Angr学习（5）

最新推荐文章于 2024-09-13 19:41:32 发布

0xwangliang

最新推荐文章于 2024-09-13 19:41:32 发布

阅读量423

点赞数 2

分类专栏： Angr 文章标签：安全

本文链接：https://blog.csdn.net/Misaka10046/article/details/109196765

版权

Angr 专栏收录该内容

7 篇文章 0 订阅

订阅专栏

低级内存接口

>>> proj.memory.store(0x4000,proj.solver.BVV(0x12345678,64))
>>> proj.memory.load
<bound method SimSymbolicMemory.load of <angr.state_plugins.symbolic_memory.SimSymbolicMemory object at 0x7f29b0fbac10>>
>>> proj.memory.load(0x4000)//进行内存的存储读取操作
<BV64 0x12345678>
>>> proj.arch.memory_endness//看是大段序还是小端序
'Iend_LE'

基础执行

>>> proj.step//当前的程序的位置
<bound method SimState.step of <SimState @ 0x400610>>
>>> proj.step()//返回当前运行到下一个分支有几种情况
<IRSB from 0x400610: 1 sat>
>>> proj.step().successors[0]
<SimState @ 0x4005d0>
>>> proj.step().successors//successors包含了程序接下来运行所有的可能性的列表
[<SimState @ 0x4005d0>]

在这里插入图片描述
发现跳转记录的分支与程序一致。

在这里插入图片描述
刚刚那个只有一个分支的，现在找有两个分支的

>>> while 1:
...     h = proj.step()
...     if len(h.successors) == 2:
...             break
...     proj = h.successors[0]
... 
>>> h.successors
[<SimState @ 0x1117a47>, <SimState @ 0x1117a88>]
>>> h.successors[0].solver.constraints
[<Bool syscall_stub_ptrace_6_64 <= 0xfffffffffffff000>]
>>> h.successors[1].solver.constraints
[<Bool syscall_stub_ptrace_6_64 > 0xfffffffffffff000>]

通过这个能很明显的看出符号执行的原理，遇到判断的时候，我们会产生两个完全分开的状态——一个用于模拟条件为真，另一个用于模拟条件为假，然后在第一个状态中，我们添加<= 0xfffffffffffff000为约束条件，而在第二个状态中，我们添加> 0xfffffffffffff000为约束条件。这样的话就能确保程序把所有路径都跑一遍从而找出正确的那个。

history插件

>>> for addr in proj.history.bbl_addrs: //接着上面的，history里面记录一个状态的执行路径，就是一个链表,bbl_addrs中是state已经执行过的基本块的地址列表
...   print hex(addr)
... 
0x400610L
0x4005d0L
0x1021ab0L
0x400890L
0x400560L
0x400575L
0x4008c3L
0x4008c8L
0x4006d0L
0x4006f8L
0x400670L
0x400692L
0x4008ddL
0x4008d0L
0x4007a8L
0x400590L
0x1042790L
0x1021100L
0x10b1690L
0x10b16b6L
0x10b16c6L
0x10427a6L
0x1042860L
0x10427f6L
0x4007bbL
0x4007c1L
0x400600L
0x11179e0L
0x1117a3fL
>>> proj.history.recent_bbl_addrs
[17922623L]
>>> proj.history.descriptions
<angr.state_plugins.history.LambdaAttrIter object at 0x7f29b116cd50>
>>> proj.history.descriptions.hardcopy//描述state上每轮执行的状态的字符串列表
['<IRSB from 0x400610: 1 sat>', '<IRSB from 0x4005d0: 1 sat>', '<SimProcedure __libc_start_main from 0x1021ab0: 1 sat>', '<IRSB from 0x400890: 1 sat>', '<IRSB from 0x400560: 1 sat 1 unsat>', '<IRSB from 0x400575: 1 sat>', '<IRSB from 0x4008c3: 1 sat 1 unsat>', '<IRSB from 0x4008c8: 1 sat>', '<IRSB from 0x4006d0: 1 sat 1 unsat>', '<IRSB from 0x4006f8: 1 sat>', '<IRSB from 0x400670: 1 sat 1 unsat>', '<IRSB from 0x400692: 1 sat>', '<IRSB from 0x4008dd: 1 sat 1 unsat>', '<IRSB from 0x4008d0: 1 sat>', '<IRSB from 0x4007a8: 1 sat>', '<IRSB from 0x400590: 1 sat>', '<IRSB from 0x1042790: 1 sat>', '<IRSB from 0x1021100: 1 sat>', '<IRSB from 0x10b1690: 1 sat 1 unsat>', '<IRSB from 0x10b16b6: 1 sat 1 unsat>', '<IRSB from 0x10b16c6: 1 sat>', '<IRSB from 0x10427a6: 1 sat 1 unsat>', '<IRSB from 0x1042860: 1 sat>', '<IRSB from 0x10427f6: 1 sat>', '<IRSB from 0x4007bb: 1 sat 1 unsat>', '<IRSB from 0x4007c1: 1 sat>', '<IRSB from 0x400600: 1 sat>', '<IRSB from 0x11179e0: 1 sat>', '<SimProcedure ptrace (syscall) (stub) from 0x1117a3f: 1 sat>']
>>> proj.history.bbl_addrs.hardcopy
[4195856L, 4195792L, 16915120L, 4196496L, 4195680L, 4195701L, 4196547L, 4196552L, 4196048L, 4196088L, 4195952L, 4195986L, 4196573L, 4196560L, 4196264L, 4195728L, 17049488L, 16912640L, 17503888L, 17503926L, 17503942L, 17049510L, 17049696L, 17049590L, 4196283L, 4196289L, 4195840L, 17922528L, 17922623L]//获取这些值的平面列表
>>> proj.history.jumpkinds
<angr.state_plugins.history.LambdaAttrIter object at 0x7f29b116cd50>
>>> proj.history.jumpkinds.hardcopy
['Ijk_Boring', 'Ijk_Call', 'Ijk_Boring', 'Ijk_Call', 'Ijk_Call', 'Ijk_Boring', 'Ijk_Ret', 'Ijk_Boring', 'Ijk_Call', 'Ijk_Boring', 'Ijk_Boring', 'Ijk_Boring', 'Ijk_Ret', 'Ijk_Boring', 'Ijk_Call', 'Ijk_Call', 'Ijk_Boring', 'Ijk_Call', 'Ijk_Boring', 'Ijk_Boring', 'Ijk_Boring', 'Ijk_Ret', 'Ijk_Boring', 'Ijk_Boring', 'Ijk_Ret', 'Ijk_Boring', 'Ijk_Call', 'Ijk_Boring', 'Ijk_Sys_syscall', 'Ijk_Ret']

Ijk_Boring：就是一个正常的跳转
Ijk_Call：用call的形式的跳转
Ijk_Ret：return形式的跳转
Ijk_Sys_syscall：系统调用
Ijk_NoHook：跳到angrHook了的地方

>>> proj.history.events
<angr.state_plugins.history.LambdaIterIter object at 0x7f29b116ccd0>
>>> proj.history.events.hardcopy//记录文件运行中的一些操作的列表
[<SimActionData __libc_start_main() reg/read>, <SimActionData __libc_start_main() reg/read>, <SimActionData __libc_start_main() reg/read>, <SimActionData __libc_start_main() reg/read>, <SimActionData __libc_start_main() reg/read>, <SimActionData __libc_start_main() reg/read>, <SimActionData __libc_start_main() reg/write>, <SimActionData __libc_start_main() reg/read>, <SimActionData __libc_start_main() reg/write>, <SimActionData __libc_start_main() reg/read>, <SimActionData __libc_start_main() reg/read>, <SimActionData __libc_start_main() reg/write>, <SimActionData __libc_start_main() reg/write>, <SimActionData __libc_start_main() reg/write>, <SimActionData __libc_start_main() reg/write>, <SimActionData __libc_start_main() reg/read>, <SimActionData __libc_start_main() mem/write>, <SimActionData __libc_start_main() reg/write>, <SimActionData __libc_start_main() mem/read>, <SimEvent unconstrained 20, with fields ['bits', 'name']>, <SimEvent uninitialized 21, with fields ['memory_id', 'addr', 'size']>, <SimEvent unconstrained 22, with fields ['bits', 'name']>, <SimEvent uninitialized 23, with fields ['memory_id', 'addr', 'size']>, <SimEvent unconstrained 24, with fields ['bits', 'name']>, <SimEvent uninitialized 25, with fields ['memory_id', 'addr', 'size']>, <SimEvent unconstrained 26, with fields ['bits', 'name']>, <SimEvent uninitialized 27, with fields ['memory_id', 'addr', 'size']>, <SimEvent unconstrained 28, with fields ['bits', 'name']>, <SimEvent uninitialized 29, with fields ['memory_id', 'addr', 'size']>, <SimEvent unconstrained 30, with fields ['bits', 'name']>, <SimEvent uninitialized 31, with fields ['memory_id', 'addr', 'size']>, <SimEvent unconstrained 32, with fields ['bits', 'name']>, <SimActionData ptrace() reg/write>, <SimActionData ptrace() reg/read>, <SimActionData ptrace() reg/read>, <SimActionData ptrace() reg/write>, <SimActionData ptrace() reg/write>]
>>> proj.history.actions
<angr.state_plugins.history.LambdaIterIter object at 0x7f29b116cc10>
>>> proj.history.actions.hardcopy
[<SimActionData __libc_start_main() reg/read>, <SimActionData __libc_start_main() reg/read>, <SimActionData __libc_start_main() reg/read>, <SimActionData __libc_start_main() reg/read>, <SimActionData __libc_start_main() reg/read>, <SimActionData __libc_start_main() reg/read>, <SimActionData __libc_start_main() reg/write>, <SimActionData __libc_start_main() reg/read>, <SimActionData __libc_start_main() reg/write>, <SimActionData __libc_start_main() reg/read>, <SimActionData __libc_start_main() reg/read>, <SimActionData __libc_start_main() reg/write>, <SimActionData __libc_start_main() reg/write>, <SimActionData __libc_start_main() reg/write>, <SimActionData __libc_start_main() reg/write>, <SimActionData __libc_start_main() reg/read>, <SimActionData __libc_start_main() mem/write>, <SimActionData __libc_start_main() reg/write>, <SimActionData __libc_start_main() mem/read>, <SimActionData ptrace() reg/write>, <SimActionData ptrace() reg/read>, <SimActionData ptrace() reg/read>, <SimActionData ptrace() reg/write>, <SimActionData ptrace() reg/write>]//填充程序对所有内存、寄存器、临时值访问的日志

观察栈帧

>>> for i in proj.callstack: //只能用迭代器的方法来打出这些栈里面的值
...     print i
... 
Backtrace:
Frame 0: 0x4007c1 => 0x400600, sp = 0x7fffffffffeff28
Frame 1: 0x4008d0 => 0x4007a8, sp = 0x7fffffffffeff38
Frame 2: 0x1021ab0 => 0x400890, sp = 0x7fffffffffeff78
Frame 3: 0x400610 => 0x4005d0, sp = 0x7fffffffffeff88
Frame 4: 0x0 => 0x0, sp = 0xffffffffffffffff
Backtrace:
Frame 0: 0x4008d0 => 0x4007a8, sp = 0x7fffffffffeff38
Frame 1: 0x1021ab0 => 0x400890, sp = 0x7fffffffffeff78
Frame 2: 0x400610 => 0x4005d0, sp = 0x7fffffffffeff88
Frame 3: 0x0 => 0x0, sp = 0xffffffffffffffff
Backtrace:
Frame 0: 0x1021ab0 => 0x400890, sp = 0x7fffffffffeff78
Frame 1: 0x400610 => 0x4005d0, sp = 0x7fffffffffeff88
Frame 2: 0x0 => 0x0, sp = 0xffffffffffffffff
Backtrace:
Frame 0: 0x400610 => 0x4005d0, sp = 0x7fffffffffeff88
Frame 1: 0x0 => 0x0, sp = 0xffffffffffffffff
Backtrace:
Frame 0: 0x0 => 0x0, sp = 0xffffffffffffffff
>>> proj.callstack//观察栈里面的值
<CallStack (depth 5)>
>>> proj.callstack[0]
<CallStack (depth 5)>
>>> proj.callstack[1]
<CallStack (depth 4)>
>>> proj.callstack[2]
<CallStack (depth 3)>
>>> proj.callstack.func_addr//函数的开始地址
4195840L
>>> proj.callstack.call_site_addr//调用当前函数的基本块地址
4196289L
>>> hex(proj.callstack.stack_ptr)//当前函数的栈顶指针
'0x7fffffffffeff28L'
>>> hex(proj.callstack.ret_addr)//当前函数的返回地址
'0x4007dfL'