amadhj by angr

gistfile1.txt

import angr
# import IPython
import claripy
import logging
import code


test_func = 0x4026D1

concated_str = []

def patch_read(s):
    global concated_str
    print 'patch'
    t = []
    for i in range(4):
        inp = s.se.BVS('usr_input', 8*8)
        s.memory.store(s.regs.rsi+8*i, inp)
        t.append(inp)

    concated_str.append(claripy.Concat(*t))
    return

logging.basicConfig()
logging.getLogger('angr.surveyors.explorer').setLevel(logging.DEBUG)


b = angr.Project('./amadhj')
b.hook(0x4026FD, patch_read, length=5)
s = b.factory.blank_state(addr=test_func)
s.regs.rdi = 0x1000 # make sure symbolic symbol at same location

def exp():
    global concated_str
    path = b.factory.path(state=s)
    ex = b.surveyors.Explorer(start=path, find=(0x040287F,), avoid=(0x0402886,), enable_veritesting=True)
    ex.run()
    yyy = concated_str

    if ex.found:
            print "found"
            code.interact(local=locals())
            for ss in concated_str:
                print ex.found[0].state.se.any_str(ss)


exp()
# some solutions
# ' IRrRAFBlelUzHZYumaqXfgTARantfSd'
# 'A PrFURjDMboQJ ScKvoH cDl  BQDqp'