angr 02_angr_find_condition 完整脚本

Posted 2021-09-06 漫小牛

文章目录

• • 1 解题过程

02_angr_find_condition是angr的第3个例子，下载位置：https://github.com/jakespringer/angr_ctf

1 解题过程

import angr                                                                                  
import sys 

def main(argv):
    bin_path = argv[1]
    p = angr.Project(bin_path)
    
    init_state = p.factory.entry_state()

    sm = p.factory.simulation_manager(init_state)
    
    def is_good(state):
        return b'Good Job' in state.posix.dumps(1)

    def is_bad(state):
        return b'Try again' in state.posix.dumps(1)

    sm.explore(find=is_good, avoid=is_bad)
    
    if sm.found:
        found_state = sm.found[0]
    
        print("Solution: {}"    .format(found_state.posix.dumps(0)))

if __name__ == '__main__':
    main(sys.argv)

执行该脚本：

python 02.py 02_angr_find_condition

结果为：

 memory at 0x7ffeff50 with 4 unconstrained bytes referenced from 0x818ac20 (strcmp+0x0 in libc.so.6 (0x8ac20))
Solution: b'HETOBRCU'