Skip to content

Instantly share code, notes, and snippets.

@aemmitt-ns
Last active June 5, 2023 16:39
Show Gist options
  • Select an option

  • Save aemmitt-ns/d083889a7698f11968959218d2fc0a1b to your computer and use it in GitHub Desktop.

Select an option

Save aemmitt-ns/d083889a7698f11968959218d2fc0a1b to your computer and use it in GitHub Desktop.
use radius2 api to solve IDA ctf challenge
use radius2::{Radius, RadiusOption, State, vc};
fn main() {
let options = [RadiusOption::SimAll(true)];
let mut radius = Radius::new_with_options(Some("challenge"), &options);
let mut state = radius.callsym_state("main");
let flag = state.symbolic_value("flag", 8*0x18);
state.constrain_bytes(&flag, "[ -~]");
radius.set_argv_env(&mut state, &[vc(0), flag.clone()], &[]);
fn skip(_state: &mut State) -> bool {
false
}
radius.hook(0x141b, skip);
let mut fin = radius.run_until(state, 0x1610, &[0x12eb]).unwrap();
println!("FLAG: {}", fin.evaluate_string(&flag).unwrap())
}
use radius2::{Radius, RadiusOption, vc};
fn main() {
let options = [RadiusOption::SimAll(true)];
let mut radius = Radius::new_with_options(Some("challenge"), &options);
radius.cmd("wx 9090 @ 0x141b").unwrap(); // nop jump
let mut state = radius.callsym_state("main");
let flag = state.symbolic_value("flag", 8*0x18);
state.constrain_bytes(&flag, "[ -~]");
radius.set_argv_env(&mut state, &[vc(0), flag.clone()], &[]);
let mut fin = radius.run_until(state, 0x1610, &[0x12eb]).unwrap();
println!("FLAG: {}", fin.evaluate_string(&flag).unwrap())
}
@aemmitt-ns

aemmitt-ns commented Jun 1, 2023

Copy link
Copy Markdown
Author

added example that just NOPs the jump

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment