Skip to content

Instantly share code, notes, and snippets.

@aemmitt-ns
Last active June 5, 2023 16:39
Show Gist options
  • Save aemmitt-ns/d083889a7698f11968959218d2fc0a1b to your computer and use it in GitHub Desktop.
Save aemmitt-ns/d083889a7698f11968959218d2fc0a1b to your computer and use it in GitHub Desktop.
use radius2 api to solve IDA ctf challenge
use radius2::{Radius, RadiusOption, State, vc};
fn main() {
let options = [RadiusOption::SimAll(true)];
let mut radius = Radius::new_with_options(Some("challenge"), &options);
let mut state = radius.callsym_state("main");
let flag = state.symbolic_value("flag", 8*0x18);
state.constrain_bytes(&flag, "[ -~]");
radius.set_argv_env(&mut state, &[vc(0), flag.clone()], &[]);
fn skip(_state: &mut State) -> bool {
false
}
radius.hook(0x141b, skip);
let mut fin = radius.run_until(state, 0x1610, &[0x12eb]).unwrap();
println!("FLAG: {}", fin.evaluate_string(&flag).unwrap())
}
use radius2::{Radius, RadiusOption, vc};
fn main() {
let options = [RadiusOption::SimAll(true)];
let mut radius = Radius::new_with_options(Some("challenge"), &options);
radius.cmd("wx 9090 @ 0x141b").unwrap(); // nop jump
let mut state = radius.callsym_state("main");
let flag = state.symbolic_value("flag", 8*0x18);
state.constrain_bytes(&flag, "[ -~]");
radius.set_argv_env(&mut state, &[vc(0), flag.clone()], &[]);
let mut fin = radius.run_until(state, 0x1610, &[0x12eb]).unwrap();
println!("FLAG: {}", fin.evaluate_string(&flag).unwrap())
}
@aemmitt-ns
Copy link
Author

aemmitt-ns commented Jun 1, 2023

added example that just NOPs the jump

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment