Release 4.2.2

Only require changelog if major changes present
Fix udp socket server AttributeError (#1706 )
2026-11-07 17:14:22 -10:00 · 2020-10-20 15:21:59 +02:00 · 2020-10-20 14:57:36 +02:00 · 2020-10-20 14:29:54 +02:00 · 2020-10-20 12:17:58 +02:00 · 2020-10-17 16:10:22 +02:00
15 changed files with 124 additions and 40 deletions
@@ -17,4 +17,13 @@ jobs:

    - name: Check changelog for updates
      run: |
-        git log --stat ${GITHUB_BASE}..HEAD | grep CHANGELOG.md
+        if git log --stat ${GITHUB_BASE}..HEAD | grep CHANGELOG.md; then
+           echo 'Changelog updated :D'
+        else
+           if git log --stat ${GITHUB_BASE}..HEAD | grep '++\|--'; then
+              echo 'Major changes detected, changelog required!'
+              false
+           else
+              echo 'Minor changes detected, no changelog required!'
+           fi
+        fi
@@ -2,7 +2,7 @@ name: Continuous Integration
 on: [push, pull_request]

 jobs:
-  build:
+  test:
    strategy:
      matrix:
        python-version: [2.7, 3.8]
@@ -186,7 +186,7 @@ jobs:
  staging-merge:
    runs-on: ubuntu-latest
    if: github.repository_owner == 'Gallopsled' && github.event_name == 'push' && startsWith(github.event.ref, 'refs/heads/') && endsWith(github.event.ref, '-staging')
-    needs: build
+    needs: test
    steps:
    - uses: actions/checkout@v2
      with:
@@ -203,7 +203,7 @@ jobs:
  pypi:
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags')
-    needs: build
+    needs: test
    steps:
    - name: Download artifacts
      uses: actions/download-artifact@v2
@@ -2,7 +2,7 @@ name: Lint
 on: [push, pull_request]

 jobs:
-  build:
+  lint:
    strategy:
      matrix:
        python-version: [3.8]
@@ -0,0 +1,28 @@
+name: Check for merge markers
+on: [pull_request]
+env:
+  GITHUB_BASE: origin/${{ github.event.pull_request.base.ref }}
+
+jobs:
+  mergecheck:
+    strategy:
+      matrix:
+        os: [ubuntu-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 5
+    steps:
+    - uses: actions/checkout@v2
+      with:
+        fetch-depth: 0
+
+    - name: Check for merge conflict markers commited
+      run: |
+        if git show ${GITHUB_BASE}..HEAD | grep -EB15 --color=always '^\+\+(>>>>>|=====|<<<<<)'; then
+            echo 'WARNING: Merge marker commits found in history.'
+            if git diff ${GITHUB_BASE}..HEAD | grep -EB15 --color=always '^\+(>>>>>|=====|<<<<<)'; then
+                echo 'ERROR: Merge markers still present! Do something!'
+                exit 1
+            fi
+        else
+            echo 'Congrats! All the merges you did were clean or resolved correctly :)'
+        fi
@@ -9,9 +9,15 @@ The table below shows which release corresponds to each branch, and what date th

 | Version          | Branch   | Release Date           |
 | ---------------- | -------- | ---------------------- |
-| [4.3.0](#430)    | `dev`    | Jun 30, 2020 (planned)
-| [4.2.0](#420)    | `beta`   | Jun 5, 2020 (planned)
-| [4.1.1](#411)    | `stable` | Jun 3, 2020
+| [4.4.0](#440)    | `dev`    | Sep 1, 2020 (planned)
+| [4.3.0](#430)    | `beta`   | Aug 1, 2020 (planned)
+| [4.2.0](#420)    | `stable` | Jul 3, 2020 (planned)
+| [4.1.7](#417)    |          | Jun 30, 2020
+| [4.1.5](#415)    |          | Jun 27, 2020
+| [4.1.4](#414)    |          | Jun 26, 2020
+| [4.1.3](#413)    |          | Jun 23, 2020
+| [4.1.2](#412)    |          | Jun 5, 2020
+| [4.1.1](#411)    |          | Jun 3, 2020
 | [4.1.0](#410)    |          | May 8, 2020
 | [4.0.1](#401)    |          | Jan 22, 2020
 | [4.0.0](#400)    |          | Jan 09, 2020
@@ -49,13 +55,44 @@ The table below shows which release corresponds to each branch, and what date th
 | [3.0.0](#300)    |          | Aug 20, 2016
 | [2.2.0](#220)    |          | Jan 5, 2015

-## 4.3.0 (`dev`)
+## 4.4.0 (`dev`)

-To be released on Jun 30, 2020.
+- [#1616][1616] Fix `cyclic` cli for 64 bit integers

-## 4.2.0 (`beta`)
+[1616]: https://github.com/Gallopsled/pwntools/pull/1616

-To be released on Jun 5, 2020.
+## 4.3.0 (`beta`)
+
+- [#1576][1576] Add `executable=` argument to `ELF.search`
+- [#1584][1584] Add `jmp_esp`/`jmp_rsp` attribute to `ROP`
+- [#1592][1592] Fix over-verbose logging of process() environment
+- [#1593][1593] Colorize output of `pwn template`
+- [#1601][1601] Add `pwn version` command line tool
+- [#1605][1605] Add to `fiddling.hexdump` a way to suppress the total at the end
+- [#1613][1613] Permit `--password` for `pwn template`
+- [#1564][1564] Fix `asm()` and `disasm()` for PowerPC64, MIPS64, Sparc64
+- [#1621][1621] Permit negative values in flat() and fit()
+
+[1576]: https://github.com/Gallopsled/pwntools/pull/1576
+[1584]: https://github.com/Gallopsled/pwntools/pull/1584
+[1592]: https://github.com/Gallopsled/pwntools/pull/1592
+[1593]: https://github.com/Gallopsled/pwntools/pull/1593
+[1601]: https://github.com/Gallopsled/pwntools/pull/1601
+[1605]: https://github.com/Gallopsled/pwntools/pull/1605
+[1613]: https://github.com/Gallopsled/pwntools/pull/1613
+[1564]: https://github.com/Gallopsled/pwntools/pull/1564
+[1621]: https://github.com/Gallopsled/pwntools/pull/1621
+
+## 4.2.1 (`stable`)
+
+- [#1625][1625] GDB now properly loads executables with QEMU
+- [#1663][1663] Change lookup algorithm of `adb.which`
+- [#1699][1699] Fix broken linux shellcraft templates
+
+[1625]: https://github.com/Gallopsled/pwntools/pull/1625
+[1699]: https://github.com/Gallopsled/pwntools/pull/1699
+
+## 4.2.0

 - [#1436][1436] Add ret2dlresolve automation
 - [fecf9f] tubes.ssh.process() no longer requires python 2 installed on remote (still requires python, though)
@@ -827,10 +827,12 @@ def which(name, all = False, *a, **kw):
    """
    # Unfortunately, there is no native 'which' on many phones.
    which_cmd = '''
-echo $PATH | while read -d: directory; do
-    [ -x "$directory/{name}" ] || continue;
-    echo -n "$directory/{name}\\x00";
-done
+(IFS=:
+  for directory in $PATH; do
+      [ -x "$directory/{name}" ] || continue;
+      echo -n "$directory/{name}\\x00";
+  done
+)
 [ -x "{name}" ] && echo -n "$PWD/{name}\\x00"
 '''.format(name=name)

@@ -21,8 +21,8 @@ class KernelConfig(object):
        self.excludes = set(excludes)

        #: Kernel version that this check should be enforced on
-        self.minver = map(int, str(minver).split('.'))
-        self.maxver = map(int, str(maxver).split('.'))
+        self.minver = list(map(int, str(minver).split('.')))
+        self.maxver = list(map(int, str(maxver).split('.')))

    def relevant(self, config):

@@ -310,7 +310,7 @@ class ELF(ELFFile):
                config = gz.read()

            if config:
-                self.config = parse_kconfig(config)
+                self.config = parse_kconfig(config.decode())

        #: ``True`` if the ELF is a statically linked executable
        self.statically_linked = bool(self.elftype == 'EXEC' and self.load_addr)
@@ -1034,7 +1034,10 @@ class ELF(ELFFile):
            return

        banner = self.string(self.symbols.linux_banner)
-
+        
+        # convert banner into a utf-8 string since re.search does not accept bytes anymore
+        banner = banner.decode('utf-8')
+        
        # 'Linux version 3.18.31-gd0846ecc
        regex = r'Linux version (\S+)'
        match = re.search(regex, banner)
@@ -631,6 +631,9 @@ def attach(target, gdbscript = '', exe = None, gdb_args = None, ssh = None, sysr
        if context.os == 'android':
            pre += 'set gnutarget ' + _bfdname() + '\n'

+        if exe:
+            pre += 'file %s\n' % exe
+
    # let's see if we can find a pid to attach to
    pid = None
    if   isinstance(target, six.integer_types):
@@ -1101,7 +1101,7 @@ class ROP(object):
        #
        # - leave
        # - pop reg
-        # - add $sp, value
+        # - add $sp, <hexadecimal value>
        # - ret
        #
        # Currently, ROPgadget does not detect multi-byte "C2" ret.
@@ -1109,7 +1109,7 @@ class ROP(object):
        #

        pop   = re.compile(r'^pop (.{3})')
-        add   = re.compile(r'^add [er]sp, (\S+)$')
+        add   = re.compile(r'^add [er]sp, ((?:0[xX])?[0-9a-fA-F]+)$')
        ret   = re.compile(r'^ret$')
        leave = re.compile(r'^leave$')
        int80 = re.compile(r'int +0x80')
@@ -1125,6 +1125,8 @@ class ROP(object):
        # False
        # >>> valid('add esp, 0x24')
        # True
+        # >>> valid('add esp, esi')
+        # False
        #
        valid = lambda insn: any(map(lambda pattern: pattern.match(insn), [pop,add,ret,leave,int80,syscall,sysenter]))

@@ -20,22 +20,22 @@ ${acceptloop}:
    /*  Socket file descriptor is placed in EBP */

    /*  sock = socket(AF_INET, SOCK_STREAM, 0) */
-    ${i386.linux.push(0)}
-    ${i386.linux.push('SOCK_STREAM')}
-    ${i386.linux.push('AF_INET')}
+    ${i386.push(0)}
+    ${i386.push('SOCK_STREAM')}
+    ${i386.push('AF_INET')}
    ${i386.linux.syscall('SYS_socketcall', 'SYS_socketcall_socket', 'esp')}

-    ${i386.linux.mov('esi', 'eax')}      /* keep socket fd */
+    ${i386.mov('esi', 'eax')}      /* keep socket fd */

    /*  bind(sock, &addr, sizeof addr); // sizeof addr == 0x10 */
-    ${i386.linux.push(0)}
+    ${i386.push(0)}
    /* ${htons(port)} == htons(${port}) */
-    ${i386.linux.push('AF_INET | (%d << 16)' % htons(port))}
-    ${i386.linux.mov('ecx', 'esp')}
+    ${i386.push('AF_INET | (%d << 16)' % htons(port))}
+    ${i386.mov('ecx', 'esp')}

-    ${i386.linux.push(0x10)}    /* sizeof addr */
-    ${i386.linux.push('ecx')}   /* &addr */
-    ${i386.linux.push('eax')}   /* sock */
+    ${i386.push(0x10)}    /* sizeof addr */
+    ${i386.push('ecx')}   /* &addr */
+    ${i386.push('eax')}   /* sock */
    ${i386.linux.syscall('SYS_socketcall', 'SYS_socketcall_bind', 'esp')}

    /*  listen(sock, whatever) */
@@ -44,17 +44,17 @@ ${acceptloop}:

 ${looplabel}:
    /*  accept(sock, NULL, NULL) */
-    ${i386.linux.push(0x0)}
-    ${i386.linux.push('esi')} /* sock */
+    ${i386.push(0x0)}
+    ${i386.push('esi')} /* sock */
    ${i386.linux.syscall('SYS_socketcall', 'SYS_socketcall_accept', 'esp')}

-    ${i386.linux.mov('ebp', 'eax')}      /* keep in-coming socket fd */
+    ${i386.mov('ebp', 'eax')}      /* keep in-coming socket fd */

    ${i386.linux.syscall('SYS_fork')}
    xchg eax, edi

    test edi, edi
-    ${i386.linux.mov('ebx', 'ebp')}
+    ${i386.mov('ebx', 'ebp')}
    cmovz ebx, esi /*  on child we close the server sock instead */

    /*  close(sock) */
@@ -22,6 +22,6 @@
 %endif
 ${label}:
    ${i386.linux.syscall('SYS_mprotect', 'ebx', 'ecx', 'PROT_READ | PROT_WRITE | PROT_EXEC')}
-    ${i386.linux.mov('ecx', 0x1000)}
+    ${i386.mov('ecx', 0x1000)}
    add ebx, ecx
    jnz ${label}
@@ -117,7 +117,7 @@ class server(sock):
                            data, rhost = listen_sock.recvfrom(4096)
                            listen_sock.connect(rhost)
                            sock = listen_sock
-                            sock.unrecv(data)
+                            self.unrecv(data)
                        sock.settimeout(self.timeout)
                        break
                    except socket.error as e:
@@ -1 +1 @@
-__version__ = '4.2.0'
+__version__ = '4.2.2'
@@ -83,7 +83,7 @@ setup(
    name                 = 'pwntools',
    python_requires      = '>=2.7',
    packages             = find_packages(),
-    version              = '4.2.0',
+    version              = '4.2.2',
    data_files           = [('',
                             glob.glob('*.md') + glob.glob('*.txt')),
                            ],
Author	SHA1	Message	Date
Arusekk	f1624dc8ac	Release 4.2.2	2020-10-20 15:21:59 +02:00
Arusekk	a824e83bcb	Only require changelog if major changes present	2020-10-20 14:57:36 +02:00
Arusekk	dff2e807cd	Fix udp socket server AttributeError (#1706 ) Closes #1690	2020-10-20 14:29:54 +02:00
Arusekk	b8ca473a39	Use descriptive workflow names	2020-10-20 12:17:58 +02:00
lucasgandArusekk	09541e042b	[elf.py] convert linux string banner into an actual str (#1700 ) * [elf.py] convert linux string banner into an actual str ``self.string(address)`` actually return a bytes object containing the raw bytes, not a string in a pythonesque sense ! Since quite some time on Python3, ``re.search`` only works on proper str so we need to convert it before feeding it to ``re.search`` ``.decode()`` works both on Python2 and Python3 * Update kernel ELF handling Co-authored-by: Arusekk <[email protected]>	2020-10-17 16:10:22 +02:00
James O'NealandJames O'Neal	dd92ca6c61	Fix broken shellcraft linux templates (#1699 ) * fixing broken linux templates * adding change to changelog Co-authored-by: James O'Neal <[email protected]>	2020-10-13 14:13:21 +02:00
Teddy Heinen	5e279e7993	fix #1684 (ROP gadget loading fails when it matches "add esp, esi") (#1686 ) * fix ROP gadget loading when binary contains a gadget with add rsp, <register> * add documentation regarding the fact that loading gadget "add $sp, <reg>" will fail	2020-09-27 11:55:39 +02:00
Jonas	846f98294f	Change lookup algorithm of `adb.which` (#1663 ) * Change lookup algorithm of `adb.which`. This is done because the current algorithm does not work when the binary (e.g. `su`) is installed in the last element of $PATH. Example: ```shell $ echo $PATH /sbin:/vendor/bin:/system/sbin:/system/bin:/system/xbin $ echo $PATH \| while read -r -d: directory; do > echo "$directory/su"; > done /sbin/su /vendor/bin/su /system/sbin/su /system/bin/su $ (IFS=: > for directory in $PATH; do > echo "$directory/su"; > done > ) /sbin/su /vendor/bin/su /system/sbin/su /system/bin/su /system/xbin/su ``` * Update CHANGELOG	2020-08-24 17:19:09 +02:00
ArusekkandHeap Crash	78df70c986	Inform GDB of file when using QEMU (#1630 ) * Inform GDB of file when using QEMU Fixes #1625 * Sync CHANGELOG from dev + version bump Co-authored-by: Heap Crash <[email protected]>	2020-07-11 15:58:16 +02:00
Arusekk	b5de88e118	[ci] Look for merge conflict markers commited (#1623 ) Inspired by #1606 Fixes #1622	2020-07-09 23:08:08 -05:00