2

I have made simple program to test the angr.

My python code is here.

import angr 
import claripy

p=angr.Project('./test2')
buf=claripy.BVS('buf', 8*10)

initial_state=p.factory.entry_state(args=["./test2", buf])

s=p.factory.simulation_manager()

s.explore(find=0x80491ab, avoid=0x80491ba)

print(s.found)

if s.found:
    sol_state=s.found[0]
    sol=sol_state.solver.eval(buf, cast_to=bytes)
    print(sol)
else:
    print("not found")

I expected this program print "hello" but It printed as follows.

WARNING  | 2023-02-13 23:57:05,077 | angr.storage.memory_mixins.default_filler_mixin | The program is accessing memory with an unspecified value. This could indicate unwanted behavior.
WARNING  | 2023-02-13 23:57:05,077 | angr.storage.memory_mixins.default_filler_mixin | angr will cope with this by generating an unconstrained symbolic variable and continuing. You can resolve this by:
WARNING  | 2023-02-13 23:57:05,077 | angr.storage.memory_mixins.default_filler_mixin | 1) setting a value to the initial state
WARNING  | 2023-02-13 23:57:05,077 | angr.storage.memory_mixins.default_filler_mixin | 2) adding the state option ZERO_FILL_UNCONSTRAINED_{MEMORY,REGISTERS}, to make unknown regions hold null
WARNING  | 2023-02-13 23:57:05,078 | angr.storage.memory_mixins.default_filler_mixin | 3) adding the state option SYMBOL_FILL_UNCONSTRAINED_{MEMORY,REGISTERS}, to suppress these messages.
WARNING  | 2023-02-13 23:57:05,078 | angr.storage.memory_mixins.default_filler_mixin | Filling memory at 0x0 with 129 unconstrained bytes referenced from 0x819f230 (strcpy+0x0 in libc.so.6 (0x9f230))
WARNING  | 2023-02-13 23:57:05,402 | angr.storage.memory_mixins.default_filler_mixin | Filling memory at 0x7ffeff6e with 10 unconstrained bytes referenced from 0x819f230 (strcpy+0x0 in libc.so.6 (0x9f230))
[<SimState @ 0x80491ab>]
b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'

Here is my source code test2.c and assembly code

test2.c

#include <stdio.h>
#include <string.h>

int main(int agrc, char* argv[])
{
    char buf[10];

    strcpy(buf, argv[1]);

    if(!strcmp(buf, "hello"))
    {
        puts("Correct!");
    }
    else
    {
        puts("Incorrect");
    }
}

test2 assembly code

Dump of assembler code for function main:
   0x08049176 <+0>:     push   ebp
   0x08049177 <+1>:     mov    ebp,esp
   0x08049179 <+3>:     sub    esp,0xc
   0x0804917c <+6>:     mov    eax,DWORD PTR [ebp+0xc]
   0x0804917f <+9>:     add    eax,0x4
   0x08049182 <+12>:    mov    eax,DWORD PTR [eax]
   0x08049184 <+14>:    push   eax
   0x08049185 <+15>:    lea    eax,[ebp-0xa]
   0x08049188 <+18>:    push   eax
   0x08049189 <+19>:    call   0x8049050 <strcpy@plt>
   0x0804918e <+24>:    add    esp,0x8
   0x08049191 <+27>:    push   0x804a008
   0x08049196 <+32>:    lea    eax,[ebp-0xa]
   0x08049199 <+35>:    push   eax
   0x0804919a <+36>:    call   0x8049030 <strcmp@plt>
   0x0804919f <+41>:    add    esp,0x8
   0x080491a2 <+44>:    test   eax,eax
   0x080491a4 <+46>:    jne    0x80491b5 <main+63>
   0x080491a6 <+48>:    push   0x804a00e
   0x080491ab <+53>:    call   0x8049060 <puts@plt>
   0x080491b0 <+58>:    add    esp,0x4
   0x080491b3 <+61>:    jmp    0x80491c2 <main+76>
   0x080491b5 <+63>:    push   0x804a017
   0x080491ba <+68>:    call   0x8049060 <puts@plt>
   0x080491bf <+73>:    add    esp,0x4
   0x080491c2 <+76>:    mov    eax,0x0
   0x080491c7 <+81>:    leave
   0x080491c8 <+82>:    ret
End of assembler dump.

Why is this happening? Thank you in advance.

1 Answer 1

1

You do not use the initial_state you create with constraints for buf arg. From the doc

If nothing is passed in, the SimulationManager is seeded with a state initialized for the program entry point, i.e. entry_state(). If a SimState is passed in, the SimulationManager is seeded with that state.

s = p.factory.simulation_manager(initial_state)

would just do it

[<SimState @ 0x4007a3>]
b'hello\x00\x08\x80\x00\x00'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.