Drop python 2 support

[hackathi]

So, the Python 2 End of Life is now finally around the corner and happens on April 2020. A number of famous projects already stopped supporting py2 in new releases; and even though boofuzz' support for Python 3 is relatively new, I feel we should discuss about dropping python 2 support with some future version.

Dropping python 2 would enable us to use new Python 3 exclusive features such as Typehints, keyword-only-arguments (looking at you, Target and Session), Pathlib, and others.

Now, I know that this is a somewhat big deal so it would probably make sense to make a road map and decide which version would be the last to support Python 2.

[hackathi]

Also, at least one dependency (Tornado) already dropped python 2 support.

[jtpereyda]

Advantages of moving to Py 3:

1. Use all the helpful language features from Py 3.

Disadvantages:

1. Limit compatibility on some systems (since boofuzz is a research tool rather than an on-target exploit tool, I don't think this matters much TBH).
2. Unable to use more obscure dependencies.

Any others?

If that's it and we could get rid of disadvantage 2, I'd say let's go for it. I suspect these two more-obscure Windows dependencies haven't been tested on Python 3:

1. pydbg
2. pydasm

Has anybody tried these with Python 3? Or know of any replacements?

[hackathi]

Couldn't pydasm be replaced by capstone? Additional benefits include support for x86_64 and a boatload of other architectures like ARM.

I don't know of a replacement for pydbg, that is something that someone shoud look into.

[jtpereyda]

Now that I look, boofuzz only uses pydbg directly, and pydbg uses pydasm.

I've received in-person feedback about boofuzz not supporting 64-bit applications on Windows due to pydbg's status, so switching to something modern would be a big plus. I'm sure there is something newer out there, but I don't know what.

Back to upgrading: I believe pydb is only used by the procmon app, so I guess we could isolate Py2 compatibility there. That leads to a bit of a messy situation though.

[keisentraut]

I can tell you my personal feedback about the monitors: I never got it to work, maybe because I only tested with 64bit applications :) However, I had a few Python2 vs. 3 annoyances with boofuzz, so dropping support for Python2 and removing the monitors for now would increase my user experience.

[jtpereyda]

As mentioned in #505, looks like it will be harder to continue supporting Python 2.7 on Windows. But Windows with libdasm was the only use case for which we don't have Python 3 support so... I think we might as well drop support. Right?

If somebody wants to use libdasm with boofuzz they can go through the necessary footwork (using on old boofuzz version or making it Py3 compatible).

[SR4ven]

Currently Windows Python 2.7 tests are failing because Microsoft doesn't provide vcpython27 downloads any longer. Hence the choco package is broken which will also be marked deprecated.
I don't see a way to work around this, so I suggest disabling the said test environment. (I'd also be happy removing the linux build too so we can get rid of python 2.7 entirely)

Additionally the docs build is failing because of a broken link, related to the same issue. In the Install docs we state it's required to download and install pydasm. This seems to require vcpython27 too.
Does this make the whole Windows process_monitor unusable?
Anyway, we'll have to update the docs.

If somebody wants to use libdasm with boofuzz they can go through the necessary footwork (using on old boofuzz version or making it Py3 compatible).

Agreed, if someone needs these feature they'll have to work a way out to get a working Python2 environment themselves.

@jtpereyda if I got you right you'd be fine with dropping Python 2 support entirely too?

[jtpereyda]

@SR4ven Yes, let's go ahead and drop it.

The only thing will be to make sure we have some kind of procmon on Windows. I think it may indeed require pydasm right now as the docs suggest. If so, we could take any option that gets us mostly working (e.g., modifying how the procmon works, or perhaps even using the simple debugger on Windows).

[jtpereyda]

But let's try to do something quick rather than perfect-- I guess users won't be able to follow the instructions as written now, which is lame.

[SR4ven]

Sounds good, I'll see if I can put something together today or tomorrow.

[SR4ven]

Python 2 support was dropped in #506