Gallopsled / pwntools

74%

dev: 74%

LAST BUILD ON BRANCH safe_link_same_page

branch: safe_link_same_page

CHANGE BRANCH

x

Reset

• safe_link_same_page
• 2020_fix
• 3.0.2
• 3.0.3
• 3.0.4
• 3.1.0
• 3.1.0beta0
• 3.1.0beta1
• 3.1.0beta2
• 3.1.0beta3
• 3.1.1
• 3.10.0
• 3.10.0beta0
• 3.10.0beta1
• 3.10.0beta2
• 3.11.0
• 3.11.0beta0
• 3.12.0
• 3.12.0beta0
• 3.12.1
• 3.12.2
• 3.13.0
• 3.13.0beta0
• 3.2.0
• 3.2.0beta0
• 3.2.0beta1
• 3.2.0beta2
• 3.2.0beta3
• 3.2.0beta4
• 3.2.0beta5
• 3.2.1
• 3.3.0
• 3.3.0beta0
• 3.3.1
• 3.3.2
• 3.3.3
• 3.3.4
• 3.4.0
• 3.4.0beta0
• 3.4.0beta1
• 3.4.0beta2
• 3.4.0beta3
• 3.4.0beta4
• 3.4.1
• 3.5.0
• 3.5.0beta0
• 3.5.0beta1
• 3.5.1
• 3.6.0
• 3.6.0beta0
• 3.6.0beta1
• 3.6.1
• 3.7.0
• 3.7.0beta0
• 3.7.0beta1
• 3.7.1
• 3.8.0
• 3.8.0beta0
• 3.8.0beta1
• 3.9.0beta0
• 3.9.1
• 3.9.2
• 4.0.0
• 4.0.0beta0
• 4.0.1
• 4.1.0beta0
• 4.1.1
• 4.10.0
• 4.10.0beta0
• 4.11.0
• 4.11.0beta0
• 4.11.1
• 4.11_changelog
• 4.12.0
• 4.12.0beta0
• 4.12.0beta1
• 4.13.0
• 4.13.0beta0
• 4.14.0
• 4.14.0beta0
• 4.14.1
• 4.15.0
• 4.15.0beta0
• 4.15.0beta1
• 4.5.0
• 4.5.0beta0
• 4.5.0beta1
• 4.5.1
• 4.6.0
• 4.6.0beta0
• 4.6.0beta1
• 4.7.0
• 4.7.0beta0
• 4.7.1
• 4.8.0
• 4.8.0beta0
• 4.9.0
• 4.9.0beta0
• Fix/typos/20251106175217
• aarch64-loader-atexit-segv
• absolute-rop
• adb-packages-error
• add-process-terminate-method
• add_gnome_for_gdb.attach
• add_ko_file_search_support
• alphabet-small
• android-separate-workflow
• android-tests
• apport-corefile
• arch64be_qemu
• arm-alphanumeric-license
• asga-license
• asm-memoize
• asm_binutils_mipsel
• asm_cache
• asm_native_tools
• auto-disable-term
• bad-unicorn
• base-image-utf8
• bash-completion
• basic-darwin
• beta
• beta-merge
• beta-staging
• better-got
• bfdname-msp430
• binutils-bionic
• blocking-poll-ssh
• broken-unicorn
• bugfix/cyclic_find_large_int
• bugfix/fix_hexdump_docstring
• bump_unicorn_dep
• bytes-iter
• bytes_overwrite
• cache_debuginfod_ci
• calm-down-coverage
• capstone-disasm
• changelog
• changelog_stable
• checksec
• checksec-forgive-dir
• ci-avoid-avd-force-push
• ci-corefile
• ci-mergemarker
• ci_py313
• ci_test
• clean_and_log_buffered
• cleanup-imports
• cleanup-imports-test1
• cleanup-pyelftools-workarounds
• colored_traceback
• colored_traceback_no_TERM
• colorize-template-output
• commandline-deprecate
• config-file
• core-missing-auxv
• corefile-elf
• corefile_stacklog_spam
• cover-more
• crlf
• cx-multi-shellcraft-cmd
• cx-multi-shellcraft-cmd-dev
• cyclic-error-message
• cyclic-find-not-in-alphabeta
• cyclic-fix
• cyclic-hexdump-skip
• cyclic-newline-fix
• debug-ci
• debug-fix-crc
• debuginfod_urls
• declarative-setup
• defer-requests-and-urllib
• demo-link
• dense-rop
• dependabot/github_actions/actions/cache-4
• dependabot/github_actions/actions/cache-5
• dependabot/github_actions/actions/checkout-3
• dependabot/github_actions/actions/checkout-5
• dependabot/github_actions/actions/checkout-6
• dependabot/github_actions/actions/download-artifact-3
• dependabot/github_actions/actions/download-artifact-5
• dependabot/github_actions/actions/download-artifact-6
• dependabot/github_actions/actions/download-artifact-7
• dependabot/github_actions/actions/setup-python-5
• dependabot/github_actions/actions/setup-python-6
• dependabot/github_actions/actions/upload-artifact-3
• dependabot/github_actions/actions/upload-artifact-4
• dependabot/github_actions/actions/upload-artifact-5
• dependabot/github_actions/actions/upload-artifact-6
• dependabot/github_actions/docker/build-push-action-5
• dependabot/github_actions/docker/build-push-action-6
• dependabot/github_actions/docker/login-action-3
• dependabot/github_actions/docker/setup-buildx-action-3
• dependabot_actions
• deprecate_wd
• dev
• dev-staging
• dev-test
• dev-travis-broken
• dev3
• disable-corefile-tests
• disable-pwnlib-ui-in-dev-pull-requests
• disasm_highlight
• disasm_highlights
• doc
• docfix
• docker_doctest
• docker_only_on_main
• docker_publish
• dockerfile-md
• docs-fixes
• document-memleak-caveat
• double-exception
• download_libc_libraries
• draft-pr-to-show-single-file-for-both-OS
• drop-six
• drop_py2
• drop_travisci
• dupio
• dynelf-consolidate
• dynelf-fix
• dynelf-issues
• eatman
• elf-bss
• elf-bss-default
• elf-disasm-vma
• elf-dont-load-dyn-dependencies
• elf-dso-address-fix
• elf-entry-point
• elf-fix-offsets-after-addr-change
• elf-in-memory
• elf-libc-mismatches
• elf-not-checksec
• elf-symbols-got-plt-prefixes
• elf-vaddr-fixup
• elf_close
• elf_libc_checksec
• elf_no_dynamic
• elf_stripped
• elfpatch
• elfpatch-correct
• elfpatch-freebsdfix
• elfutils_new
• enable-corefiles-on-github-actions
• enable_ui_tests_in_ci
• encoders-minfix
• executable-relative-to-cwd
• failing-ui
• feat/debian-libcd
• feat/libcdb-cli
• feat/libcdb-raw-param
• feat/overlap-file-structs
• feat/regshorthand
• feat/template-detect-docker-files
• feat/zellij
• featue/support_preexec_fn_in_debug
• feature/js_packing
• feature/kctf-pow
• feature/support_preexec_args_in_process
• fetch-depth-100
• file_flags
• fishy_gdb
• fix-aarch64-abi
• fix-atexit
• fix-ci
• fix-continuous-integration
• fix-corefile-tests
• fix-crc
• fix-fmtstr
• fix-fmtstr-2
• fix-hexdump_iter-regression
• fix-kitty-again-again
• fix-kitty-com
• fix-process-libs
• fix-process-maps
• fix-pwnlib-util-type-annotations
• fix-rwx-ld
• fix-template-static-binary-docker
• fix-travis
• fix/cache-tempdir-fallback
• fix/requests
• fix/rop-cache-eval
• fix/rpmlint
• fix_1506
• fix_1528
• fix_coverage
• fix_docker
• fix_docs
• fix_missing_start_symbol
• fix_prepy36_install
• fix_python2
• flag-bb
• fmt-raw
• fmtstr-1888
• fmtstr-example
• freebsd-bitswitching
• freebsd-ssh-cache
• fuck
• gdb-2s
• gdb-api
• gdb-attach-rewrite
• gdb-doctest-cleanup
• gdb-faketerminal-timeout
• gdb-helpful-message
• gdb-path
• gdb-qemu-fix
• gdb-resolve-library-addresses
• gdb.debug
• getattr-cleanup
• getexport_strcmp
• gh-actions
• github-actions-enable-corefiles
• github-actions-enable-timeout-SIGALRM
• github-actions-enable-ui
• github-actions-env-vars
• gnu_stack-missing-fix
• hand-PE-libs-with-no-asyncio
• hand-PE-libs-with-no-asyncio-and-no-refactoring
• hand-PE-libs-with-no-asyncio-and-no-refactoring-pylint
• hexii-dump
• highlight_multiline_comment
• i386-dup-fix
• input_interactive_newline
• interactive
• interactive-working-dir
• interactive_newline
• intro-docs
• issue-1427
• issue-1437
• issue-1500
• issue-1517
• issue-1549
• issue-1549-stable
• issue-1564
• issue-1579
• issue-1582
• issue-1591
• issue-1597
• issue-1619
• issue-1627
• issue-1898-stable
• issue-1898-stable-take2
• issue-1960
• issue_1038_stable
• jupyter-detection
• kitty-fallback
• less-silent-ssh
• lexer_exports
• libc_debuginfod_test
• libc_offset_lookup
• libcdb_command
• libcdb_retry_failed
• libcdb_test_skip
• libcdb_unstrip
• libcdb_unstrip_debug
• library-fix
• libs-warning
• lightweight-constants
• lint-parallel
• listen_wait_for_connection_docs
• log_console_spinners
• loglevel-validation-fix
• loong64
• main
• main_ret_glibc_2.34
• master
• mbrute-pickling
• memleak-documentation-endianness
• memleak-six
• merge-pwintool-in-pwntools-in-upstream-in-python3-incremental
• migrate
• mindfuck
• mips-nullbyte
• mips-plt-ftw
• mips_mov_typo
• missing-return-rop.find-stack-adjustment
• more-dockerfile-changes
• more_debuginfod_servers
• need_text_repr
• neko
• newline_for_windows
• optional-deps
• packing-use-args
• packing_ide
• patch-1
• patch-2
• patch-3
• patch-4
• patch-5
• patch-exit-hacks
• patch-overlap
• patch-ptr-funcs
• patch-py-header
• phd-broken-pipe
• plt_sec
• plt_windows
• pr/peace-maker/2310
• prefer-python3-for-ssh-remote-script
• proc-not-executable
• proc-psutil
• process-debug-environment
• process-env-add-2
• process-fix
• process-writemem
• process_libc_flakeytest
• push_docker
• pwn-template-password
• pwn-version
• pwnlib-2.2
• pwnlib-color-always
• pwnlib-io
• pwnlib-util-web-wget
• py2-long
• py2-long-hex
• py3.11-compat
• py39
• pyelftools_py2
• pyinstaller
• pylint
• pylint-ci
• pypi-setup
• pypi-tagcheck
• python2_editable_install
• python2_from_git
• radare2
• readme-links
• readme-pip-install-pwntools
• rebase
• rebase-radare2-2
• recvline_drop_newline
• recvpred_timeout
• recvregex_capture
• redo-1580
• redo-1580-with-more-docs
• redo-1580-with-more-docs-2
• refactor-dockerfiles-for-simplicity
• refactor-encoders
• regsort-aliases
• remote-debugging
• remote-default-sni-for-ssl
• remote-fail-resolution
• remote-sni-docs
• remote_sni
• remove_check
• remove_pip_dep
• remove_six
• replace_keepends_with_drop
• ret2csu
• retguard
• revert-1040-issue_1038_stable
• revert-1165-issue-1164
• revert-675-readthedocs-fix
• riscv-avoid-compressed
• riscv-basic
• riscv-extensions
• riscv_asm_gdb
• riscv_shellcraft
• rop
• rop-docs-assignment
• rop-easy
• rop-faster-stackmove
• rop-no-leave-gadgets
• rop-register-docs
• rop-typo
• rop_args
• rop_no_cache_dir
• rop_raw_list
• rpyc_gdb
• rtd_theme
• run-in-new-terminal-list
• run_in_new_terminal
• sage_remote
• search_executable
• server-tube
• setresuid
• setxid
• sh_string_empty
• shellcraft-amd64
• shellcraft-chain
• shellcraft-faster-enumeration
• shellcraft-registers-riscv64
• shellcraft_sleep
• shellcraft_stackargs
• sigterm_test
• six-version-1.12
• six_leftover
• small_setup_changes
• ssh
• ssh-attach-fix-exe-path
• ssh-channel-with-statement
• ssh-coverage
• ssh-directories
• ssh-easy
• ssh-env-add
• ssh-host-key-warning-error-better
• ssh-interactive-repl
• ssh-listener-broken-typo
• ssh-repr
• ssh-working-dir
• ssh_auth_none
• ssh_connector_netcat
• ssh_disabled_algorithms
• ssh_getattr_kwargs
• ssh_interactive_bytes
• ssh_log_error
• ssh_process_cwd
• ssh_sftp_deduplicate
• ssl-py2-madness
• stable
• stable-4.5.1
• stable-fix-filestructure
• stable-gdb-exe
• stable-staging
• stable-travis-no-android
• stable_ci
• stable_python2_install
• stackhunter-opt
• stale-workaround
• syscall-arg-keywords
• template-ssh-wrongfile
• template_autodetect_exe
• template_detect_files
• term_program_env
• terminator
• test
• test-2177
• test2
• test_gdb
• text_bright
• tmux-splitw
• total-coverage
• travis-ci-enable
• travis-ci-fix-failing-tests
• travis-docker
• travis-dockerfile
• travis-jaxb
• tty-escape
• tube_recvline_eof
• tube_server_loglevel
• tube_upload_manually
• tubes_server_close
• tutorials-link
• type-stubs
• ui-test-debugging
• ui-tests
• unicorn-wx
• unified-args
• unstrip_abort
• update-changelog-440
• update-dietlibc
• update-sphinx
• upload-raw-working-dir
• upload_dir-escaping
• use-context-newline-for-tubes
• v2-elf
• v2-rop
• v6only
• validate-loglevel
• various-docs-improvements
• vermin
• wget-requests
• which_pathext
• windbg
• windows_binutils
• windows_debugger_selector
• windows_doctests
• windows_process_recv
• windows_process_stderr
• windows_process_test
• windows_processes
• windows_smoke_ci
• windows_terminal_splitpane
• wsl_corefile
• wsl_new_terminal_pid
• x32
• x86-switching
• xdg-config-home
• zachriggle-patch-1
• zachriggle-patch-2
• zsh-completion

Build # 22258059965

Build Type

push

github

Committed by peace-maker

Commit Message

Add `reveal_ptr_same_page`

Reveals a pointer mangled using PROTECT_PTR without knowing where it is stored.
Only works when the pointer points to the same page as it is stored on, which happens regularly in normal tcache next-ptrs.

Run Details

3865 of 6516 branches covered (59.32%)

5 of 5 new or added lines in 1 file covered. (100.0%)

13335 of 18117 relevant lines covered (73.6%)

0.74 hits per line