1

I am currently trying to use angr, and I need to find a string "Done!" which results in the "good termination" of the program. The input is 32 bits and I need to know the input which leads to the "Done!" being printed. I thought of using the following in my python script:

b = angr.Project('a.out')
arg1 = claripy.BVS('arg1', 32)
b.factory.entry_state(args=['a.out', arg1])
pg = b.factory.simgr()
pg.explore(find=lambda x: b'Done!' in x.posix.dumps(1))

In my current knowledge of angr, this should result in the path, wich leads to "Done!" being printed. Am I mistaken? With found[0] I could then access the result. But angr leaves me with

<SimulationManager with 1 deadended>

as an output for my simulation manager. What am I doing wrong? Are there more requirements needed for this to work?

Apriciate any help.

Cheers

1
  • Can you share the binary here?
    – sudhackar
    Nov 18, 2019 at 12:08

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.