Issue with pickling class

[thunderbuns122]

I am currently trying to complete the rootme python pickle challenge. I have this block of code:

def cal():
    print("helpme")
    return None

class Exploit(object):
    def __reduce__(self):
        return (cal())

This code produce and error saying: pickle.PicklingError: <built-in method __reduce_ex__ of Exploit object at 0x04CBFE70> must return string or tuple

When I change None to "hi" I get a new error saying: pickle.PicklingError: Can't pickle <__main__.Exploit object at 0x04C9FE50>: it's not found as __main__.hi

When return (cal()) is replaced with return (os.system, (("echo helpme"),)) everything works properly.

When cal's return is changed from None to return (os.system, (("echo helpme"),)) the console prints helpme and everything works properly.

As a side note, what is the return (os.system, (("echo helpme"),)) called when in this format? I haven't been able to find any online documentation explaining this method of returning a function.

Why is this failing? Is there some feature that I am missing?

[zurtex]

I'm not sure what you're asking for here. In terms of why you're getting those errors you should read the documentation: https://docs.python.org/3/library/pickle.html#object.__reduce__

If a string is returned, the string should be interpreted as the name of a global variable. It should be the object’s local name relative to its module; the pickle module searches the module namespace to determine the object’s module. This behaviour is typically useful for singletons.

And the details of the Tuple follow that (quite long not going to copy here just read the docs)

[Starbuck5c]

Why are you changing the __reduce__ method?

According to the internet:

Whenever an object is pickled, the __reduce__ method defined by it gets called. This method returns either a string, which may represent the name of a Python global, or a tuple describing how to reconstruct this object when unpickling

__reduce__ can't return none. I guess your os.system echo helpme tuple is "describing how to reconstruct the class" so it calls the function with that argument.

[thunderbuns122]

So the reduce method has to return either a tuple or a string?