Skip to content

Instantly share code, notes, and snippets.

@cedriczirtacic
Created January 25, 2019 01:41
Show Gist options
  • Save cedriczirtacic/ecfb3fd2a1d53374f68017b3f7e6e31a to your computer and use it in GitHub Desktop.
Save cedriczirtacic/ecfb3fd2a1d53374f68017b3f7e6e31a to your computer and use it in GitHub Desktop.
#!/usr/bin/python
import logging
from angr import *
from pwn import log
'''
[0x00001080]> afl~com
0x00001173 3 110 sym.comprueba_0
0x000011e1 3 112 sym.comprueba_1
0x00001251 3 116 sym.comprueba_2
0x000012c5 3 92 sym.comprueba_3
0x00001321 3 96 sym.comprueba_4
0x00001381 3 95 sym.comprueba_5
0x000013e0 3 110 sym.comprueba_6
0x0000144e 3 96 sym.comprueba_7
0x000014ae 3 116 sym.comprueba_8
0x00001522 3 78 sym.comprueba_9
0x00001570 3 94 sym.comprueba_10
0x000015ce 3 114 sym.comprueba_11
0x00001640 3 96 sym.comprueba_12
0x000016a0 3 94 sym.comprueba_13
0x000016fe 3 112 sym.comprueba_14
0x0000176e 3 78 sym.comprueba_15
0x000017bc 3 81 sym.comprueba_16
0x0000180d 3 114 sym.comprueba_17
0x0000187f 3 79 sym.comprueba_18
0x000018ce 3 110 sym.comprueba_19
0x0000193c 3 113 sym.comprueba_20
'''
base = 0x400000
# [0x000019ad]> pdf~Enhorabuena
# 0x00001ac2 488d3d570500. leaq str.Enhorabuena__Lo_has_conseguido, %rdi ; 0x2020 ; "Enhorabuena! Lo has conseguido!" ; const char *s
find_addr = base + 0x00001ac2
# [0x000019ad]> afl~nope
# 0x00001165 1 14 sym.nope
avoid_addr = base + 0x00001165
def main(path):
manager.l.setLevel(logging.INFO)
proj = Project(path, load_options={'auto_load_libs': False})
manager.l.info("Find address: 0x%08x", find_addr)
manager.l.info("Avoid address: 0x%08x", avoid_addr)
s = proj.factory.entry_state()
simulator = proj.factory.simulation_manager(s)
manager.l.info("Exploring... (this gonna take some minutes)")
simulator.explore(find=find_addr,avoid=avoid_addr)
if simulator.found[0]:
solution = simulator.found[0].posix.dumps(0)
log.success("Clave: %s", solution)
else:
log.failure("Nope!")
return True
if __name__ == '__main__':
import sys
main(sys.argv[1])
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment