angrsolver.py

#!/usr/bin/env python

import angr
import simuvex
import binascii
import sys

part1 = None
part2 = None

# Calculates the installation id from the entered string
# This function just reverses the order of dwords in each quadword
def getInstallIdFromString(iid_string):
    qword1, qword2, qword3, qword4 = iid_string.split('-')

    dword1 = list(binascii.unhexlify(qword1))[3::-1]
    dword2 = list(binascii.unhexlify(qword1))[7:3:-1]

    dword3 = list(binascii.unhexlify(qword2))[3::-1]
    dword4 = list(binascii.unhexlify(qword2))[7:3:-1]

    dword5 = list(binascii.unhexlify(qword3))[3::-1]
    dword6 = list(binascii.unhexlify(qword3))[7:3:-1]

    dword7 = list(binascii.unhexlify(qword4))[3::-1]
    dword8 = list(binascii.unhexlify(qword4))[7:3:-1]

    return ''.join(dword1 + dword2 + dword3 + dword4 + dword5 + dword6 + dword7 + dword8)


def set_ebx_edx(state):
    global part1, part2
    state.regs.edx = part1
    state.regs.ebx = part2


def main(iid_string):
    global part1, part2
    angr.path_group.l.setLevel('DEBUG')

    # Calculate the install id from the string
    install_id = getInstallIdFromString(iid_string)

    # Load the binary
    proj = angr.Project('toyproject.exe', load_options={'auto_load_libs': False})

    # Hook strcmp
    proj.hook(0x40130E, simuvex.SimProcedures['libc.so.6']['strcmp'], length=5)

    # Create a blank state at 0x40122A i.e where check function is called
    initial_state = proj.factory.blank_state(addr=0x40122A)

    # The two parts of the serial
    part1 = initial_state.se.BVS('part1', 32)
    part2 = initial_state.se.BVS('part2', 32)

    # Store the install id in memory
    initial_state.memory.store(0x4093A8, install_id)

    # Hook to set ebx and edx registers
    proj.hook(0x4010ff, func=set_ebx_edx, length=6)

    pg = proj.factory.path_group(initial_state)

    # Go, go
    pg.explore(find=0x401234, avoid=0x401249)
    found_state = pg.found[0].state

    p1 = found_state.se.any_int(part1)
    p2 = found_state.se.any_int(part2)
    print '%08X-%08X' %(p1, p1^p2)

if __name__ == '__main__':
    if len(sys.argv) < 2:
        print 'Please provide the installation id as an arguement'
    else:
        # Sanity check
        assert len(sys.argv[1]) == 16*4+3
        main(sys.argv[1])