Release 4.4.0

Release 4.4.0beta1
Release 4.3.1
2026-11-08 17:13:31 -10:00 · 2021-03-29 11:49:32 +02:00 · 2020-11-30 00:27:41 +01:00 · 2020-11-30 00:26:51 +01:00 · 2020-11-30 00:25:25 +01:00 · 2020-11-30 00:24:01 +01:00
477 changed files with 1616 additions and 990 deletions
@@ -9,3 +9,4 @@ source =
    pwnlib
    ~/.pwntools-cache-2.7/
    ~/.pwntools-cache-3.8/
+disable_warnings = module-not-imported
@@ -14,8 +14,10 @@ jobs:
      with:
        fetch-depth: 0

-    - name: Git History 2
-      run: git log --oneline --graph -10
+    - name: Git History
+      run: |
+        git fetch origin
+        git log --oneline --graph -10

    - name: Cache for pip
      uses: actions/cache@v1
@@ -46,13 +48,12 @@ jobs:
      id: java-needed
      env:
        GITHUB_REF: ${{ github.event.ref }}
-        GITHUB_COMMIT_RANGE: ${{ github.event.before }}...${{ github.event.after }}
      run: |
        if echo "$GITHUB_REF" | grep -Eq 'staging|tags'; then
          echo "Found release or important branch ($GITHUB_REF), forcing tests."
-        elif ! git show "$GITHUB_COMMIT_RANGE" >/dev/null; then
+        elif ! git show "origin/$GITHUB_BASE_REF"..HEAD >/dev/null; then
          echo 'Incorrect commit range, forcing android tests.'
-        elif git log --stat "$GITHUB_COMMIT_RANGE" | grep -iE 'android|\<adb\>'; then
+        elif git log --stat "origin/$GITHUB_BASE_REF"..HEAD | grep -iE 'android|\<adb\>'; then
          echo 'Found Android-related commits, forcing tests.'
        else
          # clear files that cause Android doctests
@@ -73,7 +74,9 @@ jobs:
          binutils-aarch64-linux-gnu \
          binutils-arm-linux-gnueabihf \
          binutils-mips-linux-gnu \
+          binutils-msp430 \
          binutils-powerpc-linux-gnu \
+          binutils-s390x-linux-gnu \
          binutils-sparc64-linux-gnu \
          gcc-multilib \
          libc6-dbg \
@@ -0,0 +1,36 @@
+name: PyLint
+on: [pull_request]
+
+jobs:
+  build:
+    strategy:
+      matrix:
+        python-version: [3.8]
+        os: [ubuntu-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    steps:
+    - uses: actions/checkout@v2
+    - name: Cache for pip
+      uses: actions/cache@v1
+      id: cache-pip
+      with:
+        path: ~/.cache/pip
+        key: ${{ matrix.os }}-cache-pip
+
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v1
+      with:
+        python-version: ${{ matrix.python-version }}
+
+    - name: PyLint
+      run: |
+        set -x
+        pip install pylint
+        pylint --exit-zero --errors-only  pwnlib > current.txt
+        git fetch origin
+        git checkout origin/"$GITHUB_BASE_REF"
+        pylint --exit-zero --errors-only  pwnlib > base.txt
+        if diff base.txt current.txt | grep '>'; then
+          false
+        fi
@@ -19,7 +19,9 @@ addons:
    - binutils-aarch64-linux-gnu
    - binutils-arm-linux-gnueabihf
    - binutils-mips-linux-gnu
+    - binutils-msp430
    - binutils-powerpc-linux-gnu
+    - binutils-s390x-linux-gnu
    - binutils-sparc64-linux-gnu
    - bash-static
 cache:
@@ -9,9 +9,11 @@ The table below shows which release corresponds to each branch, and what date th

 | Version          | Branch   | Release Date           |
 | ---------------- | -------- | ---------------------- |
-| [4.5.0](#450)    | `dev`    | Dec 20, 2020 (planned)
-| [4.4.0](#440)    | `beta`   | Nov 20, 2020 (planned)
-| [4.3.0](#430)    | `stable` | Oct 20, 2020
+| [4.6.0](#460)    | `dev`    | May 29, 2020 (planned)
+| [4.5.0](#450)    | `beta`   | Apr 29, 2020 (planned)
+| [4.4.0](#440)    | `stable` | Mar 29, 2020
+| [4.3.1](#431)    |          | Nov 29, 2020
+| [4.3.0](#430)    |          | Oct 20, 2020
 | [4.2.0](#420)    |          | Jul 3, 2020
 | [4.1.7](#417)    |          | Jun 30, 2020
 | [4.1.5](#415)    |          | Jun 27, 2020
@@ -56,9 +58,44 @@ The table below shows which release corresponds to each branch, and what date th
 | [3.0.0](#300)    |          | Aug 20, 2016
 | [2.2.0](#220)    |          | Jan 5, 2015

-## 4.5.0 (`dev`)
+## 4.6.0 (`dev`)

-## 4.4.0 (`beta`)
+
+
+## 4.5.0 (`beta`)
+
+- [#1261][1261] Misc `run_in_new_terminal` improvements (notably gdb terminated by default)
+- [#1695][1695] Allow using GDB Python API
+- [#1735][1735] Python 3.9 support in safeeval
+- [#1738][1738] Which function support custom search path
+  - process also looks now at `env['PATH']` to find the path for the executable
+- [#1742][1742] New `baremetal` os to debug binaries executed with qemu-system-$(arch)
+- [#1757][1757] update cache directories
+- [#1758][1758] Remove eval from cli
+- [#1780][1780] Re-add Python2 to the official Dockerfile
+- [#1941][1941] Disable all Android tests, `pwnlib.adb` is no longer supported in CI
+- [#1811][1811] Remove unnecessary `pwn.toplevel.__all__`
+- [#1827][1827] Support `$XDG_CONFIG_HOME` dir for `pwn.conf`
+- [#1841][1841] Add colored_traceback
+- [#1839][1839] run_in_new_terminal now creates a runner script if given a list or tuple
+- [#1833][1833] Add pwnlib.filesystem module
+
+[1261]: https://github.com/Gallopsled/pwntools/pull/1261
+[1695]: https://github.com/Gallopsled/pwntools/pull/1695
+[1735]: https://github.com/Gallopsled/pwntools/pull/1735
+[1738]: https://github.com/Gallopsled/pwntools/pull/1738
+[1742]: https://github.com/Gallopsled/pwntools/pull/1742
+[1757]: https://github.com/Gallopsled/pwntools/pull/1757
+[1758]: https://github.com/Gallopsled/pwntools/pull/1758
+[1780]: https://github.com/Gallopsled/pwntools/pull/1780
+[1941]: https://github.com/Gallopsled/pwntools/pull/1941
+[1811]: https://github.com/Gallopsled/pwntools/pull/1811
+[1827]: https://github.com/Gallopsled/pwntools/pull/1827
+[1841]: https://github.com/Gallopsled/pwntools/pull/1841
+[1839]: https://github.com/Gallopsled/pwntools/pull/1839
+[1833]:  https://github.com/Gallopsled/pwntools/pull/1833
+
+## 4.4.0 (`stable`)

 - [#1541][1541] Use `context.newline` for tubes by default
 - [#1602][1602] Fix bytes handling in ssh tubes
@@ -80,6 +117,7 @@ The table below shows which release corresponds to each branch, and what date th
 - [#1688][1688] Add `__setattr__` and `__call__` interfaces to `ROP` for setting registers
 - [#1692][1692] Remove python2 shebangs where appropriate
 - [#1703][1703] Update libcdb buildid offsets for amd64 and i386
+- [#1704][1704] Try https://libc.rip/ for libcdb lookup

 [1541]: https://github.com/Gallopsled/pwntools/pull/1541
 [1602]: https://github.com/Gallopsled/pwntools/pull/1602
@@ -99,8 +137,15 @@ The table below shows which release corresponds to each branch, and what date th
 [1688]: https://github.com/Gallopsled/pwntools/pull/1688
 [1692]: https://github.com/Gallopsled/pwntools/pull/1692
 [1703]: https://github.com/Gallopsled/pwntools/pull/1703
+[1704]: https://github.com/Gallopsled/pwntools/pull/1704

-## 4.3.0 (`stable`)
+## 4.3.1
+
+- [#1732][1732] Fix shellcraft SSTI vulnerability (first major pwntools vuln!)
+
+[1732]: https://github.com/Gallopsled/pwntools/pull/1732
+
+## 4.3.0

 - [#1576][1576] Add `executable=` argument to `ELF.search`
 - [#1584][1584] Add `jmp_esp`/`jmp_rsp` attribute to `ROP`
@@ -198,7 +243,7 @@ The table below shows which release corresponds to each branch, and what date th
 [1001]: https://github.com/Gallopsled/pwntools/pull/1001
 [1389]: https://github.com/Gallopsled/pwntools/pull/1389
 [1241]: https://github.com/Gallopsled/pwntools/pull/1241
-[1218]: https://github.com/Gallopsled/pwntools/pull/1218  
+[1218]: https://github.com/Gallopsled/pwntools/pull/1218

 ## 4.0.1

@@ -25,6 +25,8 @@ r.interactive()

 Our documentation is available at [docs.pwntools.com](https://docs.pwntools.com/)

+A series of tutorials is also [available online](https://github.com/Gallopsled/pwntools-tutorial#readme)
+
 To get you started, we've provided some example solutions for past CTF challenges in our [write-ups repository](https://github.com/Gallopsled/pwntools-write-ups).

 # Installation
@@ -91,6 +91,7 @@ pwnlib.context.ContextType.defaults['log_console'] = stdout()

 github_actions = os.environ.get('USER') == 'runner'
 travis_ci = os.environ.get('USER') == 'travis'
+branch_dev = os.environ.get('GITHUB_BASE_REF') == 'dev'
 '''

 autoclass_content = 'both'
@@ -1,13 +1,18 @@
 .. testsetup:: *

   from pwn import *
-
+   
 :mod:`pwnlib.encoders` --- Encoding Shellcode
 ===============================================

 .. automodule:: pwnlib.encoders.encoder
   :members:

+.. automodule:: pwnlib.encoders.i386.ascii_shellcode
+   :members:
+   :special-members:
+   :exclude-members: __init__
+
 .. automodule:: pwnlib.encoders.i386.xor
   :members:

@@ -17,6 +17,13 @@ assemble, disassemble, pack, unpack, and many other things with a single functio
 A full list of everything that is imported is available on :doc:`globals`.


+Tutorials
+---------
+
+A series of tutorials for Pwntools exists online, at
+https://github.com/Gallopsled/pwntools-tutorial#readme
+
+
 Making Connections
 ------------------

@@ -188,10 +195,10 @@ Never write another hexdump, thanks to :mod:`pwnlib.util.fiddling`.

 Find offsets in your buffer that cause a crash, thanks to :mod:`pwnlib.cyclic`.

-    >>> print(cyclic(20).decode())
-    aaaabaaacaaadaaaeaaa
+    >>> cyclic(20)
+    b'aaaabaaacaaadaaaeaaa'
    >>> # Assume EIP = 0x62616166 (b'faab' which is pack(0x62616166))  at crash time
-    >>> print(cyclic_find(b'faab'))
+    >>> cyclic_find(b'faab')
    120

 ELF Manipulation
@@ -1,6 +1,6 @@
 FROM pwntools/pwntools:stable

 USER root
-RUN pip install --upgrade git+https://github.com/Gallopsled/pwntools@beta
+RUN pip3 install --upgrade git+https://github.com/Gallopsled/pwntools@beta
 RUN PWNLIB_NOTERM=1 pwn update
 USER pwntools
@@ -12,11 +12,19 @@ RUN apt-get update \
        git \
        libssl-dev \
        libffi-dev \
-        python2.7 \
-        python-pip \
-        python-dev \
-    && pip install --upgrade pip \
-    && python -m pip install --upgrade pwntools \
+        python3 \
+        python3-pip \
+        python3-dev \
+        qemu-user-static \
+        binutils-arm-linux-gnueabihf \
+        binutils-aarch64-linux-gnu \
+        binutils-mips-linux-gnu \
+        binutils-mipsel-linux-gnu \
+        binutils-powerpc-linux-gnu \
+        binutils-powerpc64-linux-gnu \
+        binutils-sparc64-linux-gnu \
+    && pip3 install --upgrade pip \
+    && python3 -m pip install --upgrade pwntools \
    && PWNLIB_NOTERM=1 pwn update \
    && apt-get install -y sudo \
    && useradd -m pwntools \
@@ -1,6 +1,6 @@
 FROM pwntools/pwntools:stable

 USER root
-RUN pip install --upgrade git+https://github.com/Gallopsled/pwntools@dev
+RUN pip3 install --upgrade git+https://github.com/Gallopsled/pwntools@dev
 RUN PWNLIB_NOTERM=1 pwn update
 USER pwntools
@@ -1,6 +1,6 @@
 FROM pwntools/pwntools:base

 USER root
-RUN pip install --upgrade git+https://github.com/Gallopsled/pwntools@stable
+RUN pip3 install --upgrade git+https://github.com/Gallopsled/pwntools@stable
 RUN PWNLIB_NOTERM=1 pwn update
 USER pwntools
@@ -5,6 +5,7 @@ import math
 import operator
 import os
 import re
+import requests
 import socks
 import signal
 import string
@@ -1,5 +1,3 @@
-
-#!/usr/bin/env python2
 """
 Pwntools exposes several magic command-line arguments and environment
 variables when operating in `from pwn import *` mode.
@@ -334,9 +334,11 @@ def _bfdname():
        'cris'    : 'elf32-cris',
        'ia64'    : 'elf64-ia64-%s' % E,
        'm68k'    : 'elf32-m68k',
+        'msp430'  : 'elf32-msp430',
        'powerpc' : 'elf32-powerpc',
        'powerpc64' : 'elf64-powerpc',
        'vax'     : 'elf32-vax',
+        's390'    : 'elf%d-s390' % context.bits,
        'sparc'   : 'elf32-sparc',
        'sparc64' : 'elf64-sparc',
    }
@@ -646,6 +648,10 @@ def asm(shellcode, vma = 0, extract = True, shared = False):
        b'H\xc7\xc0\x17\x00\x00\x00'
        >>> asm("mov r0, #SYS_select", arch = 'arm', os = 'linux', bits=32)
        b'R\x00\xa0\xe3'
+        >>> asm("mov #42, r0", arch = 'msp430')
+        b'0@*\x00'
+        >>> asm("la %r0, 42", arch = 's390', bits=64)
+        b'A\x00\x00*'
    """
    result = ''

@@ -70,7 +70,7 @@ def main(args):
            pat = int(pat, 0)
        except ValueError:
            pass
-        pat = flat(pat)
+        pat = flat(pat, bytes=args.length)

        if len(pat) != subsize:
            log.critical('Subpattern must be %d bytes' % subsize)
@@ -198,11 +198,11 @@ def main(args):
        common.parser.print_usage()
        exit()

-    if args.shellcode not in shellcraft.templates:
+    try:
+        func = get_template(args.shellcode)
+    except AttributeError:
        log.error("Unknown shellcraft template %r. Use --list to see available shellcodes." % args.shellcode)

-    func = get_template(args.shellcode)
-
    if args.show:
        # remove doctests
        doc = []
@@ -41,7 +41,14 @@ def main(args):
            log.error("Must specify --path or a exe")

        s = ssh(args.user, args.host, args.port or 22, args.password or None)
-        s.download(args.path or args.exe)
+
+        try:
+            remote = args.path or args.exe
+            s.download(remote)
+        except Exception:
+            log.warning("Could not download file %r, opening a shell", remote)
+            s.interactive()
+            return

        if not args.exe:
            args.exe = os.path.basename(args.path)
@@ -145,7 +145,13 @@ class ConstantsModule(ModuleType):
        if key not in self._env_store:
            self._env_store[key] = {key: getattr(self, key) for key in dir(self) if not key.endswith('__')}

-        return Constant('(%s)' % string, safeeval.values(string, self._env_store[key]))
+        val = safeeval.values(string, self._env_store[key])
+
+        # if the expression is not assembly-safe, it is not so vital to preserve it
+        if set(string) & (set(bytearray(range(32)).decode()) | set('"#$\',.;@[\\]`{}')):
+            string = val
+
+        return Constant('(%s)' % string, val)


 # To prevent garbage collection
@@ -1,4 +1,3 @@
-#!/usr/bin/env python2
 # -*- coding: utf-8 -*-
 """
 Implements context management so that nested/scoped contexts and threaded
@@ -359,7 +358,7 @@ class ContextType(object):
        'log_console': sys.stdout,
        'randomize': False,
        'rename_corefiles': True,
-        'newline': '\n',
+        'newline': b'\n',
        'noptrace': False,
        'os': 'linux',
        'proxy': None,
@@ -1279,6 +1278,15 @@ class ContextType(object):
        """
        return bool(v)

+    @_validator
+    def newline(self, v):
+        """Line ending used for Tubes by default.
+
+        This configures the newline emitted by e.g. ``sendline`` or that is used
+        as a delimiter for e.g. ``recvline``.
+        """
+        return six.ensure_binary(v)
+

    @_validator
    def gdbinit(self, value):
@@ -1,6 +1,7 @@
 #!/usr/bin/env python2
 from __future__ import division
 import argparse
+import keyword
 import os

 from pwnlib import constants
@@ -62,7 +63,7 @@ CALL = """

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -75,8 +76,8 @@ CALL = """

        # The argument is not a register.  It is a string value, and we
        # are expecting a string value
-        elif name in can_pushstr and isinstance(arg, (bytes, six.text_type)):
-            if not isinstance(arg, bytes):
+        elif name in can_pushstr and isinstance(arg, (six.binary_type, six.text_type)):
+            if isinstance(arg, six.text_type):
                arg = arg.encode('utf-8')
            string_arguments[name] = arg

@@ -144,12 +145,11 @@ def can_be_array(arg):


 def fix_bad_arg_names(func, arg):
-    if arg.name == 'str':
-        return 'str_'
    if arg.name == 'len':
        return 'length'
-    if arg.name == 'repr':
-        return 'repr_'
+
+    if arg.name in ('str', 'repr') or keyword.iskeyword(arg.name):
+        return arg.name + '_'

    if func.name == 'open' and arg.name == 'vararg':
        return 'mode'
@@ -277,8 +277,10 @@ def generate_one(target):
            CALL.format(**template_variables)
        ]

-        with open(os.path.join(target, name + '.asm'), 'wt+') as f:
-            f.write('\n'.join(map(str.strip, lines)))
+        if keyword.iskeyword(name):
+            name += '_'
+        with open(os.path.join(target, name + '.asm'), 'wt') as f:
+            f.write('\n'.join(map(str.strip, lines)) + '\n')

 if __name__ == '__main__':
    p = argparse.ArgumentParser()
@@ -1,4 +1,5 @@
 from __future__ import absolute_import

+from pwnlib.encoders.i386 import ascii_shellcode
 from pwnlib.encoders.i386 import delta
 from pwnlib.encoders.i386 import xor
@@ -0,0 +1,300 @@
+""" Encoder to convert shellcode to shellcode that contains only ascii
+characters """
+# https://github.com/Gallopsled/pwntools/pull/1667
+
+from __future__ import absolute_import
+
+from itertools import product
+
+import six
+
+from pwnlib.context import LocalContext
+from pwnlib.context import context
+from pwnlib.encoders.encoder import Encoder
+from pwnlib.encoders.encoder import all_chars
+from pwnlib.util.iters import group
+from pwnlib.util.packing import *
+
+
+class AsciiShellcodeEncoder(Encoder):
+    """ Pack shellcode into only ascii characters that unpacks itself and
+    executes (on the stack)
+
+    The original paper this encoder is based on:
+    http://julianor.tripod.com/bc/bypass-msb.txt
+
+    A more visual explanation as well as an implementation in C:
+    https://github.com/VincentDary/PolyAsciiShellGen/blob/master/README.md#mechanism
+    """
+
+    def __init__(self, slop=20, max_subs=4):
+        """ Init
+
+        Args:
+            slop (int, optional): The amount esp will be increased by in the
+                allocation phase (In addition to the length of the packed
+                shellcode) as well as defines the size of the NOP sled (you can
+                increase/ decrease the size of the NOP sled by adding/removing
+                b'P'-s to/ from the end of the packed shellcode).
+                Defaults to 20.
+            max_subs (int, optional): The maximum amount of subtractions
+                allowed to be taken. This may be increased if you have a
+                relatively  restrictive ``avoid`` set. The more subtractions
+                there are, the bigger the packed shellcode will be.
+                Defaults to 4.
+        """
+        if six.PY2:
+            super(AsciiShellcodeEncoder, self).__init__()
+        elif six.PY3:
+            super().__init__()
+        self.slop = slop
+        self.max_subs = max_subs
+
+    @LocalContext
+    def __call__(self, raw_bytes, avoid=None, pcreg=None):
+        r""" Pack shellcode into only ascii characters that unpacks itself and
+        executes (on the stack)
+
+        Args:
+            raw_bytes (bytes): The shellcode to be packed
+            avoid (set, optional): Characters to avoid. Defaults to allow
+                printable ascii (0x21-0x7e).
+            pcreg (NoneType, optional): Ignored
+
+        Raises:
+            RuntimeError: A required character is in ``avoid`` (required
+                characters are characters which assemble into assembly
+                instructions and are used to unpack the shellcode onto the
+                stack, more details in the paper linked above ``\ - % T X P``).
+            RuntimeError: Not supported architecture
+            ArithmeticError: The allowed character set does not contain
+                two characters that when they are bitwise-anded with eachother
+                their result is 0
+            ArithmeticError: Could not find a correct subtraction sequence
+                to get to the the desired target value with the given ``avoid``
+                parameter
+
+        Returns:
+            bytes: The packed shellcode
+
+        Examples:
+
+            >>> context.update(arch='i386', os='linux')
+            >>> sc = b"\x83\xc4\x181\xc01\xdb\xb0\x06\xcd\x80Sh/ttyh/dev\x89\xe31\xc9f\xb9\x12'\xb0\x05\xcd\x80j\x17X1\xdb\xcd\x80j.XS\xcd\x801\xc0Ph//shh/bin\x89\xe3PS\x89\xe1\x99\xb0\x0b\xcd\x80"
+            >>> encoders.i386.ascii_shellcode.encode(sc)
+            b'TX-!!!!-"_``-~~~~P\\%!!!!%@@@@-!6!!-V~!!-~~<-P-!mha-a~~~P-!!L`-a^~~-~~~~P-!!if-9`~~P-!!!!-aOaf-~~~~P-!&!<-!~`~--~~~P-!!!!-!!H^-+A~~P-U!![-~A1~P-,<V!-~~~!-~~~GP-!2!8-j~O~P-!]!!-!~!r-y~w~P-c!!!-~<(+P-N!_W-~1~~P-!!]!-Mn~!-~~~<P-!<!!-r~!P-~~x~P-fe!$-~~S~-~~~~P-!!\'$-%z~~P-A!!!-~!#!-~*~=P-!7!!-T~!!-~~E^PPPPPPPPPPPPPPPPPPPPP'
+            >>> avoid = {'\x00', '\x83', '\x04', '\x87', '\x08', '\x8b', '\x0c', '\x8f', '\x10', '\x93', '\x14', '\x97', '\x18', '\x9b', '\x1c', '\x9f', ' ', '\xa3', '\xa7', '\xab', '\xaf', '\xb3', '\xb7', '\xbb', '\xbf', '\xc3', '\xc7', '\xcb', '\xcf', '\xd3', '\xd7', '\xdb', '\xdf', '\xe3', '\xe7', '\xeb', '\xef', '\xf3', '\xf7', '\xfb', '\xff', '\x80', '\x03', '\x84', '\x07', '\x88', '\x0b', '\x8c', '\x0f', '\x90', '\x13', '\x94', '\x17', '\x98', '\x1b', '\x9c', '\x1f', '\xa0', '\xa4', '\xa8', '\xac', '\xb0', '\xb4', '\xb8', '\xbc', '\xc0', '\xc4', '\xc8', '\xcc', '\xd0', '\xd4', '\xd8', '\xdc', '\xe0', '\xe4', '\xe8', '\xec', '\xf0', '\xf4', '\xf8', '\xfc', '\x7f', '\x81', '\x02', '\x85', '\x06', '\x89', '\n', '\x8d', '\x0e', '\x91', '\x12', '\x95', '\x16', '\x99', '\x1a', '\x9d', '\x1e', '\xa1', '\xa5', '\xa9', '\xad', '\xb1', '\xb5', '\xb9', '\xbd', '\xc1', '\xc5', '\xc9', '\xcd', '\xd1', '\xd5', '\xd9', '\xdd', '\xe1', '\xe5', '\xe9', '\xed', '\xf1', '\xf5', '\xf9', '\xfd', '\x01', '\x82', '\x05', '\x86', '\t', '\x8a', '\r', '\x8e', '\x11', '\x92', '\x15', '\x96', '\x19', '\x9a', '\x1d', '\x9e', '\xa2', '\xa6', '\xaa', '\xae', '\xb2', '\xb6', '\xba', '\xbe', '\xc2', '\xc6', '\xca', '\xce', '\xd2', '\xd6', '\xda', '\xde', '\xe2', '\xe6', '\xea', '\xee', '\xf2', '\xf6', '\xfa', '\xfe'}
+            >>> sc = shellcraft.echo("Hello world") + shellcraft.exit()
+            >>> ascii = encoders.i386.ascii_shellcode.encode(asm(sc), avoid)
+            >>> ascii += asm('jmp esp') # just for testing, the unpacker should also run on the stack
+            >>> ELF.from_bytes(ascii).process().recvall()
+            b'Hello world'
+        """
+        if not avoid:
+            vocab = bytearray(
+                b"!\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~")
+        else:
+            required_chars = set('\\-%TXP')
+            allowed = set(all_chars)
+            if avoid.intersection(required_chars):
+                raise RuntimeError(
+                    '''These characters ({}) are required because they assemble
+                    into instructions used to unpack the shellcode'''.format(
+                        str(required_chars, 'ascii')))
+            allowed.difference_update(avoid)
+            vocab = bytearray(map(ord, allowed))
+
+        if context.arch != 'i386' or context.bits != 32:
+            raise RuntimeError('Only 32-bit i386 is currently supported')
+
+        int_size = context.bytes
+
+        # Prepend with NOPs for the NOP sled
+        shellcode = bytearray(b'\x90'*int_size + raw_bytes)
+        subtractions = self._get_subtractions(shellcode, vocab)
+        allocator = self._get_allocator(len(subtractions) + self.slop, vocab)
+        nop_sled = b'P' * self.slop  # push eax
+        return bytes(allocator + subtractions + nop_sled)
+
+    @LocalContext
+    def _get_allocator(self, size, vocab):
+        r""" Allocate enough space on the stack for the shellcode
+
+        int_size is taken from the context
+
+        Args:
+            size (int): The allocation size
+            vocab (bytearray): Allowed characters
+
+        Returns:
+            bytearray: The allocator shellcode
+
+        Examples:
+
+            >>> context.update(arch='i386', os='linux')
+            >>> vocab = bytearray(b'!"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~')
+            >>> encoders.i386.ascii_shellcode.encode._get_allocator(300, vocab)
+            bytearray(b'TX-!!!!-!_``-t~~~P\\%!!!!%@@@@')
+        """
+        size += 0x1e  # add typical allocator size
+        int_size = context.bytes
+        # Use eax for subtractions because sub esp, X doesn't assemble to ascii
+        result = bytearray(b'TX')  # push esp; pop eax
+        # Set target to the `size` arg
+        target = bytearray(pack(size))
+        # All we are doing here is adding (subtracting) `size`
+        # to esp (to allocate space on the stack), so we don't care
+        # about esp's actual value. That's why the `last` parameter
+        # for `calc_subtractions` can just be zero
+        for subtraction in self._calc_subtractions(
+                bytearray(int_size), target, vocab):
+            # sub eax, subtraction
+            result += b'-' + subtraction
+        result += b'P\\'  # push eax, pop esp
+        # Zero out eax for the unpacking part
+        pos, neg = self._find_negatives(vocab)
+        # and eax, pos; and eax, neg ; (0b00010101 & 0b00101010 = 0b0)
+        result += flat((b'%', pos, b'%', neg))
+        return result
+
+    @LocalContext
+    def _find_negatives(self, vocab):
+        r""" Find two bitwise negatives in the vocab so that when they are
+        and-ed the result is 0.
+
+        int_size is taken from the context
+
+        Args:
+            vocab (bytearray): Allowed characters
+
+        Returns:
+            Tuple[int, int]: value A, value B
+
+        Raises:
+            ArithmeticError: The allowed character set does not contain
+                two characters that when they are bitwise-and-ed with eachother
+                the result is 0
+
+        Examples:
+
+            >>> context.update(arch='i386', os='linux')
+            >>> vocab = bytearray(b'!"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~')
+            >>> a, b = encoders.i386.ascii_shellcode.encode._find_negatives(vocab)
+            >>> a & b
+            0
+        """
+        int_size = context.bytes
+        for products in product(vocab, vocab):
+            if products[0] & products[1] == 0:
+                return tuple(
+                    # pylint: disable=undefined-variable
+                    unpack(p8(x)*int_size)  # noqa: F405
+                    for x in bytearray(products)
+                )
+        else:
+            raise ArithmeticError(
+                'Could not find two bitwise negatives in the provided vocab')
+
+    @LocalContext
+    def _get_subtractions(self, shellcode, vocab):
+        r""" Covert the sellcode to sub eax and posh eax instructions
+
+        int_size is taken from the context
+
+        Args:
+            shellcode (bytearray): The shellcode to pack
+            vocab (bytearray): Allowed characters
+
+        Returns:
+            bytearray: packed shellcode
+
+        Examples:
+
+            >>> context.update(arch='i386', os='linux')
+            >>> sc = bytearray(b'ABCDEFGHIGKLMNOPQRSTUVXYZ')
+            >>> vocab = bytearray(b'!"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~')
+            >>> encoders.i386.ascii_shellcode.encode._get_subtractions(sc, vocab)
+            bytearray(b'-(!!!-~NNNP-!=;:-f~~~-~~~~P-!!!!-edee-~~~~P-!!!!-eddd-~~~~P-!!!!-egdd-~~~~P-!!!!-eadd-~~~~P-!!!!-eddd-~~~~P')
+        """
+        int_size = context.bytes
+        result = bytearray()
+        last = bytearray(int_size)
+        # Group the shellcode into bytes of stack cell size, pad with NOPs
+        # if the shellcode does not divide into stack cell size and reverse.
+        # The shellcode will be reversed again back to it's original order once
+        # it's pushed onto the stack
+        sc = tuple(group(int_size, shellcode, 0x90))[::-1]
+        # Pack the shellcode to a sub/push sequence
+        for x in sc:
+            for subtraction in self._calc_subtractions(last, x, vocab):
+                result += b'-' + subtraction  # sub eax, ...
+            last = x
+            result += b'P'  # push eax
+        return result
+
+    @LocalContext
+    def _calc_subtractions(self, last, target, vocab):
+        r""" Given `target` and `last`, return a list of integers that when
+         subtracted from `last` will equal `target` while only constructing
+         integers from bytes in `vocab`
+
+        int_size is taken from the context
+
+        Args:
+            last (bytearray): Original value
+            target (bytearray): Desired value
+            vocab (bytearray): Allowed characters
+
+        Raises:
+            ArithmeticError: If a sequence of subtractions could not be found
+
+        Returns:
+            List[bytearray]: List of numbers that would need to be subtracted
+            from `last` to get to `target`
+
+        Examples:
+
+            >>> context.update(arch='i386', os='linux')
+            >>> vocab = bytearray(b'!"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~')
+            >>> print(encoders.i386.ascii_shellcode.encode._calc_subtractions(bytearray(b'\x10'*4), bytearray(b'\x11'*4), vocab))
+            [bytearray(b'!!!!'), bytearray(b'`___'), bytearray(b'~~~~')]
+            >>> print(encoders.i386.ascii_shellcode.encode._calc_subtractions(bytearray(b'\x11\x12\x13\x14'), bytearray(b'\x15\x16\x17\x18'), vocab))
+            [bytearray(b'~}}}'), bytearray(b'~~~~')]
+        """
+        int_size = context.bytes
+        subtractions = [bytearray(int_size)]
+        for sub in range(self.max_subs):
+            carry = success_count = 0
+            for byte in range(int_size):
+                # Try all combinations of all the characters in vocab of
+                # `subtraction` characters in each combination. So if
+                # `max_subs` is 4 and we're on the second subtraction attempt,
+                # products will equal
+                # [\, ", #, %, ...], [\, ", #, %, ...], (0,), (0,)
+                for products in product(
+                    *[x <= sub and vocab or (0,) for x in range(self.max_subs)]
+                ):
+                    # Sum up all the products, carry from last byte and
+                    # the target
+                    attempt = target[byte] + carry + sum(products)
+                    # If the attempt equals last, we've found the combination
+                    if last[byte] == attempt & 0xff:
+                        carry = (attempt & 0xff00) >> 8
+                        # Update the result with the current `products`
+                        for p, i in zip(products, range(sub + 1)):
+                            subtractions[i][byte] = p
+                        success_count += 1
+                        break
+            if success_count == int_size:
+                return subtractions
+            else:
+                subtractions.append(bytearray(int_size))
+        else:
+            raise ArithmeticError(
+                str.format(
+                    '''Could not find the correct subtraction sequence
+                to get the the desired target ({}) from ({})''',
+                    target[byte], last[byte]))
+
+
+encode = AsciiShellcodeEncoder()
@@ -1,4 +1,3 @@
-#!/usr/bin/env python2
 # Source:
 # http://www.iodigitalsec.com/python-cascading-xor-polymorphic-shellcode-generator/
 #
@@ -1,4 +1,3 @@
-#!/usr/bin/env python2
 # Source:
 # https://github.com/zcutlip/bowcaster/blob/master/src/bowcaster/encoders/mips.py
 #
@@ -851,7 +851,7 @@ class FmtStr(object):
        payload = b"START%%%d$pEND" % offset
        leak = self.execute_fmt(prefix + payload)
        try:
-            leak = re.findall(br"START(.*)END", leak, re.MULTILINE | re.DOTALL)[0]
+            leak = re.findall(br"START(.*?)END", leak, re.MULTILINE | re.DOTALL)[0]
            leak = int(leak, 16)
        except ValueError:
            leak = 0
@@ -241,9 +241,9 @@ def _gdbserver_args(pid=None, path=None, args=None, which=None, env=None):
        env_args = []
        for key in tuple(env):
            if key.startswith('LD_'): # LD_PRELOAD / LD_LIBRARY_PATH etc.
-                env_args.append('{}={}'.format(key, env.pop(key)))
+                env_args.append('{}="{}"'.format(key, env.pop(key)))
            else:
-                env_args.append('{}={}'.format(key, env[key]))
+                env_args.append('{}="{}"'.format(key, env[key]))
        gdbserver_args += ['--wrapper', 'env', '-i'] + env_args + ['--']

    gdbserver_args += ['localhost:0']
@@ -263,7 +263,10 @@ def _gdbserver_port(gdbserver, ssh):
            'Failed to spawn process under gdbserver. gdbserver error message: %s' % process_created
        )

-    gdbserver.pid   = int(process_created.split()[-1], 0)
+    try:
+        gdbserver.pid   = int(process_created.split()[-1], 0)
+    except ValueError:
+        log.error('gdbserver did not output its pid (maybe chmod +x?): %s', six.ensure_str(process_created))

    listening_on = b''
    while b'Listening' not in listening_on:
@@ -46,7 +46,7 @@ def search_by_hash(hex_encoded_id, hash_type='build_id'):
            log.info_once("Using cached data from %r", cache)
            return cache
        else:
-            log.info_once("Skipping unavialable libc %s", hex_encoded_id)
+            log.info_once("Skipping unavailable libc %s", hex_encoded_id)
            return None

    # Build the URL using the requested hash type
@@ -186,7 +186,7 @@ def get_build_id_offsets():
    return {
    # $ check_arch 80386
    #     181 Displaying notes found at file offset 0x00000174 with length 0x00000024:
-        'i386': [0x174],
+        'i386': [0x174, 0x1b4, 0x1d4],
    # $ check_arch "ARM, EABI5"
    #      69 Displaying notes found at file offset 0x00000174 with length 0x00000024:
        'arm':  [0x174],
@@ -197,7 +197,7 @@ def get_build_id_offsets():
    # $ check_arch "x86-64"
    #       6 Displaying notes found at file offset 0x00000174 with length 0x00000024:
    #      82 Displaying notes found at file offset 0x00000270 with length 0x00000024:
-        'amd64': [0x270, 0x174, 0x2e0],
+        'amd64': [0x270, 0x174, 0x2e0, 0x370],
    # $ check_arch "PowerPC or cisco"
    #      88 Displaying notes found at file offset 0x00000174 with length 0x00000024:
        'powerpc': [0x174],
@@ -267,7 +267,7 @@ That's all there is to it.
    >>> print(rop.dump())
    0x0000:       0x1000000e pop eax; ret
    0x0004:             0x77 [arg0] eax = SYS_sigreturn
-    0x0008:       0x1000000b int 0x80
+    0x0008:       0x1000000b int 0x80; ret
    0x000c:              0x0 gs
    0x0010:              0x0 fs
    0x0014:              0x0 es
@@ -282,7 +282,7 @@ That's all there is to it.
    0x0038:              0xb eax = SYS_execve
    0x003c:              0x0 trapno
    0x0040:              0x0 err
-    0x0044:       0x1000000b int 0x80
+    0x0044:       0x1000000b int 0x80; ret
    0x0048:             0x23 cs
    0x004c:              0x0 eflags
    0x0050:              0x0 esp_at_signal
@@ -452,7 +452,7 @@ class ROP(object):
    0x0020:              0x3 arg0
    0x0024:       0x10000007 pop eax; ret
    0x0028:             0x77 [arg0] eax = SYS_sigreturn
-    0x002c:       0x10000000 int 0x80
+    0x002c:       0x10000000 int 0x80; ret
    0x0030:              0x0 gs
    0x0034:              0x0 fs
    0x0038:              0x0 es
@@ -467,7 +467,7 @@ class ROP(object):
    0x005c:              0xb eax = SYS_execve
    0x0060:              0x0 trapno
    0x0064:              0x0 err
-    0x0068:       0x10000000 int 0x80
+    0x0068:       0x10000000 int 0x80; ret
    0x006c:             0x23 cs
    0x0070:              0x0 eflags
    0x0074:              0x0 esp_at_signal
@@ -490,7 +490,7 @@ class ROP(object):
    0x8048020:              0x3 arg0
    0x8048024:       0x10000007 pop eax; ret
    0x8048028:             0x77 [arg0] eax = SYS_sigreturn
-    0x804802c:       0x10000000 int 0x80
+    0x804802c:       0x10000000 int 0x80; ret
    0x8048030:              0x0 gs
    0x8048034:              0x0 fs
    0x8048038:              0x0 es
@@ -505,7 +505,7 @@ class ROP(object):
    0x804805c:              0xb eax = SYS_execve
    0x8048060:              0x0 trapno
    0x8048064:              0x0 err
-    0x8048068:       0x10000000 int 0x80
+    0x8048068:       0x10000000 int 0x80; ret
    0x804806c:             0x23 cs
    0x8048070:              0x0 eflags
    0x8048074:              0x0 esp_at_signal
@@ -523,6 +523,14 @@ class ROP(object):
    >>> r.ret is None
    True
    """
+    BAD_ATTRS = [
+        'trait_names',          # ipython tab-complete
+        'download',             # frequent typo
+        'upload',               # frequent typo
+    ]
+    X86_SUFFIXES = ['ax', 'bx', 'cx', 'dx', 'bp', 'sp', 'di', 'si',
+                    'r8', 'r9', '10', '11', '12', '13', '14', '15']
+
    def __init__(self, elfs, base = None, badchars = b'', **kwargs):
        """
        Arguments:
@@ -661,6 +669,43 @@ class ROP(object):

        return stack

+    def __call__(self, *args, **kwargs):
+        """Set the given register(s)' by constructing a rop chain.
+
+        This is a thin wrapper around :meth:`setRegisters` which
+        actually executes the rop chain.
+
+        You can call this :class:`ROP` instance and provide keyword arguments,
+        or a dictionary.
+
+        Arguments:
+            regs(dict): Mapping of registers to values.
+                        Can instead provide ``kwargs``.
+
+        >>> context.clear(arch='amd64')
+        >>> assembly = 'pop rax; pop rdi; pop rsi; ret; pop rax; ret;'
+        >>> e = ELF.from_assembly(assembly)
+        >>> r = ROP(e)
+        >>> r(rax=0xdead, rdi=0xbeef, rsi=0xcafe)
+        >>> print(r.dump())
+        0x0000:       0x10000000
+        0x0008:           0xdead
+        0x0010:           0xbeef
+        0x0018:           0xcafe
+        >>> r = ROP(e)
+        >>> r({'rax': 0xdead, 'rdi': 0xbeef, 'rsi': 0xcafe})
+        >>> print(r.dump())
+        0x0000:       0x10000000
+        0x0008:           0xdead
+        0x0010:           0xbeef
+        0x0018:           0xcafe
+        """
+        if len(args) == 1 and isinstance(args[0], dict):
+            for value, _ in self.setRegisters(args[0]):
+                self.raw(value)
+        else:
+            self(kwargs)
+
    def resolve(self, resolvable):
        """Resolves a symbol to an address

@@ -703,6 +748,7 @@ class ROP(object):
        """
        Generates padding to be inserted into the ROP stack.

+        >>> context.clear(arch='i386')
        >>> rop = ROP([])
        >>> val = rop.generatePadding(5,15)
        >>> cyclic_find(val[:4])
@@ -925,17 +971,28 @@ class ROP(object):
    def find_stack_adjustment(self, slots):
        self.search(move=slots * context.bytes)

-    def chain(self):
+    def chain(self, base=None):
        """Build the ROP chain
+        
+        Arguments:
+            base(int):
+                The base address to build the rop-chain from. Defaults to
+                :attr:`base`.

        Returns:
            str containing raw ROP bytes
        """
-        return packing.flat(self.build())
+        return packing.flat(self.build(base=base))

-    def dump(self):
-        """Dump the ROP chain in an easy-to-read manner"""
-        return self.build().dump()
+    def dump(self, base=None):
+        """Dump the ROP chain in an easy-to-read manner
+        
+        Arguments:
+            base(int):
+                The base address to build the rop-chain from. Defaults to
+                :attr:`base`.
+        """
+        return self.build(base=base).dump()

    def regs(self, registers=None, **kw):
        if registers is None:
@@ -1050,6 +1107,7 @@ class ROP(object):
        Arguments:
            data(int/str): The raw value to put onto the rop chain.

+        >>> context.clear(arch='i386')
        >>> rop = ROP([])
        >>> rop.raw('AAAAAAAA')
        >>> rop.raw('BBBBBBBB')
@@ -1069,7 +1127,7 @@ class ROP(object):
    def migrate(self, next_base):
        """Explicitly set $sp, by using a ``leave; ret`` gadget"""
        if isinstance(next_base, ROP):
-            next_base = self.base
+            next_base = next_base.base
        pop_sp = self.rsp or self.esp
        pop_bp = self.rbp or self.ebp
        leave  = self.leave
@@ -1090,7 +1148,7 @@ class ROP(object):

    def __get_cachefile_name(self, files):
        """Given an ELF or list of ELF objects, return a cache file for the set of files"""
-        cachedir = os.path.join(tempfile.gettempdir(), 'pwntools-rop-cache-%d.%d' % sys.version_info[:2])
+        cachedir = os.path.join(context.cache_dir, 'rop-cache')
        if not os.path.exists(cachedir):
            os.mkdir(cachedir)

@@ -1106,7 +1164,7 @@ class ROP(object):
    @staticmethod
    def clear_cache():
        """Clears the ROP gadget cache"""
-        cachedir = os.path.join(tempfile.gettempdir(), 'pwntools-rop-cache')
+        cachedir = os.path.join(context.cache_dir, 'rop-cache')
        shutil.rmtree(cachedir)

    def __cache_load(self, elf):
@@ -1187,7 +1245,7 @@ class ROP(object):
            try:
                sys.stdout = Wrapper(sys.stdout)
                import ropgadget
-                sys.argv = ['ropgadget', '--binary', elf.path, '--only', 'sysenter|syscall|int|add|pop|leave|ret', '--nojop']
+                sys.argv = ['ropgadget', '--binary', elf.path, '--only', 'sysenter|syscall|int|add|pop|leave|ret', '--nojop', '--multibr']
                args = ropgadget.args.Args().getArgs()
                core = ropgadget.core.Core(args)
                core.do_binary(elf.path)
@@ -1341,6 +1399,7 @@ class ROP(object):
        Also provides a shorthand for ``.call()``:
            ``rop.function(args)`` is equivalent to ``rop.call(function, args)``

+        >>> context.clear(arch='i386')
        >>> elf=ELF(which('bash'))
        >>> rop=ROP([elf])
        >>> rop.rdi     == rop.search(regs=['rdi'], order = 'regs')
@@ -1351,16 +1410,15 @@ class ROP(object):
        True
        >>> rop.ret is not None
        True
+        >>> with context.local(arch='amd64', bits='64'):
+        ...     r = ROP(ELF.from_assembly('syscall; ret'))
+        >>> r.syscall is not None
+        True
        """
        gadget = collections.namedtuple('gadget', ['address', 'details'])
-        bad_attrs = [
-            'trait_names',          # ipython tab-complete
-            'download',             # frequent typo
-            'upload',               # frequent typo
-        ]

        if attr in self.__dict__ \
-        or attr in bad_attrs \
+        or attr in self.BAD_ATTRS \
        or attr.startswith('_'):
            raise AttributeError('ROP instance has no attribute %r' % attr)

@@ -1397,17 +1455,14 @@ class ROP(object):
             'syscall': 'syscall',
             'sysenter': 'sysenter'}
            for each in self.gadgets:
-                if self.gadgets[each]['insns'] == [mapping[attr]]:
+                if self.gadgets[each]['insns'][0] == mapping[attr]:
                    return gadget(each, self.gadgets[each])
            return None

        #
        # Check for a '_'-delimited list of registers
        #
-        x86_suffixes = ['ax', 'bx', 'cx', 'dx', 'bp', 'sp', 'di', 'si',
-                        'r8', 'r9', '10', '11', '12', '13', '14', '15']
-
-        if all(map(lambda x: x[-2:] in x86_suffixes, attr.split('_'))):
+        if all(map(lambda x: x[-2:] in self.X86_SUFFIXES, attr.split('_'))):
            return self.search(regs=attr.split('_'), order='regs')

        #
@@ -1417,3 +1472,42 @@ class ROP(object):
            return self.call(attr, args)

        return call
+
+    def __setattr__(self, attr, value):
+        """Helper for setting registers.
+
+        This convenience feature allows one to set the values of registers
+        with simple python assignment syntax.
+
+        Warning:
+            Only one register is set at a time (one per rop chain).
+            This may lead to some previously set to registers be overwritten!
+
+        Note:
+            If you would like to set multiple registers in as few rop chains
+            as possible, see :meth:`__call__`.
+
+        >>> context.clear(arch='amd64')
+        >>> assembly = 'pop rax; pop rdi; pop rsi; ret; pop rax; ret;'
+        >>> e = ELF.from_assembly(assembly)
+        >>> r = ROP(e)
+        >>> r.rax = 0xdead
+        >>> r.rdi = 0xbeef
+        >>> r.rsi = 0xcafe
+        >>> print(r.dump())
+        0x0000:       0x10000004 pop rax; ret
+        0x0008:           0xdead
+        0x0010:       0x10000001 pop rdi; pop rsi; ret
+        0x0018:           0xbeef
+        0x0020:      b'iaaajaaa' <pad rsi>
+        0x0028:       0x10000002 pop rsi; ret
+        0x0030:           0xcafe
+        """
+        if attr in self.BAD_ATTRS:
+            raise AttributeError('ROP instance has no attribute %r' % attr)
+
+        if attr[-2:] in self.X86_SUFFIXES:  # handle setting registers
+            self({attr: value})
+
+        # Otherwise, perform usual setting
+        self.__dict__[attr] = value
@@ -240,8 +240,8 @@ stack_pointers = {
 # # XXX Need to add support for Capstone in order to extract ARM and MIPS
 # XXX as the SVC code may vary.
 syscall_instructions = {
-    'amd64': ['int 0x80', 'syscall', 'sysenter'],
-    'i386': ['int 0x80', 'syscall', 'sysenter'],
+    'amd64': ['syscall'],
+    'i386': ['int 0x80'],
    'arm': ['svc 0'],
    'aarch64': ['svc 0'],
    'thumb': ['svc 0'],
@@ -142,8 +142,11 @@ class module(ModuleType):
        return constants.eval(item)

    def pretty(self, n, comment=True):
-        if isinstance(n, str):
-            return repr(n)
+        if isinstance(n, (str, bytes, list, tuple, dict)):
+            r = repr(n)
+            if not comment:  # then it can be inside a comment!
+                r = r.replace('*/', r'\x2a/')
+            return r
        if not isinstance(n, six.integer_types):
            return n
        if isinstance(n, constants.Constant):
@@ -36,7 +36,7 @@ Example:
      if syscall is None:
          args = ['?']
      else:
-          args = [repr(syscall)]
+          args = [pretty(syscall, False)]

  for arg in [arg0, arg1, arg2, arg3, arg4, arg5]:
      if arg is None:
@@ -1,5 +1,5 @@
 <%
-  from pwnlib.shellcraft import aarch64
+  from pwnlib.shellcraft import aarch64, pretty
  from pwnlib.constants import eval
  from pwnlib.abi import linux_aarch64_syscall as abi
  from six import text_type
@@ -14,7 +14,7 @@ Any of the arguments can be expressions to be evaluated by :func:`pwnlib.constan
 Example:

    >>> print(shellcraft.aarch64.linux.syscall(11, 1, 'sp', 2, 0).rstrip())
-        /* call syscall(11, 1, 'sp', 2, 0) */
+        /* call syscall(0xb, 1, 'sp', 2, 0) */
        mov  x0, #1
        mov  x1, sp
        mov  x2, #2
@@ -59,13 +59,13 @@ Example:
      if syscall is None:
          args = ['?']
      else:
-          args = [repr(syscall)]
+          args = [pretty(syscall, False)]

  for arg in [arg0, arg1, arg2, arg3, arg4, arg5]:
      if arg is None:
          args.append('?')
      else:
-          args.append(repr(arg))
+          args.append(pretty(arg, False))
  while args and args[-1] == '?':
      args.pop()
  syscall_repr = syscall_repr % ', '.join(args)
@@ -39,7 +39,7 @@ string = b''.join(array)
 if len(array) * 8 > 4095:
    raise Exception("Array size is too large (%i), max=4095" % len(array))
 %>\
-    /* push argument array ${repr(array)} */
+    /* push argument array ${shellcraft.pretty(array, False)} */
    ${shellcraft.pushstr(string, register1=register1, register2=register2)}

    /* push null terminator */
@@ -79,7 +79,7 @@ Example:
      if syscall is None:
          args = ['?']
      else:
-          args = [repr(syscall)]
+          args = [pretty(syscall, False)]

  for arg in [arg0, arg1, arg2, arg3, arg4, arg5]:
      if arg is None:
@@ -1,5 +1,5 @@
 <%
-  from pwnlib.shellcraft import amd64
+  from pwnlib.shellcraft import amd64, pretty
  from pwnlib.constants import Constant
  from pwnlib.abi import linux_amd64_syscall as abi
  from six import text_type
@@ -54,7 +54,7 @@ Example:
        ...               'PROT_READ | PROT_WRITE | PROT_EXEC',
        ...               'MAP_PRIVATE | MAP_ANONYMOUS',
        ...               -1, 0).rstrip())
-            /* call mmap(0, 4096, 'PROT_READ | PROT_WRITE | PROT_EXEC', 'MAP_PRIVATE | MAP_ANONYMOUS', -1, 0) */
+            /* call mmap(0, 0x1000, 'PROT_READ | PROT_WRITE | PROT_EXEC', 'MAP_PRIVATE | MAP_ANONYMOUS', -1, 0) */
            push (MAP_PRIVATE | MAP_ANONYMOUS) /* 0x22 */
            pop r10
            push -1
@@ -84,6 +84,20 @@ Example:
            push SYS_open /* 2 */
            pop rax
            syscall
+        >>> print(shellcraft.amd64.write(0, '*/', 2).rstrip())
+            /* write(fd=0, buf='\x2a/', n=2) */
+            /* push b'\x2a/\x00' */
+            push 0x1010101 ^ 0x2f2a
+            xor dword ptr [rsp], 0x1010101
+            mov rsi, rsp
+            xor edi, edi /* 0 */
+            push 2
+            pop rdx
+            /* call write() */
+            push SYS_write /* 1 */
+            pop rax
+            syscall
+
 </%docstring>
 <%
  append_cdq = False
@@ -95,13 +109,13 @@ Example:
      if syscall is None:
          args = ['?']
      else:
-          args = [repr(syscall)]
+          args = [pretty(syscall, False)]

  for arg in [arg0, arg1, arg2, arg3, arg4, arg5]:
      if arg is None:
          args.append('?')
      else:
-          args.append(repr(arg))
+          args.append(pretty(arg, False))
  while args and args[-1] == '?':
      args.pop()
  syscall_repr = syscall_repr % ', '.join(args)
@@ -1,6 +1,6 @@
 <%
  from pwnlib.util import packing
-  from pwnlib.shellcraft import amd64
+  from pwnlib.shellcraft import amd64, pretty
  from pwnlib.shellcraft.amd64 import pushstr
  from pwnlib import constants
  from pwnlib.shellcraft.registers import amd64 as regs
@@ -31,7 +31,7 @@ Example:
        /* push 1 */
        push 1
    >>> print(pwnlib.shellcraft.amd64.push(256).rstrip())
-        /* push 256 */
+        /* push 0x100 */
        push 0x1010201 ^ 0x100
        xor dword ptr [rsp], 0x1010201
    >>> with context.local(os = 'linux'):
@@ -58,7 +58,7 @@ Example:
        pass
 %>
 %if not is_reg:
-    /* push ${repr(value_orig)} */
+    /* push ${pretty(value_orig, False)} */
    ${re.sub(r'^\s*/.*\n', '', amd64.pushstr(packing.pack(value), False), 1)}
 % else:
    push ${value}
@@ -77,7 +77,7 @@ Args:
    else:
        extend = b'\x00'
 %>\
-    /* push ${repr(string)} */
+    /* push ${pretty(string, False)} */
 % for word in lists.group(8, string, 'fill', extend)[::-1]:
 <%
    sign = packing.u64(word, endian='little', sign='signed')
@@ -1,4 +1,4 @@
-<% from pwnlib.shellcraft import amd64 %>
+<% from pwnlib.shellcraft import amd64, pretty %>
 <%docstring>
 Pushes an array/envp-style array of pointers onto the stack.

@@ -25,14 +25,14 @@ word_size = 8
 offset = len(array_str) + word_size

 %>\
-    /* push argument array ${repr(array)} */
+    /* push argument array ${pretty(array, False)} */
    ${amd64.pushstr(array_str)}
    ${amd64.mov(reg, 0)}
    push ${reg} /* null terminate */
 % for i,arg in enumerate(reversed(array)):
    ${amd64.mov(reg, offset + word_size*i - len(arg))}
    add ${reg}, rsp
-    push ${reg} /* ${repr(arg)} */
+    push ${reg} /* ${pretty(arg, False)} */
    <% offset -= len(arg) %>\
 % endfor
    ${amd64.mov(reg,'rsp')}
@@ -36,7 +36,7 @@ Example:
      if syscall is None:
          args = ['?']
      else:
-          args = [repr(syscall)]
+          args = [pretty(syscall, False)]

  for arg in [arg0, arg1, arg2, arg3, arg4, arg5]:
      if arg is None:
@@ -12,6 +12,7 @@ Args:
  from pwnlib.asm import cpp
  from pwnlib.util.safeeval import expr
  from pwnlib.constants.linux import arm as consts
+  from pwnlib.shellcraft import pretty
  filepath_lab, after = label("filepath"), label("after")
  filepath_out = [hex(ord(c)) for c in filepath]
  while True:
@@ -31,7 +32,7 @@ Args:
    svc SYS_open
    b ${after}

-    /* The string ${repr(str(filepath))} */
+    /* The string ${pretty(str(filepath), False)} */
 ${filepath_lab}: .byte ${filepath_out}

 ${after}:
@@ -1,5 +1,5 @@
 <%
-  from pwnlib.shellcraft import arm
+  from pwnlib.shellcraft import arm, pretty
  from pwnlib.constants import eval
  from pwnlib.abi import linux_arm_syscall as abi
  from six import text_type
@@ -14,7 +14,7 @@ Any of the arguments can be expressions to be evaluated by :func:`pwnlib.constan
 Example:

    >>> print(shellcraft.arm.linux.syscall(11, 1, 'sp', 2, 0).rstrip())
-        /* call syscall(11, 1, 'sp', 2, 0) */
+        /* call syscall(0xb, 1, 'sp', 2, 0) */
        mov  r0, #1
        mov  r1, sp
        mov  r2, #2
@@ -57,13 +57,13 @@ Example:
      if syscall is None:
          args = ['?']
      else:
-          args = [repr(syscall)]
+          args = [pretty(syscall, False)]

  for arg in [arg0, arg1, arg2, arg3, arg4, arg5]:
      if arg is None:
          args.append('?')
      else:
-          args.append(repr(arg))
+          args.append(pretty(arg, False))
  while args and args[-1] == '?':
      args.pop()
  syscall_repr = syscall_repr % ', '.join(args)
@@ -1,5 +1,6 @@
 <% from pwnlib.util import lists, packing, fiddling %>
 <% from pwnlib.shellcraft.arm import push %>
+<% from pwnlib.shellcraft import pretty %>
 <% import six %>
 <%page args="string, append_null = True, register='r7'"/>
 <%docstring>
@@ -32,7 +33,7 @@ Examples:
    while len(string) % 4:
        string += b'\x41'
 %>\
-    /* push ${repr(string)} */
+    /* push ${pretty(string, False)} */
 % for word in packing.unpack_many(string, 32)[::-1]:
    ${push(word, register)}
 % endfor
@@ -1,4 +1,4 @@
-<% from pwnlib.shellcraft import arm %>
+<% from pwnlib.shellcraft import arm, pretty %>
 <%docstring>
 Pushes an array/envp-style array of pointers onto the stack.

@@ -25,13 +25,13 @@ word_size = 4
 offset = len(array_str) + word_size

 %>\
-    /* push argument array ${repr(array)} */
+    /* push argument array ${pretty(array, False)} */
    ${arm.pushstr(array_str)}
    ${arm.push(0)} /* null terminate */
 % for i,arg in enumerate(reversed(array)):
    ${arm.mov(reg, offset + word_size*i - len(arg))}
    add ${reg}, sp
-    ${arm.push(reg)} /* ${repr(arg)} */
+    ${arm.push(reg)} /* ${pretty(arg, False)} */
    <% offset -= len(arg) %>\
 % endfor
    ${arm.mov(reg,'sp')}
@@ -39,7 +39,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -98,4 +98,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -39,7 +39,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -98,4 +98,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -39,7 +39,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -98,4 +98,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -41,7 +41,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -100,4 +100,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -42,7 +42,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -101,4 +101,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -40,7 +40,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -99,4 +99,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -39,7 +39,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -98,4 +98,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -43,7 +43,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -102,4 +102,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -39,7 +39,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -98,4 +98,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -39,7 +39,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -98,4 +98,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -39,7 +39,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -98,4 +98,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -40,7 +40,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -99,4 +99,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -42,7 +42,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -101,4 +101,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -39,7 +39,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -98,4 +98,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -40,7 +40,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -99,4 +99,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -41,7 +41,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -100,4 +100,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -5,7 +5,7 @@ import pwnlib.constants
 import pwnlib.shellcraft
 import six
 %>
-<%docstring>break_(vararg_0, vararg_1, vararg_2, vararg_3, vararg_4) -> str
+<%docstring>break(vararg_0, vararg_1, vararg_2, vararg_3, vararg_4) -> str

 Invokes the syscall break.

@@ -39,7 +39,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -86,7 +86,7 @@ Returns:
    else:
        raise Exception("Could not locate any syscalls: %r" % syscalls)
 %>
-    /* break_(${', '.join(syscall_repr)}) */
+    /* break(${', '.join(syscall_repr)}) */
 %for name, arg in string_arguments.items():
    ${pwnlib.shellcraft.pushstr(arg, append_null=(b'\x00' not in arg))}
    ${pwnlib.shellcraft.mov(regs[argument_names.index(name)], abi.stack)}
@@ -39,7 +39,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -98,4 +98,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -39,7 +39,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -98,4 +98,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -41,7 +41,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -100,4 +100,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -40,7 +40,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -99,4 +99,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -40,7 +40,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -99,4 +99,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -39,7 +39,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -98,4 +98,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -40,7 +40,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -99,4 +99,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -41,7 +41,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -100,4 +100,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -39,7 +39,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -98,4 +98,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -39,7 +39,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -98,4 +98,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -40,7 +40,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -99,4 +99,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -40,7 +40,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -99,4 +99,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -42,7 +42,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -101,4 +101,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -40,7 +40,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -99,4 +99,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -43,7 +43,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -102,4 +102,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -39,7 +39,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -98,4 +98,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -41,7 +41,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -100,4 +100,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -40,7 +40,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -99,4 +99,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -40,7 +40,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -99,4 +99,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -39,7 +39,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -98,4 +98,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -39,7 +39,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -98,4 +98,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -40,7 +40,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -99,4 +99,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -41,7 +41,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -100,4 +100,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -39,7 +39,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -98,4 +98,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -39,7 +39,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -98,4 +98,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -42,7 +42,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -101,4 +101,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -39,7 +39,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -98,4 +98,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -43,7 +43,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -102,4 +102,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -42,7 +42,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -101,4 +101,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -39,7 +39,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -98,4 +98,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -40,7 +40,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -99,4 +99,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -39,7 +39,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -98,4 +98,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -41,7 +41,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -100,4 +100,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -39,7 +39,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -98,4 +98,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -39,7 +39,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -98,4 +98,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -42,7 +42,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -101,4 +101,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -39,7 +39,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -98,4 +98,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
@@ -39,7 +39,7 @@ Returns:

    for name, arg in zip(argument_names, argument_values):
        if arg is not None:
-            syscall_repr.append('%s=%r' % (name, arg))
+            syscall_repr.append('%s=%s' % (name, pwnlib.shellcraft.pretty(arg, False)))

        # If the argument itself (input) is a register...
        if arg in allregs:
@@ -98,4 +98,4 @@ Returns:
    ${pwnlib.shellcraft.push(arg)}
 %endfor
    ${pwnlib.shellcraft.setregs(register_arguments)}
-    ${pwnlib.shellcraft.syscall(syscall)}
+    ${pwnlib.shellcraft.syscall(syscall)}
Author	SHA1	Message	Date
Arusekk	d07a86d556	Release 4.4.0	2021-03-29 11:49:32 +02:00
Arusekk	b76d045a40	Release 4.4.0beta1	2020-11-30 00:27:41 +01:00
Arusekk	957a5a5835	Release 4.3.1	2020-11-30 00:26:51 +01:00
Arusekk	2efb5a0a73	Merge branch 'issue-1427' into stable	2020-11-30 00:25:25 +01:00
Arusekk	442fedeef0	Auto-generated files	2020-11-30 00:24:01 +01:00
Arusekk	138188eb1c	Fix pwntools shellcraft SSTI vulnerability This looks like the first major pwntools vuln! And it even got its own task on Hitcon CTF 2020. Fixes #1427	2020-11-30 00:23:49 +01:00
Arusekk	5dfcb53964	Apparently python 2 does not have lru_cache.	2020-11-29 14:04:24 +01:00
Arusekk	e004aa6566	Release 4.4.0beta0	2020-10-20 17:44:56 +02:00
Arusekk	23f5075d93	Merge branch 'beta' into dev	2020-10-20 17:12:12 +02:00
peace-maker	cde51065bf	Update libcdb buildid offsets (#1703 ) * Update libcdb buildid offsets Recent libcs from Debian and Ubuntu have different offsets for the build id. * Update CHANGELOG	2020-10-20 11:52:33 +02:00
Heap CrashandArusekk	e47c65c6fc	Implement property getter/setter for context.newline, and make tubes honor it (#1541 ) * Implement property getter/setter for context.newline, and make tubes honor it The default newline can now be set context-wide, or per-tube. * [changelog] Update for 1541 * [docs] Use r-prefix for embedded newlines Co-authored-by: Arusekk <[email protected]>	2020-10-14 01:08:37 +02:00
Kyle ZengandArusekk	d6859eb744	FmtStr module enhancement (#1696 ) * use non-greedy operator to handle corner cases where the program output contains END in it * END can appear in the string leak Co-authored-by: Arusekk <[email protected]> Co-authored-by: Arusekk <[email protected]>	2020-10-13 22:33:50 +02:00
Aapo SaaristoandArusekk	79cd784383	Place ROP cache in user's homedir like "regular" cache (#1453 ) * Keep ROP cache in user's home like regular cache I don't have statistics numbers on which would be more likely to be writable, an user's home directory or the OS's temp directory, but seems to me it'd make sense to try and write all caches to the same location. Optimally this would be easily configurable to allow adjusting to different set-ups, obviously. * Use cache_dir instead Co-authored-by: Arusekk <[email protected]>	2020-10-13 19:51:28 +02:00
Mariusz SkoneczkoandArusekk	1c0ca55627	Actually import `requests` when doing `from pwn import ` (#1687 ) Actually import `requests` when doing `from pwn import ` As per documentation, we claim to be importing `requests` globally (https://github.com/Gallopsled/pwntools/blame/dev/docs/source/globals.rst#L100) We should actually do this :) Update CHANGELOG Co-authored-by: Arusekk <[email protected]>	2020-10-05 12:49:16 +02:00
Mariusz Skoneczko	1d6aa2e276	Remove python2 shebangs where appropriate (#1692 ) * Remove python2 shebangs where appropriate * Update CHANGELOG.md	2020-10-05 12:32:02 +02:00
Ron	a0b3b24984	Fix documentation of #1667 (#1693 ) * add parameter max_subs to __init__ (cherry picked from commit d331be51d3bdb791d5d19d9d9b8d60706dddf5fa) * Beautify doc string (cherry picked from commit ceebf47a956073eee43efe0a5f6e9399e6a1ec65) * Fix some typos (cherry picked from commit 6bbbdcedf4c8ae075c30d01d447c372925f0a29d) * Update CHANGELOG.md * Revert changelog https://github.com/Gallopsled/pwntools/pull/1693#discussion_r499236894 * Trigger CI	2020-10-05 11:08:53 +02:00
Arusekk	26ccb97f63	Speak as simple as it can be (#1694 ) Fixes #1434	2020-10-04 22:42:59 +02:00
Arusekk	23ac852023	Make bruteforcewrap picklable (#1685 ) Closes #1665	2020-10-01 20:08:51 +02:00
Mariusz SkoneczkoandArusekk	bcb6e066aa	Add `__setattr__` and `__call__` interfaces to `ROP` for setting registers (closes #1636 ) (#1688 ) * Implement ROP.__call__ shorthand for setting registers * Fix broken doctests by ensuring they set context.arch * Implement ROP.__setattr__ shorthand for setting registers * Update CHANGELOG.md Co-authored-by: Arusekk <[email protected]>	2020-10-01 20:07:45 +02:00
152334H	2a5aac1101	ROPGadget multibr hotfix (#1682 ) * fix --multibr issue * modify changelong * In which I learn how to count * put doctest for ROP().syscall in unfortunate place * fix context malapropism	2020-10-01 19:50:44 +02:00
RonandArusekk	dc8d0e310c	I386 ascii shellcode (#1667 ) * Add module ascii_shellcode * Add doctests * Make the ascii_shellcode module accessible from pwn star import * Remove unused imports * Update docstr * Update CHANGELOG.md * Also test private functions * Undo accidental modification of CHANGELOG.md * Fix python 2 * Fix python 2 doctests * Use bytes object in doctests instead of converting from/to hex strings * Add doctest to shellcraft>asciify>run shellcode * Move to pwnlib.encoders.i386 * Fix python 2 * Apply some of the suggestions from Arusekk's code review Co-authored-by: Arusekk <[email protected]> * Fix some broken code from the suggestions https://github.com/Gallopsled/pwntools/pull/1667#discussion_r491699166 https://github.com/Gallopsled/pwntools/pull/1667#discussion_r491700154 https://github.com/Gallopsled/pwntools/pull/1667#discussion_r491700397 * Beautify code by using bytearrays everywhere https://github.com/Gallopsled/pwntools/pull/1667#discussion_r491698062 https://github.com/Gallopsled/pwntools/pull/1667#discussion_r491701007 https://github.com/Gallopsled/pwntools/pull/1667#discussion_r491700313 https://github.com/Gallopsled/pwntools/pull/1667#discussion_r491700853 https://github.com/Gallopsled/pwntools/pull/1667#discussion_r491698916 https://github.com/Gallopsled/pwntools/pull/1667#discussion_r491699243 * Fix python2 doctests Forgot to update a few doctests to use bytearrays instead of bytes * Try to improve test coverage Test correctness of avoid parameter processing * Remove unused imports Co-authored-by: Arusekk <[email protected]>	2020-09-26 10:59:21 +02:00
152334H	72ca730f4b	ROPGadget multibr (#1678 ) * ROPGadget multibr * Update CHANGELOG.md * Fix docstrings to match	2020-09-19 16:09:05 +02:00
Jan Mazur	6b7c3d99c4	Gdbserver now correctly accepts multiple libraries in LD_PRELOAD and LD_LIBRARY_PATH (#1675 ) * Gdbserver now correctly accepts multiple libraries in LD_PRELOAD and LD_LIBRARY_PATH. * modify changelog	2020-09-17 19:23:02 +02:00
152334H	4dec08b4bd	ROP: add base= argument for .chain() and .dump() (#1673 ) * Allow using specific base for ROP.chain() and ROP.dump() * Update CHANGELOG.md	2020-09-13 20:32:29 +02:00
Jacopo Tediosi	9ccf404dde	Wrong doc for recvline_endswith() (#1661 ) * Wrong doc of recvline_endswith() * Fixed "see also" link	2020-08-29 20:10:23 +02:00
magrasandArusekk	4b5969f582	Fix syscall instruction lists for SROP on `i386` and `amd64` (#1669 ) All three instructions: `int 0x80`, `sysenter`, and `syscall` require different stack frames and registers to pass arguments, but `ROP._srop_call` uses them interchangeably. This fix limits syscall instruction lists to gadgets that work. Co-authored-by: Arusekk <[email protected]>	2020-08-29 14:24:52 +02:00
magras	fb2bf934ac	Fix migration to another ROP (#1668 )	2020-08-29 14:22:32 +02:00
Arusekk	df76e24e7c	Fix SSL timeout error on py2 (#1660 ) Turns out that python 2 does not raise correct socket.timeout, but SSLError instead. With no errno. Just a message that might be localized in some circumstances. THIS IS NOT THE ONLY TIME PYTHON 2 IS CAUSING PROBLEMS. Time to stop using it, dear exploit developers. It is dead now. But here you are: the simple fix. Closes #1356	2020-08-17 18:37:37 +02:00
Arusekk	f98c4fbe2a	Disable term if initialization fails (#1659 ) Closes #1658	2020-08-17 18:37:13 +02:00
Heap Crash	9e0aa3200c	[docker] Upgrade Docker images of Pwntools to use Python3 (#1654 ) * [docker] Upgrade Docker images of Pwntools to use Python3 Also installs qemu-user-static and various binutils packages for building (binutils) and running (qemu) cross-arch binaries. Fixes #1500 * Update CHANGELOG * Switch to Python3 for stable/beta/dev Docker images * [changelog] Add missing links	2020-07-29 23:56:06 -05:00
Heap Crash	8080af8866	[shellcraft] Avoid recursive walk of all templates for command line (#1651 ) * [shellcraft] Avoid recursive walk of all templates for command line Fixes #1650 * Avoid double-fetch * Add changelog * [pylint] Only warn for additions	2020-07-27 19:24:31 -05:00
Mrmaxmeier	b6fc0f3536	tubes/remote: Support Server Name Indication and enable by default (#1644 ) * tubes/remote: Support Server Name Indication and enable by default This allows customizing the server_name via sni="custom" or sending the name specified in the host parameter via sni=True. We switch to the SSLContext.wrap_socket API because ssl.wrap_socket is deprecated and does not support SNI. Unfortunately, SSLContext.wrap_socket dropped some of the parameters that are supported by ssl.wrap_socket. These parameters have been moved to the SSLContext API and can now be used by passing a custom SSLContext to the ssl_context parameter of `remote`. * update CHANGELOG.md	2020-07-25 10:31:13 +02:00
Heap Crash	556685e150	[ci] Disable pwnlib.ui tests for branch dev (#1647 ) These still run for all other branches and tags	2020-07-22 01:39:04 -05:00
Arusekk	eb60b5d6b6	Enhance gdb error message when unable to launch binary (#1614 ) * Enhance gdb error message when unable to launch A common issue is when the binary is not executable, or the binary is simply missing. * Use six.ensure_str	2020-07-11 23:39:24 -05:00
Heap Crash	84a139f55b	[template] Drop into a shell if downloading the file fails (#1633 ) * [ssh] An error should be thrown when download fails, not a silent failure * [changelog] Add to changelog	2020-07-11 23:38:40 -05:00
Heap Crash	70f3b6fa79	[tests] Change test slightly so that failing output will be emitted (#1634 ) * [tests] Change test slightly so that failing output will be emitted * Disable flaky UI test on Github Actions * [ui] Try a sleep rather than disabling tests	2020-07-11 23:37:54 -05:00
Arusekk	2d45903ee3	Merge branch 'beta' into dev	2020-07-11 16:26:10 +02:00
Heap Crash	a8d34166c4	[ci] Prevent And-roid AVD tests from running every force-push (#1641 ) Dash is to prevent triggering installation due to And-roid reference	2020-07-10 13:33:52 -05:00
Heap Crash	a6edf2689d	[ci] Add pylint stage (#1640 )	2020-07-10 13:25:53 -05:00
heapcrash	3940631e21	Silence module-not-imported warning from coverage	2020-07-10 12:29:34 -05:00
heapcrash	7141e93243	Merge branch 'beta' into dev	2020-07-10 12:26:04 -05:00
Heap Crash	f1d8d5b8fe	[term] Automatically set PWNLIB_NOTERM when running inside Jupyter (#1632 ) * [term] Automatically set PWNLIB_NOTERM when running inside Jupyter * [changelog] Update changelog	2020-07-10 00:58:52 -05:00
ArusekkandHeap Crash	48a482df24	Enhance tubes.ssh bytes handling (#1602 ) * Enhance tubes.ssh bytes handling Closes #1437 * Add tests * grep is actually nasty * Update CHANGELOG.md Co-authored-by: Heap Crash <[email protected]>	2020-07-10 00:37:21 -05:00
Heap Crash	08ab1b6adf	[docs] Add a link to the tutorials (#1631 )	2020-07-10 00:29:58 -05:00
Jakub KądziołkaandArusekk	2c33601a86	Add a bfdname for msp430 to make asm and disasm work (#1606 ) * Add a bfdname for msp430 to make asm and disasm work * Add a bfdname for s390 to make asm and disasm work for all architectures * Add tests for new bfdnames * ci: Add binutils for newly-tested architectures Co-authored-by: Arusekk <[email protected]>	2020-07-08 01:15:46 +02:00
Arusekk	55552cd6a2	Merge branch 'beta' into dev	2020-07-07 22:01:20 +02:00
Asger Hautop Drewsen	7e0e644564	Fix cyclic cli for 64 bit integers (#1616 ) * Fix cyclic cli for 64 bit integers * Update changelog * Use bytes instead of word_size	2020-07-07 21:48:28 +02:00
Jakub Kądziołka	ca06098649	Fix documentation formatting for pwnlib.util.packing.flat (#1624 )	2020-07-03 23:30:28 -05:00
heapcrash	d2b0a5913b	[changelog] Update release date and version list	2020-07-03 20:31:52 -05:00
heapcrash	2fafbfb291	Merge branch 'beta-staging' into dev	2020-07-03 20:13:35 -05:00
Heap Crash	08d900994d	[changelog] Update changelog for new release (#1626 )	2020-07-03 20:13:17 -05:00
heapcrash	427066d937	[memleak] Fix missing import	2020-07-03 20:12:32 -05:00
heapcrash	0337387f97	Add Python3 to supported languages for PyPi	2020-07-03 19:45:49 -05:00
heapcrash	6afccefb01	Merge branch 'beta' into dev	2020-07-03 19:42:03 -05:00
heapcrash	db7312b43f	Merge branch 'stable' into beta	2020-07-03 19:41:45 -05:00
heapcrash	89e3f2bee0	[dev] Version bump for dev	2020-07-03 19:39:19 -05:00