Repository: Gallopsled/pwntools

Issue:
pwnlib.elf.ELF.checksec incorrectly reports an NX stack for pwnable.kr tiny_easy
Here is the binary: https://drive.google.com/file/d/0B_3U7vX-2nJITC15NHBjbVVyaVU/view?usp=sharing

```
$ file tiny_easy
tiny_easy: ELF 32-bit LSB  executable, Intel 80386, version 1 (SYSV), statically linked, corrupted section header size
$ ls -la tiny_easy
-r-xr-xr-x 1 user user 90 Jan 22 18:34 tiny_easy
$ file tiny_easy
tiny_easy: ELF 32-bit LSB  executable, Intel 80386, version 1 (SYSV), statically linked, corrupted section header size
$ readelf -a tiny_easy
ELF Header:
  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 
  Class:                             ELF32
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           Intel 80386
  Version:                           0x1
  Entry point address:               0x8048054
  Start of program headers:          52 (bytes into file)
  Start of section headers:          0 (bytes into file)
  Flags:                             0x0
  Size of this header:               52 (bytes)
  Size of program headers:           32 (bytes)
  Number of program headers:         1
  Size of section headers:           0 (bytes)
  Number of section headers:         0
  Section header string table index: 0

There are no sections in this file.

There are no sections to group in this file.

Program Headers:
  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align
  LOAD           0x000000 0x08048000 0x08048000 0x0005a 0x0005a R E 0x1000

There is no dynamic section in this file.

There are no relocations in this file.

The decoding of unwind sections for machine type Intel 80386 is not currently supported.

No version information found in this file.
$ checksec.sh --file tiny_easy
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      FILE
No RELRO        No canary found   NX enabled    No PIE          No RPATH   No RUNPATH   tiny_easy
$ python -c 'from pwn import *; print ELF("tiny_easy").checksec()'
RELRO:         No RELRO
Stack Canary:  No canary found
NX:            NX enabled
PIE:           No PIE
RPATH:         No RPATH
RUNPATH:       No RUNPATH
$ gdb ./tiny_easy
gdb-peda $ run
gdb-peda $ nxtest
[------------------------------------------------------------------code-------------------------------------------------------------------]
   0xffffc8bb:  add    BYTE PTR [eax],al
   0xffffc8bd:  add    BYTE PTR [eax],al
   0xffffc8bf:  add    ah,cl
=> 0xffffc8c1:  int3   
   0xffffc8c2:  int3   
   0xffffc8c3:  int3   
   0xffffc8c4:  int3   
   0xffffc8c5:  int3
Legend: stack, code, data, heap, rodata, value
Stopped reason: SIGTRAP
0xffffc8c1 in ?? ()
NX test at stack: Executable
```



Discussion:

Resolving patch:
diff --git a/pwnlib/elf/__init__.py b/pwnlib/elf/__init__.py
--- a/pwnlib/elf/__init__.py
+++ b/pwnlib/elf/__init__.py
@@ -531,6 +531,8 @@ def relro(self):
 
     @property
     def nx(self):
+        if not any('GNU_STACK' in seg.header.p_type for seg in self.segments):
+            return False
         return not any('GNU_STACK' in seg.header.p_type for seg in self.executable_segments)
 
     @property


Test patch: