I am learning angr and for that I wrote a code containing two global variables.

char pwd[8];
char flag[16];
int main()
        printf("\n\nEnter your password and the flag: ");
        return 0;
void validator()
        scanf("%s %s",pwd,flag);
        printf("\nThank You\n");//want to start the symbolic execution from here
        cipher_function();//works on pwd
        shuffle_function();//works on flag

enter image description here

and here is the solution script:

 project = angr.Project(path_to_binary)

  start_address = 0x004011BB  
  initial_state = project.factory.blank_state(addr=start_address)
  initial_state.regs.rbp = initial_state.regs.rsp
  initial_state.regs.rdx = 0x00404080
  initial_state.regs.rsi = 0x00404070
  pwd = claripy.BVS('pwd', 8*8)
  flag = claripy.BVS('flag',16*8)

  initial_state.memory.store(0x00404070, pwd)
  initial_state.memory.store(0x00404080, flag)

  simulation = project.factory.simgr(initial_state) 

Finally, the angr output is:

WARNING | 2021-03-02 08:11:19,750 | angr.storage.memory_mixins.default_filler_mixin | The program is accessing memory or registers with an unspecified value. This could indicate unwanted behavior.
WARNING | 2021-03-02 08:11:19,750 | angr.storage.memory_mixins.default_filler_mixin | angr will cope with this by generating an unconstrained symbolic variable and continuing. You can resolve this by:
WARNING | 2021-03-02 08:11:19,750 | angr.storage.memory_mixins.default_filler_mixin | 1) setting a value to the initial state
WARNING | 2021-03-02 08:11:19,750 | angr.storage.memory_mixins.default_filler_mixin | 2) adding the state option ZERO_FILL_UNCONSTRAINED_{MEMORY,REGISTERS}, to make unknown regions hold null
WARNING | 2021-03-02 08:11:19,750 | angr.storage.memory_mixins.default_filler_mixin | 3) adding the state option SYMBOL_FILL_UNCONSTRAINED_{MEMORY,REGISTERS}, to suppress these messages.
WARNING | 2021-03-02 08:11:19,750 | angr.storage.memory_mixins.default_filler_mixin | Filling register cc_ndep with 8 unconstrained bytes referenced from 0x40125e (cipher_function+0x2d in out2 (0x40125e))

can anyone please take a look and help me find what I am doing wrong. Thank you

  • Is there a typo in your code? In the screenshot, what you have in your code as start_address is not, in fact, a valid instruction address. Notice that it ends in a 6, whereas in the screenshot, valid last nibbles are 3 and A. Mar 2 '21 at 16:27
  • Thank you for the head up and sorry for the inconsistency in the code and screenshot. However, This is not the source of the issue, as I run it several time and got the same result.
    – youtab
    Mar 2 '21 at 20:09
  • I wrote my own symbolic execution framework, but have never used angr. That said, its output is telling to me. The final line indicates that the instruction at 0x40125e tried to read from memory that had not previously been initialized. Figure out which function/line of code that is and see if it's accessing something like another global variable. Alternatively, hopefully it has a more verbose output method -- instruction by instruction -- that can give you clues about what it's trying to read, and why it's trying to read it. Mar 2 '21 at 22:13
  • I wrote a tool/angr plugin to help with debugging in such cases: github.com/fmagin/angr-cli With this you should be able to easily find out at what point this happens and what is being read and then decide if this is even an issue. Mar 8 '21 at 17:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.