def __init__(self, argvlist, random: bool):

self.path = locateProgram(argvlist[0])

argvlist[0] = self.path

self.argvlist = argvlist

"""bundles the addresses for the various inserted instructions"""

def __init__(self, segmentstart: int, functioncall: int, nop: int, forkcode: int):

self.segmentstart = segmentstart

self.functioncall = functioncall

self.nop = nop

"""Provides an easy way to redirect stdout and stderr using pipes. Write to the processes STDIN and read from STDOUT at any time! """

def __init__(self, args=None, debugger=None, redirect=False, parent=None, ptraceprocess=None):

self.syscall_options = FunctionCallOptions(

write_types=True,

write_argname=True,

write_address=True,

)

self.stdinRequested = False

self.remember_insert_bp = False

self.atBreakpoint = False

self.inserted_function_data = False

self.parent = None

self.children = []

self.is_terminated = False

self.syscalls_to_trace = parent.syscalls_to_trace if parent else None # first will be set by ProcessManager

self.own_segment = None

if args:

assert debugger is not None

assert not parent

self.disable_randomization = not args.random

# create three pseudo terminals

self.in_pipe = Pipe()

self.out_pipe = Pipe()

self.err_pipe = Pipe()

self.stdin_buf = b""

self.stdout_buf = b""

self.stderr_buf = b""

# if we want to redirect, tell the subprocess to write to our pipe, else it will print to normal stdout

if redirect:

stdout_arg = self.out_pipe.writeobj

stderr_arg = self.err_pipe.writeobj

else:

stdout_arg = None

stderr_arg = None

args = [path_launcher] + args.argvlist

self.popen_obj = Popen(args, stdin=self.in_pipe.readobj, stdout=stdout_arg, stderr=stderr_arg)

self.debugger = debugger

self.ptraceProcess = self.setupPtraceProcess() # launches actual program, halts immediately

self.heap = None

self.programinfo = ProgramInfo(args[1], self.getPid(), self)

self.get_own_segment() # setup own mmap page

# this is used when a process is forked by user

else:

assert isinstance(parent, ProcessWrapper) and isinstance(ptraceprocess, PtraceProcess)

self.parent = parent

self.in_pipe = parent.in_pipe # TODO

self.out_pipe = parent.out_pipe

self.err_pipe = parent.err_pipe

self.stdin_buf = parent.stdin_buf

self.stdout_buf = parent.stdout_buf

self.stderr_buf = parent.stderr_buf

self.debugger = parent.debugger

self.ptraceProcess = ptraceprocess

self._copyBreakpoints()

self.remember_insert_bp = parent.remember_insert_bp

self.heap = None

self.own_segment = parent.own_segment

# if the process spawns new children for other purposes, it might load another library.

# the loaded path could be determined TODO

if LOAD_PROGRAMINFO: # can be disabled in Constants to improve performance

try:

self.programinfo = ProgramInfo(parent.programinfo.path_to_hack,

self.ptraceProcess.pid, self)

except ValueError as e: # if another library is loaded instead of our initial executable

self.programinfo = ProgramInfo(None, self.ptraceProcess.pid, self)

def _copyBreakpoints(self):

"""this is used to creaty new breakpoint python objects for a forked process

It could be optimized to create these Breakpoints without reading/writing again"""

debug("cloning breakpoints")

from ptrace.debugger.process import Breakpoint

debug(self.parent.ptraceProcess.breakpoints)

for bp in self.parent.ptraceProcess.breakpoints.values():

debug("bp= %s" % bp)

assert isinstance(bp, Breakpoint)

new_bp = self.ptraceProcess.createBreakpoint(bp.address)

new_bp.old_bytes = bp.old_bytes

# cover edge case where we just ran into a breakpoint (bp has been temporarily disabled)

if False:

ip = self.parent.remember_insert_bp

if ip: # this var stores the address of where the bp has to be inserted

self.insertBreakpoint(ip)

def getHeap(self):

return self.heap

def setupPtraceProcess(self) -> PtraceProcess:

from ptrace.debugger.debugger import PtraceDebugger

assert isinstance(self.debugger, PtraceDebugger)

ptrace_proc = self.debugger.addProcess(self.popen_obj.pid, is_attached=False, seize=True)

ptrace_proc.interrupt() # seize does not automatically interrupt the process

ptrace_proc.setoptions(self.debugger.options)

# as soon as this variable is changed, process will launch. Here you can alter the process' personality

# warning: right now you can only SET flags, you CANNOT UNSET them. This feature can easily be added in launcher

launcher_ELF = pwn.ELF(path_launcher, False) # get ready to launch

ad = launcher_ELF.symbols["add_personality"]

add_personality = 0

if self.disable_randomization:

add_personality += 0x40000

add_personality = pack("<I", add_personality)

ptrace_proc.writeBytes(ad, add_personality)

ptrace_proc.cont()

event = ptrace_proc.waitEvent()

assert isinstance(event, ProcessExecution), str(event) # execve syscall is hit

ptrace_proc.syscall()

ptrace_proc.waitSyscall()

return ptrace_proc

def addBreakpoints(self, *bp_list):

def addSingleBP(breakpoint):

self.ptraceProcess.createBreakpoint(breakpoint)

for bp in bp_list:

addSingleBP(bp)

def readMappings(self):

return self.ptraceProcess.readMappings()

def writeToBuf(self, text: str):

"""write to the processes stdin.

Use:

w AA

w b"\x41\x41\n"

w b'AA' (no newline added)

w pack(421) (equal to pack("<Q",421)

w pack(<I, 421)

If you write a normal string, a newline is added at the end.

Note that it isnt directly written to its stdin, but instead written to an internal buffer.

Upon a read syscall (trying to consume from stdin), the buffers contents are written to the actual stdin.

This means that if you write to stdin and fork before consumption, both processes will get to consume

what you have previously written."""

match = write_arg_regex.match(text)

if match.group(1):

fmt = match.group(2) if match.group(2) else "<Q" # remove , from fmt

val = match.group(3)

debug("%s %s" % (val, fmt))

val = int(val, 16 if val.startswith("0x") else 10)

try:

text = pack(fmt, val)

except struct_error as e:

print(e)

return

else:

text = (match.group(6) + "\n").encode() if match.group(6) \

else eval(match.group(5))

assert isinstance(text, bytes), "%s" % type(text)

print("writing ", text)

self.stdin_buf += text

def writeBufToPipe(self, n: int):

"""write N bytes to the stdin pipe"""

towrite = self.stdin_buf[0:n]

self.stdin_buf = self.stdin_buf[n:]

return self.in_pipe.write(towrite)

def read(self, n, channel="out"):

if channel == "out":

ret = self.out_pipe.read(n)

self.stdout_buf += ret

return ret

elif channel == "err":

ret = self.err_pipe.read(n)

self.stderr_buf += ret

return ret

else:

raise ValueError

def getfileno(self, which):

if which == "err":

return self.err_pipe.fileno("read")

elif which == "out":

return self.out_pipe.fileno("read")

elif which == "in":

return self.in_pipe.fileno("write")

else:

raise KeyError("specify which")

def getPid(self):

return self.ptraceProcess.pid

def forkProcess(self):

""" forks the process. If the process just syscalled (and is trapped in the syscall entry),

the forked child starts just before that syscall.

The processManager will switch to the newly created child automatically.

Usage: fork gonna_crash_this (name is optional)"""

"""How does it work?

If the process is about to enter a syscall:

Modify $rax to contain the "fork" syscall code.

Else:

Insert a syscall instruction at the current $rip

Step over the syscall, start tracing the new child.

Restore the states of both processes. (Child does not reenter syscall)

"""

process = self.ptraceProcess

ip = process.getInstrPointer() # save state

regs = process.getregs()

at_syscall_entry = process.syscall_state.next_event == "exit" # if process is about to syscall, dont inject

if at_syscall_entry: # user wants to fork just before a syscall

assert process.getreg(

"rax") == 0xffFFffFFffFFffda # rax == -ENOSYS means we are most likely about to enter a syscall

process.setreg("orig_rax", 57)

else:

#original = process.readBytes(ip, len(inject_syscall_instr))

#process.writeBytes(ip, inject_syscall_instr)

process.setreg("rax", 57) # fork code

process.setInstrPointer(self.get_own_segment().forkcode)

process.singleStep() # continue till fork happended

event = process.waitEvent()

from ptrace.debugger.process_event import NewProcessEvent

if not isinstance(event, NewProcessEvent):

rax = process.getreg("rax")

if rax > 2**64:

converted_rax = -rax - 2 ** 64

warning(errno.errorcode[converted_rax])

else:

warning("unexpected %s in forkprocess" % event)

assert isinstance(event, NewProcessEvent), str(event)

process.syscall() # exit fork syscall

process.waitSyscall()

# restore state in parent and child process

child = process.debugger.list[-1]

assert child.getreg("rax") == 0 # successful fork

process.setregs(regs)

child.setregs(regs)

if at_syscall_entry:

# we just returned from our "inserted" fork syscall

# now we need to restore the original state, meaning our

# parent has to enter a syscall again. After that, restore registers

ip = process.getInstrPointer()

process.setInstrPointer(ip - 2)

process.syscall()

process.waitSyscall()

process.setregs(regs)

# child will enter syscall when user continues

orig_rax = process.getreg("orig_rax")

child.setreg("rax", orig_rax)

child.setInstrPointer(ip - 2)

else:

pass

#process.writeBytes(ip, original)

#child.writeBytes(ip, original)

child = ProcessWrapper(parent=self, ptraceprocess=child)

self.children.append(child)

return child

def getFamily(self):

"""print all children of the process"""

def getRepr(procWrap: ProcessWrapper):

return str(procWrap.getPid())

def getChildren(procWrap: ProcessWrapper):

return procWrap.children

if USE_ASCII:

return format_ascii_tree(self, getRepr, getChildren)

else:

return format_tree(self, getRepr, getChildren)

def insertBreakpoint(self, adress):

if not isinstance(adress, int):

adress = parseInteger(adress, self)

if adress is None:

return

result = self.ptraceProcess.createBreakpoint(adress)

return result

def reinstertBreakpoint(self):

"""makes sure that breakpoints are reinserted"""

proc = self.ptraceProcess

ip = proc.getInstrPointer() - 1

bp = proc.findBreakpoint(ip)

bp.desinstall(set_ip=True)

# if the breakpoint was set at a syscall, it will be reinserted after the syscall was executed

self.remember_insert_bp = ip

def _reinstertBreakpoint(self):

""" this is the actual insertion of the breakpoint"""

ip = self.remember_insert_bp

proc = self.ptraceProcess

self.remember_insert_bp = False

proc.singleStep()

event = proc.waitEvent()

proc.createBreakpoint(ip)

assert isinstance(event, ProcessSignal)

return event

def removeBreakpoint(self, address):

"""removes breakpoint"""

if isinstance(address, str):

address = parseInteger(address, self)

assert isinstance(address, int)

proc = self.ptraceProcess

bp = proc.findBreakpoint(address)

if not bp:

return "no breakpoint at %#x" % address

else:

bp.desinstall()

return "breakpoint removed"

def callFunction(self, funcname, *args, tillResult=False):

""" Redirect control flow to call the specified function with given arguments.

Registers will be restored as soon as function returns.

If you dont see a result immediately, continue till you have stepped through all

breakpoints/syscalls

Does nothing if the process just entered syscall

If you want to do something right after this syscall, singlestep over it.

If its a read(stdin) syscall, you need to "trace write"

or disable auto-continue for write in Constants.py

use: call libc:memset $rbp 0x41 0x10

"""

"""How does this work:

call mmap to map a page where we can inject code.

the injected code will call the specified function.

After the specified function is called, it runs into an interrupt.

The "continue" logic will check for each received trap if we have

reached this certain interrupt.

Once that is the case, _afterCallFunction will be called"""

func_ad = self.programinfo.getAddrOf(funcname)

if func_ad is None:

return "function %s not found" % funcname

proc = self.ptraceProcess

if proc.syscall_state.next_event == "exit":

return "about to call syscall, returning"

if self.inserted_function_data:

return "already in an inserted function, returning"

oldregs = proc.getregs()

inject_at = self.get_own_segment().functioncall

argregs = ["rdi", "rsi", "rdx", "rcx", "r8", "r9"] # set new args (depends on calling convention)

if len(args) > len(argregs):

raise ValueError("too many arguments supplied") # TODO add push(var) functionality

for (val, reg) in zip(args, argregs):

proc.setreg(reg, val)

ip = proc.getInstrPointer()

finish = inject_at + 3 # if ip==finish, call afterCalen(pwn.asm("call rax\nint3", arch="amd64")) llFunction

debug(proc.readBytes(inject_at+2,1))

info("inject_at= %x" % inject_at)

proc.setInstrPointer(inject_at)

proc.setreg("rax",func_ad)

self.inserted_function_data = (ip, finish, oldregs, funcname)

res = self.cont() # if you want to debug the injected function, change this to cont(singlestep=True)

return res if res else "none"

def _afterCallFunction(self):

proc = self.ptraceProcess

_, _, oldregs, funcname = self.inserted_function_data

result = proc.getreg("rax")

proc.setregs(oldregs)

self.inserted_function_data = None

return "%s returned %#x" % (funcname, result)

def malloc(self, n):

"""call plt.malloc(n)"""

return self.callFunction("plt.malloc", n)

def free(self, pointer):

"""call plt.free(pointer)

If you want to call libc.free, use callFunction(libc:free, pointer)"""

return self.callFunction("plt.free", pointer)

def singlestep(self):

"""singlestep"""

return self.cont(singlestep=True)

def cont(self, signum=0, singlestep=False):

"""continue execution of the process

stops at:

- a traced syscall (?trace)

- an inserted function

- specified breakpoints"""

proc = self.ptraceProcess

event = self._getNextEvent(signum, singlestep)

if isinstance(event, str): # happens if an interesting syscall is hit

return event

if isinstance(event, ProcessSignal):

if event.signum == SIGTRAP: # normal trap, maybe breakpoint?

ip = proc.getInstrPointer()

if self.inserted_function_data and self.inserted_function_data[1] == ip:

return self._afterCallFunction()

elif ip - 1 in proc.breakpoints.keys() and not singlestep: # did we hit a breakpoint?

debug("cont calls reinsertBreakpoint")

self.reinstertBreakpoint()

return "hit breakpoint at %#x" % (ip - 1)

elif singlestep:

return self.where()

else:

print(self.where(), event)

raise NotImplementedError

else:

if event.signum in SIGNALS_IGNORE.values():

event.signum = 0

else:

warning("got %s, sending it back and continuing" % event)

# warning(self.where())

return self.cont(event.signum, singlestep)

else:

debug("encountered %s" % event)

if isinstance(event, ProcessEvent):

raise event

raise NotImplementedError

#

#

def _getNextEvent(self, signum=0, singlestep=False):

""" continues execution until an interesing syscall is entered/exited or

some other event (hopyfully breakpoint sigtrap) happens"""

def isSysTrap(event):

return isinstance(event, ProcessSignal) and event.signum == 0x80 | SIGTRAP

def isTrap(event):

return isinstance(event, ProcessSignal) and event.signum == SIGTRAP

def feedStdin(syscall):

"""called if process wants to read from stdin"""

assert syscall.result is None # make sure we are not returning from a syscall

count = syscall.arguments[2].value # how much is read

if len(self.stdin_buf) == 0:

print("process requests %d bytes from stdin" % (count))

self.stdinRequested = count

return 0

else:

return count, self.writeBufToPipe(count)

# check if process is trying to read from stdin, if yes give him what we got

if self.stdinRequested:

if self.writeBufToPipe(self.stdinRequested) == 0:

return "no data to stdin was provided"

self.stdinRequested = 0

#

'''this is the actual start of the function'''

proc = self.ptraceProcess

assert isinstance(proc, PtraceProcess)

# if we are continuing from a breakpoint, singlestep over the breakpoint and reinsert it.

# if we are not singlestepping and did not hit a syscall / exceptional event, continue till next syscall

cont_func = proc.syscall if DO_SYSCALL else proc.cont

if self.remember_insert_bp:

event = self._reinstertBreakpoint()

if not singlestep and isTrap(event):

cont_func(signum)

event = proc.waitEvent()

else:

if singlestep:

proc.singleStep(signum)

else:

cont_func(signum)

event = proc.waitEvent()

if not isSysTrap(event):

debug(" getNextEvent returns %s" % event)

return event

# everything from hereon is just about dealing with syscalls

state = proc.syscall_state

syscall = state.event(self.syscall_options)

# if process is about to read from stdin, feed it what we have. if nothing is available, notify user

if syscall.name == "read" and state.next_event == "exit" and \

syscall.arguments[0].value == 0:

written = feedStdin(syscall)

if written == 0:

return "no data to stdin was provided"

else:

print("process requests %d bytes from stdin (%d written)" % written)

# skip over boring syscalls

if syscall.name not in self.syscalls_to_trace:

if syscall.result is not None and PRINT_BORING_SYSCALLS: # print results of boring syscalls

print("syscall %s = %s" % (syscall.format(), syscall.result_text))

return self._getNextEvent()

# we are tracing the specific syscall

else:

if syscall.result is not None: # just returned

return "%s = %s" % (syscall.name, syscall.result_text)

else: # about to call

return "process is about to syscall %s" % syscall.format()

def finish(self):

"""DOES NOT WORK PROPERLY

run until the current function is finished

detected by monitoring $rsp

might break with compiler-optimisations"""

proc = self.ptraceProcess

saved_rsp = rsp = proc.getreg("rsp")

while rsp <= saved_rsp:

self.cont(singlestep=True)

rsp = proc.getreg("rsp")

print("rsp = %#x" % proc.getreg("rsp"))

print("rip = %#x" % proc.getreg("rip"))

print(self.programinfo.where(proc.getreg("rip")))

def examine(self, cmd):

"""examine memory. (use of $reg is possible)

formatting options: b,w,h,g"""

size_modifiers = dict([("b", (1, "B")), ("h", (2, "H")), ("w", (4, "L")), ("g", (8, "Q"))])

instr, _, cmd = cmd.partition(" ")

try:

address = parseInteger(cmd, self)

# make sure adress is in virtual adress space

where_symbol, where_ad = self.programinfo.where(address)

except ValueError as e:

return str(e)

except FileNotFoundError: # happens if we inspect something that is not an ELF file

where_symbol, where_ad = "", address

# check if user specified some special formatting

if "/" in instr:

_, _, instr = instr.partition("/")

args = PRINT_ARGS_REGEX.match(instr)

count = int(args.group(1)) if args.group(1) else 1

fmt = args.group(2)

if fmt not in size_modifiers.keys() and fmt is not "i":

if fmt:

print("fmt %s is not an option" % fmt)

fmt = "w"

else:

count = 1

fmt = "w"

# special case, disassemble and return early

if fmt == "i":

count_read = count

grow_factor = .5

while True:

count_read = int(count_read * (1 + grow_factor))

try:

bytesread = self.ptraceProcess.readBytes(address, count_read)

except PtraceError as e: # incase we cant read count*1.5 bytes because memory isnt mapped

print(e) # this is shitty code, but it should almost never occur

if grow_factor <= .5 ** (2 * 6):

count //= 2

grow_factor = 0.5

count_read = count

grow_factor = grow_factor ** 2

continue

lines = pwn.disasm(bytesread, byte=False, vma=address).splitlines(keepends=True)

# keep reading more bytes until we cleanly disassemlbe COUNT instructions

if any(".byte" in line for line in lines[:count]):

continue

else:

return "".join(lines)

# regular case

size, unpack_fmt = size_modifiers[fmt]

unpack_fmt = "<" + unpack_fmt

# read data from memory and print it accordingly

try:

bytesread = self.ptraceProcess.readBytes(address, size * count)

except PtraceError as e:

return str(e)

# to print offset

symbol_delta = address - where_ad

line_pref = lambda offset: where_symbol + "+%#x" % (symbol_delta + offset)

format_str = " %0" + "%d" % (size * 2) + "x" # to pad with zeros

newLineAfter = 16 // size

result = ""

for i, value in enumerate(iter_unpack(unpack_fmt, bytesread)):

if i % newLineAfter == 0:

result += "\n" + line_pref(i)

result += format_str % value

return result[1:] # remove first newline

def where(self):

ip = self.ptraceProcess.getInstrPointer()

where_symbol, where_ad = self.programinfo.where(ip)

delta = ip - where_ad

return "RIP = %s + %#x" % (where_symbol, delta)

def print(self, cmd: str):

"""print. prefixing with * dereferences the result.

Otherwise, the * works as the multiplication operator.

use: p $rax+1+malloc

p *$rbp+0x10"""

instr, _, cmd = cmd.partition(" ")

try:

result = hex(parseInteger(cmd, self))

except ValueError as e:

result = str(e)

return result

def get_own_segment(self, address=None):

"""injects an MMAP syscall so we get our own page for code"""

if self.own_segment:

return self.own_segment

start = self.programinfo.getElfStart()

address = address if address else start - 0x2000

debug("getownsegment adress = %x" % address)

proc = self.ptraceProcess

if proc.syscall_state.next_event == "exit":

print("about to call syscall, returning")

return

# save state

ip = proc.getInstrPointer()

old_regs = proc.getregs()

old_code = proc.readBytes(ip, len(inject_syscall_instr))

# prepare mmap syscall

MAP_FIXED_NOREPLACE = 1048576

prot = PROT_EXEC

mapflags = MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED_NOREPLACE

length = 0x1000

fill_regs = ["rax", "rdi", "rsi", "rdx", "r10", "r8", "r9"] # calling convention for syscalls

args = [9, address, length, prot, mapflags, -1, 0] # syscallcode, ..., filedescriptor, offset

assert len(args) == len(fill_regs)

for reg, arg in zip(fill_regs, args):

proc.setreg(reg, arg)

proc.writeBytes(ip, inject_syscall_instr)

# step over the syscall

proc.syscall()

proc.waitSyscall()

proc.syscall()

proc.waitSyscall()

result = proc.getreg("rax")

debug("result= %x" % result)

if result > 2 ** 63 - 1:

result -= 2 ** 64

import errno

if errno.EEXIST == -result:

warning("mapping exists")

return self.get_own_segment(address * 2)

# restore state

proc.writeBytes(ip, old_code)

proc.setregs(old_regs)

func_addr = address + 0x100

inject_code = """

call rax

int3

int3

int3"""

inject_code = pwn.asm(inject_code, arch="amd64")

proc.writeBytes(func_addr, inject_code)

nop_addr = address + 0x200

#proc.writeBytes(nop_addr, pwn.asm("nop\nint3")) # TODO jmp 0

proc.writeBytes(nop_addr, b"\xeb\xfe") # jumps to itself

fork_addr = address + 0x300

proc.writeBytes(fork_addr, inject_syscall_instr)

self.own_segment = InsertedGadgets(address, func_addr, nop_addr, fork_addr)

return self.own_segment

def wait_for_SIGNAL(self, signal: int):

"""catches a signal without changing the state of the process

(except the own page mapping, but that is currently done at initialization of the process)(docstrings lie sometimes)"""

if not signal:

return

proc = self.ptraceProcess

regs = proc.getregs()

proc.setInstrPointer(self.get_own_segment().nop)

proc.syscall()

event = proc.waitEvent()

assert isinstance(event, ProcessSignal) and event.signum == signal , event.signum