Angr安装与使用之使用篇（十八）

针对angr提供的练习题，现在进行求解16_angr_arbitrary_write，它也是关于hook输入的问题，需要使用angr求解出正确密码。但是需要提供排除地址以减少路径求解时间。
具体代码如下所示

import angr
import claripy
import sys

def main(argv):
  path_to_binary = argv[1]
  project = angr.Project(path_to_binary)

  initial_state = project.factory.entry_state()
  #使用hook替换__isoc99_scanf函数
  class ReplacementScanf(angr.SimProcedure):
    # Hint: scanf("%u %20s")
    def run(self, format_string, p1,p2):
      scanf0 = claripy.BVS('scanf0', 32)
      scanf1 = claripy.BVS('scanf1', 20*8)

      for char in scanf1.chop(bits=8):
        self.state.add_constraints(char >= 'A', char <= 'Z')

      scanf0_address = p1
      self.state.memory.store(scanf0_address, scanf0, endness=project.arch.memory_endness)
      scanf1_address = p2
      self.state.memory.store(scanf1_address, scanf1, endness=project.arch.memory_endness)
      
      self.state.globals['solutions'] = (scanf0,scanf1)

  scanf_symbol = '__isoc99_scanf'  # :string
  project.hook_symbol(scanf_symbol, ReplacementScanf())

  #检查strncpy函数
  def check_strncpy(state):
    # The stack will look as follows:
    # ...          ________________
    # esp + 15 -> /                \
    # esp + 14 -> |     param2     |
    # esp + 13 -> |      len       |
    # esp + 12 -> \________________/
    # esp + 11 -> /                \
    # esp + 10 -> |     param1     |
    #  esp + 9 -> |      src       |
    #  esp + 8 -> \________________/
    #  esp + 7 -> /                \
    #  esp + 6 -> |     param0     |
    #  esp + 5 -> |      dest      |
    #  esp + 4 -> \________________/
    #  esp + 3 -> /                \
    #  esp + 2 -> |     return     |
    #  esp + 1 -> |     address    |
    #      esp -> \________________/
    #利用memory.load方法提取参数内容
    strncpy_src = state.memory.load(state.regs.esp+8,4,endness=project.arch.memory_endness)
    strncpy_dest = state.memory.load(state.regs.esp+4,4,endness=project.arch.memory_endness)
    strncpy_len = state.memory.load(state.regs.esp+12,4,endness=project.arch.memory_endness)

    #使用memory.load方法把src真正的内容提取出来
    src_contents = state.memory.load(strncpy_src,strncpy_len)

    #判断src_contents及strncpy_dest是否为symbolic
    if state.se.symbolic(src_contents) and state.se.symbolic(strncpy_dest):
      password_string = 'NDYNWEUJ' # :string
      buffer_address = 0x57584344 # :integer, probably in hexadecimal
      does_src_hold_password = src_contents[-1:-64] == password_string
      does_dest_equal_buffer_address = strncpy_dest ==buffer_address

      # 判定strncpy_dest是否为password_buffe的地址
      if state.satisfiable(extra_constraints=(does_src_hold_password, does_dest_equal_buffer_address)):
        state.add_constraints(does_src_hold_password, does_dest_equal_buffer_address)
        return True
      else:
        return False
    else: # not state.se.symbolic(???)
      return False

  simulation = project.factory.simgr(initial_state)

  def is_successful(state):
    strncpy_address = 0x08048410
    if state.addr == strncpy_address:
      return check_strncpy(state)
    else:
      return False

  simulation.explore(find=is_successful)

  if simulation.found:
    solution_state = simulation.found[0]

    stored_solution0 , stored_solution1 = solution_state.globals['solutions']
    solution0=solution_state.solver.eval(stored_solution0)
    solution1=solution_state.solver.eval(stored_solution1,cast_to=bytes)
    print('solutions are {0},{1}'.format(solution0,solution1))
  else:
    raise Exception('Could not find the solution')

if __name__ == '__main__':
  main(sys.argv)

要想得到正确的输出，需要检查strncpy函数，此函数地址为0x08048410，即strncpy_address=0x08048410。

此strncpy函数接收3个输入，分别取出strncpy_src、strncpy_dest和strncpy_len这三个参数。

需要判断src_contents及strncpy_dest，此时需要用到strncmp函数，此函数接收‘NDYNWEUJ’及passwork_buffer，分别将src_contents[-1:-64]、strncpy_dest与‘DVTBOGZL’、0x57584344 进行比较，若相等则返回True。

下面验证实验结果
执行刚刚写好的程序，保存为scaffold16.py，并将其与16_angr_arbitrary_write放于同一文件夹中，具体如下图所示。

再执行16_angr_arbitrary_write，然后需要我们输入angr刚刚求解出的密码，结果如下

然而，参考其他求解代码，他们得到‘Good Job’，而在本人虚拟机中运行，结果均为‘Segmentation falut’，不知什么原因，如果有哪个小伙伴知道，欢迎告知原因。