abcpwn exposes 39 subcommands across 13 groups. This document is the
public reference. Every section gives synopsis, description, the key
options, one example, and the exit codes specific to the subcommand
beyond the generic error codes.
For the authoritative option list, prefer abcpwn <sub> --help. The
help text is generated from the same definition the binary parses, so
it never lags.
| Option | Description |
|---|---|
--format pretty|json |
Output format. pretty (default) is human-readable; json emits a stable schema. |
--color auto|always|never |
Color policy. auto honors NO_COLOR and isatty(stdout). |
--no-color |
Same as --color never. |
--no-banner |
Suppress the banner on --version and bare invocations. |
--config <file> |
Path to a TOML config file. |
--log-file <path> |
Write a JSON log of the run to the given path. |
--allow-network |
Permit the two network-using actions (libc download, pwninit). |
--help |
Print help. |
--version |
Print version and feature flags. |
Global flags are accepted before or after the subcommand name.
abcpwn info <target>
checksec-equivalent plus a libc hint. Reports NX, PIE, RELRO,
canary, fortify, stripped, RPATH and RUNPATH, plus a heuristic libc
version when symbols disambiguate.
abcpwn info ./challenge
abcpwn --format json info ./challenge | jq .findingsabcpwn syms <target> [--source dynamic|static|all] [--filter REGEX] [--dangerous]
Lists symbols from the dynamic (.dynsym) and static (.symtab)
tables with their addresses. --source selects the table (default
all), --filter is a regex over symbol names, and --dangerous
shows only unsafe imports such as gets / strcpy.
abcpwn syms ./challenge --filter '^main$'
abcpwn syms ./challenge --dangerousabcpwn strings <target> [-n|--min-length N] [--max-results N]
Like strings(1) but section-aware: groups output by which section
each hit landed in.
abcpwn strings ./challenge --min-length 8abcpwn search <target> <pattern> [--hex]
Search the binary for a literal byte sequence. --hex treats the
pattern as hex; otherwise it is interpreted as ASCII.
abcpwn search ./challenge --hex deadbeef
abcpwn search ./challenge 'admin'abcpwn hash <files>... [-a|--algorithm sha256]
Computes SHA-256, the only algorithm in this build. Multiple files may be passed.
abcpwn hash ./libc.so.6abcpwn pack <value> [-w|--width 1|2|4|8] [--be]
Packs an integer into raw bytes. --width is the byte count (default
8); --be selects big-endian (default little). Output is hex; pipe
through unhex for raw bytes.
abcpwn pack 0xdeadbeef
abcpwn pack 0xcafebabe --width 4 --beabcpwn unpack <hex> [--be]
Inverse of pack: decodes hex-encoded bytes into an integer. --be
selects big-endian (default little); the width is the input length.
abcpwn unpack efbeaddeabcpwn hex <input>
ASCII to hex.
abcpwn hex 'AAAA'abcpwn unhex <input>
Hex to raw.
abcpwn unhex 41414141abcpwn b64 <input> [--decode]
Encode by default. --decode interprets input as base64.
abcpwn b64 'AAAA'
abcpwn b64 QUFBQQ== --decodeabcpwn xor <input> --key <hex>
Input is hex bytes; key is hex bytes. Output is hex.
abcpwn xor 41414141 --key 02abcpwn errno [<query>]
query is a number (2), a name (ENOENT), or omitted (lists all).
abcpwn errno 11
abcpwn errno EAGAIN
abcpwn errno | grep -i noabcpwn signal [<query>]
query is a number (11), a full name (SIGSEGV), the short form
(SEGV -- automatically prefixed with SIG), or omitted (lists all
named signals 1..25). Surface mirrors errno.
abcpwn signal 11
abcpwn signal SIGSEGV
abcpwn signal SEGV
abcpwn signal | grep -i killabcpwn constgrep <substring>
Greps the compiled-in tables: mmap flags, signal numbers, auxv keys,
prot bits, ELF constants. Useful for "what is the value of
PROT_EXEC?" without leaving the shell.
abcpwn constgrep PROT_
abcpwn constgrep AT_RANDOMabcpwn asm <source> [--arch ...] [--base-address HEX] [--be] [--thumb]
Requires a source build configured with ABCPWN_WITH_KEYSTONE=ON
(preset: release-with-keystone). The default Apache release build
ships without Keystone and exits FeatureDisabled (exit 4) for this
subcommand; v0.1 does not distribute a pre-built Keystone-enabled
artifact.
abcpwn asm 'xor rdi, rdi; mov rax, 60; syscall' --arch x86_64abcpwn disasm <input> [--arch ...] [--base-address HEX] [--count N]
[--input-file|--input-hex] [--be] [--thumb]
Supported --arch values: x86_64, i386 (alias x86), arm,
aarch64 (alias arm64), mips, mips64, ppc (alias
powerpc), ppc64, riscv. Input is hex by default; pass
--input-file to disassemble bytes from a file path. --be
forces big-endian decoding for arches that support both byte
orders; PPC and PPC64 default to big-endian (the dominant ABI
convention), so most CTF inputs decode without an explicit flag.
abcpwn disasm 4831ff48c7c03c0000000f05 --arch x86_64
abcpwn disasm 7c0802a6 --arch ppc # PPC defaults to big-endianabcpwn phd <input> [--input-hex] [--offset N] [--length N] [--width 16|32]
Offset / hex / ASCII columns. Input is a file path; pass a hex
literal with the --input-hex flag to dump constructed bytes.
abcpwn phd ./challenge --offset 0x1000 --length 256abcpwn cyclic <length> # generate
abcpwn cyclic --find <subseq|0x...|decimal> # locate offset
abcpwn cyclic [-n N] [-a ALPHA] <length|--find>
Compatible with pwntools.cyclic. The default subsequence length
is 4 and the default alphabet is abcdefghijklmnopqrstuvwxyz,
giving 26^4 = 456976 bytes of unique-window sequence. --find
accepts a literal subsequence (haaa), a hex integer (0x61616168,
interpreted as little-endian bytes of width -n), or a decimal
integer (1633771624), matching pwntools' calling convention.
abcpwn cyclic 200
abcpwn cyclic --find haaa
abcpwn cyclic --find 0x61616168abcpwn gadget <target> [--depth N] [--type ret|jmp|call|syscall|all]
[--filter <regex>] [--bad-chars <hex>]
[--max-results N]
Forward-decode-at-every-byte gadget finder. Default --depth is 10
instructions, default --type is ret. --filter accepts a regex
against the gadget text; --bad-chars is a hex blob of bytes to
exclude (e.g. 0a00). The default cap on unique returned gadgets is
200000; when the cap is hit the command surfaces a gadget set truncated warning and the summary line names the cap so the user
knows the listing is partial. Raise the cap with --max-results N.
abcpwn gadget ./libc.so.6 --filter 'pop rdi'
abcpwn gadget ./libc.so.6 --depth 4 --type all --max-results 1000000abcpwn rop <target> --syscall N --syscall-arg ARG [--syscall-arg ARG ...]
Builds an x86_64 syscall chain. Supply the syscall number with
--syscall and zero or more arguments with repeated --syscall-arg
flags. The command first looks for exact pop rax/rdi/rsi/rdx ; ret
gadgets; if an exact match is not present it falls back to multi-pop
forms (pop <target> ; pop <safe> ; ret) where the intermediate
register is not another syscall-arg register. Multi-pop matches add
padding slots to the chain output so the operator knows where to
splice junk bytes between gadget values. Non-syscall strategies
(ret2win, leak, srop-via-rop, pwntools snippet emission) are not in
v0.1; the dedicated srop subcommand covers SROP, and syms plus
manual staging covers ret2win.
# execve("/bin/sh", 0, 0) -> syscall 59
abcpwn rop ./challenge --syscall 59 \
--syscall-arg 0x404020 --syscall-arg 0 --syscall-arg 0abcpwn one-gadget <libc> [--all]
Locates every /bin/sh\0 occurrence in the libc image and reports
file offsets. This is the string-locator half of the upstream Ruby
one_gadget tool; constraint extraction (the register / stack
preconditions that make an execve("/bin/sh", 0, 0) site
reachable) is not implemented. For full constraint analysis, run
the upstream one_gadget against the same libc.
abcpwn one-gadget ./libc.so.6abcpwn srop [--arch <arch>] [--rip HEX] [--rsp HEX] [--syscall N [--syscall-arg V ...]]
Builds an rt_sigreturn frame for SROP (x86_64 default). Set register
values with --rip / --rsp; --syscall builds a syscall sigframe
with that number in rax, with --syscall-arg values appended.
abcpwn srop --arch x86_64 --rip 0x4011aa --rsp 0x404300abcpwn ret2dl <target> <symbol> [--base <hex>] [--bad-chars <hex>]
Locates the dynamic-linker section addresses (.plt, .dynsym,
.dynstr, .rel(a).plt) and the named symbol's PLT trampoline so
the caller can hand-build, or hand off to pwntools.rop.ret2dlresolve,
the fake Elf64_Rela + Elf64_Sym payload. End-to-end payload
synthesis is not implemented in v0.1.
abcpwn ret2dl ./challenge systemabcpwn dynelf --leak <addr>=<hex-bytes> [--leak ...]
Parses one or more addr=hex leak pairs into a structured summary
that downstream tooling (abcpwn libc id, or an external
libc-database client) can consume. Libc identification itself is
not implemented in this command; feed the parsed pairs to
abcpwn libc id or an external libc-database client.
abcpwn dynelf --leak 0x7f0011aabbb0=66756e6300 \
--leak 0x7f0011aaca50=666f6f0000abcpwn aslr-bypass [--partial-overwrite] [--brute-force] [--canary-leak] [--entropy-bits N]
Selects a helper with a flag: --partial-overwrite describes the
1/2-byte partial-overwrite technique, --brute-force reports the
expected number of attempts (tune ASLR entropy with --entropy-bits,
default 28), and --canary-leak prints a canary-leak template.
abcpwn shellcode --preset sh --arch <arch>
[--output-format raw|hex|c|escaped]
[--bad-chars <hex>]
[--encoder none|null-free|xor [--xor-key <hex>]]
[--list]
Presets: sh only in v0.1. --list enumerates the compiled-in
database; the parser only accepts preset names present there. The
encoding selector is named --output-format so it does not collide
with the global --format pretty|json; combining them is allowed
(--format json --output-format hex emits JSON whose payload bytes
appear hex-encoded in raw_lines[0]).
abcpwn shellcode --preset sh --arch x86_64
abcpwn shellcode --preset sh --arch x86_64 --bad-chars 000aabcpwn fmt --find-offset <leak> # find offset
abcpwn fmt --write <addr>=<value> [...] --arg-position N # build payload
--find-offset analyzes a captured %X.%X.%X... leak and tells you
which positional index reaches your controlled buffer. --write
builds a %hn / %hhn payload that writes the given values to the
given addresses.
abcpwn fmt --find-offset 'AAAA%X.%X.%X.%X'
abcpwn fmt --write 0x404020=0x4011aa --arg-position 6abcpwn got <target> [--symbol <name>] [--overwrite <name>=<value>]
Lists entries with their resolved targets, or builds an overwrite payload for a specific GOT slot.
abcpwn got ./challenge
abcpwn got ./challenge --overwrite puts=0x4011aaabcpwn heap <technique> [--libc-version <ver>] [--target-address <addr>]
technique is one of tcache-poison, fastbin, house-of-force,
house-of-orange, unsorted-bin-attack, plus a few more. The
output describes the technique's compatibility against the libc
version detected (a static technique x libc-era matrix), the
payload shape, and the safe-linking behavior if applicable.
abcpwn heap tcache-poison --libc-version 2.34 --target-address 0x404300abcpwn safe-link <value> <pos> [--encode|--decode]
Implements the glibc 2.32+ safe-linking transform:
value ^ (pos >> 12) (the stored fd is the pointer XOR'd with the
chunk address shifted right by 12). --encode (default) computes the
obfuscated fd; --decode recovers value given the encoded fd and pos.
abcpwn safe-link 0x404300 0x55aabbcc
abcpwn safe-link 0x12340000 0x55aabbcc --decodeabcpwn iofile <technique> [--libc-version <ver>]
technique is one of fsop-leak, fsop-exec, vtable-overwrite.
Builds an _IO_FILE (or _IO_FILE_plus) layout for the named
technique. Output documents which _IO_* fields are touched and
which _IO_jump_t entry is hijacked.
abcpwn iofile fsop-exec --libc-version 2.34abcpwn vtable <target> [--list] [--analyze N] [--hijack N --hijack-target HEX]
Parses Itanium C++ ABI _ZTV* symbols to list virtual tables; with
--hijack builds a payload that overwrites the given slot.
abcpwn vtable ./challenge --list
abcpwn vtable ./challenge --hijack 2 --hijack-target 0x4011aaabcpwn seccomp <action> [<input>]
action:
disasm- decode a cBPF program (hex on the command line) to pseudo-assembly, annotated withSYS_*names per--arch.dump- extract embedded seccomp filters from a binary. Not implemented in v0.1 (target-specific; the command surfaces the manual extraction recipe and recommends piping the bytes throughseccomp disasm).
Filter assembly (asm) and emulation (emu) are not in v0.1; the
disassembler covers the common CTF case, and emulation would
introduce a dependency on Unicorn that this build does not
currently link.
abcpwn seccomp disasm 20000000040000001500000003000000...abcpwn libc <action> [<id>]
action:
id- identify libc by symbol offsets supplied via repeated--offset name:valueflags.offsets- list known offsets for a given libc id.diff- diff two libc variants.download- fetch a libc archive from https://libc.rip (requires--allow-network).search- regex search over the libc database.
abcpwn libc id --offset puts:0x80 --offset printf:0x6c
abcpwn --allow-network libc download libc6_2.35-0ubuntu3_amd64abcpwn pwninit [<directory>]
Sets up a typical CTF pwn workspace: detects challenge binary,
matches and (if --allow-network) downloads the required libc,
extracts the matching dynamic linker, patches the binary's interp,
and emits a starter solve.py.
abcpwn pwninit ./challenge-dirabcpwn pwn <target> [--script <file>] [--log <file>] [--timeout <s>]
The live process / socket tube driver is not implemented in v0.1.0:
every invocation validates the target and then exits NotImplemented
(exit 16). It is the headline item of the v0.2 roadmap.
Until it lands, pair abcpwn's offline output with a tube driver such as
pwntools (see the README's "Pair with a process driver"). When
implemented, target will be host:port (TCP), unix:/path (unix
socket), or ./local-binary (process), with the I/O script supplied
via --script.
abcpwn template <strategy> <binary> [-o <out.py>]
strategy: ret2win, ret2libc, rop, srop, fmt-leak, heap.
Writes a pwntools-shaped Python skeleton tuned to the strategy and
the binary's bits/arch.
abcpwn template ret2libc ./challenge -o solve.pyabcpwn diff <file_a> <file_b>
Byte-by-byte diff with section context. Output groups runs of contiguous differing bytes.
abcpwn diff ./challenge ./challenge.patchedabcpwn patch <target> [--byte 0xOFF=BYTES] [--nop A:B] [--in-place] [--backup]
--byte writes BYTES at OFF. --nop fills [A, B) with 0x90. By
default the result is written to <target>.patched; --in-place edits
the target directly and --backup keeps a copy first.
abcpwn patch ./challenge --byte 0x1234=9090
abcpwn patch ./challenge --nop 0x1240:0x1248In addition to the standard codes documented in ERROR_CODES.md, specific subcommands surface:
asm,seccomp emu(without Unicorn), and any feature-flag command in the default Apache build emit exit4(FeatureDisabled).libc download,pwninitwithout--allow-networkemit12(NetworkDisabled).ropwith no chain found for the requested strategy emits10(Unsupported).gadgetanddisasmon a corrupt section emit11(Corrupted).
Subcommand names, flag names, exit codes, and the JSON schema_version
contract are covered by semver. See ../CHANGELOG.md
and the versioning section of ../CONTRIBUTING.md.