io.github.daedalus/mcp-pwntools

Pack an integer into 1 byte. Args: n: Integer to pack (0-255). Returns: Hex string of packed bytes. Example: >>> p8(0x41) '41'

Pack an integer into 2 bytes. Args: n: Integer to pack (0-65535). endian: 'little' or 'big'. Returns: Hex string of packed bytes. Example: >>> p16(0x4142, endian='little') '4241'

Pack an integer into 4 bytes. Args: n: Integer to pack. endian: 'little' or 'big'. Returns: Hex string of packed bytes. Example: >>> p32(0x41424344, endian='little') '44434241'

Pack an integer into 8 bytes. Args: n: Integer to pack. endian: 'little' or 'big'. Returns: Hex string of packed bytes. Example: >>> p64(0x4142434445464748, endian='little') '4847464544434241'

Unpack 1 byte to integer. Args: data: Hex string of 1 byte. Returns: Unpacked integer. Example: >>> u8('41') 65

Unpack 2 bytes to integer. Args: data: Hex string of 2 bytes. endian: 'little' or 'big'. Returns: Unpacked integer. Example: >>> u16('4241', endian='little') 16706

Unpack 4 bytes to integer. Args: data: Hex string of 4 bytes. endian: 'little' or 'big'. Returns: Unpacked integer. Example: >>> u32('44434241', endian='little') 1094795857

Unpack 8 bytes to integer. Args: data: Hex string of 8 bytes. endian: 'little' or 'big'. Returns: Unpacked integer. Example: >>> u64('4847464544434241', endian='little') 3203391512993874777

Assemble code to bytes. Args: code: Assembly code. arch: Architecture (i386, amd64, arm, mips, etc.). Uses context if not specified. os: OS (linux, freebsd, etc.). Uses context if not specified. Returns: Hex string of assembled bytes. Example: >>> asm('nop') '90'

Disassemble bytes to code. Args: data: Hex string to disassemble. arch: Architecture. Uses context if not specified. bits: Bits (32, 64). Uses context if not specified. Returns: Disassembled code. Example: >>> disasm('90') ' 0: 90 nop'

Generate shellcode. Args: shellcode_type: Type of shellcode (e.g., 'amd64.linux.sh', 'i386.linux.bind', 'setreuid'). arg1: Optional first argument. arg2: Optional second argument. Returns: Assembly code for the shellcode. Example: >>> shellcraft('amd64.linux.sh') ' ...'

Generate setreuid shellcode. Args: uid: UID to set. euid: Effective UID to set. Returns: Assembly code for setreuid. Example: >>> shellcraft_setreuid(0, 0)

Generate dup shellcode with execve. Args: fd: File descriptor to dup. Returns: Assembly code. Example: >>> shellcraft_dupsh(4)

Hexdump utility. Args: data: Hex string to dump. begin: Offset to start from. Returns: Formatted hexdump string. Example: >>> hexdump('41424344')

Generate cyclic pattern. Args: length: Length of pattern. n: Alphabet size (default 256). Returns: Cyclic pattern as hex string. Example: >>> cyclic(20) '61616162616163616164616165616166'

Find offset in cyclic pattern. Args: pattern: Hex string of pattern to find. Returns: Offset of pattern in cyclic. Example: >>> cyclic_find('66616661') 120

Fit data into buffer. Args: data: Dictionary mapping offsets to values. length: Total length of buffer. filler: Hex string for filler bytes. Returns: Fitted buffer as hex string. Example: >>> fit({0: '41424344', 8: '45464748'}) '414243450000000045464748'

Encode bytes to hex string. Args: data: Hex string to encode. Returns: Hex string. Example: >>> enhex('41424344') '41424344'

Decode hex string to bytes. Args: data: Hex string to decode. Returns: Bytes as hex string. Example: >>> unhex('41424344') '41424344'

Flatten arguments into bytes. Args: args: List of arguments to flatten (integers or hex strings). endian: Endianness (default from context). sign: Signedness (default from context). Returns: Flattened bytes as hex string. Example: >>> flat([0x41424344, '68656c6c6f']) '44434241000000000000000068656c6c6f'

Set pwntools context. Args: arch: Architecture (i386, amd64, arm, mips, etc.). os: OS (linux, freebsd, etc.). endian: Endianness (little, big). word_size: Word size in bits (32, 64). log_level: Logging level (debug, info, warning, error). Returns: Current context settings. Example: >>> context_set(arch='amd64', os='linux', log_level='debug')

Get current pwntools context. Returns: Current context settings. Example: >>> context_get() {'arch': 'amd64', 'os': 'linux', ...}

Load an ELF file. Args: path: Path to ELF file. Returns: Dictionary with ELF info (address, symbols, plt, got, etc.). Example: >>> elf_load('/bin/ls') {'address': '0x400000', 'symbols': {...}, ...}

Assemble code at a specific address in an ELF. Args: path: Path to ELF file. address: Address (hex string like '0x400000'). code: Assembly code. Returns: Success message. Example: >>> elf_asm('/bin/cat', '0x401000', 'ret') 'Assembly applied successfully'

Read bytes from an ELF at address. Args: path: Path to ELF file. address: Address (hex string like '0x400000'). length: Number of bytes to read. Returns: Bytes as hex string. Example: >>> elf_read('/bin/cat', '0x400000', 16)

Write bytes to an ELF at address. Args: path: Path to ELF file. address: Address (hex string like '0x400000'). data: Hex string to write. Returns: Success message. Example: >>> elf_write('/bin/cat', '0x401000', '90') 'Write successful'

Create and interact with a process. Args: argv: Command and arguments as list. env: Environment variables dict. stdin: Stdin redirect (PIPE, STDOUT, etc.). stdout: Stdout redirect. stderr: Stderr redirect. timeout: Timeout in seconds. Returns: Process info dict. Example: >>> process_create(['/bin/sh']) {'pid': 1234, 'proc': {...}, 'unique': '...'}

Connect to a remote host. Args: host: Hostname or IP. port: Port number. timeout: Timeout in seconds. Returns: Connection info dict. Example: >>> remote_connect('example.com', 80) {'host': 'example.com', 'port': 80, 'connected': True}

Create a listening socket. Args: port: Port to listen on (0 for random). bindaddr: Address to bind to. Returns: Listener info dict. Example: >>> listen(8080) {'port': 8080, 'lport': 8080, ...}

Send data through a tube. Note: This is a placeholder - actual tube handling requires state management. Args: data: Hex string to send. tube_type: Type of tube to create. Returns: Status message.

Load ELF for ROP. Args: path: Path to ELF file. Returns: ROP info dict. Example: >>> rop_load('/bin/ls') {'path': '/bin/ls', 'elf': {...}, 'gadgets_count': ...}

Generate ROP call. Note: Requires an active ROP object. Args: runtime: Runtime/ELF path. func: Function name to call. args: Arguments for the call. Returns: ROP chain as hex string.

Dynamic ELF resolution. Note: Requires active memory leak. Args: leak_func: Memory leak function. elf_path: Optional ELF path. Returns: Resolution status.

Generate format string payload. Args: offset: Offset to format string. writes: Dict of {address: value} to write. nbytes: Number of bytes. Returns: Format string payload as hex string. Example: >>> fmtstr_payload(6, {0x8048000: 0x41424344})

Split format string writes. Args: writes: Dict of {address: value} to write. nbytes: Number of bytes. Returns: List of format string parts. Example: >>> fmtstr_split({0x8048000: 0x41424344})

Log debug message. Args: msg: Message to _log. Returns: Success message.

Log info message. Args: msg: Message to _log. Returns: Success message.

Log success message. Args: msg: Message to _log. Returns: Success message.

Log warning message. Args: msg: Message to _log. Returns: Success message.

Log error message. Args: msg: Message to _log. Returns: Success message.