pwntools 0.1.0 → 1.0.0

data/lib/pwnlib/shellcraft/generators/amd64/linux/syscall.rb

@@ -0,0 +1,21 @@
+# encoding: ASCII-8BIT
+
+require 'pwnlib/shellcraft/generators/amd64/linux/linux'
+require 'pwnlib/shellcraft/generators/x86/linux/syscall'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module Amd64
+        module Linux
+          # See {Generators::X86::Linux#syscall}.
+          def syscall(*arguments)
+            context.local(arch: 'amd64') do
+              cat X86::Linux.syscall(*arguments)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/helper.rb

@@ -0,0 +1,106 @@
+require 'pwnlib/abi'
+require 'pwnlib/constants/constants'
+require 'pwnlib/context'
+require 'pwnlib/reg_sort'
+require 'pwnlib/shellcraft/registers'
+require 'pwnlib/util/fiddling'
+require 'pwnlib/util/lists'
+require 'pwnlib/util/packing'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      # Define methods for generator modules.
+      #
+      # This module must and can only be extended by Common or Linux module under {Generators}.
+      module Helper
+        # Provide a 'sandbox' for generators.
+        class Runner
+          class << self
+            def label_num
+              @label_num ||= 0
+              @label_num += 1
+            end
+          end
+
+          def clear
+            @_output = StringIO.new
+          end
+
+          # Indent each line 2 spaces.
+          def typesetting
+            indent = @_output.string.lines.map do |line|
+              next line.strip + "\n" if label_str?(line.strip)
+              line == "\n" ? line : ' ' * 2 + line.lstrip
+            end
+            indent.join
+          end
+
+          private
+
+          def cat(str)
+            @_output.puts(str)
+          end
+
+          # @example
+          #   get_label('infloop') #=> 'infloop_1'
+          def get_label(str)
+            "#{str}_#{self.class.label_num}"
+          end
+
+          def okay(s, *a, **kw)
+            s = pack(s, *a, **kw) if s.is_a?(Integer)
+            !(s.include?("\x00") || s.include?("\n"))
+          end
+
+          def evaluate(item)
+            return item if register?(item)
+            Constants.eval(item)
+          end
+
+          # @param [Constants::Constant, String, Integer] n
+          def pretty(n)
+            case n
+            when Constants::Constant
+              format('%s /* %s */', pretty(n.to_i), n)
+            when Integer
+              n.abs < 10 ? n.to_s : hex(n)
+            else
+              n.inspect
+            end
+          end
+
+          def label_str?(str)
+            str.match(/\A\w+_\d+:\Z/) != nil
+          end
+
+          include ::Pwnlib::Context
+          include ::Pwnlib::RegSort
+          include ::Pwnlib::Shellcraft::Registers
+          include ::Pwnlib::Util::Fiddling
+          include ::Pwnlib::Util::Lists
+          include ::Pwnlib::Util::Packing
+        end
+
+        class << self
+          # Define a corresponding singleton method whenever an instance method is defined.
+          def extended(mod)
+            class << mod
+              define_method(:method_added) do |m|
+                # Define singleton methods, so we can invoke +Generators::X86::Common.pushstr_array+.
+                # Each method runs in an independent 'runner', so methods would not effect each other.
+                runner = Runner.new
+                method = instance_method(m).bind(runner)
+                define_singleton_method(m) do |*args|
+                  runner.clear
+                  method.call(*args)
+                  runner.typesetting
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/i386/common/common.rb

@@ -0,0 +1,14 @@
+require 'pwnlib/shellcraft/generators/helper'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        # For non os-related methods.
+        module Common
+          extend ::Pwnlib::Shellcraft::Generators::Helper
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/i386/common/infloop.rb

@@ -0,0 +1,17 @@
+require 'pwnlib/shellcraft/generators/i386/common/common'
+require 'pwnlib/shellcraft/generators/x86/common/infloop'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        module Common
+          # See {X86::Common#infloop}.
+          def infloop
+            cat X86::Common.infloop
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/i386/common/mov.rb

@@ -0,0 +1,90 @@
+# encoding: ASCII-8BIT
+
+require 'pwnlib/shellcraft/generators/i386/common/common'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        module Common
+          # Move +src+ into +dst+ without newlines and null bytes.
+          #
+          # See {Amd64::Common#mov} for parameters' details.
+          def mov(dst, src, stack_allowed: true)
+            raise ArgumentError, "#{dst} is not a register" unless register?(dst)
+            dst = get_register(dst)
+            raise ArgumentError, "cannot use #{dst} on i386" if dst.size > 32 || dst.is64bit
+            if register?(src)
+              src = get_register(src)
+              raise ArgumentError, "cannot use #{src} on i386" if src.size > 32 || src.is64bit
+              if dst.size < src.size && !dst.bigger.include?(src.name)
+                raise ArgumentError, "cannot mov #{dst}, #{src}: dst is smaller than src"
+              end
+            else
+              context.local(arch: 'i386') { src = evaluate(src) }
+              raise ArgumentError, format('cannot mov %s, %d: dst is smaller than src', dst, src) unless dst.fits(src)
+
+              # Calculate the packed version
+              srcp = pack(src & ((1 << dst.size) - 1), bits: dst.size)
+
+              # Calculate the unsigned and signed versions
+              srcu = unpack(srcp, bits: dst.size, signed: false)
+              srcs = unpack(srcp, bits: dst.size, signed: true)
+              srcp_neg = p32(-src)
+              srcp_not = p32(src ^ 0xffffffff)
+            end
+            if register?(src)
+              if src == dst || dst.bigger.include?(src.name)
+                cat "/* moving #{src} into #{dst}, but this is a no-op */"
+              elsif dst.size > src.size
+                cat "movzx #{dst}, #{src}"
+              else
+                cat "mov #{dst}, #{src}"
+              end
+            elsif src.is_a?(Numeric) # Constant or immi
+              xor = ->(reg) { "xor #{reg.xor}, #{reg.xor}" }
+              if src.zero? # special case for zeroes
+                cat "xor #{dst}, #{dst} /* #{src} */"
+              elsif stack_allowed && dst.size == 32 && src == 10
+                cat "push 9 /* mov #{dst}, '\\n' */"
+                cat "pop #{dst}"
+                cat "inc #{dst}"
+              elsif stack_allowed && dst.size == 32 && (-2**7 <= srcs && srcs < 2**7) && okay(srcp[0])
+                cat "push #{pretty(src)}"
+                cat "pop #{dst}"
+              elsif okay(srcp)
+                # Easy case. This implies that the register size and value are the same.
+                cat "mov #{dst}, #{pretty(src)}"
+              elsif srcu < 2**8 && okay(srcp[0]) && dst.sizes.include?(8)
+                # Move 8-bit value into reg.
+                cat xor[dst]
+                cat "mov #{dst.sizes[8]}, #{pretty(src)}"
+              elsif srcu == srcu & 0xff00 && okay(srcp[1]) && dst.ff00
+                # Target value is a 16-bit value with no data in the low 8 bits, we can use the 'AH' style register.
+                cat xor[dst]
+                cat "mov #{dst.ff00}, #{pretty(src)} >> 8"
+              elsif srcu < 2**16 && okay(srcp[0, 2])
+                # Target value is a 16-bit value, use a 16-bit mov.
+                cat xor[dst]
+                cat "mov #{dst.sizes[16]}, #{pretty(src)}"
+              elsif okay(srcp_neg)
+                cat "mov #{dst}, -#{pretty(src)}"
+                cat "neg #{dst}"
+              elsif okay(srcp_not)
+                cat "mov #{dst}, (-1) ^ #{pretty(src)}"
+                cat "not #{dst}"
+              else
+                # All else has failed.  Use some XOR magic to move things around.
+                a, b = xor_pair(srcp, avoid: "\x00\n")
+                a = hex(unpack(a, bits: dst.size))
+                b = hex(unpack(b, bits: dst.size))
+                cat "mov #{dst}, #{a}"
+                cat "xor #{dst}, #{b} /* #{hex(src)} == #{a} ^ #{b} */"
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/i386/common/nop.rb

@@ -0,0 +1,16 @@
+require 'pwnlib/shellcraft/generators/i386/common/common'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        module Common
+          # A no-op instruction.
+          def nop
+            cat 'nop'
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/i386/common/pushstr.rb

@@ -0,0 +1,39 @@
+# encoding: ASCII-8BIT
+
+require 'pwnlib/shellcraft/generators/i386/common/common'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        module Common
+          # Push a string to stack.
+          #
+          # See {Amd64::Common#pushstr} for parameters' details.
+          def pushstr(str, append_null: true)
+            # This will not affect callee's +str+.
+            str += "\x00" if append_null && !str.end_with?("\x00")
+            return if str.empty?
+            padding = str[-1].ord >= 128 ? "\xff" : "\x00"
+            cat "/* push #{str.inspect} */"
+            group(4, str, underfull_action: :fill, fill_value: padding).reverse_each do |word|
+              sign = u32(word, endian: 'little', signed: true)
+              if [0, 0xa].include?(sign) # simple forbidden byte case
+                cat "push #{pretty(sign + 1)}"
+                cat 'dec byte ptr [esp]'
+              elsif sign >= -128 && sign <= 127
+                cat "push #{pretty(sign)}"
+              elsif okay(word)
+                cat "push #{pretty(sign)}"
+              else
+                a = u32(xor_pair(word).first, endian: 'little', signed: false)
+                cat "push #{pretty(a)}"
+                cat "xor dword ptr [esp], #{pretty(a ^ sign)} /* #{pretty(a)} ^ #{pretty(sign)} */"
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/i386/common/pushstr_array.rb

@@ -0,0 +1,19 @@
+require 'pwnlib/shellcraft/generators/i386/common/common'
+require 'pwnlib/shellcraft/generators/x86/common/pushstr_array'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        module Common
+          # See {Pwnlib::Shellcraft::Generators::X86::Common#pushstr_array}.
+          def pushstr_array(*args)
+            context.local(arch: 'i386') do
+              cat X86::Common.pushstr_array(*args)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/i386/common/setregs.rb

@@ -0,0 +1,19 @@
+require 'pwnlib/shellcraft/generators/i386/common/common'
+require 'pwnlib/shellcraft/generators/x86/common/setregs'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        module Common
+          # See {Generators::X86::Common#setregs}.
+          def setregs(*args)
+            context.local(arch: 'i386') do
+              cat X86::Common.setregs(*args)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/i386/linux/execve.rb

@@ -0,0 +1,19 @@
+require 'pwnlib/shellcraft/generators/i386/linux/linux'
+require 'pwnlib/shellcraft/generators/x86/linux/execve'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        module Linux
+          # See {Generators::X86::Linux#execve}.
+          def execve(*arguments)
+            context.local(arch: 'i386') do
+              cat X86::Linux.execve(*arguments)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/i386/linux/linux.rb

@@ -0,0 +1,14 @@
+require 'pwnlib/shellcraft/generators/helper'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        # For os-related methods.
+        module Linux
+          extend ::Pwnlib::Shellcraft::Generators::Helper
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/i386/linux/ls.rb

@@ -0,0 +1,19 @@
+require 'pwnlib/shellcraft/generators/i386/linux/linux'
+require 'pwnlib/shellcraft/generators/x86/linux/ls'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        module Linux
+          # See #{Generators::X86::Linux#ls}.
+          def ls(*args)
+            context.local(arch: 'i386') do
+              cat X86::Linux.ls(*args)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/i386/linux/sh.rb

@@ -0,0 +1,19 @@
+require 'pwnlib/shellcraft/generators/i386/linux/linux'
+require 'pwnlib/shellcraft/generators/x86/linux/sh'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        module Linux
+          # See #{Generators::X86::Linux#sh}.
+          def sh(*args)
+            context.local(arch: 'i386') do
+              cat X86::Linux.sh(*args)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/i386/linux/syscall.rb

@@ -0,0 +1,19 @@
+require 'pwnlib/shellcraft/generators/i386/linux/linux'
+require 'pwnlib/shellcraft/generators/x86/linux/syscall'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        module Linux
+          # See {Generators::X86::Linux#syscall}.
+          def syscall(*arguments)
+            context.local(arch: 'i386') do
+              cat X86::Linux.syscall(*arguments)
+            end
+          end
+        end
+      end
+    end
+  end
+end