pwntools quickref

p = process('./chal')

spawn the local binary

r = remote(host, port)

connect to a remote service

p.recvuntil(b'...')

read until a delimiter

p.sendline(payload)

send bytes + newline

p.interactive()

drop to an interactive shell

ELF('./chal')

parse symbols, GOT, PLT, BSS

context.binary = elf

infer arch/os for packing helpers

p32 / p64 / u32 / u64

pack and unpack integers

cyclic(200)

de Bruijn pattern for offset-finding

cyclic_find(0x61616161)

recover the offset from a crash value

ROP(elf)

build a ROP chain from an ELF's gadgets

DynELF(leak, elf=elf)

resolve libc symbols via a leak oracle