python - What does `@pwnlib.memleak.MemLeak.NoNewlines` mean? -
i stumbled upon following piece of code here:
@pwnlib.memleak.memleak.nonewlines def fmtleak(addr): ... return res printf_leaked = fmtleak.q(printf_got) ... can please explain @pwnlib.memleak.memleak.nonewlines (on beginning line) , fmtleak.q mean in context? sort of python syntax used, , they?
welcome pwntools -- pwnlib.
i'm going explain you're talking about. i'm assuming know call stack is, , exploitation techniques such information leakage , uncontrolled format string known format string bug; need learn don't know among them understand i'm going say.
dynelf
the writer of the article mentioned trying use dynelf, 1 of features provided pwntools resolves remote functions using leaks. dynelf requires python function or pwnlib.memleak.memleak object leaks data @ given address as possible.
class pwnlib.dynelf.dynelf(leak, pointer=none, elf=none)dynelf knows how resolve symbols in remote processes via infoleak(information leakage) or memleak(memory leakage) vulnerability encapsulated
pwnlib.memleak.memleak.
decorator
first of all,
@pwnlib.memleak.memleak.nonewlines def fmtleak(addr): ... return res printf_leaked = fmtleak.q(printf_got) is equivalent to
def fmtleak(addr): ... return res fmtleak = pwnlib.memleak.memleak.nonewlines(fmtleak) printf_leaked = fmtleak.q(printf_got) ; @ python syntax decorators.
so fmtleak becomes instance of memleak class, returned nonewlines method.
nonewlines
pwnlib.memleak.memleak.nonewlines, static method of pwnlib.memleak.memleak class, creates pwnlib.memleak.memleak object, leak function(function leak data) wrapped wrapper function ignores leakage request memory addresses memory representations contain byte newline character, 0x0a('\n'). reason why needed because there cases such as: leaking data @ address using uncontrolled format string function such fgets, stops read when reads newline, can lead unintended data resulting when address has newline byte.
from man page fgets function:
fgets()reads in @ 1 lesssizecharacters stream , stores them buffer pointeds. reading stops after eof or newline.
from pwnlib/memleak.py:
@staticmethod def nonewlines(function): """wrapper leak functions such addresses contain newline bytes not leaked. useful if address used leak provided e.g. ``fgets()``. """ @functools.wraps(function, updated=[]) def whitespace_wrapper(address, *a, **kw): if '\n' in pack(address): log.info('ignoring leak request %#x: contains newlines' % address) return none return function(address, *a, **kw) return memleak(whitespace_wrapper) memleak class's q method
q method, of memleak class, tries leak 64 bits of value @ given memory address leak function provided. if cannot leak completely, returns none.
from pwnlib/memleak.py:
def q(self, addr, ndx = 0): """q(addr, ndx = 0) -> int leak qword @ ``((uint64_t*) addr)[ndx]`` examples: >>> import string >>> data = string.ascii_lowercase >>> l = memleak(lambda a: data[a:a+16], reraise=false) >>> l.q(0) == unpack('abcdefgh', 64) true >>> l.q(18) == unpack('stuvwxyz', 64) true >>> l.q(19) none true """ return self._b(addr, ndx, 8) 
Comments
Post a Comment