gistfile1.txt

# coding: utf-8
import angr,claripy,simuvex;

b = angr.project.Project("binaro")
s = b.factory.blank_state(addr=0x400dfd)

length = claripy.BVS("strlen", 64) # how long the string is; doesn't matter really
stri = claripy.BVS("str", 8*40) # the actual string

s.regs.rdi = 0x1000 # argument

s.mem[s.regs.rdi].qword = 0x2000 # std::string.ptr
s.mem[s.regs.rdi+8].qword=length # std::string.len
s.mem[0x2000]=stri

s.mem[s.regs.rsp].qword = 0x40106a # set up return address

p = b.factory.path(s); pg = b.factory.path_group(p)
pg2 = pg.explore(find=0x401086, avoid=0x40109c, num_find=1)
print pg2

f = pg2.found[0].state.se

print f.any_str(stri)