I am currently trying to use angr, and I need to find a string "Done!" which results in the "good termination" of the program. The input is 32 bits and I need to know the input which leads to the "Done!" being printed. I thought of using the following in my python script:
b = angr.Project('a.out') arg1 = claripy.BVS('arg1', 32) b.factory.entry_state(args=['a.out', arg1]) pg = b.factory.simgr() pg.explore(find=lambda x: b'Done!' in x.posix.dumps(1))
In my current knowledge of angr, this should result in the path, wich leads to "Done!" being printed. Am I mistaken? With found I could then access the result. But angr leaves me with
<SimulationManager with 1 deadended>
as an output for my simulation manager. What am I doing wrong? Are there more requirements needed for this to work?
Apriciate any help.