0

I am trying to use Angr to reverse engineer a plugin for an application. This plugin is loaded via DLL by the main application. To debug, I use x64dbg to attach to the main application exe. I then set breakpoints in the plugin DLL, use the main program to trigger the breakpoint, and now I am at a breakpoint in x64dbg in the DLL of interest.

Using the call stack info, I want Angr's entry point to be a couple of levels up, still inside the plugin DLL (instead of starting at the default entry point of the main application, which I assume will generate way too many paths for Angr). I want Angr to find a path from there to the breakpoint. Here is where I become a bit confused.

  • when I run angr.Project("file_to_debug") should "file_to_debug" be the main application EXE or the plugin DLL I am interested in?
  • If I want to start execution at a given address that I got from x64dbg, I run state = proj.factory.entry_state(addr=start_at)? But how do I get the memory state into Angr? From x64dbg I can dump the program memory, but I end up with a .bin file. It looks like I can use Scylla as well, but I am unclear how.

Then to find a path from an earlier point to the breakpoint address, I do something like

sim_mgr = proj.factory.simulation_manager(state)
sim_mgr.explore(find=failure_condition_from_original_breakpoint)

But I just end up with sim_mgr.errored = saying <State errored with "No bytes in memory for block starting at 0x7ffd8dfb0f29">

I suspect I am missing a few major concepts but any suggestions would be greatly appreciated.

0

After doing some more research, it looks like this is what I'm looking for:
symbion: fusing concrete and symbolic execution.

It seems that if you can provide angr (or symbion?) with programmatic access to a running debugger, I can use angr just for the part of code that I am interested in. They provide a "concrete target" for gdb server, but not x64dbg. There is a python plugin for x64dbg, but that looks like it supports python 2.7 instead of python 3 where angr seems to support python 3 at this point, so there might be some issue there.

So long story short, I think I need to use symbion and make a concrete target for x64dbg. A bit of a rabbit hole.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.