下载查壳:
ida打开,f5伪代码分析:
可以看到sub_4007C0和sub_4007F0分别指向两个结果:
编写angr脚本:
import angr
import sys
import claripy
reload(sys)
sys.setdefaultencoding("utf-8")
#这里修改了文件名
p = angr.Project("logmein")
initial_state = p.factory.entry_state()
simulation = p.factory.simgr(initial_state)
def is_good(state):
return b'You entered the correct password!' in state.posix.dumps(1)
def is_bad(state):
return b'Incorrect password!' in state.posix.dumps(1)
simulation.explore(find=is_good,avoid=is_bad)
if simulation.found:
solution_state = simulation.found[0]
print solution_state.posix.dumps(sys.stdin.fileno())
else:
raise Exception('Could not find the solution')
运行结果: