Questions tagged [angr]
angr is a Python binary analysis framework developed by the Computer Security Lab at UC Santa Barbara and their associated CTF team, Shellphish. project URL: https://github.com/angr/angr
38
questions
1
vote
0
answers
48
views
Argument section recovery for binaries
I am developing a static analysis automation tool to help me on CTFs. It would be nice for me to discover from where a certain argument of certain functions is coming from (does it come from a ...
- 11
0
votes
0
answers
28
views
Get WinAPI's parameters with angr
First, sorry for my bad english.
I want to make my script to parse PE binary and find some specific API's parameters value automatically.
For example,
.text:000000014002DF60 48 89 5C 24 08 ...
- 53
1
vote
0
answers
152
views
Analyse a statically linked binary and extract syscall from it using angr
How to extract all syscalls from analysing a statically linked binary.
I have a script written using angr(Latest - v9.2.78) but when I start my script I get few syscalls and the analysis is like hung ...
- 11
2
votes
0
answers
135
views
Angr with 'No bytes in memory for block starting at'
I am playing with the project here: https://github.com/foreverbell/angr-rust-example
After running make solve, I cannot get the desired output.
I added print(sm.errored) to the end of the script and ...
- 21
1
vote
0
answers
100
views
angr - project.loader.find_symbol("main") does not works
I have very simple C code - compiled on MSVC using clang++ compiler. When I am running it under angr environment - it simply does not finds main() function, while it can do so for other things like ...
- 121
2
votes
0
answers
76
views
Angr considers REP instruction as the end of a basic block
I'm developing a python script for angr that has to find all the basic blocks present in each function in a binary. I have noticed that angr splits the basic blocks when it finds a REP instruction, I'...
- 121
2
votes
0
answers
70
views
Why the global string varable exploitation using angr doesn't work?
To learn the angr module, I have made a simple C code like follows.
test.c
#include <stdio.h>
#include <string.h>
char input[6];
int main(void)
{
scanf("%s", input);
...
- 55
2
votes
1
answer
76
views
Why did I have gotten only null bytes argv variable from angr?
I have made simple program to test the angr.
My python code is here.
import angr
import claripy
p=angr.Project('./test2')
buf=claripy.BVS('buf', 8*10)
initial_state=p.factory.entry_state(args=[&...
- 55
2
votes
1
answer
120
views
Clean Angr disassemble output
I'm developing a python script for Angr that has to print as output something in the form of:
Instruction_disassembled opcode_bytes_of_instruction
This is my python script:
f = open(sys....
- 121
2
votes
0
answers
47
views
How to get the APIs present in a particular block in a CFG using Angr?
I'm doing binary analysis based on Control Flow Graph (CFG). As I suppose to get the APIs from every block in the CFG. I'm finding it very difficult to do so using Angr as I don't have enough grip on ...
- 39
1
vote
1
answer
265
views
Using Angr's Claripy to bruteforce a number
I'm trying to bruteforce an address as part of a CTF challenge using Angr's Claripy.
The function is the following:
unsigned __int64 __fastcall sub_555555555310(
unsigned __int64 rand_addr,
...
- 13
0
votes
1
answer
524
views
How can valid inputs be generated using the simulation manager in angr?
I have a binary compiled for x86_64 that looks like this:
#include <stdio.h>
#include <string.h>
void options(char *input) {
if (strcmp(input, "A") == 0) {
printf(&...
- 105
4
votes
0
answers
405
views
Using angr as a pure concrete emulator
I am able to successfully run my target binary under Qiling, an emulator that supplements Unicorn with hooks for system libraries. I would like to do the same thing under angr. I don't need any ...
- 237
1
vote
0
answers
442
views
Symbolic gloabal variables in angr
I am learning angr and for that I wrote a code containing two global variables.
char pwd[8];
char flag[16];
int main()
{
printf("\n\nEnter your password and the flag: ");
...
- 11
1
vote
1
answer
361
views
Proper workflow for x64dbg to Angr?
I am trying to use Angr to reverse engineer a plugin for an application. This plugin is loaded via DLL by the main application. To debug, I use x64dbg to attach to the main application exe. I then set ...
- 21
2
votes
1
answer
222
views
Using angr/radare2 to estimate values given chunks of assembly
I'm currently using radare2 in order to construct a simple CFG, each block/node in that graph is composed of one or more assembly instructions, I wish to estimate the value of specific register or ...
- 141
1
vote
1
answer
460
views
Basic `angr` framework question- is something wrong with my solver?
I'm new to reverse engineering and I've just recently learned about angr, a framework that uses symbolic execution to get the input for a given output. I'm trying to complete a crackme using angr. My ...
- 13
1
vote
1
answer
1k
views
How to restrict angr to printable characters
I have a binary that scanfs and then does some checks and returns either FAIL or SUCCESS that has SUCCESS for multiple inputs. Although only one of the inputs has only printable characters. How do I ...
- 11
2
votes
0
answers
405
views
Reverse engineering a command line argument using angr for an aarch64 binary
I am trying to reverse engineer a aarch64 binary using angr to find the required command line argument to get a desired result. From the binary I am able to extract the required length of the argument....
- 21
2
votes
2
answers
3k
views
Simple angr example not working
I am trying to learn angr from beginning. Due to lack of simple tutorials I programmed my own little executable which angr should solve.
The C code looks as follows:
#include <stdio.h>
#...
- 23
3
votes
1
answer
2k
views
How to export disassembly using angr
I would like to know how to export angr's disassembly in say txt file.
I looked at the angr documentation - https://angr.io/api-doc/angr.html#module-angr.analyses
I found that there are some ...
- 1,807
1
vote
0
answers
385
views
Angr Use argv as initialstate
I am currently trying to use angr, and I need to find a string "Done!" which results in the "good termination" of the program. The input is 32 bits and I need to know the input which leads to the "...
- 11
5
votes
3
answers
599
views
Get certain instruction count for multi-architecture binaries
I need to get an ELF binary's total count of
Function call instruction
conditional jump (branch) instruction
The binary could be any CPU architecture, like x64, ARM, MIPS, Motorola 68K, etc.
It ...
- 65
4
votes
0
answers
956
views
Using Angr in Vulnerability Research
I would like to use angr for vulnerability research.
I was thinking that if I did the following:
p = angr.Project('a.out', auto_load_libs=False)
sm = p.factory.simulation_manager()
while len(sm....
- 41
2
votes
1
answer
2k
views
angr | populate int array with constraints
How do I populate memory address using angr with array of integers (?) and add a constraint so each int will be positive & less than 17 ?
I hope it's clear I need to find out the in_array ...
- 283
3
votes
0
answers
986
views
How to prevent angr from taking dozens of hours and GB of memory solving a (seemingly) simple CTF problem
I was recently working on a (seemingly) simple CTF challenge where the input was a base64 encoded file and the binary would check for correctness in one function call. The catch is that the checking ...
- 183
4
votes
2
answers
2k
views
Angr - Solve for function return value
I'm trying to create an angr script to solve this test program:
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int main(int argc, char *argv[])
{
int value = atoi(...
- 323
0
votes
2
answers
2k
views
Solve an angr function with string parameters
Look at this C code:
#include <stdio.h>
#include <string.h>
int my_function(char *s);
int my_function(char *s)
{
for (int i=0;i<strlen(s);i++)
{
s[i]++;
}
if (...
- 797
2
votes
1
answer
1k
views
Solve a function with angr [closed]
Look at this c program:
#include <stdio.h>
int my_function(int a, int b);
int my_function(int a, int b)
{
// Imagine a very complex calculation on 'a' and 'b'
if (a==0x41 && b=...
- 797
1
vote
1
answer
1k
views
Start Symbolic Analysis at a Given Address with Angr
Lets suppose I have a very big binary and I want to reverse just a part of this binary.
Is there a way to tell angr to start symbolic analysis at a given address ?
- 797
2
votes
1
answer
540
views
angr with a golang target
Here is a very basic golang program:
package main
import "fmt"
func main() {
var s1 string
fmt.Scanln(&s1)
if s1=="goodpassword" {
fmt.Println("Good")
} else {
...
- 797
1
vote
1
answer
895
views
Angr never finishes
I create the following c program as a proof of concept. When I try to analyze it with anger it never finishes.
#include <string.h>
#include <stdlib.h>
#include <stdio.h>
char *...
- 47
5
votes
0
answers
991
views
How do I perform concolic execution with Angr and collect constraints on input?
I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
- 151
3
votes
1
answer
419
views
angr multiple reads same variable
I'm writing a script to solve a binary that asks for multiple strings like the following c code,
My problem I can't dump the 'second_pass, I just get "first_pass".
probably due of the use of the same ...
- 31
2
votes
1
answer
2k
views
problem with scanf/fgets in angr stdin exploration
I want to solve this very basic crackme using angr:
#include <stdio.h>
#include <string.h>
int main(int argc, char *argv[]) {
char buffer[64];
printf("Mot de passe:\n");
...
- 797
1
vote
0
answers
471
views
debugger trap with angr
Let's suppose this (very ugly) c code:
#include <stdio.h>
#include <string.h>
#include <signal.h>
char sav_argv[100];
void on_sigtrap(int signo)
{
if (strcmp(sav_argv, "hello")...
- 797
2
votes
2
answers
2k
views
Password Bruteforce using angr
I am having a binary which takes an input from user and checks every bit of our character using the check_value function which does some stuff. The disassembly of the interested function is:
.text:...
- 23
6
votes
1
answer
1k
views
How can I get the shared libraries' function calls using angr
I am trying to get all the library function calls that a binary performs in a preorder-DFT traversal of the CFG. I'm able to get the CFG like:
import sys, angr
import networkx as nx
proj = angr....
- 63