文章目录
02_angr_find_condition是angr的第3个例子,下载位置:https://github.com/jakespringer/angr_ctf
1 解题过程
import angr
import sys
def main(argv):
bin_path = argv[1]
p = angr.Project(bin_path)
init_state = p.factory.entry_state()
sm = p.factory.simulation_manager(init_state)
def is_good(state):
return b'Good Job' in state.posix.dumps(1)
def is_bad(state):
return b'Try again' in state.posix.dumps(1)
sm.explore(find=is_good, avoid=is_bad)
if sm.found:
found_state = sm.found[0]
print("Solution: {}" .format(found_state.posix.dumps(0)))
if __name__ == '__main__':
main(sys.argv)
执行该脚本:
python 02.py 02_angr_find_condition
结果为:
memory at 0x7ffeff50 with 4 unconstrained bytes referenced from 0x818ac20 (strcmp+0x0 in libc.so.6 (0x8ac20))
Solution: b'HETOBRCU'