I am currently trying to use angr, and I need to find a string "Done!" which results in the "good termination" of the program. The input is 32 bits and I need to know the input which leads to the "Done!" being printed. I thought of using the following in my python script:

b = angr.Project('a.out')
arg1 = claripy.BVS('arg1', 32)
b.factory.entry_state(args=['a.out', arg1])
pg = b.factory.simgr()
pg.explore(find=lambda x: b'Done!' in x.posix.dumps(1))

In my current knowledge of angr, this should result in the path, wich leads to "Done!" being printed. Am I mistaken? With found[0] I could then access the result. But angr leaves me with

<SimulationManager with 1 deadended>

as an output for my simulation manager. What am I doing wrong? Are there more requirements needed for this to work?

Apriciate any help.


  • Can you share the binary here?
    – sudhackar
    Nov 18 '19 at 12:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.