> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pwno.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Interactive Exploit Loop

> Start a pwncli driver, send input, read output, collect events, and stop cleanly.

Use the `pwncli` family when you want a session-scoped exploit driver that stays alive while the debugger session remains active.

<Steps>
  <Step title="Start the driver">
    ```json theme={null}
    {"tool":"pwncli","arguments":{"session_id":"chal-a","binary_path":"/workspace/chal","file":"from pwn import *\nprint('ready')\n"}}
    ```

    The server writes the script into the session runtime directory and launches it with `uv run`.
  </Step>

  <Step title="Check startup data">
    The returned object includes:

    * `runtime_dir`
    * `binary_path`
    * `io.current_output`
    * `attachment.result`
    * `startup.ready`, `startup.reason`, `startup.alive`, `startup.pid`, and `startup.replaced`
  </Step>

  <Step title="Send raw input">
    ```json theme={null}
    {"tool":"sendinput","arguments":{"session_id":"chal-a","data":"AAAA\n"}}
    ```
  </Step>

  <Step title="Read output or events">
    ```json theme={null}
    {"tool":"checkoutput","arguments":{"session_id":"chal-a"}}
    {"tool":"checkevents","arguments":{"session_id":"chal-a"}}
    ```
  </Step>

  <Step title="Stop the driver when finished">
    ```json theme={null}
    {"tool":"pwncli_stop","arguments":{"session_id":"chal-a"}}
    ```
  </Step>
</Steps>

<Warning>
  `sendinput` does not append a newline automatically. If the target expects line input, include `\n` yourself.
</Warning>

## Behavior notes

* a session can only have one active `pwncli` driver at a time
* starting a new driver for the same session replaces the old one
* `checkoutput` clears the buffered output it returns
* `checkevents` returns structured event history plus liveness and exit-code data

For exact fields and examples, see [pwncli Reference](/tool-reference/pwncli).