Google CTF - Unbreakable Enterprise Product Activation

solve.py

#!/usr/bin/env python2

import angr
import claripy

proj = angr.Project('./unbreakable-enterprise-product-activation',
                    load_options={"auto_load_libs": False})

# TODO: create useful
length = 67
bv = claripy.BVS("bv", length * 8)

initial_state = proj.factory.entry_state(
    args=['./unbreakable-enterprise-product-activation', bv])

# create a initial state
# initial_state = proj.factory.blank_state()
# initial_state = proj.factory.entry_state()
# initial_state = proj.factory.call_state()
initial_state.libc.buf_symbolic_bytes = length + 1

# TODO: useful state initialization
# initial_state.memory.store(0x1000, bv)
# initial_state.regs.eax = 0x4141

# TODO: add useful constraints
# initial_state.add_constraints(bv.get_byte(0) == 0)

for byte in bv.chop(8):
    initial_state.add_constraints(byte != '\x00')  # null
    initial_state.add_constraints(byte >= ' ')  # '\x20'
    initial_state.add_constraints(byte <= '~')  # '\x7e'

# create a path group based on the initial state
path_group = proj.factory.path_group(initial_state)

# explore until a path is found that we like :)
# TODO: useful find and avoid ;)
path_group.explore(find=(0x400830), avoid=(0x400850))

for found in path_group.found:
    # extract flag from the state
    solution = found.state.se.any_str(bv)
    # solution = solution[:solution.find("}") + 1]
    print(solution)
    break
else:
    print('not found')

print('done')

$ time python solve.py                        
CTF{0The1Quick2Brown3Fox4Jumped5Over6The7Lazy8Fox9}                
done

python solve-template.py  4.59s user 0.10s system 99% cpu 4.734 total