Skip to content

Commit 1701eb5

Browse files
qlixedqlixed
committed
tox.ini: Set default python env for tox to python3.3
1 parent 3b6e3ce commit 1701eb5

File tree

6 files changed

+351
-172
lines changed

6 files changed

+351
-172
lines changed

LICENSE.txt renamed to LICENSE

File renamed without changes.

‎README.rst‎

Lines changed: 5 additions & 171 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
========
2+
memwiper
3+
========
4+
Now you can overwrite with 0x0's your inmutable strings without issues.
5+
6+
27
Overview
38
========
49

@@ -98,11 +103,6 @@ Note, to combine the coverage data from all the tox environments run:
98103
- ::
99104

100105
PYTEST_ADDOPTS=--cov-append tox
101-
memwiper
102-
==========
103-
.. image:: https://travis-ci.org/qlixed/memwiper.svg?branch=master
104-
:target: https://travis-ci.org/qlixed/memwiper
105-
Now you can overwrite with 0x0's your inmutable strings without issues.
106106

107107
Platforms Supported:
108108
====================
@@ -113,169 +113,3 @@ Platforms Supported:
113113

114114
The code is full Python C API, not external libraries used, this will be done to maximize the portability.
115115
I'm searching help with the Mac and Windows testing, so check the issues and leave a comment if you wanna help!
116-
117-
Why I do this?:
118-
===============
119-
120-
All your sensitive information belongs to the memory!
121-
122-
Well that obvious, I know, but is a weird issue to handle in most of the
123-
languages that uses garbage collection for memory management and inmutable
124-
strings, let me show a quick ipython example::
125-
126-
In [1]: s1="Secret Agent data"
127-
128-
In [2]: s2=s1
129-
130-
In [3]: id(s1)
131-
Out[3]: 139856402094672
132-
133-
In [4]: id(s2)
134-
Out[4]: 139856402094672
135-
136-
In [5]: del s1
137-
138-
In [6]: id(s1)
139-
---------------------------------------------------------------------------
140-
NameError Traceback (most recent call last)
141-
<ipython-input-6-4e7c3ecb85de> in <module>()
142-
----> 1 id(s1)
143-
144-
NameError: name 's1' is not defined
145-
146-
In [7]: id(s2)
147-
Out[7]: 139856402094672
148-
149-
In [8]: help(id)
150-
Help on built-in function id in module builtins:
151-
152-
id(obj, /)
153-
Return the identity of an object.
154-
155-
This is guaranteed to be unique among simultaneously existing objects.
156-
(CPython uses the object's memory address.)
157-
158-
In [3]: print(s2)
159-
Out[3]: Secret Agent data
160-
161-
I delete the s1 string, but the s2 points to the same string,
162-
as you can see in the help showed there id show the memory address of
163-
the object, so s1 and s2 points to the same memory position.
164-
165-
The del s1 never really delete the memory object because the string have another reference to it.
166-
167-
An Example:
168-
===========
169-
170-
As you can see in the previous code chunck, we have a problem with our sensitive info, but don't worry, here comes memwiper to the rescue::
171-
172-
In [1]: s1="Another secret agent info"
173-
174-
In [2]: s2=s1
175-
176-
In [3]: id(s1)
177-
Out[3]: 139880143611344
178-
179-
In [4]: id(s1)==id(s2)
180-
Out[4]: True
181-
182-
In [5]: import memwiper
183-
184-
In [6]: memwiper.wipeit(s1)
185-
Out[6]: ''
186-
187-
In [7]: id(s1)
188-
Out[7]: 139880143611344
189-
190-
In [8]: id(s1)==id(s2)
191-
Out[8]: True
192-
193-
In [9]: s1==s2
194-
Out[9]: True
195-
196-
In [10]: print(s1)
197-
198-
199-
In [11]: print(s2)
200-
201-
202-
In [12]: s1
203-
Out[12]: '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
204-
205-
In [13]: s2
206-
Out[13]: '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
207-
208-
In [14]: del s1
209-
210-
211-
In [15]: print(s1)
212-
---------------------------------------------------------------------------
213-
NameError Traceback (most recent call last)
214-
<ipython-input-15-69407075beda> in <module>()
215-
----> 1 print(s1)
216-
217-
NameError: name 's1' is not defined
218-
219-
In [16]: print(s2)
220-
221-
So here we can see what wipeit() do: It overwrite the underlying inmutable
222-
buffer of the string object with 0x0's.
223-
224-
A memory dump example:
225-
======================
226-
227-
Here another classic example: a core dump. For this we make a script,
228-
coretest.py that you can use to check for yourself, it requires:
229-
230-
* A linux platform, We are tracking options to make this on other platforms on
231-
`Issue #6 <https://github.com/qlixed/memwiper/issues/6>`_
232-
* Any modern gdb version installed.
233-
234-
Here is an example run of coretest.py::
235-
236-
Generating the supersecretinfo.txt file:
237-
Attaching to process 4181
238-
Reading symbols from /home/qlixed/srced/memwiper/bin/python3...Reading symbols from /home/qlixed/srced/memwiper/bin/python3...(no debugging symbols found)...done.
239-
(no debugging symbols found)...done.
240-
Reading symbols from /lib64/libpthread.so.0...Reading symbols from /usr/lib/debug/usr/lib64/libpthread-2.24.so.debug...done.
241-
done.
242-
[Thread debugging using libthread_db enabled]
243-
Using host libthread_db library "/lib64/libthread_db.so.1".
244-
0x00007f43e0953f8a in __waitpid (pid=4188, stat_loc=0x7fff998c1fd4, options=0) at ../sysdeps/unix/sysv/linux/waitpid.c:29
245-
29 return SYSCALL_CANCEL (wait4, pid, stat_loc, options, NULL);
246-
Saved corefile core-pre.4181
247-
Detaching from program: /home/qlixed/srced/memwiper/bin/python3, process 4181
248-
Attaching to process 4181
249-
Reading symbols from /home/qlixed/srced/memwiper/bin/python3...Reading symbols from /home/qlixed/srced/memwiper/bin/python3...(no debugging symbols found)...done.
250-
(no debugging symbols found)...done.
251-
Reading symbols from /lib64/libpthread.so.0...Reading symbols from /usr/lib/debug/usr/lib64/libpthread-2.24.so.debug...done.
252-
done.
253-
[Thread debugging using libthread_db enabled]
254-
Using host libthread_db library "/lib64/libthread_db.so.1".
255-
0x00007f43e0953f8a in __waitpid (pid=4200, stat_loc=0x7fff998c1fd4, options=0) at ../sysdeps/unix/sysv/linux/waitpid.c:29
256-
29 return SYSCALL_CANCEL (wait4, pid, stat_loc, options, NULL);
257-
Saved corefile core-pos.4181
258-
Detaching from program: /home/qlixed/srced/memwiper/bin/python3, process 4181
259-
The super secret info is: Zl njrfbzr cnffjbeq
260-
Generating core-pre.4181:
261-
gdb -q -ex 'set auto-solib-add 0' -ex 'attach 4181' -ex 'gcore core-pre.4181' -ex detach -ex quit
262-
Now we're going to overwrite the memory,
263-
Generating core-pos.4181:
264-
gdb -q -ex 'set auto-solib-add 0' -ex 'attach 4181' -ex 'gcore core-pos.4181' -ex detach -ex quit
265-
Well, all done now you can check the files using:
266-
267-
# strings core-pre.4181 | grep 'My awesome password'
268-
# strings core-pos.4181 | grep 'My awesome password'
269-
270-
The core-pre.4181 contains the secret, as object was active in memory.
271-
The core-pos.4181 don't contains the secret, because we wipeit() from memory.
272-
273-
So, if you execute the commands mentioned you get::
274-
275-
# strings core-pre.4181 | grep 'My awesome password'
276-
My awesome password
277-
# strings core-pos.4181 | grep 'My awesome password'
278-
279-
#
280-
281-
As you can see the core dump in the core-pos.<pid> file don't contains the sensitive data in the memory dump.

‎docs/help.rst‎

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
========
2+
memwiper
3+
========
4+
Now you can overwrite with 0x0's your inmutable strings without issues.
5+
6+
Why?:
7+
=====
8+
9+
All your sensitive information belongs to the memory!
10+
11+
Well that obvious, I know, but is a weird issue to handle in most of the
12+
languages that uses garbage collection for memory management and inmutable
13+
strings, let me show a quick ipython example::
14+
15+
In [1]: s1="Secret Agent data"
16+
17+
In [2]: s2=s1
18+
19+
In [3]: id(s1)
20+
Out[3]: 139856402094672
21+
22+
In [4]: id(s2)
23+
Out[4]: 139856402094672
24+
25+
In [5]: del s1
26+
27+
In [6]: id(s1)
28+
---------------------------------------------------------------------------
29+
NameError Traceback (most recent call last)
30+
<ipython-input-6-4e7c3ecb85de> in <module>()
31+
----> 1 id(s1)
32+
33+
NameError: name 's1' is not defined
34+
35+
In [7]: id(s2)
36+
Out[7]: 139856402094672
37+
38+
In [8]: help(id)
39+
Help on built-in function id in module builtins:
40+
41+
id(obj, /)
42+
Return the identity of an object.
43+
44+
This is guaranteed to be unique among simultaneously existing objects.
45+
(CPython uses the object's memory address.)
46+
47+
In [3]: print(s2)
48+
Out[3]: Secret Agent data
49+
50+
I delete the s1 string, but the s2 points to the same string,
51+
as you can see in the help showed there id show the memory address of
52+
the object, so s1 and s2 points to the same memory position.
53+
54+
The del s1 never really delete the memory object because the string have another reference to it.
55+
56+
An Example:
57+
===========
58+
59+
60+
61+
A memory dump example:
62+
======================
63+
64+
Here another classic example: a core dump. For this we make a script,
65+
coretest.py that you can use to check for yourself, it requires:
66+
67+
* A linux platform, We are tracking options to make this on other platforms on
68+
`Issue #6 <https://github.com/qlixed/memwiper/issues/6>`_
69+
* Any modern gdb version installed.
70+
71+
Here is an example run of coretest.py::
72+
73+
Generating the supersecretinfo.txt file:
74+
Attaching to process 4181
75+
Reading symbols from /home/qlixed/srced/memwiper/bin/python3...Reading symbols from /home/qlixed/srced/memwiper/bin/python3...(no debugging symbols found)...done.
76+
(no debugging symbols found)...done.
77+
Reading symbols from /lib64/libpthread.so.0...Reading symbols from /usr/lib/debug/usr/lib64/libpthread-2.24.so.debug...done.
78+
done.
79+
[Thread debugging using libthread_db enabled]
80+
Using host libthread_db library "/lib64/libthread_db.so.1".
81+
0x00007f43e0953f8a in __waitpid (pid=4188, stat_loc=0x7fff998c1fd4, options=0) at ../sysdeps/unix/sysv/linux/waitpid.c:29
82+
29 return SYSCALL_CANCEL (wait4, pid, stat_loc, options, NULL);
83+
Saved corefile core-pre.4181
84+
Detaching from program: /home/qlixed/srced/memwiper/bin/python3, process 4181
85+
Attaching to process 4181
86+
Reading symbols from /home/qlixed/srced/memwiper/bin/python3...Reading symbols from /home/qlixed/srced/memwiper/bin/python3...(no debugging symbols found)...done.
87+
(no debugging symbols found)...done.
88+
Reading symbols from /lib64/libpthread.so.0...Reading symbols from /usr/lib/debug/usr/lib64/libpthread-2.24.so.debug...done.
89+
done.
90+
[Thread debugging using libthread_db enabled]
91+
Using host libthread_db library "/lib64/libthread_db.so.1".
92+
0x00007f43e0953f8a in __waitpid (pid=4200, stat_loc=0x7fff998c1fd4, options=0) at ../sysdeps/unix/sysv/linux/waitpid.c:29
93+
29 return SYSCALL_CANCEL (wait4, pid, stat_loc, options, NULL);
94+
Saved corefile core-pos.4181
95+
Detaching from program: /home/qlixed/srced/memwiper/bin/python3, process 4181
96+
The super secret info is: Zl njrfbzr cnffjbeq
97+
Generating core-pre.4181:
98+
gdb -q -ex 'set auto-solib-add 0' -ex 'attach 4181' -ex 'gcore core-pre.4181' -ex detach -ex quit
99+
Now we're going to overwrite the memory,
100+
Generating core-pos.4181:
101+
gdb -q -ex 'set auto-solib-add 0' -ex 'attach 4181' -ex 'gcore core-pos.4181' -ex detach -ex quit
102+
Well, all done now you can check the files using:
103+
104+
# strings core-pre.4181 | grep 'My awesome password'
105+
# strings core-pos.4181 | grep 'My awesome password'
106+
107+
The core-pre.4181 contains the secret, as object was active in memory.
108+
The core-pos.4181 don't contains the secret, because we wipeit() from memory.
109+
110+
So, if you execute the commands mentioned you get::
111+
112+
# strings core-pre.4181 | grep 'My awesome password'
113+
My awesome password
114+
# strings core-pos.4181 | grep 'My awesome password'
115+
116+
#
117+
118+
As you can see the core dump in the core-pos.<pid> file don't contains the sensitive data in the memory dump.

‎docs/usage.rst‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,59 @@ Usage
55
To use python-memwiper in a project::
66

77
import memwiper
8+
9+
As you can see in the code chunk showed on the readme, we have a problem with our sensitive info, but don't worry, here comes memwiper to the rescue::
10+
11+
In [1]: s1="Another secret agent info"
12+
13+
In [2]: s2=s1
14+
15+
In [3]: id(s1)
16+
Out[3]: 139880143611344
17+
18+
In [4]: id(s1)==id(s2)
19+
Out[4]: True
20+
21+
In [5]: import memwiper
22+
23+
In [6]: memwiper.wipeit(s1)
24+
Out[6]: ''
25+
26+
In [7]: id(s1)
27+
Out[7]: 139880143611344
28+
29+
In [8]: id(s1)==id(s2)
30+
Out[8]: True
31+
32+
In [9]: s1==s2
33+
Out[9]: True
34+
35+
In [10]: print(s1)
36+
37+
38+
In [11]: print(s2)
39+
40+
41+
In [12]: s1
42+
Out[12]: '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
43+
44+
In [13]: s2
45+
Out[13]: '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
46+
47+
In [14]: del s1
48+
49+
50+
In [15]: print(s1)
51+
---------------------------------------------------------------------------
52+
NameError Traceback (most recent call last)
53+
<ipython-input-15-69407075beda> in <module>()
54+
----> 1 print(s1)
55+
56+
NameError: name 's1' is not defined
57+
58+
In [16]: print(s2)
59+
60+
So here we can see what wipeit() do: It overwrite the underlying inmutable
61+
buffer of the string object with 0x0's.
62+
63+

0 commit comments

Comments
 (0)