1

Here is a very basic golang program:

package main
import "fmt"

func main() {
    var s1 string
    fmt.Scanln(&s1)

    if s1=="goodpassword" {
        fmt.Println("Good")
    } else {
        fmt.Println("Wrong")
    }
}

I have compiled this program (elf64 linux binary).

I have diasssembled the binary and i have found the addresses of the 2 fmt.Println calls:

...
0x00490d4f     lea rax, obj.main.statictmp_1    ; wrong
...
0x00490d99     lea rax, obj.main.statictmp_0    ; good
...

Now, i have wrote this python program:

import angr
from angr.state_plugins import SimSystemPosix

p = angr.Project('./mybinary')

sm = p.factory.simulation_manager()
sm.explore(find= 0x00490d99, avoid= 0x00490d4f)

print(sm.found[0].posix.dumps(0))

I do not understand why angr does not return "goodpassword" string. I have something wrong but i do not understand what...

Thanks for your help

2

The Go run time is fairly complicated that symbolic solvers will not run out-of-the-box as-is. You are asking angr to figure out everything on it's own which may be feasible for simple and uncomplicated C programs but not for something like Go binaries.

For example, the fmt.Scanln function will call multiple Go functions before you reach libc.read. Angr has SimProcedures for read but not for fmt.Scanln. To figure out what fmt.Scanln does it has to symbolically execute after which only it may able to discover the dependency between stdin and the program output. Symbolically executing Scanln is by no way a simple task.

Instead, you should break down the problem in parts which you can ask angr to solve. Like if you have identified the buffer where the user input is stored you can mark that as symbolic and instruct angr to find the path to the "good password" branch.

Further resources on Go reversing:

  • Thanks. I have identified the buffer but how can i mark it as symbolic and how can i instruct angr to find the good password ? – Bob5421 Jan 13 at 13:02
  • @Bob5421 Check this – 0xec Jan 13 at 19:35
  • Thanks i have already read this documentation but there are so much cases i do not understand which one is the good. In fact i want to virtually start my program at the address after the scanf and ask angr to solve password. – Bob5421 Jan 14 at 7:07

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.