pwn 0.5.720 → 0.5.722

data/lib/pwn/ai/agent/mistakes.rb

@@ -127,6 +127,31 @@ module PWN
           'other'
         end
 
+        public_class_method def self.family(opts = {})
+          klass = error_class(opts)
+          case klass
+          when 'docker_registry_auth', 'auth_denied' then 'auth_denied'
+          when 'name_conflict' then 'name_conflict'
+          when 'parse_error' then 'parse_error'
+          when 'missing_path', 'enoent' then 'missing_path'
+          when 'perm_denied', 'socket_perm', 'eacces' then 'permission_capability'
+          when 'net_unreach' then 'network_unreachable'
+          when 'timeout' then 'timeout'
+          else 'other'
+          end
+        end
+
+        FAMILY_FIXES = {
+          'auth_denied' => 'check registry credentials / image name; do NOT ls paths',
+          'name_conflict' => 'rename the resource or remove the existing name; do NOT ls paths',
+          'parse_error' => 'fix template/JSON syntax; do NOT ls paths',
+          'missing_path' => 'Path missing. ls/test -e the parent first, then run. Do not retry the same missing path.',
+          'permission_capability' => 'Raw sockets need CAP_NET_RAW. Do not retry open_sockraw. Use connect-scan or Sock.',
+          'network_unreachable' => 'network unreachable; check routing/VPN, do not ls paths',
+          'timeout' => 'deadline too short; retry same payload with timeout += 180',
+          'other' => 'inspect the exact error class before retrying'
+        }.freeze
+
         # Supported Method Parameters::
         # entry = PWN::AI::Agent::Mistakes.find(
         #   signature: 'optional - exact signature to fetch',
@@ -630,10 +655,38 @@ module PWN
 
           parts = ["seen #{m[:count]}× across #{Array(m[:sessions]).length} session(s), sig=#{m[:signature]}"]
           parts << 'REGRESSED (previous fix did not hold)' if m[:regressed]
-          parts << "KNOWN FIX: #{m[:fix]}" if m[:fix].to_s.strip.length.positive?
+          fam = family(error: opts[:error] || m[:error])
+          fam_fix = FAMILY_FIXES[fam]
+          stored = m[:fix].to_s.strip
+          stored = '' if stored.match?(%r{ls/test -e the parent}) && fam != 'missing_path'
+          stored = '' if m[:hint_confidence].to_f.negative?
+          stored = '' if stored.include?('[UNVERIFIED]')
+          hint = stored.empty? ? fam_fix : stored
+          parts << "KNOWN FIX: #{hint}" unless hint.to_s.empty?
           "[pwn-ai/mistakes] #{parts.join(' | ')}"
         end
 
+        public_class_method def self.note_hint_outcome(opts = {})
+          sig = (opts[:signature] || signature(tool: opts[:tool], error: opts[:error])).to_s
+          return nil if sig.empty?
+
+          store = load
+          m = store[sig.to_sym]
+          return nil unless m
+
+          m[:hint_outcomes] = m[:hint_outcomes].to_i + 1
+          unless opts[:helped]
+            m[:hint_misses] = m[:hint_misses].to_i + 1
+            if m[:hint_misses].to_i >= 3
+              m[:fix] = "[UNVERIFIED] #{m[:fix]}"
+              m[:hint_confidence] = -1.0
+            end
+          end
+          store[sig.to_sym] = m
+          save(store: store)
+          m
+        end
+
         # Supported Method Parameters::
         # bool = PWN::AI::Agent::Mistakes.correction?(request: user_text)
 
@@ -988,6 +1041,19 @@ module PWN
               signature: 'optional - signature value consumed by #effective_count'
             )
 
+            # Map an error string onto a coarse family (auth vs path vs parse).
+            #{self}.family(
+              error: 'required - raw error text'
+            )
+
+            # Record whether an injected KNOWN FIX helped; demote after 3 misses.
+            #{self}.note_hint_outcome(
+              tool: 'optional - tool name',
+              error: 'optional - raw error text',
+              signature: 'optional - explicit signature',
+              helped: 'optional - true when the hint resolved the failure'
+            )
+
             # Print the AUTHOR(S) string for this module.
             #{self}.authors
           "

data/lib/pwn/ai/agent/registry.rb

@@ -113,6 +113,7 @@ module PWN
         # )
 
         public_class_method def self.definitions(opts = {})
+          eager_load!
           enabled = opts[:enabled]
           enabled = enabled.map(&:to_s) if enabled
           pool = @entries.values.select { |e| (enabled.nil? || enabled.include?(e.toolset)) && safe_check(entry: e) }
@@ -296,6 +297,10 @@ module PWN
         # )
 
         public_class_method def self.discover(opts = {})
+          eager_load!(opts)
+        end
+
+        public_class_method def self.eager_load!(opts = {})
           force = opts[:force] ||= false
           return @entries.keys if @discovered && !force
 
@@ -311,6 +316,19 @@ module PWN
           @entries.keys
         end
 
+        public_class_method def self.selftest(opts = {})
+          _dry = opts[:dry_run]
+          eager_load!
+          tools_dir = File.join(__dir__, 'tools')
+          files = Dir[File.join(tools_dir, '*.rb')]
+          rows = @entries.map do |name, e|
+            schema = e.schema.is_a?(Hash)
+            required = Array(e.schema&.dig(:parameters, :required) || e.schema&.dig('parameters', 'required'))
+            { name: name, schema_valid: schema, handler: !e.handler.nil?, required: required }
+          end
+          { tools: rows, files: files.length, registered: @entries.length, ok: rows.length >= files.length }
+        end
+
         private_class_method def self.safe_check(opts = {})
           entry = opts[:entry]
           entry.check.call
@@ -428,6 +446,16 @@ module PWN
               force: 'optional - re-require tool files even if already discovered (default false)'
             )
 
+            # Eager-load every tools/*.rb so Registry.definitions works in a cold REPL.
+            #{self}.eager_load!(
+              force: 'optional - re-require tool files even if already discovered (default false)'
+            )
+
+            # Schema/handler contract check for every registered tool.
+            #{self}.selftest(
+              dry_run: 'optional - reserved dry-run flag'
+            )
+
             # Print the AUTHOR(S) string for this module.
             #{self}.authors
           "

data/lib/pwn/ai/agent/reward.rb

@@ -143,17 +143,21 @@ module PWN
           #       confidence handles that in the bandit blend.
           eng = (PWN::Env.dig(:ai, :active) if defined?(PWN::Env)).to_s.downcase
           local = eng == 'ollama' || eng.empty?
-          if v[:source].to_s == 'heuristic'
-            v[:confidence] = local ? 0.35 : 0.5
+          if v[:source].to_s == 'heuristic' || v[:source].to_s.start_with?('heuristic')
+            toolbacked = Array(trace).any?
+            v[:heuristic_class] = toolbacked ? :toolbacked : :textual
+            v[:source] = :heuristic
+            v[:confidence] = if toolbacked
+                               local ? 0.55 : 0.7
+                             else
+                               local ? 0.35 : 0.5
+                             end
             raw = v[:score].to_f
             v[:score_raw] = raw
-            # preserve empty / failure-language / polite floors exactly (raw <= 0.15)
-            # and pass-through non-capped heuristics via the default arm.
-            if local && raw > 0.15 && trace.empty? && raw >= 0.6 && final.length < 400
+            if !toolbacked && local && raw > 0.15 && trace.empty? && raw >= 0.6 && final.length < 400
               v[:score] = [raw, 0.45].min
               v[:rationale] = "#{v[:rationale]} | P1:local_no_trace_cap"
-            elsif local && raw > 0.15 && trace.length < 2 && raw >= 0.85
-              # thin-evidence local highs: mild shrink toward 0.5
+            elsif !toolbacked && local && raw > 0.15 && trace.length < 2 && raw >= 0.85
               v[:score] = (0.5 + ((raw - 0.5) * 0.7)).round(3).clamp(0.0, 1.0)
             else
               v[:score] = raw
@@ -203,10 +207,11 @@ module PWN
           v[:engine] = eng
           v[:task_class] = request.match?(/analy[sz]e|summar|strength|weakness|fitness/i) ? 'analysis' : 'operational'
           if pass
-            v[:score] = [v[:score].to_f, 0.7].max
-            v[:score] = [v[:score].to_f, 0.70].min
+            score = v[:score].to_f
+            v[:score] = [score, 0.6].max
             v[:success] = true if prec
             v[:verifier_verdict] ||= :pass
+            v[:verdict] = :solved
           end
           v[:score_components] ||= {
             judge: v[:score].to_f,
@@ -1099,7 +1104,7 @@ module PWN
         CHEAP_ORM_TEMP    = 0.1
         CHEAP_ORM_TRACE_N = 12
         ORM_SAMPLE_WEIGHT = 1.0
-        HEURISTIC_SAMPLE_WEIGHT = 0.25
+        HEURISTIC_SAMPLE_WEIGHT = 0.45
         ERROR_SAMPLE_WEIGHT = 0.15
         ENGINE_CHAT_MODS = {
           openai: 'PWN::AI::OpenAI',

data/lib/pwn/ai/agent/tool_guard.rb

@@ -5,6 +5,9 @@ require 'json'
 require 'fileutils'
 require 'securerandom'
 require 'time'
+require 'openssl'
+require 'uri'
+require 'base64'
 
 module PWN
   module AI
@@ -41,7 +44,12 @@ module PWN
         end
 
         public_class_method def self.placeholder?(opts = {})
-          PLACEHOLDER_RX.match?(opts[:text].to_s)
+          s = opts[:text].to_s.dup
+          s.gsub!(/<<[-~]?\s*(['"])(\w+)\1.*?^\2\s*$/m, ' ')
+          s.gsub!(/<<[-~]?\s*(\w+).*?^\1\s*$/m, ' ')
+          s.gsub!(/'[^']*'/, "''")
+          s.gsub!(/"([^"\\]|\\.)*"/, '""')
+          PLACEHOLDER_RX.match?(s)
         rescue StandardError
           false
         end
@@ -60,18 +68,36 @@ module PWN
         end
 
         public_class_method def self.mint_canary(opts = {})
-          n = (opts[:bytes] || 8).to_i
-          n = 8 if n <= 0
-          tok = "PWNCANARY#{SecureRandom.hex(n)}"
+          _bytes = opts[:bytes]
+          turn = (opts[:turn] || Thread.current[:pwn_loop_iter] || 0).to_i
+          sid = (opts[:session_id] || Thread.current[:pwn_session_id] || 'sess').to_s
+          key = (Thread.current[:pwn_canary_key] ||= SecureRandom.hex(16))
+          tok = OpenSSL::HMAC.hexdigest('SHA256', key, "#{sid}:#{turn}")[0, 16]
+          hist = Thread.current[:pwn_canary_hist] ||= []
+          hist << tok
+          hist.shift while hist.length > 4
           Thread.current[:pwn_canary] = tok
           tok
         end
 
         public_class_method def self.canary_leak?(opts = {})
-          tok = Thread.current[:pwn_canary].to_s
-          return false if tok.empty?
-
-          opts[:text].to_s.include?(tok)
+          text = opts[:text].to_s
+          toks = Array(Thread.current[:pwn_canary_hist])
+          toks << Thread.current[:pwn_canary].to_s
+          toks = toks.reject(&:empty?).uniq
+          return false if toks.empty?
+
+          require 'base64'
+          toks.any? do |tok|
+            next true if text.include?(tok)
+
+            b64 = Base64.strict_encode64(tok)
+            b64u = Base64.urlsafe_encode64(tok)
+            hex = tok.each_byte.map { |b| format('%02x', b) }.join
+            enc = URI.encode_www_form_component(tok)
+            rot = tok.tr('A-Za-z', 'N-ZA-Mn-za-m')
+            text.include?(b64) || text.include?(b64u) || text.include?(hex) || text.include?(enc) || text.include?(rot)
+          end
         end
 
         public_class_method def self.injection_score(opts = {})
@@ -475,6 +501,16 @@ module PWN
           nil
         end
 
+        public_class_method def self.scope_check!(opts = {})
+          return nil unless defined?(Engagement)
+
+          Engagement.deny_if_out_of_scope(
+            args: opts[:args],
+            command: opts[:command] || opts[:args].inspect,
+            text: opts[:text]
+          )
+        end
+
         public_class_method def self.rfc1918?(opts = {})
           oct = opts[:ip].to_s.split('.').map(&:to_i)
           return false unless oct.length == 4
@@ -568,7 +604,9 @@ module PWN
 
             # Mint a per-thread session canary token stored on Thread.current.
             #{self}.mint_canary(
-              bytes: 'optional - hex length (defaults to 8)'
+              bytes: 'optional - unused reserved length (HMAC uses 16 hex chars)',
+              turn: 'optional - turn number mixed into the HMAC',
+              session_id: 'optional - session id mixed into the HMAC'
             )
 
             # True when text contains the current session canary.
@@ -729,6 +767,13 @@ module PWN
               args: 'required - Hash of tool arguments'
             )
 
+            # Block network args outside the active engagement scope.
+            #{self}.scope_check!(
+              args: 'optional - Hash of tool arguments',
+              command: 'optional - command string to scan for hosts',
+              text: 'optional - free-form blob to scan'
+            )
+
             # Print the AUTHOR(S) string for this module.
             #{self}.authors
           "

data/lib/pwn/ai/agent/tools/artifacts.rb

@@ -45,17 +45,22 @@ PWN::AI::Agent::Registry.register(
         path: { type: 'string' },
         offset: { type: 'integer' },
         length: { type: 'integer' },
-        mode: { type: 'string', description: 'text|hex|base64' }
+        mode: { type: 'string', description: 'text|hex|base64' },
+        grep: { type: 'string' },
+        ref: { type: 'string' },
+        sha256: { type: 'string' }
       },
       required: %w[path]
     }
   },
   handler: lambda { |args|
     PWN::Plugins::ArtifactRegistry.read_page(
-      path: args[:path] || args['path'],
+      path: args[:path] || args['path'] || args[:ref] || args['ref'],
       offset: args[:offset] || args['offset'],
       length: args[:length] || args['length'],
-      mode: args[:mode] || args['mode']
+      mode: args[:mode] || args['mode'],
+      grep: args[:grep] || args['grep'],
+      sha256: args[:sha256] || args['sha256']
     )
   }
 )

data/lib/pwn/ai/agent/turn_finalizer.rb

@@ -227,6 +227,16 @@ module PWN
           ledger
         end
 
+        public_class_method def self.evidence_satisfied?(opts = {})
+          row = arbitrate(
+            request: opts[:request],
+            messages: opts[:messages] || opts[:trace],
+            paths: opts[:paths],
+            session_t0: opts[:session_t0]
+          )
+          row[:complete] == true && Array(row[:unmet]).empty?
+        end
+
         public_class_method def self.authors
           "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
         end
@@ -279,7 +289,16 @@ module PWN
 
             # Build path → {write,read} ledger from tool messages.
             #{self}.evidence_ledger(
-              messages: 'optional - Array of role/content hashes for this turn'
+              messages: 'optional - Array of role/content hashes'
+            )
+
+            # True when write-then-readback evidence satisfies the original request.
+            #{self}.evidence_satisfied?(
+              request: 'optional - original request text',
+              messages: 'optional - Array of role/content hashes',
+              trace: 'optional - alias for messages (Array of role/content hashes)',
+              paths: 'optional - Array of declared deliverable paths',
+              session_t0: 'optional - session start Time'
             )
 
             # Print the AUTHOR(S) string for this module.

data/lib/pwn/plugins/artifact_registry.rb

@@ -3,6 +3,7 @@
 require 'fileutils'
 require 'json'
 require 'digest'
+require 'time'
 
 module PWN
   module Plugins
@@ -50,13 +51,26 @@ module PWN
       end
 
       public_class_method def self.read_page(opts = {})
-        path = opts[:path].to_s
+        path = (opts[:path] || opts[:ref]).to_s
         raise 'ERROR: path is required' if path.empty?
         raise "ERROR: file not found: #{path}" unless File.file?(path)
 
+        raise 'ERROR: sha256 mismatch' if opts[:sha256].to_s != '' && Digest::SHA256.file(path).hexdigest != opts[:sha256].to_s
+
+        grep = opts[:grep].to_s
+        unless grep.empty?
+          rx = Regexp.new(grep, Regexp::IGNORECASE)
+          hits = []
+          File.foreach(path).with_index(1) do |ln, i|
+            hits << { line: i, text: ln.chomp } if ln.match?(rx)
+            break if hits.length >= 50
+          end
+          return { path: path, grep: grep, matches: hits }
+        end
+
         offset = opts[:offset].to_i
-        length = (opts[:length] || 4_096).to_i
-        length = 4_096 if length <= 0
+        length = (opts[:length] || 16_384).to_i
+        length = 16_384 if length <= 0
         mode = (opts[:mode] || 'text').to_s
         data = File.binread(path, length, offset).to_s
         case mode
@@ -70,6 +84,26 @@ module PWN
         end
       end
 
+      public_class_method def self.put(opts = {})
+        bytes = opts[:bytes]
+        src = opts[:path].to_s
+        bytes = File.binread(src) if bytes.nil? && File.file?(src)
+        raise 'ERROR: bytes or path is required' if bytes.nil?
+
+        sha = Digest::SHA256.hexdigest(bytes)
+        dir = File.join(ROOT, 'sha256', sha[0, 2])
+        FileUtils.mkdir_p(dir)
+        dest = File.join(dir, sha)
+        File.binwrite(dest, bytes) unless File.file?(dest)
+        meta = File.join(ROOT, 'manifest.jsonl')
+        FileUtils.mkdir_p(ROOT)
+        File.open(meta, 'a') do |f|
+          f.flock(File::LOCK_EX)
+          f.puts(JSON.generate(sha256: sha, size: bytes.bytesize, tool: opts[:tool], session: opts[:session_id], kind: opts[:kind], created_at: Time.now.utc.iso8601, source_path: src, dest: dest))
+        end
+        { sha256: sha, path: dest, size: bytes.bytesize }
+      end
+
       public_class_method def self.authors
         "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
       end
@@ -81,14 +115,14 @@ module PWN
 
           # Run register and return its result
           #{self}.register(
-            session_id: 'optional - session id value consumed by #register',
+            session_id: 'optional - pwn-ai session id that produced this artifact',
             path: 'required - filesystem path to read or write',
             kind: 'optional - kind value consumed by #register'
           )
 
           # Run list and return its result
           #{self}.list(
-            session_id: 'optional - session id value consumed by #list'
+            session_id: 'optional - pwn-ai session id whose artifacts to list'
           )
 
           # Read an artifact file and return sha256 plus a body cap.
@@ -96,12 +130,24 @@ module PWN
             path: 'required - filesystem path of a registered artifact'
           )
 
-          # Page an artifact as text, hex, or base64 from an offset.
+          # Store bytes under artifacts/sha256/<h2>/<hash> and append manifest.jsonl.
+          #{self}.put(
+            bytes: 'optional - raw bytes to store',
+            path: 'optional - filesystem path to read when bytes is omitted',
+            tool: 'optional - tool name for provenance',
+            session_id: 'optional - pwn-ai session id for provenance',
+            kind: 'optional - artifact kind'
+          )
+
+          # Page an artifact; grep: searches lines, ref: alias for path.
           #{self}.read_page(
             path: 'required - filesystem path of the artifact',
+            ref: 'optional - alias for path',
             offset: 'optional - byte offset (defaults to 0)',
-            length: 'optional - byte count (defaults to 4096)',
-            mode: 'optional - text, hex, or base64 (defaults to text)'
+            length: 'optional - byte count (defaults to 16384)',
+            mode: 'optional - text, hex, or base64 (defaults to text)',
+            grep: 'optional - regex to search instead of paging',
+            sha256: 'optional - expected sha256 of the file'
           )
 
           # Print the AUTHOR(S) string for this module.

data/lib/pwn/plugins/binary_parser.rb

@@ -120,7 +120,10 @@ module PWN
         end
         body = summary.merge(path: path, sha256: sha)
         File.write(art, JSON.pretty_generate(body))
-        body.merge(artifact: art, cached: false)
+        facts_dir = File.join(Dir.home, '.pwn', 'engagements', 'default', 'binaries', sha)
+        FileUtils.mkdir_p(facts_dir)
+        File.write(File.join(facts_dir, 'facts.json'), JSON.pretty_generate(body))
+        body.merge(artifact: art, cached: false, facts: File.join(facts_dir, 'facts.json'))
       end
 
       public_class_method def self.diff(opts = {})

data/lib/pwn/plugins/exploit_dev.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 require 'open3'
+require 'fileutils'
+require 'json'
 
 module PWN
   module Plugins
@@ -171,6 +173,39 @@ module PWN
         end
       end
 
+      public_class_method def self.scaffold(opts = {})
+        path = (opts[:path] || opts[:bin]).to_s
+        raise 'ERROR: path is required' if path.empty?
+
+        triage = {}
+        triage = PWN::Plugins::BinaryParser.triage(path: path) if defined?(PWN::Plugins::BinaryParser)
+        gadgets = []
+        gadgets = Array(self.gadgets(path: path)[:gadgets]) if File.file?(path)
+        body = <<~RB
+          # frozen_string_literal: true
+          # scaffold for #{path}
+          # arch=#{triage[:arch]} pie=#{triage.dig(:protections, :pie)} canary=#{triage.dig(:protections, :canary)}
+          require 'pwn'
+          bin = #{path.inspect}
+          cyclic = PWN::Plugins::ExploitDev.cyclic(length: 200)
+          io = PWN::Plugins::ExploitDev.io(cmd: bin)
+          PWN::Plugins::ProcessTube.write_line(id: io[:id], line: cyclic)
+        RB
+        out = opts[:out].to_s
+        out = File.join(Dir.home, '.pwn', 'artifacts', 'scaffolds', "#{File.basename(path)}.rb") if out.empty?
+        FileUtils.mkdir_p(File.dirname(out))
+        File.write(out, body)
+        { path: out, triage: triage, gadgets: gadgets.first(8) }
+      end
+
+      public_class_method def self.from_crash(opts = {})
+        path = (opts[:path] || opts[:from_crash]).to_s
+        raise 'ERROR: path is required' if path.empty?
+        raise "ERROR: file not found: #{path}" unless File.file?(path)
+
+        JSON.parse(File.read(path), symbolize_names: true)
+      end
+
       public_class_method def self.authors
         "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
       end
@@ -294,6 +329,13 @@ module PWN
             port: 'optional - remote TCP port'
           )
 
+          # Emit a ruby exploit scaffold bound to triage output.
+          #{self}.scaffold(
+            path: 'required - binary path to scaffold against',
+            bin: 'optional - alias for path',
+            out: 'optional - output .rb path (defaults under ~/.pwn/artifacts/scaffolds)'
+          )
+
           # Run gadgets and return its result
           #{self}.gadgets(
             path: 'required - filesystem path of the binary to search for gadgets'
@@ -311,6 +353,12 @@ module PWN
             names: 'optional - Array of symbol names (defaults to system, execve, __libc_start_main)'
           )
 
+          # Load a crash.json produced by a fuzz campaign.
+          #{self}.from_crash(
+            path: 'required - filesystem path of crash.json',
+            from_crash: 'optional - alias for path'
+          )
+
           # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "

data/lib/pwn/plugins/findings.rb

@@ -23,6 +23,9 @@ module PWN
         arts << opts[:poc].to_s unless opts[:poc].to_s.empty?
         raise 'ERROR: poc_artifacts are required' if arts.empty?
 
+        ev = opts[:evidence].to_s
+        raise 'ERROR: evidence must be at least 40 characters citing the PoC' if ev.length < 40
+
         row = {
           id: SecureRandom.hex(6),
           title: title,
@@ -83,7 +86,12 @@ module PWN
         parent_id = opts[:parent_id].to_s
         raise 'ERROR: parent_id is required' if parent_id.empty?
 
-        child = record(opts.merge(chain_parent_id: parent_id))
+        child = record(
+          opts.merge(
+            chain_parent_id: parent_id,
+            evidence: (opts[:evidence].to_s.length >= 40 ? opts[:evidence] : 'Chained finding reuses parent PoC evidence and raises composite impact.')
+          )
+        )
         ranks = { 'info' => 0, 'low' => 1, 'medium' => 2, 'high' => 3, 'critical' => 4 }
         parent = report.find { |r| r[:id].to_s == parent_id }
         sev = [parent&.[](:severity), child[:severity]].compact.max_by { |s| ranks[s.to_s] || 0 }

data/lib/pwn/plugins/gdb.rb

@@ -90,6 +90,18 @@ module PWN
         crash_info(opts.merge(commands: script))
       end
 
+      public_class_method def self.ptrace_preflight(opts = {})
+        _target = opts[:target]
+        scope = 0
+        path = '/proc/sys/kernel/yama/ptrace_scope'
+        scope = File.read(path).to_i if File.file?(path)
+        {
+          ptrace_scope: scope,
+          attach_ok: scope.zero?,
+          hint: scope.positive? ? 'spawn instead of attach' : 'ok'
+        }
+      end
+
       public_class_method def self.authors
         "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
       end
@@ -147,6 +159,11 @@ module PWN
             script: 'optional - Array of gdb/MI commands'
           )
 
+          # Probe yama ptrace_scope before gdb/frida attach.
+          #{self}.ptrace_preflight(
+            target: 'optional - pid or binary path being attached'
+          )
+
           # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "

data/lib/pwn/plugins/ghidra.rb

@@ -3,6 +3,7 @@
 require 'open3'
 require 'fileutils'
 require 'json'
+require 'digest'
 
 module PWN
   module Plugins
@@ -31,12 +32,28 @@ module PWN
       end
 
       public_class_method def self.decompile(opts = {})
-        analyze(opts)
+        path = (opts[:bin] || opts[:path]).to_s
+        raise 'ERROR: bin is required' if path.empty?
+
+        sha = Digest::SHA256.file(path).hexdigest if File.file?(path)
+        cache = File.join(Dir.home, '.pwn', 'cache', 'decompile', "#{sha}.json") if sha
+        return JSON.parse(File.read(cache), symbolize_names: true).merge(cached: true) if cache && File.file?(cache)
+
+        row = analyze(opts)
+        fn = opts[:function].to_s
+        row[:function] = fn unless fn.empty?
+        FileUtils.mkdir_p(File.dirname(cache)) if cache
+        File.write(cache, JSON.generate(row)) if cache
+        row
       end
 
       private_class_method def self.r2_fallback(opts = {})
         path = opts[:path].to_s
         stdout, stderr, status = Open3.capture3('r2', '-q', '-c', 'aaa;s main;pdg', path)
+        if stdout.to_s.strip.empty?
+          stdout, stderr, status = Open3.capture3('r2', '-q', '-c', 'aaa;s main;pdc', path)
+          return { stdout: stdout, stderr: stderr, exit: status.exitstatus, engine: 'r2-pdc' }
+        end
         { stdout: stdout, stderr: stderr, exit: status.exitstatus, engine: 'r2' }
       rescue StandardError => e
         { error: e.message, engine: 'r2' }
@@ -62,7 +79,8 @@ module PWN
           #{self}.decompile(
             bin: 'required - filesystem path of the binary',
             path: 'optional - alias for bin',
-            project_dir: 'optional - Ghidra project directory'
+            project_dir: 'optional - Ghidra project directory',
+            function: 'optional - function name to decompile instead of the whole program'
           )
 
           # Print the AUTHOR(S) string for this module.