cookie_math_solution_angr.py

#!/usr/bin/env python2
import angr # angr-5.6.8.22
import simuvex
import logging

class __printf_chk(simuvex.SimProcedure):
    def run(self):
        print 'useless'

p = angr.Project("./packer-release", load_options={'auto_load_libs': False})
#p.hook_symbol('__printf_chk', __printf_chk)
arg1 = angr.claripy.BVS('arg1', 30 * 8)
initial_state = p.factory.entry_state(args=['./packer-release', arg1], remove_options={simuvex.s_options.LAZY_SOLVES})

logging.getLogger('angr.path_group').setLevel(logging.DEBUG)

count = 0

for c in arg1.chop(8):
  if count == 0:
  	initial_state.add_constraints(c == ord('f'))
  if count == 1:
  	initial_state.add_constraints(c == ord('l'))
  if count == 2:
  	initial_state.add_constraints(c == ord('a'))
  if count == 3:
  	initial_state.add_constraints(c == ord('g'))
  if count == 4:
  	initial_state.add_constraints(c == ord('{'))
  if count == 29:
    initial_state.add_constraints(c == ord('}'))
  initial_state.add_constraints(c >= 32)
  initial_state.add_constraints(c <= 126)
  count += 1

base_ida = 0x80483D0
base_angr = 0x400000
nope = 0x804870F
nice = 0x804870A
print "nice ", hex(nice)
pathgroup = p.factory.path_group(initial_state)
print pathgroup
pathgroup.explore(find=nice, avoid=nope)
print pathgroup

#print pathgroup.deadended[0].state
for path in pathgroup.found:
    print path.state.se.any_str(arg1)