Angr never finishes

Question

I create the following c program as a proof of concept. When I try to analyze it with anger it never finishes.

#include <string.h>
#include <stdlib.h>
#include <stdio.h>

char *secret = "password";

int compare(char *string)
{
    int i, c=0;
    for (i=0; i< strlen(secret); i++)
    {
        if (string[i] == secret[i])
            c++;
    }
    if (c == 8)
        printf("You won");
    return 0;
}
int main(int argc, char **argv)
{
    char input[50];
    scanf("%s", input);
    compare(input);
    return EXIT_SUCCESS;
}

The script is the following:

#!/usr/bin/env python

import angr
import sys
import logging
import claripy

FIND = 0x00000000000011dd
LEN = 8 

def basic_symbolic_execution():
    p = angr.Project('test', load_options={'auto_load_libs':False})

    flag = claripy.BVS('flag', LEN * 8)

    st = p.factory.entry_state(
        stdin=flag,
    )

    sm = p.factory.simulation_manager(st)
    sm.explore(find=FIND, num_find=1)

    print("Found solution")
    out = b''

    for pp in sm.deadended:
        out = pp.posix.dumps(1)
        print(out)

    import IPython; IPython.embed()

def test():
    r = basic_symbolic_execution()

if __name__ == '__main__':
    sys.stdout.buffer.write(basic_symbolic_execution())

I have also tried to use explore on the address of c++ 8 times and then checking the stdin and it finishes but the result is all zeros. I was wondering if any of you have faced something similar and what your solutions were.

Answer 1

By your FIND address it seems like your binary was compiled with PIE. Please verify this. Angr will load PIE enabled elf at a base address of 0x400000, add this to your FIND address so that angr is able to resolve this.

I have made a couple of changes to your script to make it detect the "password".

import angr
import sys
import logging
import claripy

FIND = 0x00400672
LEN = 8

def basic_symbolic_execution():
    p = angr.Project('x', load_options={'auto_load_libs':False})

    flag = claripy.BVS('flag', LEN * 8)

    st = p.factory.entry_state(
        stdin=flag,
    )

    sm = p.factory.simulation_manager(st)
    sm.explore(find=FIND, num_find=1)

    print("Found solution")
    out = b''

    for pp in sm.found:
        out = pp.posix.dumps(0)
        print(out)
        print(pp.solver.eval(flag, cast_to=str))

    import IPython; IPython.embed()

def test():
    r = basic_symbolic_execution()

if __name__ == '__main__':
    basic_symbolic_execution()

To look for states which actually reached your FIND addresses you need to iterate over found of a simulation_manager.

According to man stdin

On program startup, the integer file descriptors associated with the streams stdin, stdout, and stderr are 0, 1, and 2, respectively.

So to get input you need to use pp.posix.dumps(0)

I have also added on how to use solver of a found state to solve for constraints that you set like the flag.

Also offset for the printf in the binary for me.

$ gcc -no-pie -fno-pic x.c -o x
$ r2 -AA x -qc "pdf @ sym.compare ~won"    
│       │   0x00400672      bf7d074000     mov edi, str.You_won        ; 0x40077d ; "You won"