pwntools 0.1.0 → 1.2.1

data/lib/pwnlib/shellcraft/generators/i386/common/common.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'pwnlib/shellcraft/generators/helper'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        # For non os-related methods.
+        module Common
+          extend ::Pwnlib::Shellcraft::Generators::Helper
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/i386/common/infloop.rb

@@ -0,0 +1,24 @@
+# encoding: ASCII-8BIT
+# frozen_string_literal: true
+
+require 'pwnlib/shellcraft/generators/i386/common/common'
+require 'pwnlib/shellcraft/generators/x86/common/infloop'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        module Common
+          # @overload infloop
+          #
+          # @see Generators::X86::Common#infloop
+          def infloop(*args)
+            context.local(arch: :i386) do
+              cat X86::Common.infloop(*args)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/i386/common/memcpy.rb

@@ -0,0 +1,34 @@
+# encoding: ASCII-8BIT
+# frozen_string_literal: true
+
+require 'pwnlib/shellcraft/generators/i386/common/common'
+require 'pwnlib/shellcraft/generators/i386/common/setregs'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        module Common
+          # Like +memcpy+ in glibc.
+          #
+          # Copy +n+ bytes from +src+ to +dst+.
+          #
+          # @param [String, Symbol, Integer] dst
+          #   Destination.
+          # @param [String, Symbol, Integer] src
+          #   Source to be copied.
+          # @param [Integer] n
+          #   The number of bytes to be copied.
+          #
+          # @see Amd64::Common#memcpy
+          def memcpy(dst, src, n)
+            cat "/* memcpy(#{pretty(dst)}, #{pretty(src)}, #{pretty(n)}) */"
+            cat 'cld'
+            cat Common.setregs({ edi: dst, esi: src, ecx: n })
+            cat 'rep movsb'
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/i386/common/mov.rb

@@ -0,0 +1,93 @@
+# encoding: ASCII-8BIT
+# frozen_string_literal: true
+
+require 'pwnlib/shellcraft/generators/i386/common/common'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        module Common
+          # Move +src+ into +dst+ without newlines and null bytes.
+          #
+          # See {Amd64::Common#mov} for parameters' details.
+          def mov(dst, src, stack_allowed: true)
+            raise ArgumentError, "#{dst} is not a register" unless register?(dst)
+
+            dst = get_register(dst)
+            raise ArgumentError, "cannot use #{dst} on i386" if dst.size > 32 || dst.is64bit
+
+            if register?(src)
+              src = get_register(src)
+              raise ArgumentError, "cannot use #{src} on i386" if src.size > 32 || src.is64bit
+              if dst.size < src.size && !dst.bigger.include?(src.name)
+                raise ArgumentError, "cannot mov #{dst}, #{src}: dst is smaller than src"
+              end
+            else
+              context.local(arch: 'i386') { src = evaluate(src) }
+              raise ArgumentError, format('cannot mov %s, %d: dst is smaller than src', dst, src) unless dst.fits(src)
+
+              # Calculate the packed version
+              srcp = pack(src & ((1 << dst.size) - 1), bits: dst.size)
+
+              # Calculate the unsigned and signed versions
+              srcu = unpack(srcp, bits: dst.size, signed: false)
+              srcs = unpack(srcp, bits: dst.size, signed: true)
+              srcp_neg = p32(-src)
+              srcp_not = p32(src ^ 0xffffffff)
+            end
+            if register?(src)
+              if src == dst || dst.bigger.include?(src.name)
+                cat "/* moving #{src} into #{dst}, but this is a no-op */"
+              elsif dst.size > src.size
+                cat "movzx #{dst}, #{src}"
+              else
+                cat "mov #{dst}, #{src}"
+              end
+            elsif src.is_a?(Numeric) # Constant or immi
+              xor = ->(reg) { "xor #{reg.xor}, #{reg.xor}" }
+              if src.zero? # special case for zeroes
+                cat "xor #{dst}, #{dst} /* #{src} */"
+              elsif stack_allowed && dst.size == 32 && src == 10
+                cat "push 9 /* mov #{dst}, '\\n' */"
+                cat "pop #{dst}"
+                cat "inc #{dst}"
+              elsif stack_allowed && dst.size == 32 && (-2**7 <= srcs && srcs < 2**7) && okay(srcp[0])
+                cat "push #{pretty(src)}"
+                cat "pop #{dst}"
+              elsif okay(srcp)
+                # Easy case. This implies that the register size and value are the same.
+                cat "mov #{dst}, #{pretty(src)}"
+              elsif srcu < 2**8 && okay(srcp[0]) && dst.sizes.include?(8)
+                # Move 8-bit value into reg.
+                cat xor[dst]
+                cat "mov #{dst.sizes[8]}, #{pretty(src)}"
+              elsif srcu == srcu & 0xff00 && okay(srcp[1]) && dst.ff00
+                # Target value is a 16-bit value with no data in the low 8 bits, we can use the 'AH' style register.
+                cat xor[dst]
+                cat "mov #{dst.ff00}, #{pretty(src)} >> 8"
+              elsif srcu < 2**16 && okay(srcp[0, 2])
+                # Target value is a 16-bit value, use a 16-bit mov.
+                cat xor[dst]
+                cat "mov #{dst.sizes[16]}, #{pretty(src)}"
+              elsif okay(srcp_neg)
+                cat "mov #{dst}, -#{pretty(src)}"
+                cat "neg #{dst}"
+              elsif okay(srcp_not)
+                cat "mov #{dst}, (-1) ^ #{pretty(src)}"
+                cat "not #{dst}"
+              else
+                # All else has failed.  Use some XOR magic to move things around.
+                a, b = xor_pair(srcp, avoid: "\x00\n")
+                a = hex(unpack(a, bits: dst.size))
+                b = hex(unpack(b, bits: dst.size))
+                cat "mov #{dst}, #{a}"
+                cat "xor #{dst}, #{b} /* #{hex(src)} == #{a} ^ #{b} */"
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/i386/common/nop.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require 'pwnlib/shellcraft/generators/i386/common/common'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        module Common
+          # A no-op instruction.
+          def nop
+            cat 'nop'
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/i386/common/pushstr.rb

@@ -0,0 +1,41 @@
+# encoding: ASCII-8BIT
+# frozen_string_literal: true
+
+require 'pwnlib/shellcraft/generators/i386/common/common'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        module Common
+          # Push a string to stack.
+          #
+          # See {Amd64::Common#pushstr} for parameters' details.
+          def pushstr(str, append_null: true)
+            # This will not affect callee's +str+.
+            str += "\x00" if append_null && !str.end_with?("\x00")
+            return if str.empty?
+
+            padding = str[-1].ord >= 128 ? "\xff" : "\x00"
+            cat "/* push #{str.inspect} */"
+            group(4, str, underfull_action: :fill, fill_value: padding).reverse_each do |word|
+              sign = u32(word, endian: 'little', signed: true)
+              if [0, 0xa].include?(sign) # simple forbidden byte case
+                cat "push #{pretty(sign + 1)}"
+                cat 'dec byte ptr [esp]'
+              elsif sign >= -128 && sign <= 127
+                cat "push #{pretty(sign)}"
+              elsif okay(word)
+                cat "push #{pretty(sign)}"
+              else
+                a = u32(xor_pair(word).first, endian: 'little', signed: false)
+                cat "push #{pretty(a)}"
+                cat "xor dword ptr [esp], #{pretty(a ^ sign)} /* #{pretty(a)} ^ #{pretty(sign)} */"
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/i386/common/pushstr_array.rb

@@ -0,0 +1,24 @@
+# encoding: ASCII-8BIT
+# frozen_string_literal: true
+
+require 'pwnlib/shellcraft/generators/i386/common/common'
+require 'pwnlib/shellcraft/generators/x86/common/pushstr_array'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        module Common
+          # @overload pushstr_array(reg, array)
+          #
+          # @see Generators::X86::Common#pushstr_array
+          def pushstr_array(*args)
+            context.local(arch: :i386) do
+              cat X86::Common.pushstr_array(*args)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/i386/common/setregs.rb

@@ -0,0 +1,24 @@
+# encoding: ASCII-8BIT
+# frozen_string_literal: true
+
+require 'pwnlib/shellcraft/generators/i386/common/common'
+require 'pwnlib/shellcraft/generators/x86/common/setregs'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        module Common
+          # @overload setregs(reg_context, stack_allowed: true)
+          #
+          # @see Generators::X86::Common#setregs
+          def setregs(*args, **kwargs)
+            context.local(arch: :i386) do
+              cat X86::Common.setregs(*args, **kwargs)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/i386/linux/cat.rb

@@ -0,0 +1,24 @@
+# encoding: ASCII-8BIT
+# frozen_string_literal: true
+
+require 'pwnlib/shellcraft/generators/i386/linux/linux'
+require 'pwnlib/shellcraft/generators/x86/linux/cat'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        module Linux
+          # @overload cat(filename, fd: 1)
+          #
+          # @see Generators::X86::Linux#cat
+          def cat(*args, **kwargs)
+            context.local(arch: :i386) do
+              cat X86::Linux.cat(*args, **kwargs)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/i386/linux/execve.rb

@@ -0,0 +1,24 @@
+# encoding: ASCII-8BIT
+# frozen_string_literal: true
+
+require 'pwnlib/shellcraft/generators/i386/linux/linux'
+require 'pwnlib/shellcraft/generators/x86/linux/execve'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        module Linux
+          # @overload execve(path, argv, envp)
+          #
+          # @see Generators::X86::Linux#execve
+          def execve(*args)
+            context.local(arch: :i386) do
+              cat X86::Linux.execve(*args)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/i386/linux/exit.rb

@@ -0,0 +1,24 @@
+# encoding: ASCII-8BIT
+# frozen_string_literal: true
+
+require 'pwnlib/shellcraft/generators/i386/linux/linux'
+require 'pwnlib/shellcraft/generators/x86/linux/exit'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        module Linux
+          # @overload exit(status = 0)
+          #
+          # @see Generators::X86::Linux#exit
+          def exit(*args)
+            context.local(arch: :i386) do
+              cat X86::Linux.exit(*args)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/i386/linux/linux.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'pwnlib/shellcraft/generators/helper'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        # For os-related methods.
+        module Linux
+          extend ::Pwnlib::Shellcraft::Generators::Helper
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/i386/linux/ls.rb

@@ -0,0 +1,24 @@
+# encoding: ASCII-8BIT
+# frozen_string_literal: true
+
+require 'pwnlib/shellcraft/generators/i386/linux/linux'
+require 'pwnlib/shellcraft/generators/x86/linux/ls'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        module Linux
+          # @overload ls(dir = '.')
+          #
+          # @see Generators::X86::Linux#ls
+          def ls(*args)
+            context.local(arch: :i386) do
+              cat X86::Linux.ls(*args)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/i386/linux/open.rb

@@ -0,0 +1,24 @@
+# encoding: ASCII-8BIT
+# frozen_string_literal: true
+
+require 'pwnlib/shellcraft/generators/i386/linux/linux'
+require 'pwnlib/shellcraft/generators/x86/linux/open'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        module Linux
+          # @overload open(filename, flags = 'O_RDONLY', mode = 0)
+          #
+          # @see Generators::X86::Linux#open
+          def open(*args)
+            context.local(arch: :i386) do
+              cat X86::Linux.open(*args)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/i386/linux/sh.rb

@@ -0,0 +1,24 @@
+# encoding: ASCII-8BIT
+# frozen_string_literal: true
+
+require 'pwnlib/shellcraft/generators/i386/linux/linux'
+require 'pwnlib/shellcraft/generators/x86/linux/sh'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module I386
+        module Linux
+          # @overload sh(argv: false)
+          #
+          # @see Generators::X86::Linux#sh
+          def sh(**kwargs)
+            context.local(arch: :i386) do
+              cat X86::Linux.sh(**kwargs)
+            end
+          end
+        end
+      end
+    end
+  end
+end