jakespringer / angr_ctf Goto Github PK

import sys
import angr
import logging
logging.getLogger('angr').setLevel('DEBUG')

win = 0x08048686
lose = 0x08048698

proj = angr.Project("./12_angr_veritesting")
state = proj.factory.entry_state()

sm = proj.factory.simulation_manager(state, veritesting = True)
sm.explore(find=win,avoid=lose)

found=sm.found[0]

print found.posix.dumps(sys.stdin.fileno())

DEBUG   | 2018-03-21 15:59:36,528 | angr.manager | Filtering 1 states
DEBUG   | 2018-03-21 15:59:36,529 | angr.manager | ... state <SimState @ 0x80486f1> matched!
DEBUG   | 2018-03-21 15:59:36,529 | angr.manager | ... returning 1 matches and 0 non-matches
DEBUG   | 2018-03-21 15:59:36,529 | angr.manager | Filtering 0 states
DEBUG   | 2018-03-21 15:59:36,529 | angr.manager | ... returning 0 matches and 0 non-matches
INFO    | 2018-03-21 15:59:36,529 | angr.analyses.veritesting | Returning new paths: (successful: 0, deadended: 0, errored: 0, deviated: 1)
DEBUG   | 2018-03-21 15:59:36,529 | angr.manager | Out of states in stash active
DEBUG   | 2018-03-21 15:59:36,530 | angr.manager | Out of states in stash active
Traceback (most recent call last):
  File "angr12_test.py", line 15, in <module>
    found=sm.found[0]
IndexError: list index out of range

DEBUG   | 2018-03-21 16:10:57,423 | angr.manager | Filtering 1 states
DEBUG   | 2018-03-21 16:10:57,423 | angr.manager | ... state <SimState @ 0x80486f1> matched!
DEBUG   | 2018-03-21 16:10:57,423 | angr.manager | ... returning 1 matches and 0 non-matches
DEBUG   | 2018-03-21 16:10:57,423 | angr.manager | Filtering 0 states
DEBUG   | 2018-03-21 16:10:57,423 | angr.manager | ... returning 0 matches and 0 non-matches
INFO    | 2018-03-21 16:10:57,424 | angr.analyses.veritesting | Returning new paths: (successful: 0, deadended: 0, errored: 0, deviated: 1)
DEBUG   | 2018-03-21 16:10:57,424 | angr.manager | Out of states in stash active
DEBUG   | 2018-03-21 16:10:57,424 | angr.manager | Out of states in stash active
Traceback (most recent call last):
  File "solve12.py", line 45, in <module>
    main(sys.argv)
  File "solve12.py", line 42, in main
    raise Exception('Could not find the solution')
Exception: Could not find the solution

  filename = "OJKSQYDP.txt"  # :string
  symbolic_file_size_bytes = 64

  password = claripy.BVS('password', symbolic_file_size_bytes * 8)
  password_file = angr.storage.SimFile(filename, content=password, size=symbolic_file_size_bytes)

  initial_state.fs.insert(filename, password_file)
  simulation = project.factory.simgr(initial_state)

(angr) angr@5364d74d028c:/ctf$ python solver03.py 03_angr_symbolic_registers 
0 0 0

(angr) angr@5364d74d028c:/ctf$ python scaffold03.py 03_angr_symbolic_registers 
WARNING | 2022-05-25 00:56:49,072 | angr.storage.memory_mixins.default_filler_mixin | The program is accessing register with an unspecified value. This could indicate unwanted behavior.
WARNING | 2022-05-25 00:56:49,072 | angr.storage.memory_mixins.default_filler_mixin | angr will cope with this by generating an unconstrained symbolic variable and continuing. You can resolve this by:
WARNING | 2022-05-25 00:56:49,072 | angr.storage.memory_mixins.default_filler_mixin | 1) setting a value to the initial state
WARNING | 2022-05-25 00:56:49,072 | angr.storage.memory_mixins.default_filler_mixin | 2) adding the state option ZERO_FILL_UNCONSTRAINED_{MEMORY,REGISTERS}, to make unknown regions hold null
WARNING | 2022-05-25 00:56:49,072 | angr.storage.memory_mixins.default_filler_mixin | 3) adding the state option SYMBOL_FILL_UNCONSTRAINED_{MEMORY,REGISTERS}, to suppress these messages.
WARNING | 2022-05-25 00:56:49,072 | angr.storage.memory_mixins.default_filler_mixin | Filling register ebp with 4 unconstrained bytes referenced from 0x804898c (main+0x32 in 03_angr_symbolic_registers (0x804898c))
WARNING | 2022-05-25 00:56:49,241 | angr.storage.memory_mixins.default_filler_mixin | Filling memory at 0xffffffed with 4 unconstrained bytes referenced from 0x804898c (main+0x32 in 03_angr_symbolic_registers (0x804898c))
WARNING | 2022-05-25 00:56:49,398 | angr.storage.memory_mixins.default_filler_mixin | Filling memory at 0xfffffff1 with 4 unconstrained bytes referenced from 0x804899f (main+0x45 in 03_angr_symbolic_registers (0x804899f))
WARNING | 2022-05-25 00:56:49,585 | angr.storage.memory_mixins.default_filler_mixin | Filling memory at 0xfffffff5 with 4 unconstrained bytes referenced from 0x80489b2 (main+0x58 in 03_angr_symbolic_registers (0x80489b2))
0 0 0

(angr) angr@5364d74d028c:/ctf$ ./03_angr_symbolic_registers    
Enter the password: 0 0 0
Try again.
(angr) angr@5364d74d028c:/ctf$