Skip to content

Instantly share code, notes, and snippets.

@RDxR10
Last active March 22, 2021 15:49
Show Gist options
  • Save RDxR10/407a062ab8feb5a478e9cdb2da19dbcd to your computer and use it in GitHub Desktop.
Save RDxR10/407a062ab8feb5a478e9cdb2da19dbcd to your computer and use it in GitHub Desktop.
#!/usr/bin/env python3
import angr
import claripy
if __name__ == '__main__':
print("[+] Solver Started")
binary = "./babymix"
flag_length = 0x16
print("[+] flag Length : 0x%02x" % flag_length)
print("[+] Starting Project :", binary)
proj = angr.Project(binary)
flag = [claripy.BVS(f"c_{i}", 8) for i in range(flag_length)]
flag_ast = claripy.Concat(*flag)
state = proj.factory.entry_state(stdin=flag_ast)
for f in flag:
state.solver.add(f >= 0x20)
state.solver.add(f < 0x7f)
simgr = proj.factory.simulation_manager(state)
print("[+] Exploring...")
good = 0x40222c
bad = 0x40223f
simgr.explore(find=good, avoid=bad)
if len(simgr.found) > 0:
print("[+] Solution Found")
found = simgr.found[0]
valid_flag = found.solver.eval(flag_ast, cast_to=bytes)
print("[+] Flag :", valid_flag.decode())
else:
print("[-] Sed Lyf")
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment