Skip to content

Instantly share code, notes, and snippets.

@gbrls
Created August 4, 2024 17:10
Show Gist options
  • Save gbrls/39f8ed3069af0f529befb793643f6fed to your computer and use it in GitHub Desktop.
Save gbrls/39f8ed3069af0f529befb793643f6fed to your computer and use it in GitHub Desktop.
angr-ctf
def first_check(project):
check0_start = base + 0x1211
check0_end = base + 0x12f5
initial_state = project.factory.entry_state(
addr = check0_start,
add_options = { angr.options.SYMBOL_FILL_UNCONSTRAINED_MEMORY,
angr.options.SYMBOL_FILL_UNCONSTRAINED_REGISTERS })
simulation = project.factory.simgr(initial_state)
p0 = claripy.BVS('p0', 8 * 8)
input0_addr = initial_state.regs.rdi
initial_state.memory.store(input0_addr, p0)
simulation.explore(find=check0_end)
if simulation.found:
solution_state = simulation.found[0]
print('found!')
to_compare_addr = solution_state.regs.rbp - 0x10
constraint_sym = solution_state.memory.load(to_compare_addr, 8)
constraint_value = 'Xsl3BDxP'.encode()
solution_state.add_constraints(constraint_sym == constraint_value)
print(solution_state.solver.eval(constraint_sym,cast_to=bytes))
solution = solution_state.solver.eval(p0,cast_to=bytes)
return solution
else:
raise Exception('Could not find the solution')
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment