Skip to content

Commit 55cfdce

Browse files
committed
change checksec=False on ELF class
There is no need to print checksec details every time. Most usecases only need to view checksec once in a while. Here is the `checksec=False` set before this patch: ``` > rg '\sELF\(' | rg checksec pwnlib/libcdb.py: local_libc = ELF(shell_path, checksec=False).libc pwnlib/libcdb.py: libc = ELF(filename, checksec=False) pwnlib/libcdb.py: >>> libc_path = ELF(which('ls'), checksec=False).libc.path pwnlib/libcdb.py: libc = ELF(libc_path, checksec=False) pwnlib/elf/elf.py: return ELF(lib, self._print_checksec) pwnlib/elf/elf.py: return ELF(exepath, checksec=False) pwnlib/elf/elf.py: return ELF(exepath, checksec=False) pwnlib/commandline/libcdb.py: exe = ELF(path, checksec=False) pwnlib/commandline/checksec.py: e = ELF(f) pwnlib/data/templates/pwnup.mako: ctx.binary = ELF(binary, checksec=False) ```
1 parent 636b3b2 commit 55cfdce

File tree

10 files changed

+42
-44
lines changed

10 files changed

+42
-44
lines changed

CHANGELOG.md

+2
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@ The table below shows which release corresponds to each branch, and what date th
7474

7575
## 5.0.0 (`dev`)
7676

77+
- [#2549][2549] `checksec` argument of `ELF` class now defaults to `False`.
7778
- [#2519][2519] Drop Python 2.7 support / Require Python 3.10
7879
- [#2507][2507] Add `+LINUX` and `+WINDOWS` doctest options and start proper testing on Windows
7980
- [#2522][2522] Support starting a kitty debugging window with the 'kitten' command
@@ -86,6 +87,7 @@ The table below shows which release corresponds to each branch, and what date th
8687
- [#2506][2506] ROP: fix `ROP(ELF(exe)).leave` is `None` in some ELF
8788
- [#2504][2504] doc: add example case for `tuple` (host, port pair) in `gdb.attach`
8889

90+
[2549]: https://github.com/Gallopsled/pwntools/pull/2549
8991
[2519]: https://github.com/Gallopsled/pwntools/pull/2519
9092
[2507]: https://github.com/Gallopsled/pwntools/pull/2507
9193
[2522]: https://github.com/Gallopsled/pwntools/pull/2522

pwnlib/commandline/checksec.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ def main(args):
3434

3535
for f in files:
3636
try:
37-
e = ELF(f)
37+
e = ELF(f, checksec=True)
3838
except Exception as e:
3939
print("{name}: {error}".format(name=f, error=e))
4040

pwnlib/commandline/debug.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ def main(args):
6161

6262
if args.executable:
6363
if os.path.exists(args.executable):
64-
context.binary = ELF(args.executable)
64+
context.binary = ELF(args.executable) # ???
6565
target = context.binary.path
6666

6767
# This path does nothing, but avoids the "print_usage()"

pwnlib/commandline/disablenx.py

+2-2
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,9 @@
1919

2020
def main(args):
2121
for f in args.elf:
22-
e = ELF(f.name)
22+
e = ELF(f.name, checksec=True)
2323
e.disable_nx()
24-
ELF(e.path)
24+
ELF(e.path, checksec=True)
2525

2626
if __name__ == '__main__':
2727
pwnlib.commandline.common.main(__file__, main)

pwnlib/commandline/elfpatch.py

+1-3
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,7 @@ def main(a):
2727
offset = int(a.offset, 16)
2828
bytes = unhex(a.bytes)
2929

30-
with context.silent:
31-
elf = ELF(a.elf)
32-
30+
elf = ELF(a.elf, checksec=False)
3331
elf.write(offset, bytes)
3432
getattr(sys.stdout, 'buffer', sys.stdout).write(elf.get_data())
3533

pwnlib/commandline/pwnstrip.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ def main(args):
2727
sys.stderr.write(p.format_usage())
2828
sys.exit(0)
2929

30-
elf = ELF(args.file.name)
30+
elf = ELF(args.file.name, checksec=True)
3131
context.clear(arch=elf.arch)
3232

3333
if args.build_id:

pwnlib/dynelf.py

+2
Original file line numberDiff line numberDiff line change
@@ -173,6 +173,7 @@ def __init__(self, leak, pointer=None, elf=None, libcdb=True):
173173
path = elf.path
174174

175175
# Load a fresh copy of the ELF
176+
# why suppress log ?
176177
with context.local(log_level='error'):
177178
w = self.waitfor("Loading from %r" % path)
178179
self.elf = ELF(path)
@@ -573,6 +574,7 @@ def lookup (self, symb = None, lib = None):
573574
log.info("Trying lookup based on Build ID: %s", build_id)
574575
path = libcdb.search_by_build_id(build_id)
575576
if path:
577+
# why suppress log ?
576578
with context.local(log_level='error'):
577579
e = ELF(path)
578580
e.address = dynlib.libbase

pwnlib/elf/elf.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -212,7 +212,7 @@ class ELF(ELFFile):
212212
_fill_gaps = True
213213

214214

215-
def __init__(self, path, checksec=True):
215+
def __init__(self, path, checksec=False):
216216
# elftools uses the backing file for all reads and writes
217217
# in order to permit writing without being able to write to disk,
218218
# mmap() the file.

pwnlib/tubes/process.py

+28-32
Original file line numberDiff line numberDiff line change
@@ -476,10 +476,8 @@ def __on_enoexec(self, exception):
476476
binfmt helpers installed for QEMU.
477477
"""
478478
# Get the ELF binary for the target executable
479-
with context.quiet:
480-
# XXX: Cyclic imports :(
481-
from pwnlib.elf import ELF
482-
binary = ELF(self.executable)
479+
from pwnlib.elf import ELF
480+
binary = ELF(self.executable)
483481

484482
# If we're on macOS, this will never work. Bail now.
485483
# if platform.mac_ver()[0]:
@@ -892,15 +890,15 @@ def maps(self):
892890
"""maps() -> [mapping]
893891
894892
Returns a list of process mappings.
895-
893+
896894
A mapping object has the following fields:
897895
addr, address (addr alias), start (addr alias), end, size, perms, path, rss, pss, shared_clean, shared_dirty, private_clean, private_dirty, referenced, anonymous, swap
898896
899897
perms is a permissions object, with the following fields:
900898
read, write, execute, private, shared, string
901899
902900
Example:
903-
901+
904902
>>> p = process(['cat'])
905903
>>> p.sendline(b"meow")
906904
>>> p.recvline()
@@ -937,16 +935,16 @@ def maps(self):
937935
pmmap_ext = namedtuple(
938936
'pmmap_ext', 'addr perms ' + ' '.join(pmmap_grouped._fields))
939937
940-
941-
Here is an example of a pmmap_ext entry:
938+
939+
Here is an example of a pmmap_ext entry:
942940
943941
.. code-block:: python
944942
945943
pmmap_ext(addr='15555551c000-155555520000', perms='r--p', path='[vvar]', rss=0, size=16384, pss=0, shared_clean=0, shared_dirty=0, private_clean=0, private_dirty=0, referenced=0, anonymous=0, swap=0)
946944
"""
947945

948946
permissions = namedtuple("permissions", "read write execute private shared string")
949-
mapping = namedtuple("mapping",
947+
mapping = namedtuple("mapping",
950948
"addr address start end size perms path rss pss shared_clean shared_dirty private_clean private_dirty referenced anonymous swap")
951949
# addr = address (alias) = start (alias)
952950

@@ -976,11 +974,11 @@ def get_mapping(self, path_value, single=True):
976974
single(bool=True): Whether to only return the first
977975
mapping matched, or all of them.
978976
979-
Returns found mapping(s) in process memory according to
977+
Returns found mapping(s) in process memory according to
980978
path_value.
981979
982980
Example:
983-
981+
984982
>>> p = process(['cat'])
985983
>>> mapping = p.get_mapping('[stack]')
986984
>>> mapping.path == '[stack]'
@@ -1039,7 +1037,7 @@ def stack_mapping(self, single=True):
10391037
10401038
"""
10411039
return self.get_mapping('[stack]', single)
1042-
1040+
10431041
def heap_mapping(self, single=True):
10441042
"""heap_mapping(single=True) -> mapping
10451043
heap_mapping(False) -> [mapping]
@@ -1071,7 +1069,7 @@ def heap_mapping(self, single=True):
10711069
10721070
"""
10731071
return self.get_mapping('[heap]', single)
1074-
1072+
10751073
def vdso_mapping(self, single=True):
10761074
"""vdso_mapping(single=True) -> mapping
10771075
vdso_mapping(False) -> [mapping]
@@ -1100,7 +1098,7 @@ def vdso_mapping(self, single=True):
11001098
11011099
"""
11021100
return self.get_mapping('[vdso]', single)
1103-
1101+
11041102
def vvar_mapping(self, single=True):
11051103
"""vvar_mapping(single=True) -> mapping
11061104
vvar_mapping(False) -> [mapping]
@@ -1129,7 +1127,7 @@ def vvar_mapping(self, single=True):
11291127
11301128
"""
11311129
return self.get_mapping('[vvar]', single)
1132-
1130+
11331131
def libc_mapping(self, single=True):
11341132
"""libc_mapping(single=True) -> mapping
11351133
libc_mapping(False) -> [mapping]
@@ -1139,7 +1137,7 @@ def libc_mapping(self, single=True):
11391137
mapping matched, or all of them.
11401138
11411139
Returns either the first libc mapping found in process memory,
1142-
or all libc mappings, depending on "single".
1140+
or all libc mappings, depending on "single".
11431141
11441142
Example:
11451143
@@ -1183,7 +1181,7 @@ def libc_mapping(self, single=True):
11831181
if 'libc.so' in lib_basename or ('libc-' in lib_basename and '.so' in lib_basename):
11841182
l_mappings.append(mapping)
11851183
return l_mappings
1186-
1184+
11871185
def musl_mapping(self, single=True):
11881186
"""musl_mapping(single=True) -> mapping
11891187
musl_mapping(False) -> [mapping]
@@ -1193,7 +1191,7 @@ def musl_mapping(self, single=True):
11931191
mapping matched, or all of them.
11941192
11951193
Returns either the first musl mapping found in process memory,
1196-
or all musl mappings, depending on "single".
1194+
or all musl mappings, depending on "single".
11971195
"""
11981196
all_maps = self.maps()
11991197

@@ -1203,14 +1201,14 @@ def musl_mapping(self, single=True):
12031201
if 'musl.so' in lib_basename or ('musl-' in lib_basename and '.so' in lib_basename):
12041202
return mapping
12051203
return None
1206-
1204+
12071205
m_mappings = []
12081206
for mapping in all_maps:
12091207
lib_basename = os.path.basename(mapping.path)
12101208
if 'musl.so' in lib_basename or ('musl-' in lib_basename and '.so' in lib_basename):
12111209
m_mappings.append(mapping)
12121210
return m_mappings
1213-
1211+
12141212
def elf_mapping(self, single=True):
12151213
"""elf_mapping(single=True) -> mapping
12161214
elf_mapping(False) -> [mapping]
@@ -1274,10 +1272,10 @@ def lib_size(self, path_value):
12741272

12751273
# Expecting this to be sorted
12761274
lib_mappings = self.get_mapping(path_value, single=False)
1277-
1275+
12781276
if len(lib_mappings) == 0:
12791277
return 0
1280-
1278+
12811279
is_contiguous = True
12821280
total_size = lib_mappings[0].size
12831281
for i in range(1, len(lib_mappings)):
@@ -1293,7 +1291,7 @@ def lib_size(self, path_value):
12931291

12941292
def address_mapping(self, address):
12951293
"""address_mapping(address) -> mapping
1296-
1294+
12971295
Returns the mapping at the specified address.
12981296
12991297
Example:
@@ -1333,10 +1331,8 @@ def libs(self):
13331331
maps_raw = self.poll() is not None and memory_maps(self.pid)
13341332

13351333
if not maps_raw:
1336-
import pwnlib.elf.elf
1337-
1338-
with context.quiet:
1339-
return pwnlib.elf.elf.ELF(self.executable).maps
1334+
from pwnlib.elf import ELF
1335+
return ELF(self.executable, checksec=False).maps
13401336

13411337
# Enumerate all of the libraries actually loaded right now.
13421338
maps = {}
@@ -1358,7 +1354,7 @@ def libs(self):
13581354
return maps
13591355

13601356
@property
1361-
def libc(self):
1357+
def libc(self, checksec=False):
13621358
"""libc() -> ELF
13631359
13641360
Returns an ELF for the libc for the current process.
@@ -1378,7 +1374,7 @@ def libc(self):
13781374
for lib, address in self.libs().items():
13791375
lib_basename = os.path.basename(lib)
13801376
if 'libc.so' in lib_basename or ('libc-' in lib_basename and '.so' in lib_basename):
1381-
e = ELF(lib)
1377+
e = ELF(lib, checksec)
13821378
e.address = address
13831379
return e
13841380

@@ -1388,8 +1384,8 @@ def elf(self):
13881384
13891385
Returns an ELF file for the executable that launched the process.
13901386
"""
1391-
import pwnlib.elf.elf
1392-
return pwnlib.elf.elf.ELF(self.executable)
1387+
from pwnlib.elf import ELF
1388+
return ELF(self.executable)
13931389

13941390
@property
13951391
def corefile(self):
@@ -1479,7 +1475,7 @@ def writemem(self, address, data):
14791475
data(bytes): Data to write to the address
14801476
14811477
Example:
1482-
1478+
14831479
Let's write data to the beginning of the mapped memory of the ELF.
14841480
14851481
>>> context.clear(arch='i386')

pwnlib/tubes/ssh.py

+3-3
Original file line numberDiff line numberDiff line change
@@ -350,7 +350,7 @@ def libc(self):
350350

351351
for lib, address in self.libs().items():
352352
if 'libc.so' in lib:
353-
e = ELF(lib)
353+
e = ELF(lib, checksec=True)
354354
e.address = address
355355
return e
356356

@@ -360,14 +360,14 @@ def elf(self):
360360
361361
Returns an ELF file for the executable that launched the process.
362362
"""
363-
import pwnlib.elf.elf
363+
from pwnlib.elf import ELF
364364

365365
libs = self.parent.libs(self.executable)
366366

367367
for lib in libs:
368368
# Cannot just check "executable in lib", see issue #1047
369369
if lib.endswith(self.executable):
370-
return pwnlib.elf.elf.ELF(lib)
370+
return ELF(lib, checksec=True)
371371

372372

373373
@property

0 commit comments

Comments
 (0)