Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
#!/usr/bin/env python3
import angr
import claripy
p = angr.Project("a.out")
flag_chars = [claripy.BVS("flag_%d" % i,8) for i in range(15)]
flag = claripy.Concat(*flag_chars + [claripy.BVV(b'\n')])
state = p.factory.entry_state(stdin=flag)
for f in flag_chars:
state.solver.add(f < 0x7f)
state.solver.add(f > 0x20)
sm = p.factory.simulation_manager(state)
sm.run()
for x in sm.deadended:
if b'SUCCESS' in x.posix.dumps(1):
print(x.posix.dumps(0))
# print(sm.active[0].posix.dumps(0))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.