{"id":17219325,"url":"https://github.com/andreafioraldi/pwntrace","last_synced_at":"2025-04-13T22:32:12.927Z","repository":{"id":62578379,"uuid":"128423867","full_name":"andreafioraldi/pwntrace","owner":"andreafioraldi","description":"Use ltrace with pwnlib.tubes.process instances, useful for heap exploitation. Pwntools rocks!","archived":false,"fork":false,"pushed_at":"2018-04-06T18:44:24.000Z","size":7,"stargazers_count":52,"open_issues_count":0,"forks_count":2,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-03-27T12:52:41.782Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/andreafioraldi.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2018-04-06T17:16:17.000Z","updated_at":"2024-11-06T18:21:30.000Z","dependencies_parsed_at":"2022-11-03T19:05:07.635Z","dependency_job_id":null,"html_url":"https://github.com/andreafioraldi/pwntrace","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andreafioraldi%2Fpwntrace","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andreafioraldi%2Fpwntrace/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andreafioraldi%2Fpwntrace/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andreafioraldi%2Fpwntrace/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/andreafioraldi","download_url":"https://codeload.github.com/andreafioraldi/pwntrace/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248125642,"owners_count":21051766,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-15T03:49:37.725Z","updated_at":"2025-04-13T22:32:12.662Z","avatar_url":"https://github.com/andreafioraldi.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# pwntrace\nUse ltrace with pwnlib.tubes.process instances, useful for heap exploitation\n\n## Install\n\npwntrace is on PyPI:\n\n```\n$ pip install pwntrace\n```\n\nI suggest you to use a vitualenv to work with pwntools.\n\n## Api\n\nltrace:\n+ `p = ltrace(argv, functions, ...)` create a modified instace of pwnlib.tubes.process for ltrace\n+ `p.get_trace()` get trace output\n+ `print_trace(trace)` pretty print p.get_trace or p.trace_now return value\n+ `p.trace_now()` get_trace + print_trace\n\nheap_ltrace:\n+ `p = heap_ltrace(argv, ...)` create a modified instace of pwnlib.tubes.process for ltrace malloc and free\n+ `p.get_trace()` get trace output\n+ `print_heap_trace(heap_trace)`\n+ `p.trace_now()`  get_trace + print_trace\n+ `p.allocd` list of `{\"addr\": ret_val, \"size\": arg_val}` objects representing the memory allocated from the last get_trace|trace_now call\n+ `p.freed` list of addresses (int) representing the memory freed from the last get_trace|trace_now call\n+ `p.print_allocd()` pretty print allocd\n+ `p.print_freed()` pretty print freed\n\n## Examples\n\n```python\n\u003e\u003e\u003e from pwntrace import *\n\u003e\u003e\u003e p = ltrace(\"/bin/ls\", [\"fflush\", \"fclose\"])\n[x] Starting local process '/usr/bin/ltrace'\n[+] Starting local process '/usr/bin/ltrace': pid 8737\n\u003e\u003e\u003e p.recv()\n[*] Process '/usr/bin/ltrace' stopped with exit code 0 (pid 8737)\n'LICENSE  pwntrace  README.md\\n'\n\u003e\u003e\u003e p.trace_now()\n \u003ctrace\u003e ls-\u003efflush(0x7efc8f6a0620) = 0\n \u003ctrace\u003e ls-\u003efclose(0x7efc8f6a0620) = 0\n \u003ctrace\u003e ls-\u003efflush(0x7efc8f6a0540) = 0\n \u003ctrace\u003e ls-\u003efclose(0x7efc8f6a0540) = 0\n[{'ret': '0', 'fn': 'ls-\u003efflush(0x7efc8f6a0620)'}, {'ret': '0', 'fn': 'ls-\u003efclose(0x7efc8f6a0620)'}, {'ret': '0', 'fn': 'ls-\u003efflush(0x7efc8f6a0540)'}, {'ret': '0', 'fn': 'ls-\u003efclose(0x7efc8f6a0540)'}]\n```\n\n```python\n\u003e\u003e\u003e p = heap_ltrace([\"/bin/ip\", \"address\"])\n[x] Starting local process '/usr/bin/ltrace'\n[+] Starting local process '/usr/bin/ltrace': pid 9694\n\u003e\u003e\u003e p.trace_now()\n \u003ctrace\u003e malloc(1276) = 0x12ec010\n \u003ctrace\u003e malloc(64) = 0x12ec520\n \u003ctrace\u003e malloc(1292) = 0x12ec570\n \u003ctrace\u003e malloc(64) = 0x12eca90\n \u003ctrace\u003e malloc(1284) = 0x12ecae0\n \u003ctrace\u003e malloc(64) = 0x12ecff0\n \u003ctrace\u003e malloc(1688) = 0x12ed040\n \u003ctrace\u003e malloc(64) = 0x12ed6e0\n \u003ctrace\u003e malloc(1696) = 0x12ed730\n \u003ctrace\u003e malloc(64) = 0x12edde0\n \u003ctrace\u003e malloc(1576) = 0x12ede30\n \u003ctrace\u003e malloc(64) = 0x12ee460\n \u003ctrace\u003e malloc(84) = 0x12ee4b0\n \u003ctrace\u003e malloc(96) = 0x12ee510\n \u003ctrace\u003e malloc(88) = 0x12ee580\n \u003ctrace\u003e malloc(96) = 0x12ee5e0\n \u003ctrace\u003e malloc(80) = 0x12ee650\n \u003ctrace\u003e malloc(80) = 0x12ee6b0\n \u003ctrace\u003e malloc(80) = 0x12ee710\n \u003ctrace\u003e malloc(80) = 0x12ee770\n \u003ctrace\u003e malloc(24) = 0x12efe20\n \u003ctrace\u003e free(0x12ee4b0) = \u003cvoid\u003e\n \u003ctrace\u003e free(0x12ee510) = \u003cvoid\u003e\n \u003ctrace\u003e free(0x12ee580) = \u003cvoid\u003e\n \u003ctrace\u003e free(0x12ee5e0) = \u003cvoid\u003e\n \u003ctrace\u003e free(0x12ee650) = \u003cvoid\u003e\n \u003ctrace\u003e free(0x12ee6b0) = \u003cvoid\u003e\n \u003ctrace\u003e free(0x12ee710) = \u003cvoid\u003e\n \u003ctrace\u003e free(0x12ee770) = \u003cvoid\u003e\n \u003ctrace\u003e free(0x12ec010) = \u003cvoid\u003e\n \u003ctrace\u003e free(0x12ec570) = \u003cvoid\u003e\n \u003ctrace\u003e free(0x12ecae0) = \u003cvoid\u003e\n \u003ctrace\u003e free(0x12ed040) = \u003cvoid\u003e\n \u003ctrace\u003e free(0x12ed730) = \u003cvoid\u003e\n \u003ctrace\u003e free(0x12ede30) = \u003cvoid\u003e\n[{'ret': 19841040, 'fn': 'malloc', 'arg': 1276}, {'ret': 19842336, 'fn': 'malloc', 'arg': 64}, {'ret': 19842416, 'fn': 'malloc', 'arg': 1292}, {'ret': 19843728, 'fn': 'malloc', 'arg': 64}, {'ret': 19843808, 'fn': 'malloc', 'arg': 1284}, {'ret': 19845104, 'fn': 'malloc', 'arg': 64}, {'ret': 19845184, 'fn': 'malloc', 'arg': 1688}, {'ret': 19846880, 'fn': 'malloc', 'arg': 64}, {'ret': 19846960, 'fn': 'malloc', 'arg': 1696}, {'ret': 19848672, 'fn': 'malloc', 'arg': 64}, {'ret': 19848752, 'fn': 'malloc', 'arg': 1576}, {'ret': 19850336, 'fn': 'malloc', 'arg': 64}, {'ret': 19850416, 'fn': 'malloc', 'arg': 84}, {'ret': 19850512, 'fn': 'malloc', 'arg': 96}, {'ret': 19850624, 'fn': 'malloc', 'arg': 88}, {'ret': 19850720, 'fn': 'malloc', 'arg': 96}, {'ret': 19850832, 'fn': 'malloc', 'arg': 80}, {'ret': 19850928, 'fn': 'malloc', 'arg': 80}, {'ret': 19851024, 'fn': 'malloc', 'arg': 80}, {'ret': 19851120, 'fn': 'malloc', 'arg': 80}, {'ret': 19856928, 'fn': 'malloc', 'arg': 24}, {'ret': None, 'fn': 'free', 'arg': 19850416}, {'ret': None, 'fn': 'free', 'arg': 19850512}, {'ret': None, 'fn': 'free', 'arg': 19850624}, {'ret': None, 'fn': 'free', 'arg': 19850720}, {'ret': None, 'fn': 'free', 'arg': 19850832}, {'ret': None, 'fn': 'free', 'arg': 19850928}, {'ret': None, 'fn': 'free', 'arg': 19851024}, {'ret': None, 'fn': 'free', 'arg': 19851120}, {'ret': None, 'fn': 'free', 'arg': 19841040}, {'ret': None, 'fn': 'free', 'arg': 19842416}, {'ret': None, 'fn': 'free', 'arg': 19843808}, {'ret': None, 'fn': 'free', 'arg': 19845184}, {'ret': None, 'fn': 'free', 'arg': 19846960}, {'ret': None, 'fn': 'free', 'arg': 19848752}]\n\u003e\u003e\u003e p.print_allocd()\n \u003e\u003e\u003e ALLOCD \u003c\u003c\u003c\n addr: 0x12ec520\tsize:64\n addr: 0x12eca90\tsize:64\n addr: 0x12ecff0\tsize:64\n addr: 0x12ed6e0\tsize:64\n addr: 0x12edde0\tsize:64\n addr: 0x12ee460\tsize:64\n addr: 0x12efe20\tsize:24\n\n```\n\n### Dedication\n\nIn loving memory of malloc_hook\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fandreafioraldi%2Fpwntrace","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fandreafioraldi%2Fpwntrace","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fandreafioraldi%2Fpwntrace/lists"}