]: https://github.com/Gallopsled/pwntools/pull/1204
-[1277]: https://github.com/Gallopsled/pwntools/pull/1277
-[1292]: https://github.com/Gallopsled/pwntools/pull/1292
-[1355]: https://github.com/Gallopsled/pwntools/pull/1355
-
-## 3.12.2
-
- [#1242][1242] Use IntervalTree 2.xx, disallow use of 3.xx
- [#1243][1243] Fix a typo that caused an exception when executing a binary with `process()` which returns `-ENOEXEC` and the system does not have `qemu-user` binaries installed.
-
-[1242]: https://github.com/Gallopsled/pwntools/pull/1242
-[1243]: https://github.com/Gallopsled/pwntools/pull/1243
-
-## 3.12.1
-
- [#1198][1198] More compatibility fixes for pyelftools==0.25, and pin Sphinx<1.8.0 since it causes testing errors
- [#1191][1191] Fix compatibility with pyelftools==0.25
- [#1159][1159] Fix check for `/proc/.../status`
- [#1162][1162] Fix broken package versions
- [#1150][1150] Fix exception raised when a cache file is missing
- [#1156][1156] Fix ROP gadget selection logic involving `int` and `syscall` instructions
- [#1152][1152] Fix QEMU LD_PREFIX calculation (wrong parameter passed)
- [#1155][1155] Use Ubuntu Trusty for all CI builds
- [#1131][1131] Add "libc-" to libc prefixes in `process` tubes
- [#1125][1125] Fix a typo
- [#1121][1121] Fix tests which were broken by an upstream Sphinx change
- [#1104][1104] Add `DynELF.dump()` for dumping remote ELF files
- [#1101][1101] Set `context.os` via `context.binary`, useful for Android exploitation
- [5fdc08][5fdc08] Work around broken `pidof` on Android
- [63dfed][63dfed] Print warning when Corefile deletion fails instead of throwing an exception
- [#1094][1094] Make hexdump output alignment more consistent
- [#1096][1096] `flat()` and `fit()` are now the same function
-
-[1198]: https://github.com/Gallopsled/pwntools/pull/1198
-[1191]: https://github.com/Gallopsled/pwntools/pull/1191
-[1159]: https://github.com/Gallopsled/pwntools/pull/1159
-[1162]: https://github.com/Gallopsled/pwntools/pull/1162
-[1150]: https://github.com/Gallopsled/pwntools/pull/1150
-[1156]: https://github.com/Gallopsled/pwntools/pull/1156
-[1152]: https://github.com/Gallopsled/pwntools/pull/1152
-[1155]: https://github.com/Gallopsled/pwntools/pull/1155
-[1131]: https://github.com/Gallopsled/pwntools/pull/1131
-[1125]: https://github.com/Gallopsled/pwntools/pull/1125
-[1121]: https://github.com/Gallopsled/pwntools/pull/1121
-[1104]: https://github.com/Gallopsled/pwntools/pull/1104
-[1101]: https://github.com/Gallopsled/pwntools/pull/1101
-[1094]: https://github.com/Gallopsled/pwntools/pull/1094
-[1096]: https://github.com/Gallopsled/pwntools/pull/1096
-[5fdc08]: https://github.com/Gallopsled/pwntools/commit/5fdc08
-[63dfed]: https://github.com/Gallopsled/pwntools/commit/63dfed
-
-## 3.12.0
-
- [#1083][1083] Better error messages for `gdb` when `LD_PRELOAD` is incorrect
- [#1085][1085] Add support for extracting Android `BOOTLDR!` images
- [#1075][1075] Add support for detecting GNU Screen for `run_in_new_terminal`
- [#1074][1074] Add support for running `pwntools-gdb` wrapper script instead of `gdb`
- [#1068][1068] Work around very old OpenSSL versions which don't have sha256 support *AND* don't exit with an error code when trying to use it
- [#1067][1067] Add `pwnlib.tubes.server` module, which adds a reusable `server` listener
- [#1063][1063] Add support for labels in `fit()`, allowing dynamic contents to be injected.  (This feature is really cool, check out the pull request!)
-
-[1083]: https://github.com/Gallopsled/pwntools/pull/1083
-[1085]: https://github.com/Gallopsled/pwntools/pull/1085
-[1075]: https://github.com/Gallopsled/pwntools/pull/1075
-[1074]: https://github.com/Gallopsled/pwntools/pull/1074
-[1068]: https://github.com/Gallopsled/pwntools/pull/1068
-[1067]: https://github.com/Gallopsled/pwntools/pull/1067
-[1063]: https://github.com/Gallopsled/pwntools/pull/1063
-
 ## 3.11.0

- [#1044][1044] Enhancements to ROP
-    + Much better support for 64-bit Intel (amd64) ROP
-    + ROP gadget selection is optimized to favor multi-pops instead of multiple single-pop gadgets
-    + Added support for blacklisting byte values in ROP gadget addresses
- [#1049][1049] Enhancements to `cyclic`
-    + `context` now has two additional attributes, `cyclic_alphabet` and `cyclic_length`, which correspond to the arguments `alphabet` and `n` to `cyclic()` and `cyclic_find()` and related routines.
-    + The motivation for this change is to allow setting the `alphabet` globally, so that any padding / patterns generated internally to pwntools can be controlled.  The specific motivation is blacklisting values in ROP padding.
- [#1052][1052] Enhancements for detecting `QEMU_LD_PREFIX` used by QEMU user-mode emulation for sysroots
- [#1035][1035] Minor documentation changes
- [#1032][1032] Enhancements to `pwn template`
- [#1031][1031] More accurate `Coredump.fault_addr` on amd64
- [#1084][1084] Fix broken tests due to `ftp.debian.org` going down
-
-[1044]: https://github.com/Gallopsled/pwntools/pull/1044
-[1049]: https://github.com/Gallopsled/pwntools/pull/1049
-[1052]: https://github.com/Gallopsled/pwntools/pull/1052
-[1035]: https://github.com/Gallopsled/pwntools/pull/1035
-[1032]: https://github.com/Gallopsled/pwntools/pull/1032
-[1031]: https://github.com/Gallopsled/pwntools/pull/1031
-[1084]: https://github.com/Gallopsled/pwntools/pull/1084
+To be released on Dec 2, 2017.

 ## 3.10.0

- [#1007][1007] Add support for setting a `gdbinit` file in the context
- [#1055][1055] Fixes for `Corefile` stack parsing, speed up `ELF.string()`
- [#1057][1057] Fix a variable name typo in `DynELF` logging which results in an exception being thrown
- [#1058][1058] Fix an edge case in `ssh_process.exe`
-
-[1007]: https://github.com/Gallopsled/pwntools/pull/1007
-[1055]: https://github.com/Gallopsled/pwntools/pull/1055
-[1057]: https://github.com/Gallopsled/pwntools/pull/1057
-[1058]: https://github.com/Gallopsled/pwntools/pull/1058
+To be released on Oct 21, 2017.

 ## 3.9.2

@@ -2,7 +2,7 @@
 ![pwntools logo](https://github.com/Gallopsled/pwntools/blob/stable/docs/source/logo.png?raw=true)

 [![Docs](https://readthedocs.org/projects/pwntools/badge/?version=stable)](https://docs.pwntools.com/)
-[![PyPI](https://img.shields.io/pypi/v/pwntools?style=flat)](https://pypi.python.org/pypi/pwntools/)
+[![PyPI](https://img.shields.io/badge/pypi-v3.9.2-green.svg?style=flat)](https://pypi.python.org/pypi/pwntools/)
 [![Travis](https://travis-ci.org/Gallopsled/pwntools.svg)](https://travis-ci.org/Gallopsled/pwntools)
 [![Coveralls](https://img.shields.io/coveralls/Gallopsled/pwntools/dev.svg)](https://coveralls.io/github/Gallopsled/pwntools?branch=dev)
 [![Twitter](https://img.shields.io/badge/twitter-pwntools-4099FF.svg?style=flat)](https://twitter.com/pwntools)
@@ -32,15 +32,15 @@ To get you started, we've provided some example solutions for past CTF challenge

 # Installation

-Pwntools is best supported on 64-bit Ubuntu LTE releases (12.04, 14.04, 16.04 and 18.04).  Most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).  Python >= 2.7 is required (Python 3 suggested as best).
+Pwntools is best supported on 64-bit Ubuntu LTE releases (12.04, 14.04, and 16.04).  Most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).  Python 2.7 is required.

 Most of the functionality of pwntools is self-contained and Python-only.  You should be able to get running quickly with

 ```sh
 apt-get update
-apt-get install python3 python3-pip python3-dev git libssl-dev libffi-dev build-essential
-python3 -m pip install --upgrade pip
-python3 -m pip install --upgrade git+https://github.com/Gallopsled/pwntools.git@dev3
+apt-get install python2.7 python-pip python-dev git libssl-dev libffi-dev build-essential
+pip install --upgrade pip
+pip install --upgrade pwntools
 ```

 However, some of the features (assembling/disassembling foreign architectures) require non-Python dependencies.  For more information, see the [complete installation instructions here](https://docs.pwntools.com/en/stable/install.html).
@@ -44,7 +44,7 @@ def main(args):
 		doc2dash.__main__.main.main( \
 			[ os.path.join(dstdir, "html"), "-d", dstdir, "-n", name, \
 					"-f", "-I", "index.html"], "doc2dash", False)
-	except SystemExit as e:
+	except SystemExit,e:
 		pass

 	# Insert a link to the online version.
@@ -1,17 +1,16 @@
-capstone
-coveralls
-doc2dash
+sphinxcontrib-napoleon
+sphinxcontrib-autoprogram==0.1.2
 isort
-mako>=1.0.0
 paramiko>=1.15.2
-pip>=6.0.8
+mako>=1.0.0
 pyelftools>=0.2.3
-pygments>=2.0
-pypandoc
+capstone
+ropgadget>=5.3
 pyserial>=2.7
 requests>=2.5.1
-ropgadget>=5.3
-sphinx
+pip>=6.0.8
+tox>=1.8.1
+pygments>=2.0
 sphinx_rtd_theme
-sphinxcontrib-napoleon
-sphinxcontrib-autoprogram
+doc2dash
+coveralls
@@ -47,7 +47,7 @@ This module is our "clean" python-code. As a rule, we do not think that
 importing :mod:`pwnlib` or any of the submodules should have any significant
 side-effects (besides e.g. caching).

-For the most part, you will also only get the bits you import. You for instance would
+For the most part, you will also only get the bits you import. You for instance
 not get access to :mod:`pwnlib.util.packing` simply by doing ``import
 pwnlib.util``.

@@ -1,6 +1,5 @@
 .. testsetup:: *

-   from pprint import pprint
   from pwn import *
   adb = pwnlib.adb

@@ -6,7 +6,6 @@
   from pwnlib.asm import *
   from pwnlib import shellcraft
   from pwnlib.tubes.process import process
-   from pwnlib.util.fiddling import unhex


 :mod:`pwnlib.asm` --- Assembler functions
@@ -12,9 +12,6 @@
 # serve to show the default.

 import os
-import doctest
-import signal
-import six
 import subprocess
 import sys

@@ -27,6 +24,8 @@ sys.path.insert(0, os.path.abspath('../..'))

 import pwnlib

+# -- General configuration -----------------------------------------------------
+
 # If your documentation needs a minimal Sphinx version, state it here.
 #needs_sphinx = '1.0'

@@ -70,9 +69,9 @@ doctest_global_setup = '''
 import sys, os
 os.environ['PWNLIB_NOTERM'] = '1'
 os.environ['PWNLIB_RANDOMIZE'] = '0'
-import pwnlib, logging
+import pwnlib
 pwnlib.context.context.reset_local()
-pwnlib.context.ContextType.defaults['log_level'] = logging.ERROR
+pwnlib.context.ContextType.defaults['log_level'] = 'ERROR'
 pwnlib.context.ContextType.defaults['randomize'] = False
 pwnlib.util.fiddling.default_style = {}
 pwnlib.term.text.when = 'never'
@@ -314,13 +313,13 @@ texinfo_documents = [
 branch = release

 try:
-    git_branch = subprocess.check_output('git describe --tags', shell = True, universal_newlines = True)
+    git_branch = subprocess.check_output('git describe --tags', shell = True)
 except subprocess.CalledProcessError:
    git_branch = '-'

 try:
    if '-' in git_branch:
-        branch = subprocess.check_output('git rev-parse HEAD', shell = True, universal_newlines = True).strip()[:10]
+        branch = subprocess.check_output('git rev-parse HEAD', shell = True).strip()[:10]
 except subprocess.CalledProcessError:
    pass

@@ -348,11 +347,11 @@ def linkcode_resolve(domain, info):
    else:
        filename = info['module'].replace('.', '/') + '.py'

-        if isinstance(val, (types.ModuleType, types.MethodType, types.FunctionType, types.TracebackType, types.FrameType, types.CodeType) + six.class_types):
+        if isinstance(val, (types.ModuleType, types.ClassType, types.MethodType, types.FunctionType, types.TracebackType, types.FrameType, types.CodeType)):
            try:
                lines, first = inspect.getsourcelines(val)
-                filename += '#L%d-L%d' % (first, first + len(lines) - 1)
-            except (IOError, TypeError):
+                filename += '#L%d-%d' % (first, first + len(lines) - 1)
+            except IOError:
                pass

    return "https://github.com/Gallopsled/pwntools/blob/%s/%s" % (branch, filename)
@@ -375,49 +374,46 @@ if build_dash:

 # -- Customization to Sphinx autodoc generation --------------------------------------------
 import sphinx.ext.autodoc
+from sphinx.util.inspect import safe_getmembers, safe_getattr

 # Test hidden members (e.g. def _foo(...))
 def dont_skip_any_doctests(app, what, name, obj, skip, options):
    return False

-class _DummyClass(object): pass
-
-class Py2OutputChecker(_DummyClass, doctest.OutputChecker):
-    def check_output(self, want, got, optionflags):
-        sup = super(Py2OutputChecker, self).check_output
-        if sup(want, got, optionflags):
-            return True
-        try:
-            rly_want = pwnlib.util.safeeval.const(want)
-            if sup(repr(rly_want), got, optionflags):
-                return True
-            rly_got = pwnlib.util.safeeval.const(got)
-            if rly_want == rly_got:
-                return True
-        except ValueError:
-            pass
-        rly_want = ' '.join(x[:2].replace('b"','"').replace("b'","'")+x[2:] for x in want.replace('\n','\n ').split(' ')).replace('\n ','\n')
-        if sup(rly_want, got, optionflags):
-            return True
-        rly_want = ' '.join(x[:2].replace('b"',' "').replace("b'"," '")+x[2:] for x in want.replace('\n','\n ').split(' ')).replace('\n ','\n')
-        return sup(rly_want, got, optionflags)
-
-def py2_doctest_init(self, checker=None, verbose=None, optionflags=0):
-    if checker is None:
-        checker = Py2OutputChecker()
-    doctest.DocTestRunner.__init__(self, checker, verbose, optionflags)
-
-class EndlessLoop(Exception): pass
-def alrm_handler(sig, frame):
-    signal.alarm(180) # three minutes
-    raise EndlessLoop()
-signal.signal(signal.SIGALRM, alrm_handler)
-signal.alarm(600) # ten minutes
+# Test non-exported members
+class ModuleDocumenter(sphinx.ext.autodoc.ModuleDocumenter):
+    def get_object_members(self, want_all):
+        if want_all:
+            # if not hasattr(self.object, '__all__'):
+            #     for implicit module members, check __module__ to avoid
+            #     documenting imported objects
+                return True, safe_getmembers(self.object)
+            # else:
+            #     memberlist = self.object.__all__
+            #     # Sometimes __all__ is broken...
+            #     if not isinstance(memberlist, (list, tuple)) or not \
+            #        all(isinstance(entry, string_types) for entry in memberlist):
+            #         self.directive.warn(
+            #             '__all__ should be a list of strings, not %r '
+            #             '(in module %s) -- ignoring __all__' %
+            #             (memberlist, self.fullname))
+            #         # fall back to all members
+            #         return True, safe_getmembers(self.object)
+        else:
+            memberlist = self.options.members or []
+        ret = []
+        for mname in memberlist:
+            try:
+                ret.append((mname, safe_getattr(self.object, mname)))
+            except AttributeError:
+                self.directive.warn(
+                    'missing attribute mentioned in :members: or __all__: '
+                    'module %s, attribute %s' % (
+                        safe_getattr(self.object, '__name__', '???'), mname))
+        return False, ret

 if 'doctest' in sys.argv:
    def setup(app):
        app.connect('autodoc-skip-member', dont_skip_any_doctests)

-    if sys.version_info[:1] < (3,):
-        import sphinx.ext.doctest
-        sphinx.ext.doctest.SphinxDocTestRunner.__init__ = py2_doctest_init
+    sphinx.ext.autodoc.ModuleDocumenter = ModuleDocumenter
@@ -8,7 +8,7 @@
 :mod:`pwnlib.context` --- Setting runtime variables
 =====================================================

-Many settings in ``pwntools`` are controlled via the global variable :data:`.context`, such as the selected target operating system, architecture, and bit-width.
+Many settings in ``pwntools`` are controlled via the global variable :data:`.context, such as the selected target operating system, architecture, and bit-width.

 In general, exploits will start with something like:

@@ -1,6 +1,5 @@
 .. testsetup:: *

-   from glob import glob
   from pwn import *

 :mod:`pwnlib.elf.corefile` --- Core Files
@@ -2,7 +2,6 @@

   from pwn import *
   from glob import glob
-   from pwnlib.elf.maps import CAT_PROC_MAPS_EXIT

 :mod:`pwnlib.elf.elf` --- ELF Files
 ===========================================================
@@ -1,9 +0,0 @@
-.. testsetup:: *
-
-   from pwnlib.filepointer import *
-
-:mod:`pwnlib.filepointer` --- `FILE*` structure exploitation
-============================================================
-
-.. automodule:: pwnlib.filepointer
-   :members:
@@ -1,8 +1,6 @@
 .. testsetup:: *

    from pwn import *
-    context.arch = 'amd64'
-    context.terminal = [os.path.join(os.path.dirname(pwnlib.__file__), 'gdb_faketerminal.py')]

 :mod:`pwnlib.gdb` --- Working with GDB
 ======================================
@@ -13,7 +13,7 @@ Which imports a bazillion things into the global namespace to make your life eas

 This is a quick list of most of the objects and routines imported, in rough order of importance and frequency of use.

- :mod:`pwnlib.context`
+- :obj:`.context`
    - :data:`pwnlib.context.context`
    - Responsible for most of the pwntools convenience settings
    - Set `context.log_level = 'debug'` when troubleshooting your exploit
@@ -54,7 +54,6 @@ Each of the ``pwntools`` modules is documented here.
   encoders
   elf
   exception
-   filepointer
   flag
   fmtstr
   gdb
@@ -62,7 +61,6 @@ Each of the ``pwntools`` modules is documented here.
   log
   memleak
   protocols
-   qemu
   replacements
   rop
   rop/*
@@ -25,9 +25,9 @@ pwntools is available as a ``pip`` package.
 .. code-block:: bash

    $ apt-get update
-    $ apt-get install python3 python3-pip python3-dev git libssl-dev libffi-dev build-essential
-    $ python3 -m pip install --upgrade pip
-    $ python3 -m pip install --upgrade pwntools
+    $ apt-get install python2.7 python-pip python-dev git libssl-dev libffi-dev build-essential
+    $ pip install --upgrade pip
+    $ pip install --upgrade pwntools

 Development
 --------------
@@ -27,14 +27,14 @@ This exposes a standard interface to talk to processes, sockets, serial ports,
 and all manner of things, along with some nifty helpers for common tasks.
 For example, remote connections via :mod:`pwnlib.tubes.remote`.

-    >>> conn = remote('ftp.ubuntu.com',21)
+    >>> conn = remote('ftp.debian.org',21)
    >>> conn.recvline() # doctest: +ELLIPSIS
-    b'220 ...'
-    >>> conn.send(b'USER anonymous\r\n')
-    >>> conn.recvuntil(b' ', drop=True)
-    b'331'
+    '220 ...'
+    >>> conn.send('USER anonymous\r\n')
+    >>> conn.recvuntil(' ', drop=True)
+    '331'
    >>> conn.recvline()
-    b'Please specify the password.\r\n'
+    'Please specify the password.\r\n'
    >>> conn.close()

 It's also easy to spin up a listener
@@ -42,20 +42,20 @@ It's also easy to spin up a listener
    >>> l = listen()
    >>> r = remote('localhost', l.lport)
    >>> c = l.wait_for_connection()
-    >>> r.send(b'hello')
+    >>> r.send('hello')
    >>> c.recv()
-    b'hello'
+    'hello'

 Interacting with processes is easy thanks to :mod:`pwnlib.tubes.process`.

 ::

    >>> sh = process('/bin/sh')
-    >>> sh.sendline(b'sleep 3; echo hello world;')
+    >>> sh.sendline('sleep 3; echo hello world;')
    >>> sh.recvline(timeout=1)
-    b''
+    ''
    >>> sh.recvline(timeout=5)
-    b'hello world\n'
+    'hello world\n'
    >>> sh.close()

 Not only can you interact with processes programmatically, but you can
@@ -74,14 +74,14 @@ a ``process`` tube.

    >>> shell = ssh('bandit0', 'bandit.labs.overthewire.org', password='bandit0', port=2220)
    >>> shell['whoami']
-    b'bandit0'
+    'bandit0'
    >>> shell.download_file('/etc/motd')
    >>> sh = shell.run('sh')
-    >>> sh.sendline(b'sleep 3; echo hello world;') # doctest: +SKIP
+    >>> sh.sendline('sleep 3; echo hello world;') # doctest: +SKIP
    >>> sh.recvline(timeout=1)
-    b''
+    ''
    >>> sh.recvline(timeout=5)
-    b'hello world\n'
+    'hello world\n'
    >>> shell.close()

 Packing Integers
@@ -97,13 +97,13 @@ unpacking codes, and littering your code with helper routines.
    >>> import struct
    >>> p32(0xdeadbeef) == struct.pack('I', 0xdeadbeef)
    True
-    >>> leet = unhex('37130000')
-    >>> u32(b'abcd') == struct.unpack('I', b'abcd')[0]
+    >>> leet = '37130000'.decode('hex')
+    >>> u32('abcd') == struct.unpack('I', 'abcd')[0]
    True

 The packing/unpacking operations are defined for many common bit-widths.

-    >>> u8(b'A') == 0x41
+    >>> u8('A') == 0x41
    True

 Setting the Target Architecture and OS
@@ -112,9 +112,9 @@ Setting the Target Architecture and OS
 The target architecture can generally be specified as an argument to the routine that requires it.

    >>> asm('nop')
-    b'\x90'
+    '\x90'
    >>> asm('nop', arch='arm')
-    b'\x00\xf0 \xe3'
+    '\x00\xf0 \xe3'

 However, it can also be set once in the global ``context``.  The operating system, word size, and endianness can also be set here.

@@ -126,10 +126,10 @@ However, it can also be set once in the global ``context``.  The operating syste
 Additionally, you can use a shorthand to set all of the values at once.

    >>> asm('nop')
-    b'\x90'
+    '\x90'
    >>> context(arch='arm', os='linux', endian='big', word_size=32)
    >>> asm('nop')
-    b'\xe3 \xf0\x00'
+    '\xe3 \xf0\x00'

 .. doctest::
   :hide:
@@ -158,12 +158,12 @@ Assembly and Disassembly
 Never again will you need to run some already-assembled pile of shellcode
 from the internet!  The :mod:`pwnlib.asm` module is full of awesome.

-    >>> enhex(asm('mov eax, 0'))
+    >>> asm('mov eax, 0').encode('hex')
    'b800000000'

 But if you do, it's easy to suss out!

-    >>> print(disasm(unhex('6a0258cd80ebf9')))
+    >>> print disasm('6a0258cd80ebf9'.decode('hex'))
       0:   6a 02                   push   0x2
       2:   58                      pop    eax
       3:   cd 80                   int    0x80
@@ -176,7 +176,7 @@ loaded with useful time-saving shellcodes.
 Let's say that we want to `setreuid(getuid(), getuid())` followed by `dup`ing
 file descriptor 4 to `stdin`, `stdout`, and `stderr`, and then pop a shell!

-    >>> enhex(asm(shellcraft.setreuid() + shellcraft.dupsh(4))) # doctest: +ELLIPSIS
+    >>> asm(shellcraft.setreuid() + shellcraft.dupsh(4)).encode('hex') # doctest: +ELLIPSIS
    '6a3158cd80...'


@@ -188,10 +188,10 @@ Never write another hexdump, thanks to :mod:`pwnlib.util.fiddling`.

 Find offsets in your buffer that cause a crash, thanks to :mod:`pwnlib.cyclic`.

-    >>> print(cyclic(20).decode())
+    >>> print cyclic(20)
    aaaabaaacaaadaaaeaaa
-    >>> # Assume EIP = 0x62616166 (b'faab' which is pack(0x62616166))  at crash time
-    >>> print(cyclic_find(b'faab'))
+    >>> # Assume EIP = 0x62616166 ('faab' which is pack(0x62616166))  at crash time
+    >>> print cyclic_find('faab')
    120

 ELF Manipulation
@@ -200,22 +200,22 @@ ELF Manipulation
 Stop hard-coding things!  Look them up at runtime with :mod:`pwnlib.elf`.

    >>> e = ELF('/bin/cat')
-    >>> print(hex(e.address)) #doctest: +SKIP
+    >>> print hex(e.address) #doctest: +SKIP
    0x400000
-    >>> print(hex(e.symbols['write'])) #doctest: +SKIP
+    >>> print hex(e.symbols['write']) #doctest: +SKIP
    0x401680
-    >>> print(hex(e.got['write'])) #doctest: +SKIP
+    >>> print hex(e.got['write']) #doctest: +SKIP
    0x60b070
-    >>> print(hex(e.plt['write'])) #doctest: +SKIP
+    >>> print hex(e.plt['write']) #doctest: +SKIP
    0x401680

 You can even patch and save the files.

    >>> e = ELF('/bin/cat')
    >>> e.read(e.address, 4)
-    b'\x7fELF'
+    '\x7fELF'
    >>> e.asm(e.address, 'ret')
    >>> e.save('/tmp/quiet-cat')
-    >>> disasm(open('/tmp/quiet-cat','rb').read(1))
+    >>> disasm(file('/tmp/quiet-cat','rb').read(1))
    '   0:   c3                      ret'

@@ -2,7 +2,6 @@

   from pwn import *
   from pwnlib.protocols.adb import AdbClient
-   AdbClient().wait_for_device()

 :mod:`pwnlib.protocols.adb` --- ADB Protocol Implementation
 ===========================================================
@@ -1,10 +0,0 @@
-.. testsetup:: *
-
-   from pwn import *
-
-
-:mod:`pwnlib.qemu` --- QEMU Utilities
-==========================================
-
-.. automodule:: pwnlib.qemu
-   :members:
@@ -3,9 +3,3 @@

 .. automodule:: pwnlib.term
   :members:
-
-Term Modules
-------------------
-
-.. toctree::
-    term/readline
@@ -1,10 +0,0 @@
-.. testsetup:: *
-
-   from pwnlib.term.readline import *
-   import io
-
-:mod:`pwnlib.term.readline` --- Terminal nice readline
-======================================================
-
-.. automodule:: pwnlib.term.readline
-   :members:
@@ -1,9 +0,0 @@
-.. testsetup:: *
-
-   from pwnlib.tubes.buffer import *
-
-:mod:`pwnlib.tubes.buffer` --- buffer implementation for tubes
-==============================================================
-
-.. automodule:: pwnlib.tubes.buffer
-   :members:
@@ -1,7 +1,6 @@
 .. testsetup:: *

   from pwn import *
-   from pwnlib.tubes.server import server

 :mod:`pwnlib.tubes.sock` --- Sockets
 ===========================================================
@@ -24,9 +23,3 @@
   .. autoclass:: pwnlib.tubes.listen.listen
      :members:
      :show-inheritance:
-
-.. automodule:: pwnlib.tubes.server
-
-   .. autoclass:: pwnlib.tubes.server.server
-      :members:
-      :show-inheritance:
@@ -1,8 +1,3 @@
-.. testsetup:: *
-
-   from pwn import *
-   import io
-
 :mod:`pwnlib.ui` --- Functions for user interaction
 ===================================================

@@ -1,6 +1,5 @@
 .. testsetup:: *

-   from pwn import *
   from pwnlib.util.cyclic import *


@@ -1,11 +0,0 @@
-.. testsetup:: *
-
-   from pwnlib.util.getdents import *
-   from pwnlib.util.fiddling import unhex
-
-
-:mod:`pwnlib.util.getdents` --- Linux binary directory listing
-==============================================================
-
-.. automodule:: pwnlib.util.getdents
-   :members:
@@ -1,6 +1,5 @@
 .. testsetup:: *

-   from pprint import pprint
   from pwnlib.util.misc import *
   import os, subprocess
   os.chdir("..")
@@ -1,7 +1,6 @@
 .. testsetup:: *

   from pwnlib.util.proc import *
-   from pwnlib.tubes.process import process
   import os, sys


@@ -26,10 +26,6 @@ Try running this example with::
 ```
 Example showing the interface to `pwnlib.asm.asm` and `pwnlib.shellcraft`.
 ```
-* `attach.py`
-```
-Example showing `pwnlib.gdb.attach()`
-```
 * `clean_and_log.py`
 ```
 Use case for `pwnlib.tubes.tube.clean_and_log`.
@@ -69,7 +65,8 @@ Example showing `pwnlib.ui.options()`
 ```
 * `port_forward.py`
 ```
-A very simple port forwarder using `pwnlib.tubes.tube.connect_both()`.
+A very simple port forwarder using `pwnlib.tubes.tube.connect_both()`.  Notice
+that `<>` is just a shorthand.
 ```
 * `readline_completers.py`
 ```
@@ -77,10 +74,6 @@ Example showing pwnlib's readline implementation and a few completers.  This
 part of pwnlib will probably see some major changes soon, but we wanted to show
 off some proof-of-concepts.
 ```
-* `remote.py`
-```
-Example showing how to use the remote class.
-```
 * `remote_gdb_debugging.py`
 ```
 Simple example showing how to use the remote
@@ -110,7 +103,7 @@ and::

  $ TERM=xterm-256color python text.py
 ```
-* `yesno.py`
+* `remote.py`
 ```
-Example showing `pwnlib.ui.yesno()`
+Example showing how to use the remote class.
 ```
@@ -1,25 +1,22 @@
-from __future__ import print_function
-
-import gdb
-from pwn import adb, context
+from pwn import *

 # Tell pwntools that the target is an Android device
-context.os = "android"
-context.arch = "aarch64"  # or 'arm'
+context.os='android'
+context.arch='aarch64' # or 'arm'

 # Optionally, set the remote ADB server address
-context.adb_host = "172.16.110.1"
+context.adb_host='172.16.110.1'

 # Wait for a device to become available
-print(adb.wait_for_device())
+print adb.wait_for_device()

 # Who am I?
-print(adb.process("id").recvall().strip())
+print adb.process('id').recvall().strip()

 # Interactive sessions!
 io = adb.shell()
-io.sendline("echo Hello, world; exit")
-print(io.recvall().replace("\r\n", "\n").strip())
+io.sendline('echo Hello, world; exit')
+print io.recvall().replace('\r\n', '\n').strip()

 # Debugging!
-gdb.debug("sh").interactive()
+gdb.debug('sh').interactive()
@@ -14,5 +14,5 @@ Try running this example with::

 from pwn import *

-print(args['RHOST'] or 'RHOST is not set')
-print(args['RPORT'] or 'RPORT is not set')
+print args['RHOST'] or 'RHOST is not set'
+print args['RPORT'] or 'RPORT is not set'
@@ -9,5 +9,5 @@ context(arch='i386', os='linux')
 shellcode = shellcraft.i386_to_amd64()
 shellcode_asm = asm(shellcode)

-print(enhex(shellcode_asm))
-print(disasm(shellcode_asm))
+print enhex(shellcode_asm)
+print disasm(shellcode_asm)
@@ -5,7 +5,7 @@ Example showing `pwnlib.gdb.attach()`
 from pwn import *

 bash = process('/bin/bash')
-gdb.attach(bash, gdbscript = '''
+gdb.attach(bash, execute = '''
 p "hello from pwnlib"
 c
 ''')
@@ -25,4 +25,4 @@ atexit.register(r.clean_and_log)

 while True:
    line = r.recvline()
-    print(re.findall('^prefix (\S+)$', line)[0])
+    print re.findall('^prefix (\S+)$', line)[0]
@@ -1,51 +0,0 @@
-CFLAGS := -Wno-unused-result -Wno-format-security
-TARGETS := printf.mips printf.mips64 printf.mipsel printf.mips64el printf.arm printf.aarch64 \
-	         printf.ppc printf.ppc64 printf.sparc64 printf.native printf.native32
-
-.PHONY: run
-run: all
-	./exploit.py
-
-.PHONY: all
-all: $(TARGETS)
-
-.PHONY: clean
-clean:
-	rm -f $(TARGETS)
-
-# mips variants
-%.mips: %.c
-	mips-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
-%.mipsel: %.c
-	mipsel-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
-%.mips64: %.c
-	mips64-linux-gnuabi64-gcc $(CFLAGS) -static -Os -o "$@" $^
-%.mips64el: %.c
-	mips64el-linux-gnuabi64-gcc $(CFLAGS) -static -Os -o "$@" $^
-
-# arm variants
-%.arm: %.c
-	arm-linux-gnueabi-gcc $(CFLAGS) -static -Os -o "$@" $^
-%.aarch64: %.c
-	aarch64-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
-
-# ppc variants
-%.ppc: %.c
-	powerpc-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
-%.ppc64: %.c
-	powerpc64-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
-
-# sparc variants
-%.sparc64: %.c
-	sparc64-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
-
-# native variants
-%.native: %.c
-	gcc $(CFLAGS) -o "$@" $^
-%.native32: %.c
-	i686-linux-gnu-gcc $(CFLAGS) -o "$@" $^
-
-# install deps on ubuntu xenial
-.PHONY: install-apt
-install-apt:
-	apt-get install -y make gcc-mips64el-linux-gnuabi64 gcc-sparc64-linux-gnu gcc-powerpc64-linux-gnu gcc-powerpc-linux-gnu gcc-arm-linux-gnueabi gcc-aarch64-linux-gnu gcc-mips64-linux-gnuabi64 gcc-mipsel-linux-gnu gcc-mips64el-linux-gnuabi64 gcc-mips-linux-gnu gcc-i686-linux-gnu gcc
@@ -1,39 +0,0 @@
-#!/usr/bin/env python2
-from pwn import *
-
-@context.quiet
-def exec_fmt(payload):
-    p = context.binary.process()
-    p.sendline(payload)
-    return p.recvall()
-
-def exploit(binary):
-    context.binary = ELF(binary)
-    autofmt = FmtStr(exec_fmt)
-    offset = autofmt.offset
-    with context.binary.process() as p:
-        addr = unpack(p.recv(context.bytes))
-        payload = fmtstr_payload(offset, {addr: p32(0x1337babe)})
-        p.sendline(payload)
-        p.recvuntil("DONE")
-        print(hex(u32(p.recv(4))))
-
-binaries = [
-    "printf.mips",
-    "printf.mips64",
-    "printf.mipsel",
-    "printf.mips64el",
-    "printf.native",
-    "printf.native32",
-    "printf.ppc",
-    "printf.ppc64",
-    "printf.sparc64",
-    "printf.arm",
-    "printf.aarch64",
-]
-
-if len(sys.argv) > 1:
-    binaries = sys.argv[1:]
-
-for binary in binaries:
-    exploit(binary)
@@ -1,29 +0,0 @@
-#ifdef _FORTIFY_SOURCE
-#undef _FORTIFY_SOURCE
-#endif
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <sys/mman.h>
-#define MEMORY_ADDRESS ((void*)0x11110000)
-#define MEMORY_SIZE 1024
-#define TARGET ((int *) 0x11110100)
-int main(int argc, char const *argv[])
-{
-       char buff[1024];
-       void *ptr = NULL;
-       int *my_var = TARGET;
-       ptr = mmap(MEMORY_ADDRESS, MEMORY_SIZE, PROT_READ|PROT_WRITE, MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE, 0, 0);
-       if(ptr != MEMORY_ADDRESS)
-       {
-               perror("mmap");
-               return EXIT_FAILURE;
-       }
-       *my_var = 0x41414141;
-       write(1, &my_var, sizeof(int *));
-       scanf("%s", buff);
-       dprintf(2, buff);
-       write(1, "DONE", 4);
-       write(1, my_var, sizeof(int));
-       return 0;
-}
@@ -24,7 +24,7 @@ def append_example(_arg, top, names):
            continue
        path = os.path.join(top, name)[2:] # strip './'
        log.info('-> %s' % path)
-        data = read(path).strip().decode()
+        data = read(path).strip()
        if data[0:3] not in ('"""', "'''"):
            log.warning('  Has no docstring!')
            continue
@@ -37,7 +37,6 @@ def append_example(_arg, top, names):
        out += '* `%s`\n' % path
        out += '```%s```\n' % doc

-for path, dirs, files in os.walk('.', onerror=None):
-    append_example(dirs, path, sorted(files))
+os.path.walk('.', append_example, None)

 write('README.md', out)
@@ -5,4 +5,4 @@ Example showing `pwnlib.ui.options()`
 from pwn import *

 opts = [string.letters[x] for x in range(10)]
-print('You choose "%s"' % opts[options('Pick one:', opts)])
+print 'You choose "%s"' % opts[options('Pick one:', opts)]
@@ -1,10 +1,11 @@
 """
-A very simple port forwarder using `pwnlib.tubes.tube.connect_both()`.
+A very simple port forwarder using `pwnlib.tubes.tube.connect_both()`.  Notice
+that `<>` is just a shorthand.
 """

 from pwn import *

 while True:
-    listen(1337).wait_for_connection().connect_both(remote('google.com', 80))
+    listen(1337).wait_for_connection() <> remote('google.com', 80)

 # now point your browser (or curl(1)) to http://localhost:1337
@@ -19,13 +19,13 @@ c1 = LongestPrefixCompleter([
 c2 = PathCompleter(mask = '*.py')

 with c1:
-    print('type "exit" to exit')
+    print 'type "exit" to exit'
    while True:
        s = term.readline.readline(prompt = '> ').strip()
        if s in ('exit', 'enough!'):
            break
-        print('You wrote', s)
+        print 'You wrote', s
 with c2:
-    print('choose a file')
+    print 'choose a file'
    s = term.readline.readline(prompt = text.bold_green('$ ')).strip()
-    print('You picked', s)
+    print 'You picked', s
@@ -6,6 +6,6 @@ from pwn import *

 sock = remote('127.0.0.1', 9001)

-print(sock.recvline())
+print sock.recvline()
 sock.send('foo')
 sock.interactive()
@@ -8,10 +8,10 @@ import getpass
 from pwn import *

 s = ssh(getpass.getuser(), '127.0.0.1', port = 22, keyfile = "~/.ssh/id_rsa")
-c = gdb.ssh_gdb(s, '/bin/sh', gdbscript = '''
+c = gdb.ssh_gdb(s, '/bin/sh', execute = '''
 p/x $pc
 c''')

 c.sendline('ls -la')
 c.sendline('exit')
-print(c.recvall())
+print c.recvall()
@@ -10,7 +10,7 @@ n = 1
 h = log.waitfor('spinners running', status = str(n))

 hs = []
-print('type "q" to quit')
+print 'type "q" to quit'
 while True:
    s = raw_input('> ')
    if s == 'q':
@@ -14,7 +14,7 @@ log.info("pwd: %s" % shell.pwd())
 tube = shell.run('cat')
 tube.send("Hello, cat")
 tube.shutdown("out")
-print(tube.recvall())
+print tube.recvall()

 # Show automatic working directories
 shell.set_working_directory()
@@ -29,12 +29,12 @@ int main() {

 shell.gcc(['example.c','-o','example'])

-print(shell['./example'])
+print shell['./example']

 # Show the different styles of calling
-print(shell.echo("single string"))
-print(shell.echo(["list","of","strings"]))
-print(shell["echo single statement"])
+print shell.echo("single string")
+print shell.echo(["list","of","strings"])
+print shell["echo single statement"]

 # Show off the interactive shell
 shell.interactive()
@@ -12,8 +12,8 @@ and::
 from pwn import *

 s = 'hello from pwntools'
-print(text.black_on_green(s))
-print(text.black_on_bright_green(s))
-print(text.green_on_black(s))
-print(text.bright_green_on_black(s))
-print(text.bold_green_on_black(s))
+print text.black_on_green(s)
+print text.black_on_bright_green(s)
+print text.green_on_black(s)
+print text.bright_green_on_black(s)
+print text.bold_green_on_black(s)
@@ -5,6 +5,6 @@ Example showing `pwnlib.ui.yesno()`
 from pwn import *

 if ui.yesno('Do you like Pwntools?'):
-    print(':D')
+    print ':D'
 else:
-    print(':(')
+    print ':('
@@ -6,21 +6,21 @@
 FROM kalilinux/kali-linux-docker
 MAINTAINER Maintainer Gallopsled et al.

-RUN apt-get update \
-    && apt-get install -y \
-        build-essential \
-        git \
-        libssl-dev \
-        libffi-dev \
-        python2.7 \
-        python-pip \
-        python-dev \
-    && pip install --upgrade pip \
-    && python -m pip install --upgrade pwntools \
-    && PWNLIB_NOTERM=1 pwn update \
-    && apt-get install -y sudo \
-    && useradd -m pwntools \
-    && passwd --delete --unlock pwntools \
-    && echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
+RUN apt-get update
+RUN apt-get install -y build-essential
+RUN apt-get install -y git
+RUN apt-get install -y libssl-dev
+RUN apt-get install -y libffi-dev
+RUN apt-get install -y python2.7
+RUN apt-get install -y python-pip
+RUN apt-get install -y python-dev
+RUN pip install --upgrade pip
+RUN python -m pip install --upgrade pwntools
+RUN PWNLIB_NOTERM=1 pwn update
+
+RUN apt-get install -y sudo
+RUN useradd -m pwntools
+RUN passwd --delete --unlock pwntools
+RUN echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
 USER pwntools
 WORKDIR /home/pwntools
@@ -6,21 +6,21 @@
 FROM ubuntu:precise
 MAINTAINER Maintainer Gallopsled et al.

-RUN apt-get update \
-    && apt-get install -y \
-        build-essential \
-        git \
-        libssl-dev \
-        libffi-dev \
-        python2.7 \
-        python-pip \
-        python-dev \
-    && pip install --upgrade pip \
-    && python -m pip install --upgrade pwntools \
-    && PWNLIB_NOTERM=1 pwn update \
-    && apt-get install -y sudo \
-    && useradd -m pwntools \
-    && passwd --delete --unlock pwntools \
-    && echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
+RUN apt-get update
+RUN apt-get install -y build-essential
+RUN apt-get install -y git
+RUN apt-get install -y libssl-dev
+RUN apt-get install -y libffi-dev
+RUN apt-get install -y python2.7
+RUN apt-get install -y python-pip
+RUN apt-get install -y python-dev
+RUN pip install --upgrade pip
+RUN python -m pip install --upgrade pwntools
+RUN PWNLIB_NOTERM=1 pwn update
+
+RUN apt-get install -y sudo
+RUN useradd -m pwntools
+RUN passwd --delete --unlock pwntools
+RUN echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
 USER pwntools
 WORKDIR /home/pwntools
@@ -6,21 +6,21 @@
 FROM ubuntu:trusty
 MAINTAINER Maintainer Gallopsled et al.

-RUN apt-get update \
-    && apt-get install -y \
-        build-essential \
-        git \
-        libssl-dev \
-        libffi-dev \
-        python2.7 \
-        python-pip \
-        python-dev \
-    && pip install --upgrade pip \
-    && python -m pip install --upgrade pwntools \
-    && PWNLIB_NOTERM=1 pwn update \
-    && apt-get install -y sudo \
-    && useradd -m pwntools \
-    && passwd --delete --unlock pwntools \
-    && echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
+RUN apt-get update
+RUN apt-get install -y build-essential
+RUN apt-get install -y git
+RUN apt-get install -y libssl-dev
+RUN apt-get install -y libffi-dev
+RUN apt-get install -y python2.7
+RUN apt-get install -y python-pip
+RUN apt-get install -y python-dev
+RUN pip install --upgrade pip
+RUN python -m pip install --upgrade pwntools
+RUN PWNLIB_NOTERM=1 pwn update
+
+RUN apt-get install -y sudo
+RUN useradd -m pwntools
+RUN passwd --delete --unlock pwntools
+RUN echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
 USER pwntools
 WORKDIR /home/pwntools
@@ -6,21 +6,21 @@
 FROM ubuntu:xenial
 MAINTAINER Maintainer Gallopsled et al.

-RUN apt-get update \
-    && apt-get install -y \
-        build-essential \
-        git \
-        libssl-dev \
-        libffi-dev \
-        python2.7 \
-        python-pip \
-        python-dev \
-    && pip install --upgrade pip \
-    && python -m pip install --upgrade pwntools \
-    && PWNLIB_NOTERM=1 pwn update \
-    && apt-get install -y sudo \
-    && useradd -m pwntools \
-    && passwd --delete --unlock pwntools \
-    && echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
+RUN apt-get update
+RUN apt-get install -y build-essential
+RUN apt-get install -y git
+RUN apt-get install -y libssl-dev
+RUN apt-get install -y libffi-dev
+RUN apt-get install -y python2.7
+RUN apt-get install -y python-pip
+RUN apt-get install -y python-dev
+RUN pip install --upgrade pip
+RUN python -m pip install --upgrade pwntools
+RUN PWNLIB_NOTERM=1 pwn update
+
+RUN apt-get install -y sudo
+RUN useradd -m pwntools
+RUN passwd --delete --unlock pwntools
+RUN echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
 USER pwntools
 WORKDIR /home/pwntools
@@ -21,7 +21,7 @@ import pwnlib
 from pwnlib import *
 from pwnlib.asm import *
 from pwnlib.context import Thread
-from pwnlib.context import context, LocalContext
+from pwnlib.context import context
 from pwnlib.dynelf import DynELF
 from pwnlib.encoders import *
 from pwnlib.elf.corefile import Core, Corefile, Coredump
@@ -29,7 +29,6 @@ from pwnlib.elf.elf import ELF, load
 from pwnlib.encoders import *
 from pwnlib.exception import PwnlibException
 from pwnlib.gdb import attach, debug, debug_assembly, debug_shellcode
-from pwnlib.filepointer import *
 from pwnlib.flag import *
 from pwnlib.fmtstr import FmtStr, fmtstr_payload
 from pwnlib.log import getLogger
@@ -44,7 +43,6 @@ from pwnlib.tubes.listen import listen
 from pwnlib.tubes.process import process, PTY, PIPE, STDOUT
 from pwnlib.tubes.remote import remote, tcp, udp, connect
 from pwnlib.tubes.serialtube import serialtube
-from pwnlib.tubes.server import server
 from pwnlib.tubes.ssh import ssh
 from pwnlib.tubes.tube import tube
 from pwnlib.ui import *
@@ -68,8 +66,15 @@ from pwnlib.util.web import *

 # Promote these modules, so that "from pwn import *" will let you access them

-from six.moves import cPickle as pickle, cStringIO as StringIO
-from six import BytesIO
+try:
+    import cPickle as pickle
+except ImportError:
+    import pickle
+
+try:
+    from cStringIO import StringIO
+except ImportError:
+    from StringIO import StringIO

 error   = log.error
 warning = log.warning
@@ -77,5 +82,3 @@ warn    = log.warning
 info    = log.info
 debug   = log.debug
 success = log.success
-
-__all__ = [x for x in globals().keys() if x != '__name__']
@@ -1,6 +1,5 @@
 # -*- coding: utf-8 -*-
 from __future__ import absolute_import
-from __future__ import division

 from pwnlib.context import LocalContext
 from pwnlib.context import context
@@ -46,18 +45,10 @@ class ABI(object):
        (32, 'arm', 'linux'):   linux_arm,
        (32, 'thumb', 'linux'):   linux_arm,
        (32, 'mips', 'linux'):   linux_mips,
-        (32, 'powerpc', 'linux'): linux_ppc,
-        (64, 'powerpc', 'linux'): linux_ppc64,
-        (32, 'i386', 'freebsd'):  freebsd_i386,
-        (64, 'aarch64', 'freebsd'): freebsd_aarch64,
-        (64, 'amd64', 'freebsd'): freebsd_amd64,
-        (32, 'arm', 'freebsd'):   freebsd_arm,
-        (32, 'thumb', 'freebsd'):   freebsd_arm,
-        (32, 'mips', 'freebsd'):   freebsd_mips,
-        (32, 'powerpc', 'freebsd'): freebsd_ppc,
-        (64, 'powerpc', 'freebsd'): freebsd_ppc64,
        (32, 'i386', 'windows'):  windows_i386,
        (64, 'amd64', 'windows'): windows_amd64,
+        (32, 'powerpc', 'linux'): linux_ppc,
+        (64, 'powerpc', 'linux'): linux_ppc64,
        }[(context.bits, context.arch, context.os)]

    @staticmethod
@@ -76,15 +67,6 @@ class ABI(object):
        (64, 'aarch64', 'linux'):   linux_aarch64_syscall,
        (32, 'powerpc', 'linux'): linux_ppc_syscall,
        (64, 'powerpc', 'linux'): linux_ppc64_syscall,
-        (32, 'i386', 'freebsd'):  freebsd_i386_syscall,
-        (64, 'amd64', 'freebsd'): freebsd_amd64_syscall,
-        (64, 'aarch64', 'freebsd'): freebsd_aarch64_syscall,
-        (32, 'arm', 'freebsd'):   freebsd_arm_syscall,
-        (32, 'thumb', 'freebsd'):   freebsd_arm_syscall,
-        (32, 'mips', 'freebsd'):   freebsd_mips_syscall,
-        (64, 'aarch64', 'freebsd'):   freebsd_aarch64_syscall,
-        (32, 'powerpc', 'freebsd'): freebsd_ppc_syscall,
-        (64, 'powerpc', 'freebsd'): freebsd_ppc64_syscall,
        }[(context.bits, context.arch, context.os)]

    @staticmethod
@@ -99,11 +81,6 @@ class ABI(object):
        (32, 'arm', 'linux'):   linux_arm_sigreturn,
        (32, 'thumb', 'linux'):   linux_arm_sigreturn,
        (64, 'aarch64', 'linux'):   linux_aarch64_sigreturn,
-        (32, 'i386', 'freebsd'):  freebsd_i386_sigreturn,
-        (64, 'amd64', 'freebsd'): freebsd_amd64_sigreturn,
-        (32, 'arm', 'freebsd'):   freebsd_arm_sigreturn,
-        (32, 'thumb', 'freebsd'):   freebsd_arm_sigreturn,
-        (64, 'aarch64', 'freebsd'):   freebsd_aarch64_sigreturn,
        }[(context.bits, context.arch, context.os)]

 class SyscallABI(ABI):
@@ -124,7 +101,6 @@ class SigreturnABI(SyscallABI):
    returns = False


-# System V ABI used by many UNIXes
 linux_i386   = ABI('esp', [], 4, 0)
 linux_amd64  = ABI('rsp', ['rdi','rsi','rdx','rcx','r8','r9'], 8, 0)
 linux_arm    = ABI('sp', ['r0', 'r1', 'r2', 'r3'], 8, 0)
@@ -133,14 +109,6 @@ linux_mips  = ABI('$sp', ['$a0','$a1','$a2','$a3'], 4, 0)
 linux_ppc = ABI('sp', ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 4, 0)
 linux_ppc64 = ABI('sp', ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 8, 0)

-sysv_i386 = linux_i386
-sysv_amd64 = linux_amd64
-sysv_arm = linux_arm
-sysv_aarch64 = linux_aarch64
-sysv_mips = linux_mips
-sysv_ppc = linux_ppc
-sysv_ppc64 = linux_ppc64
-
 linux_i386_syscall = SyscallABI('esp', ['eax', 'ebx', 'ecx', 'edx', 'esi', 'edi', 'ebp'], 4, 0)
 linux_amd64_syscall = SyscallABI('rsp', ['rax', 'rdi', 'rsi', 'rdx', 'r10', 'r8', 'r9'],   8, 0)
 linux_arm_syscall   = SyscallABI('sp', ['r7', 'r0', 'r1', 'r2', 'r3', 'r4', 'r5', 'r6'], 4, 0)
@@ -154,31 +122,10 @@ linux_amd64_sigreturn = SigreturnABI('rsp', ['rax'], 4, 0)
 linux_arm_sigreturn = SigreturnABI('sp', ['r7'], 4, 0)
 linux_aarch64_sigreturn = SigreturnABI('sp', ['x8'], 16, 0)

-sysv_i386_sigreturn = linux_i386_sigreturn
-sysv_amd64_sigreturn = linux_amd64_sigreturn
-sysv_arm_sigreturn = linux_arm_sigreturn
-sysv_aarch64_sigreturn = linux_aarch64_sigreturn
-
-freebsd_i386 = sysv_i386
-freebsd_amd64 = sysv_amd64
-freebsd_arm = sysv_arm
-freebsd_aarch64 = sysv_aarch64
-freebsd_mips = sysv_mips
-freebsd_ppc = sysv_ppc
-freebsd_ppc64 = sysv_ppc64
-
-freebsd_i386_syscall   = SyscallABI('esp', ['eax'], 4, 0)
-freebsd_amd64_syscall  = SyscallABI('rsp', ['rax','rdi','rsi','rdx','rcx','r8','r9'], 8, 0)
-freebsd_arm_syscall    = SyscallABI('sp', ['r7', 'r0', 'r1', 'r2', 'r3'], 8, 0)
-freebsd_aarch64_syscall = SyscallABI('sp', ['x8', 'x0', 'x1', 'x2', 'x3'], 16, 0)
-freebsd_mips_syscall  = SyscallABI('$sp', ['$v0','$a0','$a1','$a2','$a3'], 4, 0)
-freebsd_ppc_syscall = SyscallABI('sp', ['r0', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 4, 0)
-freebsd_ppc64_syscall = SyscallABI('sp', ['r0', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 8, 0)
-
-freebsd_i386_sigreturn = sysv_i386_sigreturn
-freebsd_amd64_sigreturn = sysv_amd64_sigreturn
-freebsd_arm_sigreturn = sysv_arm_sigreturn
-freebsd_aarch64_sigreturn = sysv_aarch64_sigreturn
-
 windows_i386  = ABI('esp', [], 4, 0)
 windows_amd64 = ABI('rsp', ['rcx','rdx','r8','r9'], 32, 32)
+
+# Fake ABIs used by SROP
+linux_i386_srop = ABI('esp', ['eax'], 4, 0)
+linux_amd64_srop = ABI('rsp', ['rax'], 4, 0)
+linux_arm_srop = ABI('sp', ['r7'], 4, 0)
@@ -2,5 +2,3 @@ from __future__ import absolute_import

 from pwnlib.adb.adb import *
 from pwnlib.adb.protocol import Client
-from pwnlib.adb.bootimg import BootImage
-from pwnlib.adb.bootloader import BootloaderImage
@@ -35,26 +35,25 @@ the :mod:`pwnlib.adb` module.
 .. code-block:: python

    # Get a process listing
-    print(adb.process(['ps']).recvall())
+    print adb.process(['ps']).recvall()

    # Fetch properties
-    print(adb.properties.ro.build.fingerprint)
+    print adb.properties.ro.build.fingerprint

    # Read and write files
-    print(adb.read('/proc/version'))
+    print adb.read('/proc/version')
    adb.write('/data/local/tmp/foo', 'my data')

 """
 from __future__ import absolute_import
-from __future__ import division

 import functools
 import glob
 import logging
 import os
+import platform
 import re
 import shutil
-import six
 import stat
 import tempfile
 import time
@@ -76,9 +75,9 @@ def adb(argv, *a, **kw):
    r"""Returns the output of an ADB subcommand.

    >>> adb.adb(['get-serialno'])
-    b'emulator-5554\n'
+    'emulator-5554\n'
    """
-    if isinstance(argv, (bytes, six.text_type)):
+    if isinstance(argv, (str, unicode)):
        argv = [argv]

    log.debug("$ " + ' '.join(context.adb + argv))
@@ -115,7 +114,7 @@ def current_device(any=False):

        >>> device = adb.current_device(any=True)
        >>> device
-        AdbDevice(serial='emulator-5554', type='device', port='emulator', product='sdk_google_phone_armv7', model='sdk google phone armv7', device='generic')
+        AdbDevice(serial='emulator-5554', type='device', port='emulator', product='sdk_phone_armv7', model='sdk phone armv7', device='generic')
        >>> device.port
        'emulator'
    """
@@ -228,7 +227,7 @@ class AdbDevice(Device):
        >>> device.os
        'android'
        >>> device.product
-        'sdk_google_phone_armv7'
+        'sdk_phone_armv7'
        >>> device.serial
        'emulator-5554'
    """
@@ -277,7 +276,7 @@ class AdbDevice(Device):
            return

        with context.local(device=self.serial):
-            abi = getprop('ro.product.cpu.abi')
+            abi = str(properties.ro.product.cpu.abi)
            context.clear()
            context.arch = str(abi)
            self._arch = context.arch
@@ -356,6 +355,7 @@ class AdbDevice(Device):

            if name not in g:
                raise AttributeError('%r object has no attribute %r' % (type(self).__name__,name))
+
            value = g[name]

        if not hasattr(value, '__call__'):
@@ -415,7 +415,7 @@ def wait_for_device(kick=False):
@with_device
 def disable_verity():
    """Disables dm-verity on the device."""
-    with log.waitfor("Disabling dm-verity on %s" % context.device):
+    with log.waitfor("Disabling dm-verity on %s" % context.device) as w:
        root()

        with AdbClient() as c:
@@ -433,7 +433,7 @@ def disable_verity():
@with_device
 def remount():
    """Remounts the filesystem as writable."""
-    with log.waitfor("Remounting filesystem on %s" % context.device):
+    with log.waitfor("Remounting filesystem on %s" % context.device) as w:
        disable_verity()
        root()

@@ -486,7 +486,7 @@ def pull(remote_path, local_path=None):
    Example:

        >>> _=adb.pull('/proc/version', './proc-version')
-        >>> print(read('./proc-version').decode('utf-8')) # doctest: +ELLIPSIS
+        >>> print read('./proc-version') # doctest: +ELLIPSIS
        Linux version ...
    """
    if local_path is None:
@@ -520,7 +520,7 @@ def push(local_path, remote_path):
        >>> adb.push('./filename', '/data/local/tmp')
        '/data/local/tmp/filename'
        >>> adb.read('/data/local/tmp/filename')
-        b'contents'
+        'contents'
        >>> adb.push('./filename', '/does/not/exist')
        Traceback (most recent call last):
        ...
@@ -573,7 +573,7 @@ def read(path, target=None, callback=None):

    Examples:

-        >>> print(adb.read('/proc/version').decode('utf-8')) # doctest: +ELLIPSIS
+        >>> print adb.read('/proc/version') # doctest: +ELLIPSIS
        Linux version ...
        >>> adb.read('/does/not/exist')
        Traceback (most recent call last):
@@ -593,7 +593,7 @@ def read(path, target=None, callback=None):

@context.quietfunc
@with_device
-def write(path, data=b''):
+def write(path, data=''):
    """Create a file on the device with the provided contents.

    Arguments:
@@ -602,7 +602,7 @@ def write(path, data=b''):

    Examples:

-        >>> adb.write('/dev/null', b'data')
+        >>> adb.write('/dev/null', 'data')
        >>> adb.write('/data/local/tmp/')
    """
    with tempfile.NamedTemporaryFile() as temp:
@@ -650,7 +650,7 @@ def mkdir(path):

        # Any output at all is an error
        if result:
-            log.error(result.rstrip().decode('utf-8'))
+            log.error(result)

@context.quietfunc
@with_device
@@ -680,7 +680,7 @@ def exists(path):

        >>> adb.exists('/')
        True
-        >>> adb.exists('/etc/hosts')
+        >>> adb.exists('/init')
        True
        >>> adb.exists('/does/not/exist')
        False
@@ -746,12 +746,12 @@ def unlink(path, recursive=False):
        if isdir(path) and c.list(path) and not recursive:
            log.error("Cannot delete non-empty directory %r without recursive=True" % path)

-        flags = '-rf' if recursive else '-f'
+        flags = '-rf' if recursive else '-r'

        output = c.execute(['rm', flags, path]).recvall()

        if output:
-            log.error(output.decode('utf-8'))
+            log.error(output)

@with_device
 def process(argv, *a, **kw):
@@ -765,10 +765,10 @@ def process(argv, *a, **kw):
    Examples:

        >>> adb.root()
-        >>> print(adb.process(['cat','/proc/version']).recvall().decode('utf-8')) # doctest: +ELLIPSIS
+        >>> print adb.process(['cat','/proc/version']).recvall() # doctest: +ELLIPSIS
        Linux version ...
    """
-    if isinstance(argv, (bytes, six.text_type)):
+    if isinstance(argv, (str, unicode)):
        argv = [argv]

    message = "Starting %s process %r" % ('Android', argv[0])
@@ -820,13 +820,10 @@ echo $PATH | while read -d: directory; do
    [ -x "$directory/{name}" ] || continue;
    echo -n "$directory/{name}\\x00";
 done
-[ -x "{name}" ] && echo -n "$PWD/{name}\\x00"
 '''.format(name=name)

    which_cmd = which_cmd.strip()
    data = process(['sh','-c', which_cmd], *a, **kw).recvall()
-    if not hasattr(data, 'encode'):
-        data = data.decode('utf-8')
    result = []

    for path in data.split('\x00'):
@@ -855,7 +852,7 @@ def whoami():
 def forward(port):
    """Sets up a port to forward to the device."""
    tcp_port = 'tcp:%s' % port
-    adb(['forward', tcp_port, tcp_port])
+    start_forwarding = adb(['forward', tcp_port, tcp_port])
    atexit.register(lambda: adb(['forward', '--remove', tcp_port]))

@context.quietfunc
@@ -883,16 +880,9 @@ def logcat(stream=False):
 def pidof(name):
    """Returns a list of PIDs for the named process."""
    with context.quiet:
-        # Older devices have a broken 'pidof', apparently.
-        # Try pgrep first.
-        io = process(['pgrep', name])
-        data = io.recvall()
-
-        if 'not found' in data:
-            io = process(['pidof', name])
-            data = io.recvall()
-
-    return list(map(int, data.split()))
+        io = process(['pidof', name])
+        data = io.recvall().split()
+    return list(map(int, data))

@with_device
 def proc_exe(pid):
@@ -915,17 +905,11 @@ def getprop(name=None):
    """
    with context.quiet:
        if name:
-            result = process(['getprop', name]).recvall().strip()
-            if not hasattr(result, 'encode'):
-                result = result.decode('utf-8')
-            return result
+            return process(['getprop', name]).recvall().strip()


        result = process(['getprop']).recvall()

-    if not hasattr(result, 'encode'):
-        result = result.decode('utf-8')
-
    expr = r'\[([^\]]+)\]: \[(.*)\]'

    props = {}
@@ -975,17 +959,17 @@ def fastboot(args, *a, **kw):
@with_device
 def fingerprint():
    """Returns the device build fingerprint."""
-    return getprop('ro.build.fingerprint')
+    return str(properties.ro.build.fingerprint)

@with_device
 def product():
    """Returns the device product identifier."""
-    return getprop('ro.build.product')
+    return str(properties.ro.build.product)

@with_device
 def build():
    """Returns the Build ID of the device."""
-    return getprop('ro.build.id')
+    return str(properties.ro.build.id)

@with_device
@no_emulator
@@ -995,33 +979,9 @@ def unlock_bootloader():
    Note:
        This requires physical interaction with the device.
    """
-    w = log.waitfor("Unlocking bootloader")
-    with w:
-        if getprop('ro.oem_unlock_supported') == '0':
-            log.error("Bootloader cannot be unlocked: ro.oem_unlock_supported=0")
-
-        if getprop('ro.boot.oem_unlock_support') == '0':
-            log.error("Bootloader cannot be unlocked: ro.boot.oem_unlock_support=0")
-
-        if getprop('sys.oem_unlock_allowed') == '0':
-            log.error("Bootloader cannot be unlocked: Enable OEM Unlock in developer settings first", context.device)
-
-        AdbClient().reboot_bootloader()
-
-        # Check to see if it's unlocked before attempting unlock
-        unlocked = fastboot(['getvar', 'unlocked'])
-        if 'unlocked: yes' in unlocked:
-            w.success("Already unlocked")
-            fastboot(['continue'])
-            return
-
-        fastboot(['oem', 'unlock'])
-        unlocked = fastboot(['getvar', 'unlocked'])
-
-        fastboot(['continue'])
-
-        if 'unlocked: yes' not in unlocked:
-            log.error("Unlock failed")
+    AdbClient().reboot_bootloader()
+    fastboot(['oem', 'unlock'])
+    fastboot(['continue'])

 class Kernel(object):
    _kallsyms = None
@@ -1078,7 +1038,7 @@ class Kernel(object):

    def enable_uart(self):
        """Reboots the device with kernel logging to the UART enabled."""
-        model = getprop('ro.product.model')
+        model = str(properties.ro.product.model)

        known_commands = {
            'Nexus 4': None,
@@ -1089,7 +1049,7 @@ class Kernel(object):
            'Nexus 7': 'oem uart-on',
        }

-        with log.waitfor('Enabling kernel UART'):
+        with log.waitfor('Enabling kernel UART') as w:

            if model not in known_commands:
                log.error("Device UART is unsupported.")
@@ -1126,15 +1086,15 @@ kernel = Kernel()

 class Property(object):
    def __init__(self, name=None):
-        # Need to avoid overloaded setattr() so we go through __dict__
        self.__dict__['_name'] = name

    def __str__(self):
-        return str(getprop(self._name)).strip()
+        return getprop(self._name).strip()
+
+    def __repr__(self):
+        return repr(str(self))

    def __getattr__(self, attr):
-        if attr.startswith('_'):
-            raise AttributeError(attr)
        if self._name:
            attr = '%s.%s' % (self._name, attr)
        return Property(attr)
@@ -1147,17 +1107,6 @@ class Property(object):
            attr = '%s.%s' % (self._name, attr)
        setprop(attr, value)

-    def __eq__(self, other):
-        # Allow simple comparison, e.g.:
-        # adb.properties.ro.oem_unlock_supported == "1"
-        if isinstance(other, six.string_types):
-            return str(self) == other
-        return super(Property, self).__eq__(other)
-
-    def __hash__(self, other):
-        # Allow hash indices matching on the property
-        return hash(self._name)
-
 properties = Property()

 def _build_date():
@@ -1260,8 +1209,8 @@ def compile(source):

        # If we have an attached device, use its settings.
        if context.device:
-            abi = getprop('ro.product.cpu.abi')
-            sdk = getprop('ro.build.version.sdk')
+            abi = str(properties.ro.product.cpu.abi)
+            sdk = str(properties.ro.build.version.sdk)

        if abi is None:
            log.error("Unknown CPU ABI")
@@ -1357,10 +1306,9 @@ class Partitions(object):
        for name in listdir(self.by_name_dir):
            yield name

+    @context.quietfunc
+    @with_device
    def __getattr__(self, attr):
-        if name.startswith("_"):
-            raise AttributeError(attr)
-
        for name in self:
            if name == attr:
                break
@@ -1369,20 +1317,19 @@ class Partitions(object):

        path = os.path.join(self.by_name_dir, name)

-        with context.quiet:
-            # Find the actual path of the device
-            devpath = readlink(path)
-            devname = os.path.basename(devpath)
+        # Find the actual path of the device
+        devpath = readlink(path)
+        devname = os.path.basename(devpath)

-            # Get the size of the partition
-            for line in read('/proc/partitions').splitlines():
-                if not line.strip():
-                    continue
-                major, minor, blocks, name = line.split(None, 4)
-                if devname == name:
-                    break
-            else:
-                log.error("Could not find size of partition %r" % name)
+        # Get the size of the partition
+        for line in read('/proc/partitions').splitlines():
+            if not line.strip():
+                continue
+            major, minor, blocks, name = line.split(None, 4)
+            if devname == name:
+                break
+        else:
+            log.error("Could not find size of partition %r" % name)

        return Partition(devpath, attr, int(blocks))

@@ -1434,9 +1381,3 @@ def packages():
    """Returns a list of packages installed on the system"""
    packages = process(['pm', 'list', 'packages']).recvall()
    return [line.split('package:', 1)[-1] for line in packages.splitlines()]
-
-@context.quietfunc
-def version():
-    """Returns rthe platform version as a tuple."""
-    prop = getprop('ro.build.version.release')
-    return [int(v) for v in prop.split('.')]
@@ -1,52 +0,0 @@
-from __future__ import division
-
-import ctypes
-
-BOOT_MAGIC = b"ANDROID!"
-BOOT_MAGIC_SIZE = 8
-BOOT_NAME_SIZE = 16
-BOOT_ARGS_SIZE = 512
-BOOT_EXTRA_ARGS_SIZE = 1024
-
-
-class boot_img_hdr(ctypes.Structure):
-    _fields_ = [
-        ('magic', ctypes.c_char * BOOT_MAGIC_SIZE),
-
-        ('kernel_size', ctypes.c_uint32),
-        ('kernel_addr', ctypes.c_uint32),
-
-        ('ramdisk_size', ctypes.c_uint32),
-        ('ramdisk_addr', ctypes.c_uint32),
-
-        ('second_size', ctypes.c_uint32),
-        ('second_addr', ctypes.c_uint32),
-
-        ('tags_addr', ctypes.c_uint32),
-        ('page_size', ctypes.c_uint32),
-        ('unused', ctypes.c_uint32),
-
-        ('os_version', ctypes.c_uint32),
-
-        ('name', ctypes.c_char * BOOT_NAME_SIZE),
-        ('cmdline', ctypes.c_char * BOOT_ARGS_SIZE),
-        ('id', ctypes.c_char * 8),
-
-        ('extra_cmdline', ctypes.c_char * BOOT_EXTRA_ARGS_SIZE),
-    ]
-
-class BootImage(object):
-    def __init__(self, data):
-        self.data = data
-        self.header = boot_img_hdr.from_buffer_copy(data)
-
-        PAGE = self.page_size
-
-        # The kernel starts at the beginning of the second page.
-        self.kernel = self.data[PAGE:PAGE+self.kernel_size]
-
-    def __getattr__(self, name):
-        value = getattr(self.header, name, None)
-        if value is not None:
-            return value
-        return getattr(super(BootImage, self), name)
@@ -1,124 +0,0 @@
-from __future__ import unicode_literals
-from __future__ import division
-
-import ctypes
-import io
-import os
-import sys
-
-from pwnlib.log import getLogger
-
-log = getLogger(__name__)
-
-class img_info(ctypes.Structure):
-    _fields_ = [
-        ('name', ctypes.c_char * 64),
-        ('size', ctypes.c_uint32)
-    ]
-
-class bootloader_images_header(ctypes.Structure):
-    _fields_ = [
-        ('magic', ctypes.c_char * 8),
-        ('num_images', ctypes.c_uint32),
-        ('start_offset', ctypes.c_uint32),
-        ('bootldr_size', ctypes.c_uint32),
-    ]
-
-BOOTLDR_MAGIC = b'BOOTLDR!'
-
-class BootloaderImage(object):
-    def __init__(self, data):
-        """Android Bootloader image
-
-        Arguments:
-            data(str): Binary data from the image file.
-        """
-        self.data = data
-        self.header = bootloader_images_header.from_buffer_copy(data)
-
-        if self.magic != BOOTLDR_MAGIC:
-            log.error("Incorrect magic (%r, expected %r)" % (self.magic, BOOTLDR_MAGIC))
-
-        if(self.bootldr_size > len(data)):
-            log.warn_once("Bootloader is supposed to be %#x bytes, only have %#x",
-                          self.bootldr_size,
-                          len(data))
-
-        if(self.num_images >= 0x100):
-            old = self.num_images
-            self.num_images = 1
-            log.warn_once("Bootloader num_images (%#x) appears corrupted, truncating to 1",
-                          old)
-
-        imgarray = ctypes.ARRAY(img_info, self.num_images)
-        self.img_info = imgarray.from_buffer_copy(data, ctypes.sizeof(self.header))
-
-    def extract(self, index_or_name):
-        """extract(index_or_name) -> bytes
-
-        Extract the contents of an image.
-
-        Arguments:
-            index_or_name(str,int): Either an image index or name.
-
-        Returns:
-            Contents of the image.
-        """
-        if isinstance(index_or_name, int):
-            index = index_or_name
-        else:
-            for i in range(len(self.img_info)):
-                if self.img_info[i].name == index_or_name:
-                    index = i
-                    break
-            else:
-                raise ValueError("Invalid img name: %r" % index_or_name)
-
-        if index >= len(self.img_info):
-            raise ValueError("index out of range (%s, max %s)" % (index, len(self.img_info)))
-
-        offset = self.start_offset
-
-        for i in range(index):
-            offset += self.img_info[i].size
-
-        return self.data[offset:offset + self.img_info[index].size]
-
-    def extract_all(self, path):
-        """extract_all(path)
-
-        Extracts all images to the provided path.  The filenames are taken
-        from the image name, with '.img' appended.
-        """
-        if not os.path.isdir(path):
-            raise ValueError("%r does not exist or is not a directory" % path)
-
-        for img in self.img_info:
-            imgpath = os.path.join(path, img.name + '.img')
-            with open(imgpath, 'wb+') as f:
-                data = self.extract(img.name)
-                f.write(data)
-
-    def __str__(self):
-        rv = []
-        rv.append("Bootloader")
-        rv.append("  Magic:  %r" % self.magic)
-        rv.append("  Offset: %#x" % self.start_offset)
-        rv.append("  Size:   %#x" % self.bootldr_size)
-        rv.append("  Images: %s" % self.num_images)
-        for img in self.img_info:
-            rv.append("    Name: %s" % img.name)
-            rv.append("    Size: %#x" % img.size)
-            rv.append("    Data: %r..." % self.extract(img.name)[:32])
-        return '\n'.join(rv)
-
-    def __getattr__(self, name):
-        value = getattr(self.header, name, None)
-        if value is not None:
-            return value
-        return getattr(super(BootImage, self), name)
-
-if __name__ == '__main__':
-    # Easy sanity checking
-    b = BootloaderImage(open(sys.argv[1], 'rb').read())
-    print(b)
@@ -23,7 +23,7 @@ this way.

 .. code-block:: bash

-    $ python -c 'from pwn import *; print(args)' A=1 B=Hello HOST=1.2.3.4 DEBUG
+    $ python -c 'from pwn import *; print args' A=1 B=Hello HOST=1.2.3.4 DEBUG
    defaultdict(<type 'str'>, {'A': '1', 'HOST': '1.2.3.4', 'B': 'Hello'})

 This is very useful for conditional code, for example determining whether to
@@ -51,7 +51,6 @@ below.

 """
 from __future__ import absolute_import
-from __future__ import division

 import collections
 import logging
@@ -86,7 +85,7 @@ def isident(s):
    Helper function to check whether a string is a valid identifier,
    as passed in on the command-line.
    """
-    first = string.ascii_uppercase + '_'
+    first = string.uppercase + '_'
    body = string.digits + first
    if not s:
        return False
@@ -195,7 +194,7 @@ def initialize():
        value = 'True'

        if '=' in arg:
-            arg, value = arg.split('=', 1)
+            arg, value = arg.split('=')

        if arg in hooks:
            sys.argv.remove(orig)
@@ -16,38 +16,39 @@ Assembly
    To assemble code, simply invoke :func:`asm` on the code to assemble.

        >>> asm('mov eax, 0')
-        b'\xb8\x00\x00\x00\x00'
+        '\xb8\x00\x00\x00\x00'

    Additionally, you can use constants as defined in the :mod:`pwnlib.constants`
    module.

        >>> asm('mov eax, SYS_execve')
-        b'\xb8\x0b\x00\x00\x00'
+        '\xb8\x0b\x00\x00\x00'

    Finally, :func:`asm` is used to assemble shellcode provided by ``pwntools``
    in the :mod:`shellcraft` module.

        >>> asm(shellcraft.nop())
-        b'\x90'
+        '\x90'

 Disassembly
 ------------------------

    To disassemble code, simply invoke :func:`disasm` on the bytes to disassemble.

-    >>> disasm(b'\xb8\x0b\x00\x00\x00')
-    '   0:   b8 0b 00 00 00          mov    eax, 0xb'
+    >>> disasm('\xb8\x0b\x00\x00\x00')
+    '   0:   b8 0b 00 00 00          mov    eax,0xb'

 """
 from __future__ import absolute_import
-from __future__ import division

 import errno
 import os
 import platform
 import re
 import shutil
+import string
 import subprocess
+import sys
 import tempfile
 from collections import defaultdict
 from glob import glob
@@ -89,7 +90,7 @@ def dpkg_search_for_binutils(arch, util):

    try:
        filename = 'bin/%s*linux*-%s' % (arch, util)
-        output = subprocess.check_output(['dpkg','-S',filename], universal_newlines = True)
+        output = subprocess.check_output(['dpkg','-S',filename])
        for line in output.strip().splitlines():
            package, path = line.split(':', 1)
            packages.append(package)
@@ -159,6 +160,7 @@ def which_binutils(util):
        Exception: Could not find 'as' installed for ContextType(arch = 'msp430')
    """
    arch = context.arch
+    bits = context.bits

    # Fix up pwntools vs Debian triplet naming, and account
    # for 'thumb' being its own pwntools architecture.
@@ -242,7 +244,7 @@ def _assembler():
    if not checked_assembler_version[gas]:
        checked_assembler_version[gas] = True
        result = subprocess.check_output([gas, '--version','/dev/null'],
-                                         stderr=subprocess.STDOUT, universal_newlines=True)
+                                         stderr=subprocess.STDOUT)
        version = re.search(r' (\d\.\d+)', result).group(1)
        if version < '2.19':
            log.warn_once('Your binutils version is too old and may not work!\n'  + \
@@ -362,8 +364,7 @@ def _run(cmd, stdin = None):
            cmd,
            stdin  = subprocess.PIPE,
            stdout = subprocess.PIPE,
-            stderr = subprocess.PIPE,
-            universal_newlines = True
+            stderr = subprocess.PIPE
        )
        stdout, stderr = proc.communicate(stdin)
        exitcode = proc.wait()
@@ -408,6 +409,8 @@ def cpp(shellcode):
        >>> cpp("SYS_setresuid", os = "freebsd")
        '311\n'
    """
+    arch = context.arch
+    os   = context.os
    code = _include_header() + shellcode
    cmd  = [
        'cpp',
@@ -471,7 +474,7 @@ def make_elf_from_assembly(assembly,
        >>> sc += shellcraft.echo('Hello\n')
        >>> sc += 'mov rsp, rbp; pop rbp; ret'
        >>> solib = make_elf_from_assembly(sc, shared=1)
-        >>> subprocess.check_output(['echo', 'World'], env={'LD_PRELOAD': solib}, universal_newlines = True)
+        >>> subprocess.check_output(['echo', 'World'], env={'LD_PRELOAD': solib})
        'Hello\nWorld\n'

        The same thing can be done with :func:`.make_elf`, though the sizes
@@ -504,7 +507,7 @@ def make_elf_from_assembly(assembly,
    result = asm(assembly, vma = vma, shared = shared, extract = False, **kwargs)

    if not extract:
-        os.chmod(result, 0o755)
+        os.chmod(result, 0755)
    else:
        with open(result, 'rb') as io:
            result = io.read()
@@ -537,12 +540,12 @@ def make_elf(data,
        execve('/bin/sh',...).

        >>> context.clear(arch='i386')
-        >>> bin_sh = unhex('6a68682f2f2f73682f62696e89e331c96a0b5899cd80')
+        >>> bin_sh = '6a68682f2f2f73682f62696e89e331c96a0b5899cd80'.decode('hex')
        >>> filename = make_elf(bin_sh, extract=False)
        >>> p = process(filename)
-        >>> p.sendline(b'echo Hello; exit')
+        >>> p.sendline('echo Hello; exit')
        >>> p.recvline()
-        b'Hello\n'
+        'Hello\n'
    """
    retval = None

@@ -559,7 +562,7 @@ def make_elf(data,
    assembler = _assembler()
    linker    = _linker()
    code      = _arch_header()
-    code      += '.string "%s"' % ''.join('\\x%02x' % c for c in bytearray(data))
+    code      += '.string "%s"' % ''.join('\\x%02x' % ord(c) for c in data)
    code      += '\n'

    log.debug("Building ELF:\n" + code)
@@ -570,13 +573,13 @@ def make_elf(data,
    step3     = path.join(tmpdir, 'step3-elf')

    try:
-        with open(step1, 'w') as f:
+        with open(step1, 'wb+') as f:
            f.write(code)

        _run(assembler + ['-o', step2, step1])

        linker_options = ['-z', 'execstack']
-        if vma is not None:
+        if vma:
            linker_options += ['--section-start=.shellcode=%#x' % vma,
                               '--entry=%#x' % vma]
        elif shared:
@@ -591,11 +594,11 @@ def make_elf(data,
            _run([which_binutils('strip'), '--strip-unneeded', step3])

        if not extract:
-            os.chmod(step3, 0o755)
+            os.chmod(step3, 0755)
            retval = step3

        else:
-            with open(step3, 'rb') as f:
+            with open(step3, 'r') as f:
                retval = f.read()
    except Exception:
        log.exception("An error occurred while building an ELF:\n%s" % code)
@@ -611,7 +614,7 @@ def asm(shellcode, vma = 0, extract = True, shared = False):
    Runs :func:`cpp` over a given shellcode and then assembles it into bytes.

    To see which architectures or operating systems are supported,
-    look in :mod:`pwnlib.context`.
+    look in :mod:`pwnlib.contex`.

    Assembling shellcode requires that the GNU assembler is installed
    for the target architecture.
@@ -630,13 +633,13 @@ def asm(shellcode, vma = 0, extract = True, shared = False):
    Examples:

        >>> asm("mov eax, SYS_select", arch = 'i386', os = 'freebsd')
-        b'\xb8]\x00\x00\x00'
+        '\xb8]\x00\x00\x00'
        >>> asm("mov eax, SYS_select", arch = 'amd64', os = 'linux')
-        b'\xb8\x17\x00\x00\x00'
+        '\xb8\x17\x00\x00\x00'
        >>> asm("mov rax, SYS_select", arch = 'amd64', os = 'linux')
-        b'H\xc7\xc0\x17\x00\x00\x00'
+        'H\xc7\xc0\x17\x00\x00\x00'
        >>> asm("mov r0, #SYS_select", arch = 'arm', os = 'linux', bits=32)
-        b'R\x00\xa0\xe3'
+        'R\x00\xa0\xe3'
    """
    result = ''

@@ -684,11 +687,10 @@ def asm(shellcode, vma = 0, extract = True, shared = False):

            _run(linker + ldflags)

-        elif open(step2,'rb').read(4) == b'\x7fELF':
+        elif file(step2,'rb').read(4) == '\x7fELF':
            # Sanity check for seeing if the output has relocations
            relocs = subprocess.check_output(
-                [which_binutils('readelf'), '-r', step2],
-                universal_newlines = True
+                [which_binutils('readelf'), '-r', step2]
            ).strip()
            if extract and len(relocs.split('\n')) > 1:
                log.error('Shellcode contains relocations:\n%s' % relocs)
@@ -700,7 +702,7 @@ def asm(shellcode, vma = 0, extract = True, shared = False):

        _run(objcopy + [step3, step4])

-        with open(step4, 'rb') as fd:
+        with open(step4) as fd:
            result = fd.read()

    except Exception:
@@ -720,6 +722,9 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):
    To see which architectures are supported,
    look in :mod:`pwnlib.contex`.

+    To support all these architecture, we bundle the GNU objcopy
+    and objdump with pwntools.
+
    Arguments:
      data(str): Bytestring to disassemble.
      vma(int): Passed through to the --adjust-vma argument of objdump
@@ -731,28 +736,26 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):

    Examples:

-        >>> print(disasm(unhex('b85d000000'), arch = 'i386'))
-           0:   b8 5d 00 00 00          mov    eax, 0x5d
-        >>> print(disasm(unhex('b85d000000'), arch = 'i386', byte = 0))
-           0:   mov    eax, 0x5d
-        >>> print(disasm(unhex('b85d000000'), arch = 'i386', byte = 0, offset = 0))
-        mov    eax, 0x5d
-        >>> print(disasm(unhex('b817000000'), arch = 'amd64'))
-           0:   b8 17 00 00 00          mov    eax, 0x17
-        >>> print(disasm(unhex('48c7c017000000'), arch = 'amd64'))
-           0:   48 c7 c0 17 00 00 00    mov    rax, 0x17
-        >>> print(disasm(unhex('04001fe552009000'), arch = 'arm'))
+        >>> print disasm('b85d000000'.decode('hex'), arch = 'i386')
+           0:   b8 5d 00 00 00          mov    eax,0x5d
+        >>> print disasm('b85d000000'.decode('hex'), arch = 'i386', byte = 0)
+           0:   mov    eax,0x5d
+        >>> print disasm('b85d000000'.decode('hex'), arch = 'i386', byte = 0, offset = 0)
+        mov    eax,0x5d
+        >>> print disasm('b817000000'.decode('hex'), arch = 'amd64')
+           0:   b8 17 00 00 00          mov    eax,0x17
+        >>> print disasm('48c7c017000000'.decode('hex'), arch = 'amd64')
+           0:   48 c7 c0 17 00 00 00    mov    rax,0x17
+        >>> print disasm('04001fe552009000'.decode('hex'), arch = 'arm')
           0:   e51f0004        ldr     r0, [pc, #-4]   ; 0x4
           4:   00900052        addseq  r0, r0, r2, asr r0
-        >>> print(disasm(unhex('4ff00500'), arch = 'thumb', bits=32))
+        >>> print disasm('4ff00500'.decode('hex'), arch = 'thumb', bits=32)
           0:   f04f 0005       mov.w   r0, #5
-        >>> print(disasm(unhex('656664676665400F18A4000000000051'), byte=0, arch='amd64'))
-           0:   gs data16 fs data16 rex nop/reserved BYTE PTR gs:[eax+eax*1+0x0]
-           f:   push   rcx
    """
    result = ''

    arch   = context.arch
+    os     = context.os

    tmpdir = tempfile.mkdtemp(prefix = 'pwn-disasm-')
    step1  = path.join(tmpdir, 'step1')
@@ -769,9 +772,6 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):
        '--rename-section', '.data=.text',
    ]

-    if not byte:
-        objdump += ['--no-show-raw-insn']
-
    if arch == 'thumb':
        objcopy += ['--prefix-symbol=$t.']
    else:
@@ -779,10 +779,10 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):

    try:

-        with open(step1, 'wb') as fd:
+        with open(step1, 'w') as fd:
            fd.write(data)

-        _run(objcopy + [step1, step2])
+        res = _run(objcopy + [step1, step2])

        output0 = _run(objdump + [step2])
        output1 = output0.split('<.text>:\n')
@@ -798,22 +798,14 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):


    lines = []
-    pattern = '^( *[0-9a-f]+: *)', '((?:[0-9a-f]+ )+ *)', '(.*)'
-    if not byte:
-        pattern = pattern[::2]
-    pattern = ''.join(pattern)
+    pattern = '^( *[0-9a-f]+: *)((?:[0-9a-f]+ )+ *)(.*)'
    for line in result.splitlines():
-        match = re.search(pattern, line)
-        if not match:
+        try:
+            o, b, i = re.search(pattern, line).groups()
+        except:
            lines.append(line)
            continue

-        groups = match.groups()
-        if byte:
-            o, b, i = groups
-        else:
-            o, i = groups
-
        line = ''

        if offset:
@@ -824,4 +816,4 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):
            line += i
        lines.append(line)

-    return re.sub(',([^ ])', r', \1', '\n'.join(lines))
+    return '\n'.join(lines)
@@ -3,7 +3,6 @@ Analogous to atexit, this module allows the programmer to register functions to
 be run if an unhandled exception occurs.
 """
 from __future__ import absolute_import
-from __future__ import division

 import sys
 import threading
@@ -8,7 +8,6 @@ This module also fixes a the issue that exceptions raised by an exit handler is
 printed twice when the standard :mod:`atexit` is used.
 """
 from __future__ import absolute_import
-from __future__ import division

 import sys
 import threading
@@ -1,6 +1,5 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
-from __future__ import division

 import argparse
 import sys
@@ -30,8 +29,8 @@ parser.add_argument(
    "-o","--output",
    metavar='file',
    help="Output file (defaults to stdout)",
-    type=argparse.FileType('wb'),
-    default=getattr(sys.stdout, 'buffer', sys.stdout)
+    type=argparse.FileType('w'),
+    default=sys.stdout
 )

 parser.add_argument(
@@ -46,14 +45,14 @@ parser.add_argument(
 parser.add_argument(
    '-v', '--avoid',
    action='append',
-    help = 'Encode the shellcode to avoid the listed bytes (provided as hex)'
+    help = 'Encode the shellcode to avoid the listed bytes (provided as hex; default: 000a)'
 )

 parser.add_argument(
    '-n', '--newline',
    dest='avoid',
    action='append_const',
-    const='0a',
+    const='\n',
    help = 'Encode the shellcode to avoid newlines'
 )

@@ -61,7 +60,7 @@ parser.add_argument(
    '-z', '--zero',
    dest='avoid',
    action='append_const',
-    const='00',
+    const='\x00',
    help = 'Encode the shellcode to avoid NULL bytes'
 )

@@ -84,7 +83,7 @@ parser.add_argument(
    '--infile',
    help="Specify input file",
    default=sys.stdin,
-    type=argparse.FileType('r')
+    type=file
 )

 parser.add_argument(
@@ -104,11 +103,10 @@ def main(args):
    data   = '\n'.join(args.lines) or args.infile.read()
    output = asm(data.replace(';', '\n'))
    fmt    = args.format or ('hex' if tty else 'raw')
-    formatters = {'r':bytes, 'h':enhex, 's':repr}
+    formatters = {'r':str, 'h':enhex, 's':repr}

    if args.avoid:
-        avoid = unhex(''.join(args.avoid))
-        output = encode(output, avoid)
+        output = encode(output, args.avoid)

    if args.debug:
        proc = gdb.debug_shellcode(output, arch=context.arch)
@@ -122,16 +120,13 @@ def main(args):

    if fmt[0] == 'e':
        args.output.write(make_elf(output))
-        try: os.fchmod(args.output.fileno(), 0o700)
+        try: os.fchmod(args.output.fileno(), 0700)
        except OSError: pass
    else:
-        output = formatters[fmt[0]](output)
-        if not hasattr(output, 'decode'):
-            output = output.encode('ascii')
-        args.output.write(output)
+        args.output.write(formatters[fmt[0]](output))

-    if tty and fmt != 'raw':
-        args.output.write(b'\n')
+    if tty and fmt is not 'raw':
+        args.output.write('\n')

 if __name__ == '__main__':
    pwnlib.commandline.common.main(__file__)
@@ -1,6 +1,5 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
-from __future__ import division

 import argparse
 import sys
@@ -15,7 +14,7 @@ parser = common.parser_commands.add_parser(
 parser.add_argument(
    'elf',
    nargs='*',
-    type=argparse.FileType('rb'),
+    type=file,
    help='Files to check'
 )
 parser.add_argument(
@@ -23,7 +22,7 @@ parser.add_argument(
    nargs='*',
    dest='elf2',
    metavar='elf',
-    type=argparse.FileType('rb'),
+    type=file,
    help='File to check (for compatibility with checksec.sh)'
 )

@@ -5,7 +5,7 @@ import sys
 import pwnlib
 from pwnlib.context import context

-choices = list(map(str, [16,32,64]))
+choices = map(str, [16,32,64])
 choices += list(context.oses)
 choices += list(context.architectures)
 choices += list(context.endiannesses)
@@ -1,9 +1,7 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
-from __future__ import division

 import argparse
-import functools
 import os
 import re

@@ -65,7 +63,7 @@ p.add_argument(
 def main(args):
    if args.exact:
        # This is the simple case
-        print(cpp(args.exact).strip())
+        print cpp(args.exact).strip()
    else:
        # New we search in the right module.
        # But first: We find the right module
@@ -119,7 +117,7 @@ def main(args):

        # Output all matching constants
        for _, k in sorted(out):
-            print('#define %s %s' % (k.ljust(maxlen), cpp(k).strip()))
+            print '#define %s %s' % (k.ljust(maxlen), cpp(k).strip())

        # If we are in match_mode, then try to find a combination of
        # constants that yield the exact given value
@@ -136,9 +134,9 @@ def main(args):

                out = [(v, k) for v, k in out if mask & v == v]

-            if functools.reduce(lambda x, cur: x | cur[0], good, 0) == constant:
-                print('')
-                print('(%s) == %s' % (' | '.join(k for v, k in good), args.constant))
+            if reduce(lambda x, cur: x | cur[0], good, 0) == constant:
+                print
+                print '(%s) == %s' % (' | '.join(k for v, k in good), args.constant)

 if __name__ == '__main__':
    pwnlib.commandline.common.main(__file__)
@@ -1,9 +1,7 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
-from __future__ import division

 import argparse
-import six
 import string
 import sys

@@ -21,8 +19,7 @@ parser = common.parser_commands.add_parser(
 parser.add_argument(
    '-a', '--alphabet',
    metavar = 'alphabet',
-    default = string.ascii_lowercase.encode(),
-    type = six.ensure_binary,
+    default = string.ascii_lowercase,
    help = 'The alphabet to use in the cyclic pattern (defaults to all lower case letters)',
 )

@@ -66,10 +63,9 @@ def main(args):
        pat = args.lookup

        try:
-            pat = int(pat, 0)
+            pat = packing.pack(int(pat, 0), subsize*8)
        except ValueError:
            pass
-        pat = flat(pat)

        if len(pat) != subsize:
            log.critical('Subpattern must be %d bytes' % subsize)
@@ -85,7 +81,7 @@ def main(args):
            log.critical('Given pattern does not exist in cyclic pattern')
            sys.exit(1)
        else:
-            print(offset)
+            print offset
    else:
        want   = args.count
        result = cyclic(want, alphabet, subsize)
@@ -93,11 +89,10 @@ def main(args):
        if got < want:
            log.failure("Alphabet too small (max length = %i)" % got)

-        out = getattr(sys.stdout, 'buffer', sys.stdout)
-        out.write(result)
+        sys.stdout.write(result)

-        if out.isatty():
-            out.write(b'\n')
+        if sys.stdout.isatty():
+            sys.stdout.write('\n')

 if __name__ == '__main__':
    pwnlib.commandline.common.main(__file__)
@@ -1,6 +1,5 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
-from __future__ import division

 import argparse
 import sys
@@ -14,7 +13,7 @@ parser = common.parser_commands.add_parser(
 )
 parser.add_argument(
    '-x', metavar='GDBSCRIPT',
-    type=argparse.FileType('r'),
+    type=file,
    help='Execute GDB commands from this file.'
 )
 parser.add_argument(
@@ -31,25 +30,13 @@ parser.add_argument(
    help = 'The os/architecture/endianness/bits the shellcode will run in (default: linux/i386), choose from: %s' % common.choices,
 )
 parser.add_argument(
-    '--exec',
-
-    # NOTE: Type cannot be "file" because we may be referring to a remote
-    #       file, or a file on an Android device.
-    type=str,
-
-    dest='executable',
+    '--exec', type=file, dest='executable',
    help='File to debug'
 )
 parser.add_argument(
    '--process', metavar='PROCESS_NAME',
    help='Name of the process to attach to (e.g. "bash")'
 )
-parser.add_argument(
-    '--sysroot', metavar='SYSROOT',
-    type=str,
-    default='',
-    help="GDB sysroot path"
-)

 def main(args):
    gdbscript = ''
@@ -60,46 +47,23 @@ def main(args):
        context.device = adb.wait_for_device()

    if args.executable:
-        if os.path.exists(args.executable):
-            context.binary = ELF(args.executable)
-            target = context.binary.path
-
-        # This path does nothing, but avoids the "print_usage()"
-        # path below.
-        elif context.os == 'android':
-            target = args.executable
+        context.binary = ELF(args.executable.name)
+        target = context.binary.path
    elif args.pid:
        target = int(args.pid)
    elif args.process:
        if context.os == 'android':
-            target = adb.pidof(args.process)
+            target = adb.pidof(process)
        else:
-            target = pidof(args.process)
-
-        # pidof() returns a list
-        if not target:
-            log.error("Could not find a PID for %r", args.process)
-
-        target = target[0]
-
-        # pidof will sometimes return all PIDs, including init
-        if target == 1:
-            log.error("Got PID 1 from pidof.  Check the process name, or use --pid 1 to debug init")
+            target = pidof(process)
    else:
        parser.print_usage()
        return 1

    if args.pid or args.process:
-        pid = gdb.attach(target, gdbscript=gdbscript, sysroot=args.sysroot)
-
-        # Since we spawned the gdbserver process, and process registers an
-        # atexit handler to close itself, gdbserver will be terminated when
-        # we exit.  This will manifest as a "remote connected ended" or
-        # similar error message.  Hold it open for the user.
-        log.info("GDB connection forwarding will terminate when you press enter")
-        pause()
+        gdb.attach(target, gdbscript=gdbscript)
    else:
-        gdb.debug(target, gdbscript=gdbscript, sysroot=args.sysroot).interactive()
+        gdb.debug(target, gdbscript=gdbscript).interactive()

 if __name__ == '__main__':
    pwnlib.commandline.common.main(__file__)
@@ -1,8 +1,6 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
-from __future__ import division

-import argparse
 from pwn import *
 from pwnlib.commandline import common

@@ -13,7 +11,7 @@ parser = common.parser_commands.add_parser(
 parser.add_argument(
    'elf',
    nargs='+',
-    type=argparse.FileType('rb'),
+    type=file,
    help='Files to check'
 )

@@ -1,7 +1,5 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
-from __future__ import division
-from __future__ import print_function

 import argparse
 import string
@@ -22,7 +20,7 @@ parser.add_argument(
    'hex',
    metavar = 'hex',
    nargs = '*',
-    help = 'Hex-string to disassemble. If none are supplied, then it uses stdin in non-hex mode.'
+    help = 'Hex-string to disasemble. If none are supplied, then it uses stdin in non-hex mode.'
 )

 parser.add_argument(
@@ -61,14 +59,14 @@ parser.add_argument(

 def main(args):
    if len(args.hex) > 0:
-        dat = ''.join(args.hex).encode('utf-8', 'surrogateescape')
-        dat = dat.translate(None, string.whitespace.encode('ascii'))
-        if not set(string.hexdigits.encode('ascii')) >= set(dat):
-            print("This is not a hex string")
+        dat = ''.join(args.hex)
+        dat = dat.translate(None, string.whitespace)
+        if not set(string.hexdigits) >= set(dat):
+            print "This is not a hex string"
            exit(-1)
-        dat = unhex(dat)
+        dat = dat.decode('hex')
    else:
-        dat = getattr(sys.stdin, 'buffer', sys.stdin).read()
+        dat = sys.stdin.read()


    if args.color:
@@ -81,16 +79,17 @@ def main(args):
        instrs  = disasm(dat, vma=safeeval.const(args.address), byte=False, offset=False)
        # instrs  = highlight(instrs, PwntoolsLexer(), TerminalFormatter())

-        for o,b,i in zip(*map(str.splitlines, (offsets, bytes, instrs))):
+        split = lambda x: x.splitlines()
+        for o,b,i in zip(*list(map(split, (offsets, bytes, instrs)))):
            b = b.replace('00', text.red('00'))
            b = b.replace('0a', text.red('0a'))
            i = highlight(i.strip(), PwntoolsLexer(), TerminalFormatter()).strip()
            i = i.replace(',',', ')

-            print(o,b,i)
+            print o,b,i
        return

-    print(disasm(dat, vma=safeeval.const(args.address)))
+    print disasm(dat, vma=safeeval.const(args.address))

 if __name__ == '__main__':
    pwnlib.commandline.common.main(__file__)
@@ -1,6 +1,5 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
-from __future__ import division

 import shutil
 from argparse import ArgumentParser
@@ -23,7 +22,7 @@ def dump(objdump, path):
    return n.name

 def diff(a,b):
-    try: return check_output(['diff',a,b], universal_newlines=True)
+    try: return check_output(['diff',a,b])
    except CalledProcessError as e:
        return e.output

@@ -56,7 +55,7 @@ def main(a):
    shutil.copy(y.path, name)
    y = dump(objdump, name)

-    print(diff(x, y))
+    print diff(x, y)

 if __name__ == '__main__':
    pwnlib.commandline.common.main(__file__)
@@ -1,7 +1,7 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
-from __future__ import division

+import argparse
 import sys

 import pwnlib
@@ -15,6 +15,7 @@ p = common.parser_commands.add_parser(
    help = 'Patch an ELF file'
 )

+p = argparse.ArgumentParser()
 p.add_argument('elf',help="File to patch")
 p.add_argument('offset',help="Offset to patch in virtual address (hex encoded)")
 p.add_argument('bytes',help='Bytes to patch (hex encoded)')
@@ -31,7 +32,7 @@ def main(a):
        elf    = ELF(a.elf)

    elf.write(offset, bytes)
-    getattr(sys.stdout, 'buffer', sys.stdout).write(elf.get_data())
+    sys.stdout.write(elf.get_data())

 if __name__ == '__main__':
    pwnlib.commandline.common.main(__file__)
@@ -1,8 +1,7 @@
-from __future__ import absolute_import, print_function
+from __future__ import absolute_import

 import argparse
 import os
-import errno

 from pwnlib.commandline import common

@@ -25,24 +24,24 @@ def main(args):
    if 0x100000000 - value < 0x200:
      value = 0x100000000 - value

-    if value not in errno.errorcode:
-      print("No errno for %s" % value)
+    if value not in os.errno.errorcode:
+      print "No errno for %s" % value
      return

-    name = errno.errorcode[value]
+    name = os.errno.errorcode[value]

  except ValueError:
    name = args.error.upper()

-    if not hasattr(errno, name):
-      print("No errno for %s" % name)
+    if not hasattr(os.errno, name):
+      print "No errno for %s" % name
      return

-    value = getattr(errno, name)
+    value = getattr(os.errno, name)


-  print('#define', name, value)
-  print(os.strerror(value))
+  print '#define', name, value
+  print os.strerror(value)

 if __name__ == '__main__':
    pwnlib.commandline.common.main(__file__)
@@ -1,12 +1,10 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
-from __future__ import division

 import argparse
 import sys

 from pwnlib.commandline import common
-from pwnlib.util.fiddling import enhex

 parser = common.parser_commands.add_parser(
    'hex',
@@ -18,12 +16,9 @@ parser.add_argument('data', nargs='*',

 def main(args):
    if not args.data:
-        print(enhex(getattr(sys.stdin, 'buffer', sys.stdin).read()))
+        print sys.stdin.read().encode('hex')
    else:
-        data = ' '.join(args.data)
-        if not hasattr(data, 'decode'):
-            data = data.encode('utf-8', 'surrogateescape')
-        print(enhex(data))
+        print ' '.join(args.data).encode('hex')

 if __name__ == '__main__':
    pwnlib.commandline.common.main(__file__)
@@ -46,9 +46,6 @@ commands = {
 }

 def main():
-    if len(sys.argv) < 2:
-        parser.print_usage()
-        sys.exit()
    args = parser.parse_args()
    with context.local(log_console = sys.stderr):
        commands[args.command](args)
@@ -1,11 +1,9 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
-from __future__ import division

 import argparse
 import os
 import sys
-import io

 import pwnlib
 pwnlib.args.free_form = False
@@ -23,8 +21,8 @@ parser.add_argument(
    metavar='file',
    nargs='?',
    help='File to hexdump.  Reads from stdin if missing.',
-    type=argparse.FileType('rb'),
-    default=getattr(sys.stdin, 'buffer', sys.stdin)
+    type=argparse.FileType('r'),
+    default=sys.stdin
 )

 parser.add_argument(
@@ -90,9 +88,6 @@ def main(args):
        else:
            infile.seek(skip, os.SEEK_CUR)

-    if count:
-        infile = io.BytesIO(infile.read(count))
-
    hl = []
    if args.highlight:
        for hs in args.highlight:
@@ -101,7 +96,7 @@ def main(args):

    try:
        for line in hexdump_iter(infile, width, highlight = hl, begin = offset + skip):
-            print(line)
+            print line
    except (KeyboardInterrupt, IOError):
        pass

@@ -1,5 +1,4 @@
 from __future__ import absolute_import
-from __future__ import division

 import argparse

@@ -17,8 +16,8 @@ p = common.parser_commands.add_parser(
 g = p.add_argument_group("actions")
 g.add_argument('-b', '--build-id', help="Strip build ID", action='store_true')
 g.add_argument('-p', '--patch', metavar='FUNCTION', help="Patch function", action='append')
-p.add_argument('-o', '--output', type=argparse.FileType('wb'), default=getattr(sys.stdout, 'buffer', sys.stdout))
-p.add_argument('file', type=argparse.FileType('rb'))
+p.add_argument('-o', '--output', type=file, default=sys.stdout)
+p.add_argument('file', type=file)

 def main(args):
    if not (args.patch or args.build_id):
@@ -33,7 +32,7 @@ def main(args):
        for offset in pwnlib.libcdb.get_build_id_offsets():
            data = elf.read(elf.address + offset + 0xC, 4)
            if data == 'GNU\x00':
-                elf.write(elf.address + offset + 0x10, os.urandom(20))
+                elf.write(elf.address + offset + 0x10, read('/dev/urandom', 20))

    for function in args.patch:
        if function not in elf.symbols:
@@ -47,7 +46,7 @@ def main(args):
    result = elf.data

    if args.output.isatty():
-        result = enhex(result).encode('ascii')
+        result = enhex(result)

    args.output.write(result)

@@ -1,5 +1,4 @@
 from __future__ import absolute_import
-from __future__ import division

 import argparse
 import sys
@@ -25,8 +24,8 @@ parser.add_argument(
    "-o","--output",
    metavar='file',
    help="Output file (defaults to stdout)",
-    type=argparse.FileType('wb'),
-    default=getattr(sys.stdout, 'buffer', sys.stdout)
+    type=argparse.FileType('w'),
+    default=sys.stdout
 )

 parser.add_argument(
@@ -83,7 +82,7 @@ def main(args):
    data   = sys.stdin.read()
    output = data
    fmt    = args.format or ('hex' if tty else 'raw')
-    formatters = {'r':bytes, 'h':enhex, 's':repr}
+    formatters = {'r':str, 'h':enhex, 's':repr}

    if args.alphanumeric:
        output = alphanumeric(output)
@@ -99,13 +98,10 @@ def main(args):
    if fmt[0] == 'e':
        sys.stdout.write(make_elf(output))
    else:
-        output = formatters[fmt[0]](output)
-        if not hasattr(output, 'decode'):
-            output = output.encode('ascii')
-        args.output.write(output)
+        args.output.write(formatters[fmt[0]](output))

-    if tty and fmt != 'raw':
-        args.output.write(b'\n')
+    if tty and fmt is not 'raw':
+        args.output.write('\n')


 if __name__ == '__main__':
@@ -1,10 +1,8 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
-from __future__ import division

 import argparse
 import os
-import six
 import sys
 import types

@@ -23,8 +21,8 @@ from pwnlib.commandline import common

 def _string(s):
    out = []
-    for co in bytearray(s):
-        c = chr(co)
+    for c in s:
+        co = ord(c)
        if co >= 0x20 and co <= 0x7e and c not in '/$\'"`':
            out.append(c)
        else:
@@ -47,8 +45,8 @@ p.add_argument(
 p.add_argument(
    '-o', '--out',
    metavar = 'file',
-    type = argparse.FileType('wb'),
-    default = getattr(sys.stdout, 'buffer', sys.stdout),
+    type = argparse.FileType('w'),
+    default = sys.stdout,
    help = 'Output file (default: stdout)',
 )

@@ -166,12 +164,6 @@ p.add_argument(
    help='List available shellcodes, optionally provide a filter'
 )

-p.add_argument(
-    '-s', '--shared',
-    action='store_true',
-    help='Generated ELF is a shared library'
-)
-
 def get_template(name):
    func = shellcraft
    for attr in name.split('.'):
@@ -191,7 +183,7 @@ def main(args):
        elif not args.syscalls:
            templates = filter(is_not_a_syscall_template, templates)

-        print('\n'.join(templates))
+        print '\n'.join(templates)
        exit()

    if not args.shellcode:
@@ -246,11 +238,11 @@ def main(args):
            if not in_doctest:
                doc.append(line)
            i += 1
-        print('\n'.join(doc).rstrip())
+        print '\n'.join(doc).rstrip()
        exit()

-    defargs = len(six.get_function_defaults(func) or ())
-    reqargs = six.get_function_code(func).co_argcount - defargs
+    defargs = len(func.func_defaults or ())
+    reqargs = func.func_code.co_argcount - defargs
    if len(args.args) < reqargs:
        if defargs > 0:
            log.critical('%s takes at least %d arguments' % (args.shellcode, reqargs))
@@ -267,7 +259,7 @@ def main(args):
            pass

    # And he strikes again!
-    list(map(common.context_arg, args.shellcode.split('.')))
+    map(common.context_arg, args.shellcode.split('.'))
    code = func(*args.args)


@@ -285,10 +277,10 @@ def main(args):

            code = highlight(code, PwntoolsLexer(), TerminalFormatter())

-        print(code)
+        print code
        exit()
    if args.format == 'p':
-        print(cpp(code))
+        print cpp(code)
        exit()

    assembly = code
@@ -299,16 +291,16 @@ def main(args):

    if args.format in ['e','elf']:
        args.format = 'default'
-        try: os.fchmod(args.out.fileno(), 0o700)
+        try: os.fchmod(args.out.fileno(), 0700)
        except OSError: pass


        if not args.avoid:
-            code = read(make_elf_from_assembly(assembly, vma=vma, shared=args.shared))
+            code = read(make_elf_from_assembly(assembly, vma=vma))
        else:
            code = asm(assembly)
            code = encode(code, args.avoid)
-            code = make_elf(code, vma=vma, shared=args.shared)
+            code = make_elf(code, vma=vma)
            # code = read(make_elf(encode(asm(code), args.avoid)))
    else:
        code = encode(asm(assembly), args.avoid)
@@ -343,12 +335,10 @@ def main(args):
    elif args.format in ['i', 'hexii']:
        code = hexii(code) + '\n'
    elif args.format in ['d', 'escaped']:
-        code = ''.join('\\x%02x' % c for c in bytearray(code)) + '\n'
+        code = ''.join('\\x%02x' % ord(c) for c in code) + '\n'
    if not sys.stdin.isatty():
-        args.out.write(getattr(sys.stdin, 'buffer', sys.stdin).read())
+        args.out.write(sys.stdin.read())

-    if not hasattr(code, 'decode'):
-        code = code.encode()
    args.out.write(code)

 if __name__ == '__main__':
@@ -1,6 +1,5 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
-from __future__ import division

 import re

@@ -20,7 +19,6 @@ parser.add_argument('--port', help='Remote port / SSH port', type=int)
 parser.add_argument('--user', help='SSH Username')
 parser.add_argument('--pass', help='SSH Password', dest='password')
 parser.add_argument('--path', help='Remote path of file on SSH server')
-parser.add_argument('--quiet', help='Less verbose template comments', action='store_true')

 def main(args):
    cache = None
@@ -51,16 +49,15 @@ def main(args):
                             args.port,
                             args.user,
                             args.password,
-                             args.path,
-                             args.quiet)
+                             args.path)

    # Fix Mako formatting bs
    output = re.sub('\n\n\n', '\n\n', output)

-    print(output)
+    print output

    if not sys.stdout.isatty():
-        try: os.fchmod(sys.stdout.fileno(), 0o700)
+        try: os.fchmod(sys.stdout.fileno(), 0700)
        except OSError: pass

 if __name__ == '__main__':
@@ -1,13 +1,11 @@
 #!/usr/bin/env python2
 from __future__ import absolute_import
-from __future__ import division

 import argparse
 import sys
 from string import whitespace

 from pwnlib.commandline import common
-from pwnlib.util.fiddling import unhex

 parser = common.parser_commands.add_parser(
    'unhex',
@@ -20,13 +18,12 @@ parser.add_argument('hex', nargs='*',

 def main(args):
    try:
-        o = getattr(sys.stdout, 'buffer', sys.stdout)
        if not args.hex:
-            s = getattr(sys.stdin, 'buffer', sys.stdin).read().translate(None, whitespace.encode('ascii'))
-            o.write(unhex(s))
+            s = sys.stdin.read().translate(None, whitespace)
+            sys.stdout.write(s.decode('hex'))
        else:
-            o.write(unhex(''.join(args.hex)))
-    except TypeError as e:
+            sys.stdout.write(''.join(args.hex).decode('hex'))
+    except TypeError, e:
        sys.stderr.write(str(e) + '\n')

 if __name__ == '__main__':
@@ -1,6 +1,5 @@
-#!/usr/bin/env python
+#!/usr/bin/env python2
 from __future__ import absolute_import
-from __future__ import division

 import subprocess

@@ -25,7 +24,7 @@ p.add_argument('--pre', action='store_true', help='''

 def main(a):
    result = pwnlib.update.perform_check(prerelease=a.pre)
-    if result and a.install:
+    if a.install:
        subprocess.check_call(result, shell=False)

 if __name__ == '__main__':
@@ -28,9 +28,8 @@ supported by ``pwnlib.util.safeeval.expr``.
    terminal=['x-terminal-emulator', '-e']
 """
 from __future__ import absolute_import
-from __future__ import division

-from six.moves import configparser
+import ConfigParser
 import os

 registered_configs = {}
@@ -50,7 +49,7 @@ def initialize():
    from pwnlib.log import getLogger
    log = getLogger(__name__)

-    c = configparser.ConfigParser()
+    c = ConfigParser.ConfigParser()
    c.read(['/etc/pwn.conf', os.path.expanduser('~/.pwn.conf')])

    for section in c.sections():