Questions tagged [angr]
angr is a Python binary analysis framework developed by the Computer Security Lab at UC Santa Barbara and their associated CTF team, Shellphish. project URL: https://github.com/angr/angr
18
questions
1
vote
1answer
107 views
How to export disassembly using angr
I would like to know how to export angr's disassembly in say txt file.
I looked at the angr documentation - https://angr.io/api-doc/angr.html#module-angr.analyses
I found that there are some ...
1
vote
0answers
37 views
Angr Use argv as initialstate
I am currently trying to use angr, and I need to find a string "Done!" which results in the "good termination" of the program. The input is 32 bits and I need to know the input which leads to the "...
3
votes
2answers
101 views
Get certain instruction count for multi-architecture binaries
I need to get an ELF binary's total count of
Function call instruction
conditional jump (branch) instruction
The binary could be any CPU architecture, like x64, ARM, MIPS, Motorola 68K, etc.
It ...
2
votes
0answers
225 views
Using Angr in Vulnerability Research
I would like to use angr for vulnerability research.
I was thinking that if I did the following:
p = angr.Project('a.out', auto_load_libs=False)
sm = p.factory.simulation_manager()
while len(sm....
2
votes
1answer
642 views
angr | populate int array with constraints
How do I populate memory address using angr with array of integers (?) and add a constraint so each int will be positive & less than 17 ?
I hope it's clear I need to find out the in_array ...
3
votes
0answers
212 views
How to prevent angr from taking dozens of hours and GB of memory solving a (seemingly) simple CTF problem
I was recently working on a (seemingly) simple CTF challenge where the input was a base64 encoded file and the binary would check for correctness in one function call. The catch is that the checking ...
4
votes
2answers
526 views
Angr - Solve for function return value
I'm trying to create an angr script to solve this test program:
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int main(int argc, char *argv[])
{
int value = atoi(...
0
votes
2answers
455 views
Solve an angr function with string parameters
Look at this C code:
#include <stdio.h>
#include <string.h>
int my_function(char *s);
int my_function(char *s)
{
for (int i=0;i<strlen(s);i++)
{
s[i]++;
}
if (...
1
vote
1answer
253 views
Solve a function with angr [closed]
Look at this c program:
#include <stdio.h>
int my_function(int a, int b);
int my_function(int a, int b)
{
// Imagine a very complex calculation on 'a' and 'b'
if (a==0x41 && b=...
0
votes
1answer
172 views
Start Symbolic Analysis at a Given Address with Angr
Lets suppose I have a very big binary and I want to reverse just a part of this binary.
Is there a way to tell angr to start symbolic analysis at a given address ?
2
votes
1answer
205 views
angr with a golang target
Here is a very basic golang program:
package main
import "fmt"
func main() {
var s1 string
fmt.Scanln(&s1)
if s1=="goodpassword" {
fmt.Println("Good")
} else {
...
1
vote
1answer
322 views
Angr never finishes
I create the following c program as a proof of concept. When I try to analyze it with anger it never finishes.
#include <string.h>
#include <stdlib.h>
#include <stdio.h>
char *...
4
votes
0answers
415 views
How do I perform concolic execution with Angr and collect constraints on input?
I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
3
votes
1answer
128 views
angr multiple reads same variable
I'm writing a script to solve a binary that asks for multiple strings like the following c code,
My problem I can't dump the 'second_pass, I just get "first_pass".
probably due of the use of the same ...
2
votes
1answer
649 views
problem with scanf/fgets in angr stdin exploration
I want to solve this very basic crackme using angr:
#include <stdio.h>
#include <string.h>
int main(int argc, char *argv[]) {
char buffer[64];
printf("Mot de passe:\n");
...
0
votes
0answers
233 views
debugger trap with angr
Let's suppose this (very ugly) c code:
#include <stdio.h>
#include <string.h>
#include <signal.h>
char sav_argv[100];
void on_sigtrap(int signo)
{
if (strcmp(sav_argv, "hello")...
2
votes
2answers
824 views
Password Bruteforce using angr
I am having a binary which takes an input from user and checks every bit of our character using the check_value function which does some stuff. The disassembly of the interested function is:
.text:...
5
votes
1answer
593 views
How can I get the shared libraries' function calls using angr
I am trying to get all the library function calls that a binary performs in a preorder-DFT traversal of the CFG. I'm able to get the CFG like:
import sys, angr
import networkx as nx
proj = angr....
