Questions tagged [angr]
angr is a Python binary analysis framework developed by the Computer Security Lab at UC Santa Barbara and their associated CTF team, Shellphish. project URL: https://github.com/angr/angr
2
votes
2answers
90 views
Angr - Solve for function return value
I'm trying to create an angr script to solve this test program:
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int main(int argc, char *argv[])
{
int value = atoi(...
0
votes
2answers
104 views
Solve an angr function with string parameters
Look at this C code:
#include <stdio.h>
#include <string.h>
int my_function(char *s);
int my_function(char *s)
{
for (int i=0;i<strlen(s);i++)
{
s[i]++;
}
if (...
1
vote
1answer
115 views
Solve a function with angr [closed]
Look at this c program:
#include <stdio.h>
int my_function(int a, int b);
int my_function(int a, int b)
{
// Imagine a very complex calculation on 'a' and 'b'
if (a==0x41 && b=...
0
votes
1answer
59 views
Start Symbolic Analysis at a Given Address with Angr
Lets suppose I have a very big binary and I want to reverse just a part of this binary.
Is there a way to tell angr to start symbolic analysis at a given address ?
3
votes
1answer
72 views
angr with a golang target
Here is a very basic golang program:
package main
import "fmt"
func main() {
var s1 string
fmt.Scanln(&s1)
if s1=="goodpassword" {
fmt.Println("Good")
} else {
...
1
vote
1answer
152 views
Angr never finishes
I create the following c program as a proof of concept. When I try to analyze it with anger it never finishes.
#include <string.h>
#include <stdlib.h>
#include <stdio.h>
char *...
4
votes
0answers
202 views
How do I perform concolic execution with Angr and collect constraints on input?
I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
3
votes
1answer
82 views
angr multiple reads same variable
I'm writing a script to solve a binary that asks for multiple strings like the following c code,
My problem I can't dump the 'second_pass, I just get "first_pass".
probably due of the use of the same ...
1
vote
1answer
276 views
problem with scanf/fgets in angr stdin exploration
I want to solve this very basic crackme using angr:
#include <stdio.h>
#include <string.h>
int main(int argc, char *argv[]) {
char buffer[64];
printf("Mot de passe:\n");
...
0
votes
0answers
113 views
debugger trap with angr
Let's suppose this (very ugly) c code:
#include <stdio.h>
#include <string.h>
#include <signal.h>
char sav_argv[100];
void on_sigtrap(int signo)
{
if (strcmp(sav_argv, "hello")...
0
votes
0answers
107 views
Hooking with angr
I have created and compiled a very basic c program which displays a message with printf. I have compiled a 64 bits PIE elf binary.
I want to learn how works angr analysis tool.
I have written this ...
3
votes
2answers
593 views
Password Bruteforce using angr
I am having a binary which takes an input from user and checks every bit of our character using the check_value function which does some stuff. The disassembly of the interested function is:
.text:...
5
votes
1answer
340 views
How can I get the shared libraries' function calls using angr
I am trying to get all the library function calls that a binary performs in a preorder-DFT traversal of the CFG. I'm able to get the CFG like:
import sys, angr
import networkx as nx
proj = angr....
