I create the following c program as a proof of concept. When I try to analyze it with anger it never finishes.

#include <string.h>
#include <stdlib.h>
#include <stdio.h>

char *secret = "password";

int compare(char *string)
{
    int i, c=0;
    for (i=0; i< strlen(secret); i++)
    {
        if (string[i] == secret[i])
            c++;
    }
    if (c == 8)
        printf("You won");
    return 0;
}
int main(int argc, char **argv)
{
    char input[50];
    scanf("%s", input);
    compare(input);
    return EXIT_SUCCESS;
}

The script is the following:

#!/usr/bin/env python

import angr
import sys
import logging
import claripy

FIND = 0x00000000000011dd
LEN = 8 

def basic_symbolic_execution():
    p = angr.Project('test', load_options={'auto_load_libs':False})

    flag = claripy.BVS('flag', LEN * 8)

    st = p.factory.entry_state(
        stdin=flag,
    )

    sm = p.factory.simulation_manager(st)
    sm.explore(find=FIND, num_find=1)

    print("Found solution")
    out = b''

    for pp in sm.deadended:
        out = pp.posix.dumps(1)
        print(out)

    import IPython; IPython.embed()

def test():
    r = basic_symbolic_execution()

if __name__ == '__main__':
    sys.stdout.buffer.write(basic_symbolic_execution())

I have also tried to use explore on the address of c++ 8 times and then checking the stdin and it finishes but the result is all zeros. I was wondering if any of you have faced something similar and what your solutions were.

  • Hi, while this is fully on topic, you may want to consider filing a ticket here as that's more likely to catch the attention of the Angr developers. Also, your question isn't really a question, it's more of a statement. You may want to edit it to clarify what you expect members of this site to contribute to your RCE effort. – 0xC0000022L Nov 10 at 22:34
up vote 1 down vote accepted

By your FIND address it seems like your binary was compiled with PIE. Please verify this. Angr will load PIE enabled elf at a base address of 0x400000, add this to your FIND address so that angr is able to resolve this.

I have made a couple of changes to your script to make it detect the "password".

import angr
import sys
import logging
import claripy

FIND = 0x00400672
LEN = 8

def basic_symbolic_execution():
    p = angr.Project('x', load_options={'auto_load_libs':False})

    flag = claripy.BVS('flag', LEN * 8)

    st = p.factory.entry_state(
        stdin=flag,
    )

    sm = p.factory.simulation_manager(st)
    sm.explore(find=FIND, num_find=1)

    print("Found solution")
    out = b''

    for pp in sm.found:
        out = pp.posix.dumps(0)
        print(out)
        print(pp.solver.eval(flag, cast_to=str))

    import IPython; IPython.embed()

def test():
    r = basic_symbolic_execution()

if __name__ == '__main__':
    basic_symbolic_execution()

To look for states which actually reached your FIND addresses you need to iterate over found of a simulation_manager.

According to man stdin

On program startup, the integer file descriptors associated with the streams stdin, stdout, and stderr are 0, 1, and 2, respectively.

So to get input you need to use pp.posix.dumps(0)

I have also added on how to use solver of a found state to solve for constraints that you set like the flag.

Also offset for the printf in the binary for me.

$ gcc -no-pie -fno-pic x.c -o x
$ r2 -AA x -qc "pdf @ sym.compare ~won"    
│       │   0x00400672      bf7d074000     mov edi, str.You_won        ; 0x40077d ; "You won"
  • I tried your way with no luck. I also tried with sm.run() plainly and it logs """Exit state has over 256 possible solutions. Likely unconstrained; skipping. """ over and over and no solution is found. – letFunny Nov 11 at 15:51
  • 1
    @letFunny I have updated my answer. – sudhackar Nov 12 at 6:03
  • It does work this way. However the problem with using sm.run() is the number of possible states (>500). How is that possible in such tiny program. When using num_find = 1 it finished thou. – letFunny Nov 12 at 8:52

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.