针对angr提供的练习题,现在进行求解05_angr_symbolic_memory,需要使用angr求解出正确密码。但是需要提供排除地址以减少路径求解时间。
具体代码如下所示
import angr
import claripy
import sys
def main(argv):
path_to_binary = argv[1]
project = angr.Project(path_to_binary)
start_address = 0x08048601
initial_state = project.factory.blank_state(addr=start_address)
#输入4个字符串,为8bytes则为8*8=64bits
password0 = claripy.BVS('password0', 64)
password1 = claripy.BVS('password1', 64)
password2 = claripy.BVS('password2', 64)
password3 = claripy.BVS('password3', 64)
##找到输入的四个字符串的地址,即0x0a1ba1c0、0x0a1ba1c8、0x0a1ba1d0、0x0a1ba1d8
# Determine the address of the global variable to which scanf writes the user
# input. The function 'initial_state.memory.store(address, value)' will write
# 'value' (a bitvector) to 'address' (a memory location, as an integer.) The
# 'address' parameter can also be a bitvector (and can be symbolic!).
password0_address = 0x0a1ba1c0
initial_state.memory.store(password0_address, password0)
password1_address = 0x0a1ba1c8
initial_state.memory.store(password1_address, password1)
password2_address = 0x0a1ba1d0
initial_state.memory.store(password2_address, password2)
password3_address = 0x0a1ba1d8
initial_state.memory.store(password3_address, password3)
simulation = project.factory.simgr(initial_state)
def is_successful(state):
stdout_output = state.posix.dumps(sys.stdout.fileno())
return b'Good Job.' in stdout_output
def should_abort(state):
stdout_output = state.posix.dumps(sys.stdout.fileno())
return b'Try Again.' in stdout_output
simulation.explore(find=is_successful, avoid=should_abort)
if simulation.found:
solution_state = simulation.found[0]
solution0 = solution_state.solver.eval(password0,cast_to=bytes)
solution1 = solution_state.solver.eval(password1,cast_to=bytes)
solution2 = solution_state.solver.eval(password2,cast_to=bytes)
solution3 = solution_state.solver.eval(password3,cast_to=bytes)
solution = solution0+b' '+solution1+b' '+solution2+b' '+solution3
print('solutions is: {} '.format(solution.decode('utf-8')))
else:
raise Exception('Could not find the solution')
if __name__ == '__main__':
main(sys.argv)
入口地址为0x0a1ba1c0,这是是因为上一行’add esp,20h’的作用是清理scanf的栈空间。
下面验证实验结果
执行刚刚写好的程序,保存为scaffold05.py,并将其与05_angr_symbolic_memory放于同一文件夹中,具体如下图所示。
再执行05_angr_symbolic_memory,然后需要我们输入angr刚刚求解出的密码,结果为Good Job。
至此,求解05_angr_symbolic_memory已全部完成。