I am trying to use Angr to reverse engineer a plugin for an application. This plugin is loaded via DLL by the main application. To debug, I use x64dbg to attach to the main application exe. I then set breakpoints in the plugin DLL, use the main program to trigger the breakpoint, and now I am at a breakpoint in x64dbg in the DLL of interest.
Using the call stack info, I want Angr's entry point to be a couple of levels up, still inside the plugin DLL (instead of starting at the default entry point of the main application, which I assume will generate way too many paths for Angr). I want Angr to find a path from there to the breakpoint. Here is where I become a bit confused.
- when I run
angr.Project("file_to_debug")should "file_to_debug" be the main application EXE or the plugin DLL I am interested in?
- If I want to start execution at a given address that I got from x64dbg, I run
state = proj.factory.entry_state(addr=start_at)? But how do I get the memory state into Angr? From x64dbg I can dump the program memory, but I end up with a .bin file. It looks like I can use Scylla as well, but I am unclear how.
Then to find a path from an earlier point to the breakpoint address, I do something like
sim_mgr = proj.factory.simulation_manager(state) sim_mgr.explore(find=failure_condition_from_original_breakpoint)
But I just end up with sim_mgr.errored = saying
<State errored with "No bytes in memory for block starting at 0x7ffd8dfb0f29">
I suspect I am missing a few major concepts but any suggestions would be greatly appreciated.