pwn 0.5.746 → 0.5.749

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aacb6a992222f92a5a198def002962a7f92105b68489ae2a9dd01fb9207332f9
-  data.tar.gz: d48b7f1c97a7a18bba283685075d887d9e539280abe3cc41064a88374e9bf355
+  metadata.gz: bf86add502082e14d3299544ffc90b9e86887ada46569fa867d9ce6e0cc8560a
+  data.tar.gz: bb266bdff59a1187f99664eb876dc6b591a43d4f725689025e8af2325b735c00
 SHA512:
-  metadata.gz: 614149c9170c27dad853ec23b90f3990ae9182001bd6d2b7e4b919095a003bc2b85b949946c834e32052e37ba0f4b785c59adbaeb127a1f90298025ec657cfe6
-  data.tar.gz: 40f3119856e9a6965b5977494fcb1afb4ea8ef13f226a7044353232be87a46dda4bd4970b6806677d327e18e53af6bb328852bd170fd4c9095821b8947222a5f
+  metadata.gz: b5191f1ecd9004cd4152ead0630c3c91df671ecb6f1f7b1c801a8a9983b6d919734b4006dca79740b9dc5be7181880ac5cddd219d343478a4c5cb66c86bad741
+  data.tar.gz: 8ef2550a781242412f81402b29fa5257fcf404fe5a97facd8126544aabe651cd4e26d008cf92bb040b8d675985943a06cac1800a88eb85b2b3c35bb3f79c4692

data/Gemfile

@@ -11,7 +11,7 @@ gemspec
 # In some circumstances custom flags are passed to gems in order
 # to build appropriately.  Defer to ./reinstall_pwn_gemset.sh
 # to review these custom flags (e.g. pg, serialport, etc).
-gem 'activesupport', '<8.1.3.1'
+gem 'activesupport', '<8.1.4'
 gem 'anemone', '0.7.2'
 gem 'authy', '3.0.1'
 gem 'aws-sdk', '3.3.0'
@@ -50,7 +50,7 @@ gem 'libusb', '0.8.0'
 gem 'luhn', '3.0.0'
 gem 'mail', '2.9.1'
 gem 'mcp', '1.6.0'
-gem 'meshtastic', '0.0.184'
+gem 'meshtastic', '0.0.186'
 gem 'metasm', '1.0.6'
 gem 'mongo', '2.26.0'
 gem 'msfrpc-client', '1.1.2'
@@ -77,7 +77,7 @@ gem 'rbvmomi2', '3.10.0'
 gem 'rdoc', '7.0.4'
 gem 'rest-client', '2.1.0'
 gem 'rex', '2.0.13'
-gem 'rmagick', '7.1.4'
+gem 'rmagick', '7.1.5'
 gem 'rqrcode', '3.2.0'
 gem 'rspec', '3.13.2'
 gem 'rtesseract', '3.1.4'

data/etc/default_skills/pwn/ffi/capstone/SKILL.md

@@ -42,6 +42,7 @@ PWN::FFI::Capstone.available(opts)
 - `cs_disasm`
 - `cs_free`
 - `cs_open`
+- `cs_version`
 - `load_error`
 
 ## Source

data/lib/pwn/ffi/capstone.rb

@@ -17,8 +17,20 @@ module PWN
       CS_MODE_32 = 4
       CS_MODE_64 = 8
 
-      # Capstone cs_insn layout used by cs_disasm.
-      class Insn < PubFFI::Struct
+      # Capstone 4 stores 16 instruction bytes; Capstone 5 stores 24.
+      # A mismatched layout returns non-empty garbage instead of raising.
+      class InsnV4 < PubFFI::Struct
+        layout :id, :uint,
+               :address, :uint64,
+               :size, :ushort,
+               :bytes, [:uchar, 16],
+               :mnemonic, [:char, 32],
+               :op_str, [:char, 160],
+               :detail, :pointer
+      end
+
+      # Capstone 5 widened cs_insn.bytes from 16 to 24.
+      class InsnV5 < PubFFI::Struct
         layout :id, :uint,
                :address, :uint64,
                :size, :ushort,
@@ -44,6 +56,7 @@ module PWN
         attach_function :cs_disasm, %i[size_t pointer size_t uint64 size_t pointer], :size_t
         attach_function :cs_free, %i[pointer size_t], :void
         attach_function :cs_close, [:pointer], :int
+        attach_function :cs_version, %i[pointer pointer], :uint
       end
 
       public_class_method def self.available?(opts = {})
@@ -67,8 +80,9 @@ module PWN
         count = cs_disasm(handle.read_ulong, buf, bytes.bytesize, (opts[:address] || 0).to_i, 0, insn_ptr)
         insns = []
         base = insn_ptr.read_pointer
+        klass = insn_class
         count.times do |i|
-          insn = Insn.new(base + (i * Insn.size))
+          insn = klass.new(base + (i * klass.size))
           insns << { address: insn[:address], mnemonic: insn[:mnemonic].to_s, op_str: insn[:op_str].to_s, size: insn[:size] }
         end
         cs_free(base, count) unless base.null?
@@ -76,6 +90,13 @@ module PWN
         { engine: 'capstone', insns: insns, count: count }
       end
 
+      private_class_method def self.insn_class
+        major = PubFFI::MemoryPointer.new(:int)
+        minor = PubFFI::MemoryPointer.new(:int)
+        cs_version(major, minor)
+        major.read_int >= 5 ? InsnV5 : InsnV4
+      end
+
       private_class_method def self.arch_mode(opts = {})
         arch = opts[:arch].to_s.downcase
         case arch

data/lib/pwn/plugins/assembly.rb

@@ -204,7 +204,8 @@ module PWN
 
         if opts[:engine].to_s != 'metasm' && PWN::FFI.available?(mod: :Keystone)
           begin
-            return PWN::FFI::Keystone.assemble(opts)
+            row = PWN::FFI::Keystone.assemble(opts)
+            return row if assembled_matches?(bytes: row[:bytes], asm: asm, arch: opts[:arch])
           rescue StandardError
             nil
           end
@@ -222,7 +223,7 @@ module PWN
         if opts[:engine].to_s != 'metasm' && PWN::FFI.available?(mod: :Capstone)
           begin
             row = PWN::FFI::Capstone.disassemble(opts)
-            return row if Array(row[:insns]).any?
+            return row if plausible_insns?(insns: row[:insns])
           rescue StandardError
             nil
           end
@@ -231,14 +232,34 @@ module PWN
         arch_obj = arch_object(opts)
         text = Metasm::Shellcode.disassemble(arch_obj, raw.to_s.b).to_s
         insns = text.lines.filter_map do |line|
-          match = line.match(/^\s*(?:0x)?([0-9a-f]+)\s+(\S+)\s*(.*)$/i)
-          next unless match
-
-          { address: match[1].to_i(16), mnemonic: match[2], op_str: match[3].to_s.strip }
+          if (match = line.match(/^\s*([A-Za-z][A-Za-z0-9.]*)\s*(.*?)\s*;\s*@([0-9a-f]+)/))
+            { address: match[3].to_i(16), mnemonic: match[1], op_str: match[2].to_s.strip }
+          elsif (match = line.match(/^\s*(?:0x)?([0-9a-f]+)\s+(\S+)\s*(.*)$/i))
+            { address: match[1].to_i(16), mnemonic: match[2], op_str: match[3].to_s.strip }
+          end
         end
         { engine: 'metasm', insns: insns, count: insns.length, text: text }
       end
 
+      # A mis-laid-out libcapstone still returns rows. Reject those and use Metasm.
+      private_class_method def self.plausible_insns?(opts = {})
+        insns = Array(opts[:insns])
+        return false if insns.empty?
+
+        insns.all? do |insn|
+          insn[:mnemonic].to_s.match?(/\A[A-Za-z][A-Za-z0-9.]{0,15}\z/) && insn[:size].to_i.between?(1, 15)
+        end
+      end
+
+      # Keystone ABI mismatches can return bytes that are not the requested instructions.
+      private_class_method def self.assembled_matches?(opts = {})
+        token = opts[:asm].to_s.lines.filter_map { |line| line.strip.split(/\s+/, 2).first }.find { |word| !word.end_with?(':') }
+        return false if token.to_s.empty?
+
+        dis = disassemble(bytes: opts[:bytes], arch: opts[:arch], engine: 'metasm')
+        Array(dis[:insns]).any? { |insn| insn[:mnemonic].to_s.casecmp?(token) }
+      end
+
       public_class_method def self.list_supported_archs
         [
           { name: 'i386', endian: 'little' },

data/lib/pwn/plugins/binary_parser.rb

@@ -578,6 +578,8 @@ module PWN
         pltrelsz = dyn[2].to_i
         relaent = bits == 64 ? 24 : 12
         plt_base = sections['.plt.sec']&.[](:addr) || sections['.plt']&.[](:addr)
+        # .plt.sec slots start at the section base. Classic .plt reserves the first 16 bytes for the lazy resolver.
+        plt_bias = sections['.plt.sec'] ? 0 : 1
         if jmprel && pltrelsz.positive?
           rel_off = v2off.call(jmprel)
           idx = 0
@@ -593,7 +595,7 @@ module PWN
             end
             unless name.to_s.empty?
               got[name] = r_offset
-              plt[name] = plt_base + (16 * (idx + 1)) if plt_base
+              plt[name] = plt_base + (16 * (idx + plt_bias)) if plt_base
             end
             idx += 1
           end

data/lib/pwn/plugins/repl/mesh.rb

@@ -149,11 +149,14 @@ module PWN
           end
         end
         PWN_MESH_TRANSPORTS = %i[serial bluetooth tcp mqtt].freeze
-        # meshtastic 0.0.184 loses protobuf defaults in Data#to_h. Empty
-        # decoded data is not an unsupported application payload.
+        # meshtastic 0.0.184 Data#to_h omits empty payload bytes, and an
+        # unknown PortNum stays an integer (51 is not in the enum). That is
+        # not an undecodable application payload. Bytes on an unsupported
+        # port still warn.
         EMPTY_DATA_DECODER = Module.new do
           define_method(:decode_payload) do |opts = {}|
-            return nil if opts[:payload].nil? && opts[:msg_type].nil?
+            payload = opts[:payload]
+            return nil if payload.nil? || payload == ''
 
             super(opts)
           end
@@ -1140,6 +1143,9 @@ module PWN
             text = opts[:text].to_s.dup.force_encoding(Encoding::UTF_8).scrub
             text.gsub!(/\e\[[0-9;?]*[A-Za-z]/, '')
             text.gsub!(/[\x00-\x08\x0b\x0c\x0e-\x1f]/, '')
+            # Serial.subscribe prints this on startup. It is not a diagnostic,
+            # and capturing it opens a NOTICE before the TUI can be used.
+            text.gsub!('Subscribing to serial FromRadio stream...', '')
             text.strip!
             text.empty? ? nil : text
           end

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.746'
+  VERSION = '0.5.749'
 end

data/spec/lib/pwn/ai/agent/tools/exploitdev_spec.rb

@@ -38,7 +38,9 @@ describe 'PWN::AI::Agent::Tools exploitdev' do
           return 0;
         }
       C
-      out, status = Open3.capture2e('cc', '-O0', '-fno-stack-protector', '-fno-pie', '-no-pie', '-o', bin, src)
+      out, status = Open3.capture2e('cc', '-O0', '-fno-stack-protector', '-fno-pie', '-no-pie', '-Wl,-z,ibt', '-o', bin, src)
+      linked = status.success? && File.binread(bin).include?('.plt.sec')
+      out, status = Open3.capture2e('cc', '-O0', '-fno-stack-protector', '-fno-pie', '-no-pie', '-o', bin, src) unless linked
       expect(status.success?).to eq(true), out
       elf = File.binread(bin)
       expect(elf[16, 2].unpack1('v')).to eq(2), 'cc produced a PIE binary; file addresses would not be the runtime addresses'

data/spec/lib/pwn/plugins/assembly_spec.rb

@@ -24,4 +24,18 @@ describe PWN::Plugins::Assembly do
     expect(blob).to match(/nop/i)
     expect(%w[capstone metasm]).to include(dis[:engine].to_s)
   end
+
+  it 'falls back to metasm when capstone returns a mis-laid-out mnemonic' do
+    allow(PWN::FFI).to receive(:available?).and_call_original
+    allow(PWN::FFI).to receive(:available?).with(mod: :Capstone).and_return(true)
+    allow(PWN::FFI::Capstone).to receive(:disassemble).and_return(
+      engine: 'capstone',
+      insns: [{ mnemonic: "L\xCB\xEFy", op_str: "L\xCB\xEFy", size: 4 }]
+    )
+    asm = described_class.assemble(asm: "nop\nret", arch: 'x86_64', engine: 'metasm')
+    dis = described_class.disassemble(bytes: asm[:bytes], arch: 'x86_64')
+    expect(dis[:engine]).to eq('metasm')
+    blob = dis[:insns].map { |row| row[:mnemonic] }.join(' ')
+    expect(blob).to match(/nop/i)
+  end
 end

data/spec/lib/pwn/plugins/binary_parser_spec.rb

@@ -89,4 +89,21 @@ describe PWN::Plugins::BinaryParser do
       expect(row[:symbols]['main'] || row[:symbols][:main]).to be_a(Integer)
     end
   end
+
+  it 'elf_resolve points system at the .plt.sec stub, not the next slot' do
+    Dir.mktmpdir('pwn-elf-ibt-') do |dir|
+      src = File.join(dir, 't.c')
+      path = File.join(dir, 't')
+      File.write(src, "#include <stdlib.h>\nint main(void) { return system(\"x\"); }\n")
+      out, status = Open3.capture2e('cc', '-O0', '-fno-pie', '-no-pie', '-Wl,-z,ibt', '-o', path, src)
+      expect(status.success?).to eq(true), out
+      expect(File.binread(path)).to include('.plt.sec')
+      row = described_class.elf_resolve(path: path)
+      dump, dump_status = Open3.capture2('objdump', '-d', path)
+      expect(dump_status.success?).to eq(true), dump
+      real = dump[/^([0-9a-f]+) <system@plt>:/, 1]
+      expect(real).not_to be_nil
+      expect(row[:plt]['system']).to eq(real.to_i(16))
+    end
+  end
 end

data/spec/lib/pwn/plugins/repl_mesh_history_spec.rb

@@ -18,8 +18,26 @@ describe PWN::Plugins::REPL, 'mesh compose history' do
     described_class.send(:mesh_subscribe, obj: { from_radio_queue: queue }, psks: {}, on_message: proc { |message| received << message })
     expect(received.size).to eq(2)
     expect(output.string).not_to include("Can't decode")
-    Meshtastic::MeshInterface.new.decode_payload(payload: 'unsupported', msg_type: :PRIVATE_APP)
-    expect(output.string).to include("Can't decode", 'unsupported')
+    # meshtastic 0.0.186 returns unknown application bytes instead of warning.
+    decoded = Meshtastic::MeshInterface.new.decode_payload(payload: 'unsupported', msg_type: :PRIVATE_APP)
+    expect(decoded).to eq('unsupported')
+    expect(output.string).not_to include("Can't decode")
+  ensure
+    $stdout = old
+  end
+
+  it 'does not warn when a packet has an unknown portnum and no payload' do
+    stub_const('PWN::MeshTransport', :serial)
+    queue = Queue.new
+    encoded = Meshtastic::FromRadio.new(packet: { decoded: Meshtastic::Data.new(portnum: 51) }).to_proto
+    queue << Meshtastic::FromRadio.decode(encoded)
+    queue.close
+    output = StringIO.new
+    old = $stdout
+    $stdout = output
+    described_class.send(:mesh_subscribe, obj: { from_radio_queue: queue }, psks: {}, on_message: proc { |_message| })
+    expect(output.string).not_to include("Can't decode")
+    expect(output.string).not_to include('portnum: 51')
   ensure
     $stdout = old
   end
@@ -69,6 +87,25 @@ describe PWN::Plugins::REPL, 'mesh compose history' do
     expect(events).to be_empty
   end
 
+  it 'does not open a notice for the serial subscribe banner' do
+    events = Queue.new
+    stub_const('PWN::MeshEvents', events)
+    described_class.send(:mesh_capture_output, run: proc {
+      puts 'Subscribing to serial FromRadio stream...'
+    })
+    expect(events).to be_empty
+  end
+
+  it 'keeps a warning that shares a chunk with the serial subscribe banner' do
+    events = Queue.new
+    stub_const('PWN::MeshEvents', events)
+    described_class.send(:mesh_capture_output, run: proc {
+      $stdout.write("Subscribing to serial FromRadio stream...\nWARNING: decoder fixture\n")
+    })
+    expect(events.pop(true)[:notice]).to eq('WARNING: decoder fixture')
+    expect(events).to be_empty
+  end
+
   it 'captures dependency stdout and stderr and restores both streams on failure' do
     events = Queue.new
     stub_const('PWN::MeshEvents', events)

data/third_party/pwn_rdoc.jsonl

@@ -1952,6 +1952,7 @@
 {"messages":[{"role":"user","content":"PWN::FFI::Capstone.available? Usage"},{"role":"assistant","content":"`PWN::FFI::Capstone.available?`: "}]}
 {"messages":[{"role":"user","content":"PWN::FFI::Capstone.disassemble Usage"},{"role":"assistant","content":"`PWN::FFI::Capstone.disassemble`: "}]}
 {"messages":[{"role":"user","content":"PWN::FFI::Capstone.help Usage"},{"role":"assistant","content":"`PWN::FFI::Capstone.help`: "}]}
+{"messages":[{"role":"user","content":"PWN::FFI::Capstone.insn_class Usage"},{"role":"assistant","content":"`PWN::FFI::Capstone.insn_class`: "}]}
 {"messages":[{"role":"user","content":"PWN::FFI::DSPNative.authors Usage"},{"role":"assistant","content":"`PWN::FFI::DSPNative.authors`: Author(s)\n\n0day Inc. <support@0dayinc.com>\n"}]}
 {"messages":[{"role":"user","content":"PWN::FFI::DSPNative.available? Usage"},{"role":"assistant","content":"`PWN::FFI::DSPNative.available?`: Supported Method Parameters\n\nPWN::FFI::DSPNative.available?\n"}]}
 {"messages":[{"role":"user","content":"PWN::FFI::DSPNative.cfft_mag Usage"},{"role":"assistant","content":"`PWN::FFI::DSPNative.cfft_mag`: Supported Method Parameters\n\nmagnitudes = PWN::FFI::DSPNative.cfft_mag(iq:, n:) Power-of-two FFT; input is zero-padded/truncated, output unshifted.\n"}]}
@@ -2188,11 +2189,13 @@
 {"messages":[{"role":"user","content":"PWN::Plugins::Assembly.arch_object Usage"},{"role":"assistant","content":"`PWN::Plugins::Assembly.arch_object`: "}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::Assembly.asm_to_opcodes Usage"},{"role":"assistant","content":"`PWN::Plugins::Assembly.asm_to_opcodes`: Supported Method Parameters\n\nPWN::Plugins::Assembly.asm_to_opcodes(\n\nasm: 'required - assembly instruction(s) (e.g. 'nop\\nnop\\nnop\\njmp rsp\\n)',\narch: 'optional - architecture returned from objdump --info (defaults to PWN::Plugins::DetectOS.arch)',\nendian: 'optional - endianess :big|:little (defaults to current system endianess)'\n\n)\n"}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::Assembly.assemble Usage"},{"role":"assistant","content":"`PWN::Plugins::Assembly.assemble`: "}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::Assembly.assembled_matches? Usage"},{"role":"assistant","content":"`PWN::Plugins::Assembly.assembled_matches?`: "}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::Assembly.authors Usage"},{"role":"assistant","content":"`PWN::Plugins::Assembly.authors`: Author(s)\n\n0day Inc. <support@0dayinc.com>\n"}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::Assembly.disassemble Usage"},{"role":"assistant","content":"`PWN::Plugins::Assembly.disassemble`: "}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::Assembly.help Usage"},{"role":"assistant","content":"`PWN::Plugins::Assembly.help`: "}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::Assembly.list_supported_archs Usage"},{"role":"assistant","content":"`PWN::Plugins::Assembly.list_supported_archs`: "}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::Assembly.opcodes_to_asm Usage"},{"role":"assistant","content":"`PWN::Plugins::Assembly.opcodes_to_asm`: Supported Method Parameters\n\nPWN::Plugins::Assembly.opcodes_to_asm(\n\nopcodes: 'required - hex escaped opcode(s) (e.g. \"\\x90\\x90\\x90\")',\nopcodes_always_string_obj: 'optional - always interpret opcodes passed in as a string object (defaults to false)',\narch: 'optional - architecture returned from objdump --info (defaults to PWN::Plugins::DetectOS.arch)',\nendian: 'optional - endianess :big|:little (defaults to current system endianess)'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::Assembly.plausible_insns? Usage"},{"role":"assistant","content":"`PWN::Plugins::Assembly.plausible_insns?`: "}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::AuthenticationHelper.authors Usage"},{"role":"assistant","content":"`PWN::Plugins::AuthenticationHelper.authors`: Author(s)\n\n0day Inc. <support@0dayinc.com>\n"}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::AuthenticationHelper.help Usage"},{"role":"assistant","content":"`PWN::Plugins::AuthenticationHelper.help`: "}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::AuthenticationHelper.mask_password Usage"},{"role":"assistant","content":"`PWN::Plugins::AuthenticationHelper.mask_password`: Supported Method Parameters\n\nPWN::Plugins::AuthenticationHelper.mask_password(\n\nprompt: 'optional - string to display at prompt (Default: Password)'\n\n)\n"}]}

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.746
+  version: 0.5.749
 platform: ruby
 authors:
 - 0day Inc.
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - "<"
       - !ruby/object:Gem::Version
-        version: 8.1.3.1
+        version: 8.1.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "<"
       - !ruby/object:Gem::Version
-        version: 8.1.3.1
+        version: 8.1.4
 - !ruby/object:Gem::Dependency
   name: anemone
   requirement: !ruby/object:Gem::Requirement
@@ -519,14 +519,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.0.184
+        version: 0.0.186
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.0.184
+        version: 0.0.186
 - !ruby/object:Gem::Dependency
   name: metasm
   requirement: !ruby/object:Gem::Requirement
@@ -897,14 +897,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.4
+        version: 7.1.5
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.4
+        version: 7.1.5
 - !ruby/object:Gem::Dependency
   name: rqrcode
   requirement: !ruby/object:Gem::Requirement