1

How to extract all syscalls from analysing a statically linked binary. I have a script written using angr(Latest - v9.2.78) but when I start my script I get few syscalls and the analysis is like hung up or like going to recursion and it runs until memory is exhausted and eventually it is killed by OS(Ubuntu 22 LTS). My project is very similar to this thread

Any help will be beneficial :)

Thanks in advance

Edit -> Here is the script i'm using

import angr
import logging

logging.getLogger('angr').setLevel('INFO')

def syscall_action_builder(fd):
    def syscall_action_func(state):
        simproc = state.inspect.simprocedure
        fd.write("{}\n".format(simproc.display_name))
    return syscall_action_func

if __name__ == '__main__':
    FILE_NAME = 'path/to/binary'

    trace_fd = open('syscall.log', 'w')

    proj = angr.Project(FILE_NAME, load_options={'auto_load_libs': True, 'except_missing_libs': True},
                        use_sim_procedures=False)

    start_state = proj.factory.full_init_state()
    start_state.inspect.b('syscall', when=angr.BP_AFTER, action = syscall_action_builder(trace_fd))

    simgr = proj.factory.simgr(start_state)
    simgr.run()

Output of above script

geteuid
getuid
getegid
getgid
arch_prctl
brk
brk
arch_prctl
set_tid_address
set_robust_list
sys_334
uname
uname
prlimit64
prlimit64
readlink
readlink
readlink
readlink
readlink
readlink
getrandom
getrandom
clock_gettime
clock_gettime
getrandom
getrandom
clock_gettime
clock_gettime

logging of 'clock_gettime', 'getrandom' continues until memory is exhausted or killed by OS or me.

Script used is from this angr's github issue thread

0

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.