pwntools 1.1.0 → 1.2.0

data/test/constants/constant_test.rb

@@ -1,4 +1,5 @@
 # encoding: ASCII-8BIT
+# frozen_string_literal: true
 
 require 'test_helper'
 

data/test/constants/constants_test.rb

@@ -1,4 +1,5 @@
 # encoding: ASCII-8BIT
+# frozen_string_literal: true
 
 require 'test_helper'
 

data/test/context_test.rb

@@ -1,4 +1,5 @@
 # encoding: ASCII-8BIT
+# frozen_string_literal: true
 
 require 'test_helper'
 

data/test/data/assembly/aarch64.s

@@ -0,0 +1,19 @@
+# These tests are fetched from Capstone's test_arm64.c
+# ARM-64
+  2c:   09 00 38 d5  mrs   x9, midr_el1
+  30:   bf 40 00 d5  msr   spsel, #0
+  34:   0c 05 13 d5  msr   dbgdtrtx_el0, x12
+  38:   20 50 02 0e  tbx   v0.8b, {v1.16b, v2.16b, v3.16b}, v2.8b
+  3c:   20 e4 3d 0f  scvtf v0.2s, v1.2s, #3
+  40:   00 18 a0 5f  fmla  s0, s0, v0.s[3]
+  44:   a2 00 ae 9e  fmov  x2, v5.d[1]
+  48:   9f 37 03 d5  dsb   nsh
+  4c:   bf 33 03 d5  dmb   osh
+  50:   df 3f 03 d5  isb
+  54:   21 7c 02 9b  mul   x1, x1, x2
+  58:   21 7c 00 53  lsr   w1, w1, #0
+  5c:   00 40 21 4b  sub   w0, w0, w1, uxtw
+  60:   e1 0b 40 b9  ldr   w1, [sp, #8]
+  64:   20 04 81 da  cneg  x0, x1, ne
+  68:   20 08 02 8b  add   x0, x1, x2, lsl #2
+  6c:   10 5b e8 3c  ldr   q16, [x24, w8, uxtw #4]

data/test/data/assembly/amd64.s

@@ -0,0 +1,21 @@
+# simple move
+  0:   b8 17 00 00 00  mov eax, 0x17
+
+# pwntools-python's shellcraft.sh()
+   0:   6a 68                          push    0x68
+   2:   48 b8 2f 62 69 6e 2f 2f 2f 73  movabs  rax, 0x732f2f2f6e69622f
+   c:   50                             push    rax
+   d:   48 89 e7                       mov     rdi, rsp
+  10:   68 72 69 01 01                 push    0x1016972
+  15:   81 34 24 01 01 01 01           xor     dword ptr [rsp], 0x1010101
+  1c:   31 f6                          xor     esi, esi
+  1e:   56                             push    rsi
+  1f:   6a 08                          push    8
+  21:   5e                             pop     rsi
+  22:   48 01 e6                       add     rsi, rsp
+  25:   56                             push    rsi
+  26:   48 89 e6                       mov     rsi, rsp
+  29:   31 d2                          xor     edx, edx
+  2b:   6a 3b                          push    0x3b
+  2d:   58                             pop     rax
+  2e:   0f 05                          syscall

data/test/data/assembly/arm.s

@@ -0,0 +1,9 @@
+# These tests are fetched from Capstone's test_arm.c
+  1000:   ed ff ff eb  bl    #0xfbc
+  1004:   04 e0 2d e5  str   lr, [sp, #-4]!
+  1008:   00 00 00 00  andeq r0, r0, r0
+  100c:   e0 83 22 e5  str   r8, [r2, #-0x3e0]!
+  1010:   f1 02 03 0e  mcreq p2, #0, r0, c3, c1, #7
+  1014:   00 00 a0 e3  mov   r0, #0
+  1018:   02 30 c1 e7  strb  r3, [r1, r2]
+  101c:   00 00 53 e3  cmp   r3, #0

data/test/data/assembly/i386.s

@@ -0,0 +1,21 @@
+# simple move
+  0:   b8 5d 00 00 00  mov eax, 0x5d
+
+# pwntools-python's shellcraft.sh()
+   0:   6a 68                 push 0x68
+   2:   68 2f 2f 2f 73        push 0x732f2f2f
+   7:   68 2f 62 69 6e        push 0x6e69622f
+   c:   89 e3                 mov  ebx, esp
+   e:   68 01 01 01 01        push 0x1010101
+  13:   81 34 24 72 69 01 01  xor  dword ptr [esp], 0x1016972
+  1a:   31 c9                 xor  ecx, ecx
+  1c:   51                    push ecx
+  1d:   6a 04                 push 4
+  1f:   59                    pop  ecx
+  20:   01 e1                 add  ecx, esp
+  22:   51                    push ecx
+  23:   89 e1                 mov  ecx, esp
+  25:   31 d2                 xor  edx, edx
+  27:   6a 0b                 push 0xb
+  29:   58                    pop  eax
+  2a:   cd 80                 int  0x80

data/test/data/assembly/mips.s

@@ -0,0 +1,16 @@
+# These tests are fetched from Capstone's test_mips.c
+
+# context: endian: big
+# !skip asm # because of keystone-engine/keystone#405
+# MIPS-32 (Big-endian)
+  1000:   0c 10 00 97  jal   0x40025c
+  1004:   00 00 00 00  nop
+  1008:   24 02 00 0c  addiu $v0, $zero, 0xc
+  100c:   8f a2 00 00  lw    $v0, ($sp)
+  1010:   34 21 34 56  ori   $at, $at, 0x3456
+
+# context: endian: big
+# Copied from above, ignored branch instructions
+  1008:   24 02 00 0c  addiu $v0, $zero, 0xc
+  100c:   8f a2 00 00  lw    $v0, ($sp)
+  1010:   34 21 34 56  ori   $at, $at, 0x3456

data/test/data/assembly/mips64.s

@@ -0,0 +1,6 @@
+# context: endian: little
+# These tests are fetched from Capstone's test_mips.c
+# MIPS-64-EL (Little-endian)
+  1000:   56 34 21 34  ori $at, $at, 0x3456
+  1004:   c2 17 01 00  srl $v0, $at, 0x1f
+  1008:   70 00 b2 ff  sd  $s2, 0x70($sp)

data/test/data/assembly/powerpc.s

@@ -0,0 +1,18 @@
+# context: endian: big
+# This test is (almost) same as powerpc64.s
+  1000:   43 20 0c 07  bdnzla+  0xc04
+  1004:   41 56 ff 17  bdztla   4*cr5+eq, 0xffffffffffffff14
+  1008:   80 20 00 00  lwz      1, 0(0)
+  1010:   80 3f 00 00  lwz      1, 0(31)
+  1014:   10 43 23 0e  vpkpx    2, 3, 4
+  1018:   d0 44 00 80  stfs     2, 0x80(4)
+  101c:   4c 43 22 02  crand    2, 3, 4
+  1020:   2d 03 00 80  cmpwi    cr2, 3, 0x80
+  1024:   7c 43 20 14  addc     2, 3, 4
+  1028:   7c 43 20 93  mulhd.   2, 3, 4
+  102c:   4f 20 00 21  bdnzlrl+
+  1030:   4c c8 00 21  bgelrl-  cr2
+  1034:   40 82 00 14  bne      0x1044
+
+# This instruction in ppc32 only
+  0:   7c 21 04 a6  mfsr 1, 1

data/test/data/assembly/powerpc64.s

@@ -0,0 +1,36 @@
+# These tests are fetched from Capstone's test_ppc.c
+
+# context: endian: big
+# !skip asm
+# PPC-64
+  1000:   43 20 0c 07  bdnzla+  0xc04
+  1004:   41 56 7f 17  bdztla   4*cr5+eq, 0x7f14
+# Inconsistent output between capstone3 and later versions, skip
+  ; 1008:   80 20 00 00  lwz      r1, 0(0)
+  ; 100c:   80 3f 00 00  lwz      r1, 0(r31)
+  1008:   10 43 23 0e  vpkpx    v2, v3, v4
+  100c:   d0 44 00 80  stfs     f2, 0x80(r4)
+  1010:   4c 43 22 02  crand    2, 3, 4
+  1014:   2d 03 00 80  cmpwi    cr2, r3, 0x80
+  1018:   7c 43 20 14  addc     r2, r3, r4
+  101c:   7c 43 20 93  mulhd.   r2, r3, r4
+  1020:   4f 20 00 21  bdnzlrl+
+  1024:   4c c8 00 21  bgelrl-  cr2
+  1028:   40 82 00 14  bne      0x103c
+
+# context: endian: big
+# !skip disasm
+# PPC-64
+  1000:   43 20 0c 07  bdnzla+  0xc04
+  1004:   41 56 7f 17  bdztla   4*cr5+eq, 0x7f14
+  1008:   80 20 00 00  lwz      1, 0(0)
+  1010:   80 3f 00 00  lwz      1, 0(31)
+  1014:   10 43 23 0e  vpkpx    2, 3, 4
+  1018:   d0 44 00 80  stfs     2, 0x80(4)
+  101c:   4c 43 22 02  crand    2, 3, 4
+  1020:   2d 03 00 80  cmpwi    cr2, 3, 0x80
+  1024:   7c 43 20 14  addc     2, 3, 4
+  1028:   7c 43 20 93  mulhd.   2, 3, 4
+  102c:   4f 20 00 21  bdnzlrl+
+  1030:   4c c8 00 21  bgelrl-  cr2
+  1034:   40 82 00 14  bne      0x1044

data/test/data/assembly/sparc.s

@@ -0,0 +1,33 @@
+# These tests are fetched from Capstone's test_sparc.c
+
+# !skip asm # because of keystone-engine/keystone#405
+  1000:   80 a0 40 02  cmp     %g1, %g2
+  1004:   85 c2 60 08  jmpl    %o1+8, %g2
+  1008:   85 e8 20 01  restore %g0, 1, %g2
+  100c:   81 e8 00 00  restore
+  1010:   90 10 20 01  mov     1, %o0
+  1014:   d5 f6 10 16  casx    [%i0], %l6, %o2
+  1018:   21 00 00 0a  sethi   0xa, %l0
+  101c:   86 00 40 02  add     %g1, %g2, %g3
+  1020:   01 00 00 00  nop
+  1024:   12 bf ff ff  bne     0x1020
+  1028:   10 bf ff ff  ba      0x1024
+  102c:   a0 02 00 09  add     %o0, %o1, %l0
+  1030:   0d bf ff ff  fbg     0x102c
+  1034:   d4 20 40 00  st      %o2, [%g1]
+  1038:   d4 4e 00 16  ldsb    [%i0+%l6], %o2
+# The output between objdump/llvm/capstone is inconsistent
+  ; 103c:   2a c2 80 03  brnz,a,pn %o2, 0x1048
+
+# Copied from above, ignored branch instructions
+  1000:   80 a0 40 02  cmp     %g1, %g2
+  1004:   85 e8 20 01  restore %g0, 1, %g2
+  1008:   81 e8 00 00  restore
+  100c:   90 10 20 01  mov     1, %o0
+  1010:   d5 f6 10 16  casx    [%i0], %l6, %o2
+  1014:   21 00 00 0a  sethi   0xa, %l0
+  1018:   86 00 40 02  add     %g1, %g2, %g3
+  101c:   01 00 00 00  nop
+  1020:   a0 02 00 09  add     %o0, %o1, %l0
+  1024:   d4 20 40 00  st      %o2, [%g1]
+  1028:   d4 4e 00 16  ldsb    [%i0+%l6], %o2

data/test/data/assembly/sparc64.s

@@ -0,0 +1,5 @@
+# These tests are fetched from Capstone's test_sparc.c
+  1000:   81 a8 0a 24  fcmps %f0, %f4
+  1004:   89 a0 10 20  fstox %f0, %f4
+  1008:   89 a0 1a 60  fqtoi %f0, %f4
+  100c:   89 a0 00 e0  fnegq %f0, %f4

data/test/data/assembly/thumb.s

@@ -0,0 +1,37 @@
+# These tests are fetched from Capstone's test_arm.c
+# Thumb
+# PC-relative instructions are buggy in Capstone3, two lines are commented.
+  80001000:   60 f9 1f 04  vld3.8  {d16, d17, d18}, [r0:0x40]
+  80001004:   e0 f9 4f 07  vld4.16 {d16[1], d17[1], d18[1], d19[1]}, [r0]
+  80001008:   70 47        bx      lr
+  ; 8000100a:   00 f0 10 e8 blx     #0x8000102c
+  8000100a:   eb 46        mov     fp, sp
+  8000100c:   83 b0        sub     sp, #0xc
+  8000100e:   c9 68        ldr     r1, [r1, #0xc]
+  ; 80001010:   1f b1        cbz     r7, #0x8000101e
+  80001010:   30 bf        wfi
+  80001012:   af f3 20 84  cpsie.w f
+  80001016:   52 f8 23 f0  ldr.w   pc, [r2, r3, lsl #2]
+
+# Thumb-mixed
+  80001000:   d1 e8 00 f0  tbb   [r1, r0]
+  80001004:   f0 24        movs  r4, #0xf0
+  80001006:   04 07        lsls  r4, r0, #0x1c
+  80001008:   1f 3c        subs  r4, #0x1f
+  8000100a:   f2 c0        stm   r0!, {r1, r4, r5, r6, r7}
+  8000100c:   00 00        movs  r0, r0
+  8000100e:   4f f0 00 01  mov.w r1, #0
+  80001012:   46 6c        ldr   r6, [r0, #0x44]
+
+# Thumb-2 & register named with numbers
+# An `iteet` instruction is removed to make the `it` instruction valid
+  80001000:   4f f0 00 01  mov.w     r1, #0
+  80001004:   bd e8 00 88  pop.w     {fp, pc}
+  80001008:   d1 e8 00 f0  tbb       [r1, r0]
+  8000100c:   18 bf        it        ne
+  ; 8000100e:   ad bf        iteet     ge
+  8000100e:   f3 ff 0b 0c  vdupne.8  d16, d11[1]
+  80001012:   86 f3 00 89  msr       cpsr_fc, r6
+  80001016:   80 f3 00 8c  msr       apsr_nzcvqg, r0
+  8000101a:   4f fa 99 f6  sxtb.w    r6, sb, ror #8
+  8000101e:   d0 ff a2 01  vaddw.u16 q8, q8, d18

data/test/data/echo.rb

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 require 'socket'
 

data/test/dynelf_test.rb

@@ -1,4 +1,5 @@
 # encoding: ASCII-8BIT
+# frozen_string_literal: true
 
 require 'open3'
 
@@ -16,7 +17,7 @@ class DynELFTest < MiniTest::Test
   include ::Pwnlib::ELF
 
   def setup
-    skip 'Only tested on linux' unless TTY::Platform.new.linux?
+    linux_only
   end
 
   # popen victim with specific libc.so.6
@@ -49,6 +50,7 @@ class DynELFTest < MiniTest::Test
         IO.readlines("/proc/#{options[:pid]}/maps").map(&:split).each do |s|
           st, ed = s[0].split('-').map { |x| x.to_i(16) }
           next unless main_ra.between?(st, ed)
+
           realbase = st
           break
         end

data/test/elf/elf_test.rb

@@ -1,11 +1,15 @@
 # encoding: ASCII-8BIT
+# frozen_string_literal: true
 
 require 'test_helper'
 
+require 'pwnlib/context'
 require 'pwnlib/elf/elf'
 require 'pwnlib/logger'
 
 class ELFTest < MiniTest::Test
+  include ::Pwnlib::Context
+
   def setup
     @path_of = ->(file) { File.join(__dir__, '..', 'data', 'elfs', file) }
     @elf = to_elf_silent('i386.prelro.elf')
@@ -126,4 +130,18 @@ PIE:      No PIE (0x400000)
     assert_equal([0x1234001, 0x1392613], elf.search('ELF').to_a)
     assert_equal(0x138d00b, elf.find('/bin/sh').next)
   end
+
+  def test_one_gadgets
+    libc = ::Pwnlib::ELF::ELF.new(File.join(__dir__, '..', 'data', 'lib64', 'libc.so.6'), checksec: false)
+    # Well.. one_gadget(s) may change in the future, so we just check the return type
+    val = libc.one_gadgets.first
+    assert(val.is_a?(Integer))
+    assert_equal(libc.one_gadgets[0], val)
+    assert_equal(libc.one_gadgets[-1], libc.one_gadgets.last)
+
+    libc.address = 0xdeadf000
+    assert_equal(0xdeadf000 + val, libc.one_gadgets[0])
+
+    assert_output(/execve/) { log_stdout { context.local(log_level: :debug) { libc.one_gadgets[0] } } }
+  end
 end

data/test/ext_test.rb

@@ -1,4 +1,5 @@
 # encoding: ASCII-8BIT
+# frozen_string_literal: true
 
 require 'test_helper'
 

data/test/files/use_pwn.rb

@@ -1,4 +1,5 @@
 # encoding: ASCII-8BIT
+# frozen_string_literal: true
 
 # Make sure we're using local copy for local testing.
 $LOAD_PATH.unshift File.expand_path(File.join(__FILE__, '..', '..', '..', 'lib'))

data/test/files/use_pwnlib.rb

@@ -1,4 +1,5 @@
 # encoding: ASCII-8BIT
+# frozen_string_literal: true
 
 # Make sure we're using local copy for local testing.
 $LOAD_PATH.unshift File.expand_path(File.join(__FILE__, '..', '..', '..', 'lib'))

data/test/full_file_test.rb

@@ -1,4 +1,5 @@
 # encoding: ASCII-8BIT
+# frozen_string_literal: true
 
 require 'open3'
 
@@ -13,4 +14,9 @@ class FullFileTest < MiniTest::Test
       assert(status.success?, stderr)
     end
   end
+
+  def test_ruby_cli
+    _, stderr, status = Open3.capture3('ruby', '-e', 'require "pwn"', binmode: true)
+    assert(status.success?, stderr)
+  end
 end

data/test/logger_test.rb

@@ -1,4 +1,8 @@
 # encoding: ASCII-8BIT
+# frozen_string_literal: true
+
+require 'open3'
+require 'tempfile'
 
 require 'test_helper'
 
@@ -12,15 +16,15 @@ class LoggerTest < MiniTest::Test
   def setup
     @logger = ::Pwnlib::Logger::LoggerType.new
     class << @logger
-      def add(*args)
+      def add(*)
         clear
         super
         @logdev.string
       end
 
-      def indented(*args)
+      def indented(*, **)
         clear
-        super(*args)
+        super
         @logdev.string
       end
 
@@ -95,5 +99,22 @@ class LoggerTest < MiniTest::Test
        libc.to_s
        libc.to_s(16) = "bc614e000"
     EOS
+
+    lib_path = File.expand_path(File.join(__dir__, '..', 'lib'))
+    f = Tempfile.new(['dump', '.rb'])
+    begin
+      f.write <<~EOS
+        $LOAD_PATH.unshift #{lib_path.inspect}
+        require 'pwn'
+        FileUtils.remove(__FILE__)
+        log.dump 1337
+      EOS
+      f.close
+      _, stderr, status = Open3.capture3('ruby', f.path, binmode: true)
+      assert(status.success?, stderr)
+    ensure
+      f.close
+      f.unlink
+    end
   end
 end

data/test/memleak_test.rb

@@ -1,4 +1,5 @@
 # encoding: ASCII-8BIT
+# frozen_string_literal: true
 
 require 'open3'
 

data/test/reg_sort_test.rb

@@ -1,4 +1,5 @@
 # encoding: ASCII-8BIT
+# frozen_string_literal: true
 
 require 'test_helper'
 

data/test/runner_test.rb

@@ -0,0 +1,32 @@
+# encoding: ASCII-8BIT
+# frozen_string_literal: true
+
+require 'test_helper'
+
+require 'pwnlib/runner'
+require 'pwnlib/shellcraft/shellcraft'
+
+class RunnerTest < MiniTest::Test
+  include ::Pwnlib::Context
+
+  def setup
+    linux_only 'Runner can only be used on Linux'
+  end
+
+  def shellcraft
+    ::Pwnlib::Shellcraft::Shellcraft.instance
+  end
+
+  def test_i386_run_assembly
+    context.local(arch: 'i386') do
+      r = ::Pwnlib::Runner.run_assembly(
+        shellcraft.pushstr('run_assembly') +
+        shellcraft.syscall('SYS_write', 1, 'esp', 12) +
+        shellcraft.exit(0)
+      )
+      assert_equal('run_assembly', r.recvn(12))
+      # Test if reach EOF
+      assert_raises(::Pwnlib::Errors::EndOfTubeError) { r.recv }
+    end
+  end
+end