Wip/dumb tracer

[Kyle-Kyle]

angr/archr#85
angr/angr#2627
angr/binaries#75
mechaphish/colorguard#10
angr/angrop#33

[Kyle-Kyle]

too many changes.
in short:

1. rewrite crash.py to separate the concrete tracing and symbolic tracing part from the core Crash logic and name it CrashTracer. It describes how we interact with the target
2. add dumb tracer that allows us to do some stupid but effective dynamic tracing
3. add ret2libc technique that allows us to perform ret2libc attack, currently, what it does is call system with arbitrary command
4. revive call_shellcode
5. rewrite scripter to cleanly generate python scripts

[rhelmot]

do we have to use pwnlib for this? can we use keystone, which has shortcuts for use in archinfo?

[Kyle-Kyle]

so, the problem @Lukas-Dresel found was that some of the shellcodes we maintain never worked at all. It took him a lot of time to figure out why they didn't work. This concerns me because we only maintain a few shellcodes at this moment. And also, these shellcodes were written by hand for specific architectures and specific purposes.

If we want to extend the capability of rex in shellcode execution in the future, this hardcoded shellcode method will not work. We need an approach to automatically generate shellcode. The first thing that came to our mind was pwntools, its shellcraft module is designed for this purpose.

This will be the first step we include shellcraft in our exploit generation engine. If possible, I plan to use it to replace our current shellcode generation engine so we don't need to debug manually written shellcode.

And I do agree that pwntools is a messed up package that we should avoid as much as possible in our release because of its instability. But its capability of exploit generation is too powerful. What I suggest is we pin pwntools to a version that works with angr and we stick to it.