Skip to main content
Use the pwncli family when you want an interactive exploit driver that stays attached to a specific debug session.

​
pwncli

pwncli writes the provided script into the session runtime directory, launches it with uv run, and exposes both startup output and any parsed attach result marker. 
{"tool":"pwncli","arguments":{"session_id":"chal-a","binary_path":"/workspace/chal","file":"from pwn import *\nprint('ready')\n"}}

​
Important returned fields

  • runtime_dir: session-specific directory used for the inline script
  • io.current_output: output collected for this call
  • attachment.result: parsed attach result marker when present
  • startup.ready: whether the driver reached a ready state
  • startup.reason: why the wait finished
  • startup.alive: whether the driver is still alive
  • startup.pid: driver process id
  • startup.replaced: whether an older driver was replaced for this session

​
I/O tools

{"tool":"sendinput","arguments":{"session_id":"chal-a","data":"AAAA\n"}}
{"tool":"checkoutput","arguments":{"session_id":"chal-a"}}
{"tool":"checkevents","arguments":{"session_id":"chal-a"}}
  • sendinput writes raw bytes to stdin
  • checkoutput returns buffered output and clears it
  • checkevents returns structured events plus alive, exit_code, and driver_pid
sendinput does not append a newline automatically.

​
Session management tools

{"tool":"pwncli_stop","arguments":{"session_id":"chal-a"}}
{"tool":"list_pwncli_sessions","arguments":{}}
  • pwncli_stop kills the driver bound to a session
  • list_pwncli_sessions lists all active drivers

​
Behavior notes

  • one pwncli driver per debug session
  • launching a new driver for the same session replaces the old one
  • close_debug_session also stops the session’s active driver