Last active
June 5, 2023 16:39
-
-
Save aemmitt-ns/d083889a7698f11968959218d2fc0a1b to your computer and use it in GitHub Desktop.
use radius2 api to solve IDA ctf challenge
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
use radius2::{Radius, RadiusOption, State, vc}; | |
fn main() { | |
let options = [RadiusOption::SimAll(true)]; | |
let mut radius = Radius::new_with_options(Some("challenge"), &options); | |
let mut state = radius.callsym_state("main"); | |
let flag = state.symbolic_value("flag", 8*0x18); | |
state.constrain_bytes(&flag, "[ -~]"); | |
radius.set_argv_env(&mut state, &[vc(0), flag.clone()], &[]); | |
fn skip(_state: &mut State) -> bool { | |
false | |
} | |
radius.hook(0x141b, skip); | |
let mut fin = radius.run_until(state, 0x1610, &[0x12eb]).unwrap(); | |
println!("FLAG: {}", fin.evaluate_string(&flag).unwrap()) | |
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
use radius2::{Radius, RadiusOption, vc}; | |
fn main() { | |
let options = [RadiusOption::SimAll(true)]; | |
let mut radius = Radius::new_with_options(Some("challenge"), &options); | |
radius.cmd("wx 9090 @ 0x141b").unwrap(); // nop jump | |
let mut state = radius.callsym_state("main"); | |
let flag = state.symbolic_value("flag", 8*0x18); | |
state.constrain_bytes(&flag, "[ -~]"); | |
radius.set_argv_env(&mut state, &[vc(0), flag.clone()], &[]); | |
let mut fin = radius.run_until(state, 0x1610, &[0x12eb]).unwrap(); | |
println!("FLAG: {}", fin.evaluate_string(&flag).unwrap()) | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
added example that just NOPs the jump