8d7613a419f51385e765cb9998da65eb488faa2e

pending completion

Build # 8d7613a419f51385e765cb9998da65eb488faa2e

Build Type

push

github-actions

Committed by

web-flow

Commit Message

Merge branch 'dev' into process-env-add-2

Run Details

3905 of 6422 branches covered (60.81%)

1649 of 1649 new or added lines in 79 files covered. (100.0%)

12255 of 16708 relevant lines covered (73.35%)

0.73 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

97.73

/pwnlib/elf/datatypes.py

#!/usr/bin/env python
# -*- coding: utf-8 -*-
#
#  mayhem/datatypes/elf.py
#
#  Redistribution and use in source and binary forms, with or without
#  modification, are permitted provided that the following conditions are
#  met:
#
#  * Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
#  * Redistributions in binary form must reproduce the above
#    copyright notice, this list of conditions and the following disclaimer
#    in the documentation and/or other materials provided with the
#    distribution.
#  * Neither the name of the project nor the names of its
#    contributors may be used to endorse or promote products derived from
#    this software without specific prior written permission.
#
#  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
#  "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
#  LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
#  A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
#  OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
#  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
#  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
#  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
#  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
#  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
#  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
from __future__ import division

import ctypes

Elf32_Addr = ctypes.c_uint32
Elf32_Half = ctypes.c_uint16
Elf32_Off = ctypes.c_uint32
Elf32_Sword = ctypes.c_int32
Elf32_Word = ctypes.c_uint32

Elf64_Addr = ctypes.c_uint64
Elf64_Half = ctypes.c_uint16
Elf64_SHalf = ctypes.c_int16
Elf64_Off = ctypes.c_uint64
Elf64_Sword = ctypes.c_int32
Elf64_Word = ctypes.c_uint32
Elf64_Xword = ctypes.c_uint64
Elf64_Sxword = ctypes.c_int64


AT_CONSTANTS = {
    0 : 'AT_NULL',      # /* End of vector */
    1 : 'AT_IGNORE',    # /* Entry should be ignored */
    2 : 'AT_EXECFD',    # /* File descriptor of program */
    3 : 'AT_PHDR',      # /* Program headers for program */
    4 : 'AT_PHENT',     # /* Size of program header entry */
    5 : 'AT_PHNUM',     # /* Number of program headers */
    6 : 'AT_PAGESZ',    # /* System page size */
    7 : 'AT_BASE',      # /* Base address of interpreter */
    8 : 'AT_FLAGS',     # /* Flags */
    9 : 'AT_ENTRY',     # /* Entry point of program */
    10: 'AT_NOTELF',    # /* Program is not ELF */
    11: 'AT_UID',       # /* Real uid */
    12: 'AT_EUID',      # /* Effective uid */
    13: 'AT_GID',       # /* Real gid */
    14: 'AT_EGID',      # /* Effective gid */
    15: 'AT_PLATFORM',  # /* String identifying platform */
    16: 'AT_HWCAP',     # /* Machine dependent hints about processor capabilities */
    17: 'AT_CLKTCK',    # /* Frequency of times() */
    18: 'AT_FPUCW',
    19: 'AT_DCACHEBSIZE',
    20: 'AT_ICACHEBSIZE',
    21: 'AT_UCACHEBSIZE',
    22: 'AT_IGNOREPPC',
    23: 'AT_SECURE',
    24: 'AT_BASE_PLATFORM', # String identifying real platforms
    25: 'AT_RANDOM',    # Address of 16 random bytes
    31: 'AT_EXECFN',    # Filename of executable
    32: 'AT_SYSINFO',
    33: 'AT_SYSINFO_EHDR',
    34: 'AT_L1I_CACHESHAPE',
    35: 'AT_L1D_CACHESHAPE',
    36: 'AT_L2_CACHESHAPE',
    37: 'AT_L3_CACHESHAPE',
}

class constants:
    EI_MAG0                 = 0
    EI_MAG1                 = 1
    EI_MAG2                 = 2
    EI_MAG3                 = 3
    EI_CLASS                = 4
    EI_DATA                 = 5
    EI_VERSION              = 6
    EI_OSABI                = 7
    EI_ABIVERSION           = 8
    EI_PAD                  = 9
    EI_NIDENT               = 16

    ELFMAG0                 = 0x7f
    ELFMAG1                 = ord('E')
    ELFMAG2                 = ord('L')
    ELFMAG3                 = ord('F')

    ELFCLASSNONE            = 0
    ELFCLASS32              = 1
    ELFCLASS64              = 2

    ELFDATANONE             = 0
    ELFDATA2LSB             = 1
    ELFDATA2MSB             = 2

    # Legal values for Elf_Phdr.p_type (segment type).
    PT_NULL                 = 0
    PT_LOAD                 = 1
    PT_DYNAMIC              = 2
    PT_INTERP               = 3
    PT_NOTE                 = 4
    PT_SHLIB                = 5
    PT_PHDR                 = 6
    PT_TLS                  = 7

    # Legal values for Elf_Ehdr.e_type (object file type).
    ET_NONE                 = 0
    ET_REL                  = 1
    ET_EXEC                 = 2
    ET_DYN                  = 3
    ET_CORE                 = 4

    # Legal values for Elf_Dyn.d_tag (dynamic entry type).
    DT_NULL                 = 0
    DT_NEEDED               = 1
    DT_PLTRELSZ             = 2
    DT_PLTGOT               = 3
    DT_HASH                 = 4
    DT_STRTAB               = 5
    DT_SYMTAB               = 6
    DT_RELA                 = 7
    DT_RELASZ               = 8
    DT_RELAENT              = 9
    DT_STRSZ                = 10
    DT_SYMENT               = 11
    DT_INIT                 = 12
    DT_FINI                 = 13
    DT_SONAME               = 14
    DT_RPATH                = 15
    DT_SYMBOLIC             = 16
    DT_REL                  = 17
    DT_RELSZ                = 18
    DT_RELENT               = 19
    DT_PLTREL               = 20
    DT_DEBUG                = 21
    DT_TEXTREL              = 22
    DT_JMPREL               = 23
    DT_ENCODING             = 32

    # Legal values for Elf_Shdr.sh_type (section type).
    SHT_NULL                = 0
    SHT_PROGBITS            = 1
    SHT_SYMTAB              = 2
    SHT_STRTAB              = 3
    SHT_RELA                = 4
    SHT_HASH                = 5
    SHT_DYNAMIC             = 6
    SHT_NOTE                = 7
    SHT_NOBITS              = 8
    SHT_REL                 = 9
    SHT_SHLIB               = 10
    SHT_DYNSYM              = 11
    SHT_NUM                 = 12

    # Legal values for ST_TYPE subfield of Elf_Sym.st_info (symbol type).
    STT_NOTYPE              = 0
    STT_OBJECT              = 1
    STT_FUNC                = 2
    STT_SECTION             = 3
    STT_FILE                = 4
    STT_COMMON              = 5
    STT_TLS                 = 6

    #
    # Notes used in ET_CORE. Architectures export some of the arch register sets
    # using the corresponding note types via the PTRACE_GETREGSET and
    # PTRACE_SETREGSET requests.
    #
    NT_PRSTATUS             = 1
    NT_PRFPREG              = 2
    NT_PRPSINFO             = 3
    NT_TASKSTRUCT           = 4
    NT_AUXV                 = 6
    #
    # Note to userspace developers: size of NT_SIGINFO note may increase
    # in the future to accommodate more fields, don't assume it is fixed!
    #
    NT_SIGINFO              = 0x53494749
    NT_FILE                 = 0x46494c45
    NT_PRXFPREG             = 0x46e62b7f
    NT_PPC_VMX              = 0x100
    NT_PPC_SPE              = 0x101
    NT_PPC_VSX              = 0x102
    NT_386_TLS              = 0x200
    NT_386_IOPERM           = 0x201
    NT_X86_XSTATE           = 0x202
    NT_S390_HIGH_GPRS       = 0x300
    NT_S390_TIMER           = 0x301
    NT_S390_TODCMP          = 0x302
    NT_S390_TODPREG         = 0x303
    NT_S390_CTRS            = 0x304
    NT_S390_PREFIX          = 0x305
    NT_S390_LAST_BREAK      = 0x306
    NT_S390_SYSTEM_CALL     = 0x307
    NT_S390_TDB             = 0x308
    NT_ARM_VFP              = 0x400
    NT_ARM_TLS              = 0x401
    NT_ARM_HW_BREAK         = 0x402
    NT_ARM_HW_WATCH         = 0x403
    NT_METAG_CBUF           = 0x500
    NT_METAG_RPIPE          = 0x501
    NT_METAG_TLS            = 0x502

    AT_NULL                 = 0
    AT_IGNORE               = 1
    AT_EXECFD               = 2
    AT_PHDR                 = 3
    AT_PHENT                = 4
    AT_PHNUM                = 5
    AT_PAGESZ               = 6
    AT_BASE                 = 7
    AT_FLAGS                = 8
    AT_ENTRY                = 9
    AT_NOTELF               = 10
    AT_UID                  = 11
    AT_EUID                 = 12
    AT_GID                  = 13
    AT_EGID                 = 14
    AT_PLATFORM             = 15
    AT_HWCAP                = 16
    AT_CLKTCK               = 17
    AT_FPUCW                = 18
    AT_DCACHEBSIZE          = 19
    AT_ICACHEBSIZE          = 20
    AT_UCACHEBSIZE          = 21
    AT_IGNOREPPC            = 22
    AT_SECURE               = 23
    AT_BASE_PLATFORM        = 24
    AT_RANDOM               = 25
    AT_EXECFN               = 31
    AT_SYSINFO              = 32
    AT_SYSINFO_EHDR         = 33
    AT_L1I_CACHESHAPE       = 34
    AT_L1D_CACHESHAPE       = 35
    AT_L2_CACHESHAPE        = 36
    AT_L3_CACHESHAPE        = 37

    # Legal flags used in the d_val field of the DT_FLAGS dynamic entry.
    DF_ORIGIN               = 0x01
    DF_SYMBOLIC             = 0x02
    DF_TEXTREL              = 0x04
    DF_BIND_NOW             = 0x08
    DF_STATIC_TLS           = 0x10

    # Legal flags used in the d_val field of the DT_FLAGS_1 dynamic entry.
    DF_1_NOW                = 0x00000001
    DF_1_GLOBAL             = 0x00000002
    DF_1_GROUP              = 0x00000004
    DF_1_NODELETE           = 0x00000008
    DF_1_LOADFLTR           = 0x00000010
    DF_1_INITFIRST          = 0x00000020
    DF_1_NOOPEN             = 0x00000040
    DF_1_ORIGIN             = 0x00000080
    DF_1_DIRECT             = 0x00000100
    DF_1_TRANS              = 0x00000200
    DF_1_INTERPOSE          = 0x00000400
    DF_1_NODEFLIB           = 0x00000800
    DF_1_NODUMP             = 0x00001000
    DF_1_CONFALT            = 0x00002000
    DF_1_ENDFILTEE          = 0x00004000
    DF_1_DISPRELDNE         = 0x00008000
    DF_1_DISPRELPND         = 0x00010000
    DF_1_NODIRECT           = 0x00020000
    DF_1_IGNMULDEF          = 0x00040000
    DF_1_NOKSYMS            = 0x00080000
    DF_1_NOHDR              = 0x00100000
    DF_1_EDITED             = 0x00200000
    DF_1_NORELOC            = 0x00400000
    DF_1_SYMINTPOSE         = 0x00800000
    DF_1_GLOBAUDIT          = 0x01000000
    DF_1_SINGLETON          = 0x02000000


class Elf32_Ehdr(ctypes.Structure):
    _fields_ = [("e_ident", (ctypes.c_ubyte * 16)),
                ("e_type", Elf32_Half),
                ("e_machine", Elf32_Half),
                ("e_version", Elf32_Word),
                ("e_entry", Elf32_Addr),
                ("e_phoff", Elf32_Off),
                ("e_shoff", Elf32_Off),
                ("e_flags", Elf32_Word),
                ("e_ehsize", Elf32_Half),
                ("e_phentsize", Elf32_Half),
                ("e_phnum", Elf32_Half),
                ("e_shentsize", Elf32_Half),
                ("e_shnum", Elf32_Half),
                ("e_shstrndx", Elf32_Half),]

class Elf64_Ehdr(ctypes.Structure):
    _fields_ = [("e_ident", (ctypes.c_ubyte * 16)),
                ("e_type", Elf64_Half),
                ("e_machine", Elf64_Half),
                ("e_version", Elf64_Word),
                ("e_entry", Elf64_Addr),
                ("e_phoff", Elf64_Off),
                ("e_shoff", Elf64_Off),
                ("e_flags", Elf64_Word),
                ("e_ehsize", Elf64_Half),
                ("e_phentsize", Elf64_Half),
                ("e_phnum", Elf64_Half),
                ("e_shentsize", Elf64_Half),
                ("e_shnum", Elf64_Half),
                ("e_shstrndx", Elf64_Half),]

class Elf32_Phdr(ctypes.Structure):
    _fields_ = [("p_type", Elf32_Word),
                ("p_offset", Elf32_Off),
                ("p_vaddr", Elf32_Addr),
                ("p_paddr", Elf32_Addr),
                ("p_filesz", Elf32_Word),
                ("p_memsz", Elf32_Word),
                ("p_flags", Elf32_Word),
                ("p_align", Elf32_Word),]

class Elf64_Phdr(ctypes.Structure):
    _fields_ = [("p_type", Elf64_Word),
                ("p_flags", Elf64_Word),
                ("p_offset", Elf64_Off),
                ("p_vaddr", Elf64_Addr),
                ("p_paddr", Elf64_Addr),
                ("p_filesz", Elf64_Xword),
                ("p_memsz", Elf64_Xword),
                ("p_align", Elf64_Xword),]

class Elf32_Shdr(ctypes.Structure):
    _fields_ = [("sh_name", Elf32_Word),
                ("sh_type", Elf32_Word),
                ("sh_flags", Elf32_Word),
                ("sh_addr", Elf32_Addr),
                ("sh_offset", Elf32_Off),
                ("sh_size", Elf32_Word),
                ("sh_link", Elf32_Word),
                ("sh_info", Elf32_Word),
                ("sh_addralign", Elf32_Word),
                ("sh_entsize", Elf32_Word),]

class Elf64_Shdr(ctypes.Structure):
    _fields_ = [("sh_name", Elf64_Word),
                ("sh_type", Elf64_Word),
                ("sh_flags", Elf64_Xword),
                ("sh_addr", Elf64_Addr),
                ("sh_offset", Elf64_Off),
                ("sh_size", Elf64_Xword),
                ("sh_link", Elf64_Word),
                ("sh_info", Elf64_Word),
                ("sh_addralign", Elf64_Xword),
                ("sh_entsize", Elf64_Xword),]

class _U__Elf32_Dyn(ctypes.Union):
    _fields_ = [("d_val", Elf32_Sword),
                ("d_ptr", Elf32_Addr),]

class Elf32_Dyn(ctypes.Structure):
    _anonymous_ = ("d_un",)
    _fields_ = [("d_tag", Elf32_Sword),
                ("d_un", _U__Elf32_Dyn),]

class _U__Elf64_Dyn(ctypes.Union):
    _fields_ = [("d_val", Elf64_Xword),
                ("d_ptr", Elf64_Addr),]

class Elf64_Dyn(ctypes.Structure):
    _anonymous_ = ("d_un",)
    _fields_ = [("d_tag", Elf64_Sxword),
                ("d_un", _U__Elf64_Dyn),]

class Elf32_Sym(ctypes.Structure):
    _fields_ = [("st_name", Elf32_Word),
                ("st_value", Elf32_Addr),
                ("st_size", Elf32_Word),
                ("st_info", ctypes.c_ubyte),
                ("st_other", ctypes.c_ubyte),
                ("st_shndx", Elf32_Half),]

class Elf64_Sym(ctypes.Structure):
    _fields_ = [("st_name", Elf64_Word),
                ("st_info", ctypes.c_ubyte),
                ("st_other", ctypes.c_ubyte),
                ("st_shndx", Elf64_Half),
                ("st_value", Elf64_Addr),
                ("st_size", Elf64_Xword),]

class Elf32_Link_Map(ctypes.Structure):
    _fields_ = [("l_addr", Elf32_Addr),
                ("l_name", Elf32_Addr),
                ("l_ld", Elf32_Addr),
                ("l_next", Elf32_Addr),
                ("l_prev", Elf32_Addr),]

class Elf64_Link_Map(ctypes.Structure):
    _fields_ = [("l_addr", Elf64_Addr),
                ("l_name", Elf64_Addr),
                ("l_ld",   Elf64_Addr),
                ("l_next", Elf64_Addr),
                ("l_prev", Elf64_Addr),]


#
# Additions below here by Zach Riggle for pwntool
#
# See the routine elf_machine_runtime_setup for the relevant architecture
# for the layout of the GOT.
#
# https://chromium.googlesource.com/chromiumos/third_party/glibc/+/master/sysdeps/x86/dl-machine.h
# https://chromium.googlesource.com/chromiumos/third_party/glibc/+/master/sysdeps/x86_64/dl-machine.h
# https://fossies.org/dox/glibc-2.20/aarch64_2dl-machine_8h_source.html#l00074
# https://fossies.org/dox/glibc-2.20/powerpc32_2dl-machine_8c_source.html#l00203
#
# For now, these are defined for x86 and x64
#
char = ctypes.c_char
byte = ctypes.c_byte

class Elf_eident(ctypes.Structure):
    _fields_ = [('EI_MAG',char*4),
                ('EI_CLASS',byte),
                ('EI_DATA',byte),
                ('EI_VERSION',byte),
                ('EI_OSABI',byte),
                ('EI_ABIVERSION',byte),
                ('EI_PAD', byte*(16-9))]

class Elf_i386_GOT(ctypes.Structure):
    _fields_ = [("jmp", Elf32_Addr),
                ("linkmap", Elf32_Addr),
                ("dl_runtime_resolve", Elf32_Addr)]
class Elf_x86_64_GOT(ctypes.Structure):
    _fields_ = [("jmp", Elf64_Addr),
                ("linkmap", Elf64_Addr),
                ("dl_runtime_resolve", Elf64_Addr)]

class Elf_HashTable(ctypes.Structure):
    _fields_ = [('nbucket', Elf32_Word),
                ('nchain', Elf32_Word),]
              # ('bucket', nbucket * Elf32_Word),
              # ('chain',  nchain * Elf32_Word)]

# Docs: http://dyncall.org/svn/dyncall/tags/r0.4/dyncall/dynload/dynload_syms_elf.c
class GNU_HASH(ctypes.Structure):
    _fields_ = [('nbuckets',  Elf32_Word),
                ('symndx',    Elf32_Word),
                ('maskwords', Elf32_Word),
                ('shift2',    Elf32_Word)]

class Elf32_r_debug(ctypes.Structure):
    _fields_ = [('r_version', Elf32_Word),
                ('r_map', Elf32_Addr)]

class Elf64_r_debug(ctypes.Structure):
    _fields_ = [('r_version', Elf32_Word),
                ('r_map', Elf64_Addr)]

constants.DT_GNU_HASH = 0x6ffffef5
constants.STN_UNDEF   = 0

pid_t = ctypes.c_uint32

class elf_siginfo(ctypes.Structure):
    _fields_ = [('si_signo', ctypes.c_int32),
                ('si_code', ctypes.c_int32),
                ('si_errno', ctypes.c_int32)]

class timeval32(ctypes.Structure):
    _fields_ = [('tv_sec', ctypes.c_int32),
                ('tv_usec', ctypes.c_int32),]

class timeval64(ctypes.Structure):
    _fields_ = [('tv_sec', ctypes.c_int64),
                ('tv_usec', ctypes.c_int64),]

# See linux/elfcore.h
def generate_prstatus_common(size, regtype):
    c_long = ctypes.c_uint32 if size==32 else ctypes.c_uint64
    timeval = timeval32 if size==32 else timeval64

    return [('pr_info', elf_siginfo),
            ('pr_cursig', ctypes.c_int16),
            ('pr_sigpend', c_long),
            ('pr_sighold', c_long),
            ('pr_pid', pid_t),
            ('pr_ppid', pid_t),
            ('pr_pgrp', pid_t),
            ('pr_sid', pid_t),
            ('pr_utime', timeval),
            ('pr_stime', timeval),
            ('pr_cutime', timeval),
            ('pr_cstime', timeval),
            ('pr_reg', regtype),
            ('pr_fpvalid', ctypes.c_uint32)
            ]

# See i386-linux-gnu/sys/user.h
class user_regs_struct_i386(ctypes.Structure):
    _fields_ = [(name, ctypes.c_uint32) for name in [
                'ebx',
                'ecx',
                'edx',
                'esi',
                'edi',
                'ebp',
                'eax',
                'xds',
                'xes',
                'xfs',
                'xgs',
                'orig_eax',
                'eip',
                'xcs',
                'eflags',
                'esp',
                'xss',
                ]]


assert ctypes.sizeof(user_regs_struct_i386) == 0x44


# See i386-linux-gnu/sys/user.h
class user_regs_struct_amd64(ctypes.Structure):
    _fields_ = [(name, ctypes.c_uint64) for name in [
                'r15',
                'r14',
                'r13',
                'r12',
                'rbp',
                'rbx',
                'r11',
                'r10',
                'r9',
                'r8',
                'rax',
                'rcx',
                'rdx',
                'rsi',
                'rdi',
                'orig_rax',
                'rip',
                'cs',
                'eflags',
                'rsp',
                'ss',
                'fs_base',
                'gs_base',
                'ds',
                'es',
                'fs',
                'gs',
                ]]

assert ctypes.sizeof(user_regs_struct_amd64) == 0xd8

class user_regs_struct_arm(ctypes.Structure):
    _fields_ = [('r%i' % i, ctypes.c_uint32) for i in range(18)]

    @property
    def cpsr(self):
        return self.r16
    @property
    def pc(self):
        return self.r15
    @property
    def lr(self):
        return self.r14
    @property
    def sp(self):
        return self.r13
    @property
    def ip(self):
        return self.r12
    @property
    def fp(self):
        return self.r11


class user_regs_struct_aarch64(ctypes.Structure):
    _fields_ = [('x%i' % i, ctypes.c_uint64) for i in range(31)] \
             + [('sp', ctypes.c_uint64),
                ('pc', ctypes.c_uint64),
                ('pstate', ctypes.c_uint64)]

    @property
    def lr(self):
        return self.x30

    def __getattr__(self, name):
        if name.startswith('r'):
            name = 'x' + name[1:]
            return getattr(self, name) & 0xffffffff
        raise AttributeError(name)

class elf_prstatus_i386(ctypes.Structure):
    _fields_ = generate_prstatus_common(32, user_regs_struct_i386)

assert ctypes.sizeof(elf_prstatus_i386) == 0x90

class elf_prstatus_amd64(ctypes.Structure):
    _fields_ = generate_prstatus_common(64, user_regs_struct_amd64) \
             + [('padding', ctypes.c_uint32)]

assert ctypes.sizeof(elf_prstatus_amd64) == 0x150

class elf_prstatus_arm(ctypes.Structure):
    _fields_ = generate_prstatus_common(32, user_regs_struct_arm)

class elf_prstatus_aarch64(ctypes.Structure):
    _fields_ = generate_prstatus_common(64, user_regs_struct_aarch64)

class Elf32_auxv_t(ctypes.Structure):
    _fields_ = [('a_type', ctypes.c_uint32),
                ('a_val', ctypes.c_uint32),]
class Elf64_auxv_t(ctypes.Structure):
    _fields_ = [('a_type', ctypes.c_uint64),
                ('a_val', ctypes.c_uint64),]

def generate_prpsinfo(long):
    return [
        ('pr_state', byte),
        ('pr_sname', char),
        ('pr_zomb', byte),
        ('pr_nice', byte),
        ('pr_flag', long),
        ('pr_uid', ctypes.c_ushort),
        ('pr_gid', ctypes.c_ushort),
        ('pr_pid', ctypes.c_int),
        ('pr_ppid', ctypes.c_int),
        ('pr_pgrp', ctypes.c_int),
        ('pr_sid', ctypes.c_int),
        ('pr_fname', char * 16),
        ('pr_psargs', char * 80)
    ]

class elf_prpsinfo_32(ctypes.Structure):
    _fields_ = generate_prpsinfo(Elf32_Addr)

class elf_prpsinfo_64(ctypes.Structure):
    _fields_ = generate_prpsinfo(Elf64_Addr)

def generate_siginfo(int_t, long_t):
    class siginfo_t(ctypes.Structure):
        _fields_ = [('si_signo', int_t),
                    ('si_errno', int_t),
                    ('si_code', int_t),
                    ('sigfault_addr', long_t),
                    ('sigfault_trapno', int_t)]
    return siginfo_t

class elf_siginfo_32(generate_siginfo(ctypes.c_uint32, ctypes.c_uint32)):
    pass

class elf_siginfo_64(generate_siginfo(ctypes.c_uint32, ctypes.c_uint64)):
    pass

1	#!/usr/bin/env python
2	# -- coding: utf-8 --
3	#
4	# mayhem/datatypes/elf.py
5	#
6	# Redistribution and use in source and binary forms, with or without
7	# modification, are permitted provided that the following conditions are
8	# met:
9	#
10	# * Redistributions of source code must retain the above copyright
11	# notice, this list of conditions and the following disclaimer.
12	# * Redistributions in binary form must reproduce the above
13	# copyright notice, this list of conditions and the following disclaimer
14	# in the documentation and/or other materials provided with the
15	# distribution.
16	# * Neither the name of the project nor the names of its
17	# contributors may be used to endorse or promote products derived from
18	# this software without specific prior written permission.
19	#
20	# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21	# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22	# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
23	# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
24	# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
25	# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
26	# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27	# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28	# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29	# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
30	# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31	#
32	from __future__ import division	1✔
33
34	import ctypes	1✔
35
36	Elf32_Addr = ctypes.c_uint32	1✔
37	Elf32_Half = ctypes.c_uint16	1✔
38	Elf32_Off = ctypes.c_uint32	1✔
39	Elf32_Sword = ctypes.c_int32	1✔
40	Elf32_Word = ctypes.c_uint32	1✔
41
42	Elf64_Addr = ctypes.c_uint64	1✔
43	Elf64_Half = ctypes.c_uint16	1✔
44	Elf64_SHalf = ctypes.c_int16	1✔
45	Elf64_Off = ctypes.c_uint64	1✔
46	Elf64_Sword = ctypes.c_int32	1✔
47	Elf64_Word = ctypes.c_uint32	1✔
48	Elf64_Xword = ctypes.c_uint64	1✔
49	Elf64_Sxword = ctypes.c_int64	1✔
50
51
52	AT_CONSTANTS = {	1✔
53	0 : 'AT_NULL', # /* End of vector */
54	1 : 'AT_IGNORE', # /* Entry should be ignored */
55	2 : 'AT_EXECFD', # /* File descriptor of program */
56	3 : 'AT_PHDR', # /* Program headers for program */
57	4 : 'AT_PHENT', # /* Size of program header entry */
58	5 : 'AT_PHNUM', # /* Number of program headers */
59	6 : 'AT_PAGESZ', # /* System page size */
60	7 : 'AT_BASE', # /* Base address of interpreter */
61	8 : 'AT_FLAGS', # /* Flags */
62	9 : 'AT_ENTRY', # /* Entry point of program */
63	10: 'AT_NOTELF', # /* Program is not ELF */
64	11: 'AT_UID', # /* Real uid */
65	12: 'AT_EUID', # /* Effective uid */
66	13: 'AT_GID', # /* Real gid */
67	14: 'AT_EGID', # /* Effective gid */
68	15: 'AT_PLATFORM', # /* String identifying platform */
69	16: 'AT_HWCAP', # /* Machine dependent hints about processor capabilities */
70	17: 'AT_CLKTCK', # /* Frequency of times() */
71	18: 'AT_FPUCW',
72	19: 'AT_DCACHEBSIZE',
73	20: 'AT_ICACHEBSIZE',
74	21: 'AT_UCACHEBSIZE',
75	22: 'AT_IGNOREPPC',
76	23: 'AT_SECURE',
77	24: 'AT_BASE_PLATFORM', # String identifying real platforms
78	25: 'AT_RANDOM', # Address of 16 random bytes
79	31: 'AT_EXECFN', # Filename of executable
80	32: 'AT_SYSINFO',
81	33: 'AT_SYSINFO_EHDR',
82	34: 'AT_L1I_CACHESHAPE',
83	35: 'AT_L1D_CACHESHAPE',
84	36: 'AT_L2_CACHESHAPE',
85	37: 'AT_L3_CACHESHAPE',
86	}
87
88	class constants:	1✔
89	EI_MAG0 = 0	1✔
90	EI_MAG1 = 1	1✔
91	EI_MAG2 = 2	1✔
92	EI_MAG3 = 3	1✔
93	EI_CLASS = 4	1✔
94	EI_DATA = 5	1✔
95	EI_VERSION = 6	1✔
96	EI_OSABI = 7	1✔
97	EI_ABIVERSION = 8	1✔
98	EI_PAD = 9	1✔
99	EI_NIDENT = 16	1✔
100
101	ELFMAG0 = 0x7f	1✔
102	ELFMAG1 = ord('E')	1✔
103	ELFMAG2 = ord('L')	1✔
104	ELFMAG3 = ord('F')	1✔
105
106	ELFCLASSNONE = 0	1✔
107	ELFCLASS32 = 1	1✔
108	ELFCLASS64 = 2	1✔
109
110	ELFDATANONE = 0	1✔
111	ELFDATA2LSB = 1	1✔
112	ELFDATA2MSB = 2	1✔
113
114	# Legal values for Elf_Phdr.p_type (segment type).
115	PT_NULL = 0	1✔
116	PT_LOAD = 1	1✔
117	PT_DYNAMIC = 2	1✔
118	PT_INTERP = 3	1✔
119	PT_NOTE = 4	1✔
120	PT_SHLIB = 5	1✔
121	PT_PHDR = 6	1✔
122	PT_TLS = 7	1✔
123
124	# Legal values for Elf_Ehdr.e_type (object file type).
125	ET_NONE = 0	1✔
126	ET_REL = 1	1✔
127	ET_EXEC = 2	1✔
128	ET_DYN = 3	1✔
129	ET_CORE = 4	1✔
130
131	# Legal values for Elf_Dyn.d_tag (dynamic entry type).
132	DT_NULL = 0	1✔
133	DT_NEEDED = 1	1✔
134	DT_PLTRELSZ = 2	1✔
135	DT_PLTGOT = 3	1✔
136	DT_HASH = 4	1✔
137	DT_STRTAB = 5	1✔
138	DT_SYMTAB = 6	1✔
139	DT_RELA = 7	1✔
140	DT_RELASZ = 8	1✔
141	DT_RELAENT = 9	1✔
142	DT_STRSZ = 10	1✔
143	DT_SYMENT = 11	1✔
144	DT_INIT = 12	1✔
145	DT_FINI = 13	1✔
146	DT_SONAME = 14	1✔
147	DT_RPATH = 15	1✔
148	DT_SYMBOLIC = 16	1✔
149	DT_REL = 17	1✔
150	DT_RELSZ = 18	1✔
151	DT_RELENT = 19	1✔
152	DT_PLTREL = 20	1✔
153	DT_DEBUG = 21	1✔
154	DT_TEXTREL = 22	1✔
155	DT_JMPREL = 23	1✔
156	DT_ENCODING = 32	1✔
157
158	# Legal values for Elf_Shdr.sh_type (section type).
159	SHT_NULL = 0	1✔
160	SHT_PROGBITS = 1	1✔
161	SHT_SYMTAB = 2	1✔
162	SHT_STRTAB = 3	1✔
163	SHT_RELA = 4	1✔
164	SHT_HASH = 5	1✔
165	SHT_DYNAMIC = 6	1✔
166	SHT_NOTE = 7	1✔
167	SHT_NOBITS = 8	1✔
168	SHT_REL = 9	1✔
169	SHT_SHLIB = 10	1✔
170	SHT_DYNSYM = 11	1✔
171	SHT_NUM = 12	1✔
172
173	# Legal values for ST_TYPE subfield of Elf_Sym.st_info (symbol type).
174	STT_NOTYPE = 0	1✔
175	STT_OBJECT = 1	1✔
176	STT_FUNC = 2	1✔
177	STT_SECTION = 3	1✔
178	STT_FILE = 4	1✔
179	STT_COMMON = 5	1✔
180	STT_TLS = 6	1✔
181
182	#
183	# Notes used in ET_CORE. Architectures export some of the arch register sets
184	# using the corresponding note types via the PTRACE_GETREGSET and
185	# PTRACE_SETREGSET requests.
186	#
187	NT_PRSTATUS = 1	1✔
188	NT_PRFPREG = 2	1✔
189	NT_PRPSINFO = 3	1✔
190	NT_TASKSTRUCT = 4	1✔
191	NT_AUXV = 6	1✔
192	#
193	# Note to userspace developers: size of NT_SIGINFO note may increase
194	# in the future to accommodate more fields, don't assume it is fixed!
195	#
196	NT_SIGINFO = 0x53494749	1✔
197	NT_FILE = 0x46494c45	1✔
198	NT_PRXFPREG = 0x46e62b7f	1✔
199	NT_PPC_VMX = 0x100	1✔
200	NT_PPC_SPE = 0x101	1✔
201	NT_PPC_VSX = 0x102	1✔
202	NT_386_TLS = 0x200	1✔
203	NT_386_IOPERM = 0x201	1✔
204	NT_X86_XSTATE = 0x202	1✔
205	NT_S390_HIGH_GPRS = 0x300	1✔
206	NT_S390_TIMER = 0x301	1✔
207	NT_S390_TODCMP = 0x302	1✔
208	NT_S390_TODPREG = 0x303	1✔
209	NT_S390_CTRS = 0x304	1✔
210	NT_S390_PREFIX = 0x305	1✔
211	NT_S390_LAST_BREAK = 0x306	1✔
212	NT_S390_SYSTEM_CALL = 0x307	1✔
213	NT_S390_TDB = 0x308	1✔
214	NT_ARM_VFP = 0x400	1✔
215	NT_ARM_TLS = 0x401	1✔
216	NT_ARM_HW_BREAK = 0x402	1✔
217	NT_ARM_HW_WATCH = 0x403	1✔
218	NT_METAG_CBUF = 0x500	1✔
219	NT_METAG_RPIPE = 0x501	1✔
220	NT_METAG_TLS = 0x502	1✔
221
222	AT_NULL = 0	1✔
223	AT_IGNORE = 1	1✔
224	AT_EXECFD = 2	1✔
225	AT_PHDR = 3	1✔
226	AT_PHENT = 4	1✔
227	AT_PHNUM = 5	1✔
228	AT_PAGESZ = 6	1✔
229	AT_BASE = 7	1✔
230	AT_FLAGS = 8	1✔
231	AT_ENTRY = 9	1✔
232	AT_NOTELF = 10	1✔
233	AT_UID = 11	1✔
234	AT_EUID = 12	1✔
235	AT_GID = 13	1✔
236	AT_EGID = 14	1✔
237	AT_PLATFORM = 15	1✔
238	AT_HWCAP = 16	1✔
239	AT_CLKTCK = 17	1✔
240	AT_FPUCW = 18	1✔
241	AT_DCACHEBSIZE = 19	1✔
242	AT_ICACHEBSIZE = 20	1✔
243	AT_UCACHEBSIZE = 21	1✔
244	AT_IGNOREPPC = 22	1✔
245	AT_SECURE = 23	1✔
246	AT_BASE_PLATFORM = 24	1✔
247	AT_RANDOM = 25	1✔
248	AT_EXECFN = 31	1✔
249	AT_SYSINFO = 32	1✔
250	AT_SYSINFO_EHDR = 33	1✔
251	AT_L1I_CACHESHAPE = 34	1✔
252	AT_L1D_CACHESHAPE = 35	1✔
253	AT_L2_CACHESHAPE = 36	1✔
254	AT_L3_CACHESHAPE = 37	1✔
255
256	# Legal flags used in the d_val field of the DT_FLAGS dynamic entry.
257	DF_ORIGIN = 0x01	1✔
258	DF_SYMBOLIC = 0x02	1✔
259	DF_TEXTREL = 0x04	1✔
260	DF_BIND_NOW = 0x08	1✔
261	DF_STATIC_TLS = 0x10	1✔
262
263	# Legal flags used in the d_val field of the DT_FLAGS_1 dynamic entry.
264	DF_1_NOW = 0x00000001	1✔
265	DF_1_GLOBAL = 0x00000002	1✔
266	DF_1_GROUP = 0x00000004	1✔
267	DF_1_NODELETE = 0x00000008	1✔
268	DF_1_LOADFLTR = 0x00000010	1✔
269	DF_1_INITFIRST = 0x00000020	1✔
270	DF_1_NOOPEN = 0x00000040	1✔
271	DF_1_ORIGIN = 0x00000080	1✔
272	DF_1_DIRECT = 0x00000100	1✔
273	DF_1_TRANS = 0x00000200	1✔
274	DF_1_INTERPOSE = 0x00000400	1✔
275	DF_1_NODEFLIB = 0x00000800	1✔
276	DF_1_NODUMP = 0x00001000	1✔
277	DF_1_CONFALT = 0x00002000	1✔
278	DF_1_ENDFILTEE = 0x00004000	1✔
279	DF_1_DISPRELDNE = 0x00008000	1✔
280	DF_1_DISPRELPND = 0x00010000	1✔
281	DF_1_NODIRECT = 0x00020000	1✔
282	DF_1_IGNMULDEF = 0x00040000	1✔
283	DF_1_NOKSYMS = 0x00080000	1✔
284	DF_1_NOHDR = 0x00100000	1✔
285	DF_1_EDITED = 0x00200000	1✔
286	DF_1_NORELOC = 0x00400000	1✔
287	DF_1_SYMINTPOSE = 0x00800000	1✔
288	DF_1_GLOBAUDIT = 0x01000000	1✔
289	DF_1_SINGLETON = 0x02000000	1✔
290
291
292	class Elf32_Ehdr(ctypes.Structure):	1✔
293	_fields_ = [("e_ident", (ctypes.c_ubyte * 16)),	1✔
294	("e_type", Elf32_Half),
295	("e_machine", Elf32_Half),
296	("e_version", Elf32_Word),
297	("e_entry", Elf32_Addr),
298	("e_phoff", Elf32_Off),
299	("e_shoff", Elf32_Off),
300	("e_flags", Elf32_Word),
301	("e_ehsize", Elf32_Half),
302	("e_phentsize", Elf32_Half),
303	("e_phnum", Elf32_Half),
304	("e_shentsize", Elf32_Half),
305	("e_shnum", Elf32_Half),
306	("e_shstrndx", Elf32_Half),]
307
308	class Elf64_Ehdr(ctypes.Structure):	1✔
309	_fields_ = [("e_ident", (ctypes.c_ubyte * 16)),	1✔
310	("e_type", Elf64_Half),
311	("e_machine", Elf64_Half),
312	("e_version", Elf64_Word),
313	("e_entry", Elf64_Addr),
314	("e_phoff", Elf64_Off),
315	("e_shoff", Elf64_Off),
316	("e_flags", Elf64_Word),
317	("e_ehsize", Elf64_Half),
318	("e_phentsize", Elf64_Half),
319	("e_phnum", Elf64_Half),
320	("e_shentsize", Elf64_Half),
321	("e_shnum", Elf64_Half),
322	("e_shstrndx", Elf64_Half),]
323
324	class Elf32_Phdr(ctypes.Structure):	1✔
325	_fields_ = [("p_type", Elf32_Word),	1✔
326	("p_offset", Elf32_Off),
327	("p_vaddr", Elf32_Addr),
328	("p_paddr", Elf32_Addr),
329	("p_filesz", Elf32_Word),
330	("p_memsz", Elf32_Word),
331	("p_flags", Elf32_Word),
332	("p_align", Elf32_Word),]
333
334	class Elf64_Phdr(ctypes.Structure):	1✔
335	_fields_ = [("p_type", Elf64_Word),	1✔
336	("p_flags", Elf64_Word),
337	("p_offset", Elf64_Off),
338	("p_vaddr", Elf64_Addr),
339	("p_paddr", Elf64_Addr),
340	("p_filesz", Elf64_Xword),
341	("p_memsz", Elf64_Xword),
342	("p_align", Elf64_Xword),]
343
344	class Elf32_Shdr(ctypes.Structure):	1✔
345	_fields_ = [("sh_name", Elf32_Word),	1✔
346	("sh_type", Elf32_Word),
347	("sh_flags", Elf32_Word),
348	("sh_addr", Elf32_Addr),
349	("sh_offset", Elf32_Off),
350	("sh_size", Elf32_Word),
351	("sh_link", Elf32_Word),
352	("sh_info", Elf32_Word),
353	("sh_addralign", Elf32_Word),
354	("sh_entsize", Elf32_Word),]
355
356	class Elf64_Shdr(ctypes.Structure):	1✔
357	_fields_ = [("sh_name", Elf64_Word),	1✔
358	("sh_type", Elf64_Word),
359	("sh_flags", Elf64_Xword),
360	("sh_addr", Elf64_Addr),
361	("sh_offset", Elf64_Off),
362	("sh_size", Elf64_Xword),
363	("sh_link", Elf64_Word),
364	("sh_info", Elf64_Word),
365	("sh_addralign", Elf64_Xword),
366	("sh_entsize", Elf64_Xword),]
367
368	class _U__Elf32_Dyn(ctypes.Union):	1✔
369	_fields_ = [("d_val", Elf32_Sword),	1✔
370	("d_ptr", Elf32_Addr),]
371
372	class Elf32_Dyn(ctypes.Structure):	1✔
373	_anonymous_ = ("d_un",)	1✔
374	_fields_ = [("d_tag", Elf32_Sword),	1✔
375	("d_un", _U__Elf32_Dyn),]
376
377	class _U__Elf64_Dyn(ctypes.Union):	1✔
378	_fields_ = [("d_val", Elf64_Xword),	1✔
379	("d_ptr", Elf64_Addr),]
380
381	class Elf64_Dyn(ctypes.Structure):	1✔
382	_anonymous_ = ("d_un",)	1✔
383	_fields_ = [("d_tag", Elf64_Sxword),	1✔
384	("d_un", _U__Elf64_Dyn),]
385
386	class Elf32_Sym(ctypes.Structure):	1✔
387	_fields_ = [("st_name", Elf32_Word),	1✔
388	("st_value", Elf32_Addr),
389	("st_size", Elf32_Word),
390	("st_info", ctypes.c_ubyte),
391	("st_other", ctypes.c_ubyte),
392	("st_shndx", Elf32_Half),]
393
394	class Elf64_Sym(ctypes.Structure):	1✔
395	_fields_ = [("st_name", Elf64_Word),	1✔
396	("st_info", ctypes.c_ubyte),
397	("st_other", ctypes.c_ubyte),
398	("st_shndx", Elf64_Half),
399	("st_value", Elf64_Addr),
400	("st_size", Elf64_Xword),]
401
402	class Elf32_Link_Map(ctypes.Structure):	1✔
403	_fields_ = [("l_addr", Elf32_Addr),	1✔
404	("l_name", Elf32_Addr),
405	("l_ld", Elf32_Addr),
406	("l_next", Elf32_Addr),
407	("l_prev", Elf32_Addr),]
408
409	class Elf64_Link_Map(ctypes.Structure):	1✔
410	_fields_ = [("l_addr", Elf64_Addr),	1✔
411	("l_name", Elf64_Addr),
412	("l_ld", Elf64_Addr),
413	("l_next", Elf64_Addr),
414	("l_prev", Elf64_Addr),]
415
416
417	#
418	# Additions below here by Zach Riggle for pwntool
419	#
420	# See the routine elf_machine_runtime_setup for the relevant architecture
421	# for the layout of the GOT.
422	#
423	# https://chromium.googlesource.com/chromiumos/third_party/glibc/+/master/sysdeps/x86/dl-machine.h
424	# https://chromium.googlesource.com/chromiumos/third_party/glibc/+/master/sysdeps/x86_64/dl-machine.h
425	# https://fossies.org/dox/glibc-2.20/aarch64_2dl-machine_8h_source.html#l00074
426	# https://fossies.org/dox/glibc-2.20/powerpc32_2dl-machine_8c_source.html#l00203
427	#
428	# For now, these are defined for x86 and x64
429	#
430	char = ctypes.c_char	1✔
431	byte = ctypes.c_byte	1✔
432
433	class Elf_eident(ctypes.Structure):	1✔
434	_fields_ = [('EI_MAG',char*4),	1✔
435	('EI_CLASS',byte),
436	('EI_DATA',byte),
437	('EI_VERSION',byte),
438	('EI_OSABI',byte),
439	('EI_ABIVERSION',byte),
440	('EI_PAD', byte*(16-9))]
441
442	class Elf_i386_GOT(ctypes.Structure):	1✔
443	_fields_ = [("jmp", Elf32_Addr),	1✔
444	("linkmap", Elf32_Addr),
445	("dl_runtime_resolve", Elf32_Addr)]
446	class Elf_x86_64_GOT(ctypes.Structure):	1✔
447	_fields_ = [("jmp", Elf64_Addr),	1✔
448	("linkmap", Elf64_Addr),
449	("dl_runtime_resolve", Elf64_Addr)]
450
451	class Elf_HashTable(ctypes.Structure):	1✔
452	_fields_ = [('nbucket', Elf32_Word),	1✔
453	('nchain', Elf32_Word),]
454	# ('bucket', nbucket * Elf32_Word),
455	# ('chain', nchain * Elf32_Word)]
456
457	# Docs: http://dyncall.org/svn/dyncall/tags/r0.4/dyncall/dynload/dynload_syms_elf.c
458	class GNU_HASH(ctypes.Structure):	1✔
459	_fields_ = [('nbuckets', Elf32_Word),	1✔
460	('symndx', Elf32_Word),
461	('maskwords', Elf32_Word),
462	('shift2', Elf32_Word)]
463
464	class Elf32_r_debug(ctypes.Structure):	1✔
465	_fields_ = [('r_version', Elf32_Word),	1✔
466	('r_map', Elf32_Addr)]
467
468	class Elf64_r_debug(ctypes.Structure):	1✔
469	_fields_ = [('r_version', Elf32_Word),	1✔
470	('r_map', Elf64_Addr)]
471
472	constants.DT_GNU_HASH = 0x6ffffef5	1✔
473	constants.STN_UNDEF = 0	1✔
474
475	pid_t = ctypes.c_uint32	1✔
476
477	class elf_siginfo(ctypes.Structure):	1✔
478	_fields_ = [('si_signo', ctypes.c_int32),	1✔
479	('si_code', ctypes.c_int32),
480	('si_errno', ctypes.c_int32)]
481
482	class timeval32(ctypes.Structure):	1✔
483	_fields_ = [('tv_sec', ctypes.c_int32),	1✔
484	('tv_usec', ctypes.c_int32),]
485
486	class timeval64(ctypes.Structure):	1✔
487	_fields_ = [('tv_sec', ctypes.c_int64),	1✔
488	('tv_usec', ctypes.c_int64),]
489
490	# See linux/elfcore.h
491	def generate_prstatus_common(size, regtype):	1✔
492	c_long = ctypes.c_uint32 if size==32 else ctypes.c_uint64	1✔
493	timeval = timeval32 if size==32 else timeval64	1✔
494
495	return [('pr_info', elf_siginfo),	1✔
496	('pr_cursig', ctypes.c_int16),
497	('pr_sigpend', c_long),
498	('pr_sighold', c_long),
499	('pr_pid', pid_t),
500	('pr_ppid', pid_t),
501	('pr_pgrp', pid_t),
502	('pr_sid', pid_t),
503	('pr_utime', timeval),
504	('pr_stime', timeval),
505	('pr_cutime', timeval),
506	('pr_cstime', timeval),
507	('pr_reg', regtype),
508	('pr_fpvalid', ctypes.c_uint32)
509	]
510
511	# See i386-linux-gnu/sys/user.h
512	class user_regs_struct_i386(ctypes.Structure):	1✔
513	_fields_ = [(name, ctypes.c_uint32) for name in [	1✔
514	'ebx',
515	'ecx',
516	'edx',
517	'esi',
518	'edi',
519	'ebp',
520	'eax',
521	'xds',
522	'xes',
523	'xfs',
524	'xgs',
525	'orig_eax',
526	'eip',
527	'xcs',
528	'eflags',
529	'esp',
530	'xss',
531	]]
532
533
534	assert ctypes.sizeof(user_regs_struct_i386) == 0x44	1✔
535
536
537	# See i386-linux-gnu/sys/user.h
538	class user_regs_struct_amd64(ctypes.Structure):	1✔
539	_fields_ = [(name, ctypes.c_uint64) for name in [	1✔
540	'r15',
541	'r14',
542	'r13',
543	'r12',
544	'rbp',
545	'rbx',
546	'r11',
547	'r10',
548	'r9',
549	'r8',
550	'rax',
551	'rcx',
552	'rdx',
553	'rsi',
554	'rdi',
555	'orig_rax',
556	'rip',
557	'cs',
558	'eflags',
559	'rsp',
560	'ss',
561	'fs_base',
562	'gs_base',
563	'ds',
564	'es',
565	'fs',
566	'gs',
567	]]
568
569	assert ctypes.sizeof(user_regs_struct_amd64) == 0xd8	1✔
570
571	class user_regs_struct_arm(ctypes.Structure):	1✔
572	_fields_ = [('r%i' % i, ctypes.c_uint32) for i in range(18)]	1✔
573
574	@property	1✔
575	def cpsr(self):
576	return self.r16	1✔
577	@property	1✔
578	def pc(self):
579	return self.r15	1✔
580	@property	1✔
581	def lr(self):
582	return self.r14	1✔
583	@property	1✔
584	def sp(self):
585	return self.r13	1✔
586	@property	1✔
587	def ip(self):
588	return self.r12	1✔
589	@property	1✔
590	def fp(self):
591	return self.r11	1✔
592
593
594	class user_regs_struct_aarch64(ctypes.Structure):	1✔
595	_fields_ = [('x%i' % i, ctypes.c_uint64) for i in range(31)] \	1✔
596	+ [('sp', ctypes.c_uint64),
597	('pc', ctypes.c_uint64),
598	('pstate', ctypes.c_uint64)]
599
600	@property	1✔
601	def lr(self):
602	return self.x30	×
603
604	def __getattr__(self, name):	1✔
605	if name.startswith('r'):	×
606	name = 'x' + name[1:]	×
607	return getattr(self, name) & 0xffffffff	×
608	raise AttributeError(name)	×
609
610	class elf_prstatus_i386(ctypes.Structure):	1✔
611	_fields_ = generate_prstatus_common(32, user_regs_struct_i386)	1✔
612
613	assert ctypes.sizeof(elf_prstatus_i386) == 0x90	1✔
614
615	class elf_prstatus_amd64(ctypes.Structure):	1✔
616	_fields_ = generate_prstatus_common(64, user_regs_struct_amd64) \	1✔
617	+ [('padding', ctypes.c_uint32)]
618
619	assert ctypes.sizeof(elf_prstatus_amd64) == 0x150	1✔
620
621	class elf_prstatus_arm(ctypes.Structure):	1✔
622	_fields_ = generate_prstatus_common(32, user_regs_struct_arm)	1✔
623
624	class elf_prstatus_aarch64(ctypes.Structure):	1✔
625	_fields_ = generate_prstatus_common(64, user_regs_struct_aarch64)	1✔
626
627	class Elf32_auxv_t(ctypes.Structure):	1✔
628	_fields_ = [('a_type', ctypes.c_uint32),	1✔
629	('a_val', ctypes.c_uint32),]
630	class Elf64_auxv_t(ctypes.Structure):	1✔
631	_fields_ = [('a_type', ctypes.c_uint64),	1✔
632	('a_val', ctypes.c_uint64),]
633
634	def generate_prpsinfo(long):	1✔
635	return [	1✔
636	('pr_state', byte),
637	('pr_sname', char),
638	('pr_zomb', byte),
639	('pr_nice', byte),
640	('pr_flag', long),
641	('pr_uid', ctypes.c_ushort),
642	('pr_gid', ctypes.c_ushort),
643	('pr_pid', ctypes.c_int),
644	('pr_ppid', ctypes.c_int),
645	('pr_pgrp', ctypes.c_int),
646	('pr_sid', ctypes.c_int),
647	('pr_fname', char * 16),
648	('pr_psargs', char * 80)
649	]
650
651	class elf_prpsinfo_32(ctypes.Structure):	1✔
652	_fields_ = generate_prpsinfo(Elf32_Addr)	1✔
653
654	class elf_prpsinfo_64(ctypes.Structure):	1✔
655	_fields_ = generate_prpsinfo(Elf64_Addr)	1✔
656
657	def generate_siginfo(int_t, long_t):	1✔
658	class siginfo_t(ctypes.Structure):	1✔
659	_fields_ = [('si_signo', int_t),	1✔
660	('si_errno', int_t),
661	('si_code', int_t),
662	('sigfault_addr', long_t),
663	('sigfault_trapno', int_t)]
664	return siginfo_t	1✔
665
666	class elf_siginfo_32(generate_siginfo(ctypes.c_uint32, ctypes.c_uint32)):	1✔
667	pass	1✔
668
669	class elf_siginfo_64(generate_siginfo(ctypes.c_uint32, ctypes.c_uint64)):	1✔
670	pass	1✔

Gallopsled / pwntools / 8d7613a419f51385e765cb9998da65eb488faa2e

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous