1

I am trying to learn angr from beginning. Due to lack of simple tutorials I programmed my own little executable which angr should solve.

The C code looks as follows:

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

int main(int argc, char *argv[]) {
    char buffer[20];
    printf("Password\n");
    fgets(buffer,20,stdin);
    if (strcmp(buffer,"super!\n")==0) {
        printf("SUCCESS!\n");
    } else {
        printf("FAIL!\n");
    }
    return 0;
}

When compiled and opened in binary ninja I see the printfs at following addresses: BN So I created following angr python3 code:

import angr
from angr.state_plugins import SimSystemPosix

p = angr.Project('./test')
state = p.factory.entry_state()



sm = p.factory.simulation_manager(state)
sm.explore(find=0x40118c, avoid=0x40119a)

print(sm.found)

Running the python code shows following output:

python3 solve_angr.py WARNING | 2020-06-08 10:02:29,497 | angr.state_plugins.symbolic_memory | The program is accessing memory or registers with an unspecified value. This could indicate unwanted behavior.
WARNING | 2020-06-08 10:02:29,497 | angr.state_plugins.symbolic_memory | angr will cope with this by generating an unconstrained symbolic variable and continuing. You can resolve this by:
WARNING | 2020-06-08 10:02:29,497 | angr.state_plugins.symbolic_memory | 1) setting a value to the initial state
WARNING | 2020-06-08 10:02:29,497 | angr.state_plugins.symbolic_memory | 2) adding the state option ZERO_FILL_UNCONSTRAINED_{MEMORY,REGISTERS}, to make unknown regions hold null
WARNING | 2020-06-08 10:02:29,497 | angr.state_plugins.symbolic_memory | 3) adding the state option SYMBOL_FILL_UNCONSTRAINED_{MEMORY_REGISTERS}, to suppress these messages.
WARNING | 2020-06-08 10:02:29,498 | angr.state_plugins.symbolic_memory | Filling memory at 0x7fffffffffefff8 with 72 unconstrained bytes referenced from 0x58d4e0 (strcmp+0x0 in libc.so.6 (0x8d4e0))
WARNING | 2020-06-08 10:02:29,499 | angr.state_plugins.symbolic_memory | Filling memory at 0x7fffffffffeff70 with 8 unconstrained bytes referenced from 0x58d4e0 (strcmp+0x0 in libc.so.6 (0x8d4e0))
[]

The [] indicates that it did not find any solution.

Can anybody tell me what I did wrong?

0

I believe that the issue is related to the way gets symbolic procedure implemented in angr. You are asking to read 20 bytes, and as far as I understand, the actual symbolic memory that is allocated is of the size of 20 (19 string characters and a NULL terminator). Later, when you call to strcmp, the comparison will always fail, because you compare 20 bytes string to super!\n which is shorter. So the compare result will never be 0, and angr's symbolic execution engine will never reach the printf("SUCCESS!\n"); clause.

If you modify your code to be:

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

int main(int argc, char *argv[]) {
    char buffer[20];
    printf("Password\n");
    fgets(buffer,8,stdin); // <-------------- Adjust size to be same as "super!\n"
    if (strcmp(buffer,"super!\n")==0) {
        printf("SUCCESS!\n");
    } else {
        printf("FAIL!\n");
    }
    return 0;
}

This way it works fine and reaches printf("SUCCESS!\n");

| improve this answer | |
0

If you can't modify the binary but through the static analysis you get the number of bytes you need to provide as a flag, you can construct bit vector

flag_chars = [claripy.BVS('flag_%d' % i, 8) for i in range(6)]
flag = claripy.Concat(*flag_chars + [claripy.BVV(b'\n')])

and pass that to the entry_state since the flag is provided as an input through stdin to this binary.

p = angr.Project('test')
state = p.factory.entry_state(args=['./test'], stdin=flag)

With such setup, angr will successfully find the solution.

Additionally, if you would like to extract the flag

found = sm.found[0]
flag_str = found.solver.eval_upto(flag, 7, cast_to = bytes)
print(flag_str)
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.