I have a binary that scanfs and then does some checks and returns either FAIL or SUCCESS that has SUCCESS for multiple inputs. Although only one of the inputs has only printable characters. How do I restrict angr to work with only printable characters entered into the scanf?
import angr def main(): proj = angr.Project('a.out') init_state = proj.factory.entry_state() simulation = proj.factory.simgr(init_state) simulation.explore(find=lambda s: b"SUCCESS\n" in s.posix.dumps(1)) for solution in simulation.found: print(solution.posix.dumps(0), solution.posix.dumps(1)) if __name__ == '__main__': main()
This gives me an output containing a lot of unprintable \xDD where DD is a hex number. Can I restrict angr to use only printable characters when exploring and how; or how do I prevent angr from stopping after it finds one solution to get to the SUCCESS message. Currently although there are multiple solutions it finds one and only ONE.